Google Desktop Search Under Fire

← Back to Stories (view on slashdot.org)

Google Desktop Search Under Fire

Posted by CmdrTaco on Thursday October 21, 2004 @07:53AM from the be-aware-people dept.

AchilleCB writes "Cnn and many other sources are jumping on the Google-privacy-bash bandwagon, they are carrying stories warning of more privacy implications regarding Google's Desktop Search, "if it's installed on computers at libraries and Internet cafes, users could unwittingly allow people who follow them on the PCs, for example, to see sensitive information in e-mails they've exchanged. That could mean revealed passwords, conversations with doctors, or viewed Web pages detailing online purchases." ... Type in "hotmail.com" and you'll get copies, or stored caches, of messages that previous users have seen. Enter an e-mail address and you can read all the messages sent to and from that address. Type "password" and get password reminders that were sent back via e-mail."

19 of 444 comments (clear)

Security Diversion by stecoop · 2004-10-21 07:54 · Score: 5, Interesting
warning of more privacy implications regarding Google's Desktop Search

So the actual problem is that public computers aren't secure? Google Desktop Search doesn't do anything more than what a halfway good script kiddies can do. I say that all public computers install the software and plug the permissions problem on the OS. If everyone can SEE the insecurity then the users will either
1. become aware
2. find alternatives
3. clamor to have the problem fixed
4. Another law will be written (don't let it get to this).
  Choose one or proactively make a "none of the above choice" by doing something about it.
  PS we almost freaking died out here - it's been an over an 1 1/2 since the last story.
1. Re:Security Diversion by Jucius+Maximus · 2004-10-21 07:55 · Score: 5, Insightful
  
  Exactly. Google desktop search doesn't find anything that wasn't there before. It just is better at organising and mining it than a human being.
2. Re:Security Diversion by antarctican · 2004-10-21 08:00 · Score: 5, Insightful
  
  I wouldn't blame Google for this, I'd say Google has unwittingly discovered existing problems with shared computers and caching.
  
  From what I understand, Google's desktop only caches what's already on the machine's hard drive. So all this "sensitive information" that it's finding is already there for those who know how to find it, and take the time to.
  
  This is a wake up call for how much personal information is actually kept on our desktop machines.
3. Re:Security Diversion by RealProgrammer · 2004-10-21 08:01 · Score: 5, Insightful
  [...] If everyone can SEE the insecurity then the users will either
  become aware
  
  find alternatives
  
  clamor to have the problem fixed
  [...]
  
  The clamor will be, at best, "Make Google stop!"
  
  People who don't understand how things should be done are befuddled when confronted with the way they are done.
  --
  sigs, as if you care.
4. Re:Security Diversion by William+Tanksley · 2004-10-21 09:05 · Score: 5, Insightful
  
  Right! We demand to NOT be told about collections of our public data, including leaks of our private data into the public.
  
  Your approach is all wrong. It DOES matter that your data is available; that _by definition_ transforms your data from "private" to "public". That's the end of your privacy with respect to that data. And you have yourself to blame. Don't use your credit card on a public computer.
  
  -Billy
5. Re:Security Diversion by Short+Circuit · 2004-10-21 09:18 · Score: 5, Insightful
  
  My point is that the ease of searching data is more important than the data itself.
  
  If you go through my comment history, you'll find out all sorts of things about me. But will you? Probably not. It's not worth your time to sift through all the data.
  
  However, with data analysis algorithms, you could have a computer tell you all you need to know about my posting habits, and possibly even find cyclical behaviors and suspicious gaps in my posting.
  
  Add other users' histories into the mix, and you might think you've stumbled onto a conspiracy.
  
  --
  tasks(723) drafts(105) languages(484) examples(29106)
This was discussed before! by Discotechnica · 2004-10-21 07:55 · Score: 5, Insightful

It's not google's fault that other programs leave data out in the open. The search tool does nothing a regular user couldn't do!
Again? by __aaitqo8496 · 2004-10-21 07:55 · Score: 5, Informative

Didn't we already determine that Google has stated Desktop Search is not for use on multiple-user machines and that you can always retrict domains, directories and result types from inclusion despite the fact that the files are still publically accessible.
and how is this googles problem? by Ummagumma · 2004-10-21 07:55 · Score: 5, Insightful

...google provides this tool, for personal use. Any libraries/public terminals that ALLOW the desktop search are the real problem here, not the desktop search agent itself.

I've been using the desktop search for a week, and find it indispensible now. But, like any good, powerful tools, it can be misused, in a mis-configured enviornment.

Basically, just watch where you surf on a PUBLIC machine. duh.

--
"The natural progress of things is for liberty to yield and government to gain ground." - Thomas Jefferson
Reasonable thing to comment on! by francisew · 2004-10-21 07:56 · Score: 5, Insightful

Isn't it time that media start to put up opposition to services that compromise privacy in fundamental ways? I think this bandwagon is one that isn't so bad to have going on.

Google does great things, but without such opposition, they might not keep all issues in proper perspective. The things they mention are very important.
Oh come on by savagedome · 2004-10-21 07:57 · Score: 5, Insightful

First of all, GDS does not bypass security or username/passwords. These files are accessible via the IE cache using Windows Explorer anyway. The index is stored in %USERPROFILE%\Local Settings\Application Data\Google\Google Desktop Search

Plus, why are these people have rights to install GDS on library computers? The libraries need to take notice by using a policy control to begin with.

Its a GOOGLE DESKTOP SEARCH tool. It says SEARCH in a screaming font. If that doesn't ring these people's bells, then they need to buy hi-fidelity headphones that are used by chronic deaf.

Blaming the kinfe company when the kid cut itself playing with the knife.

--

Free XBox, PS2
When you remove the obscurity... by Kiaser+Zohsay · 2004-10-21 07:58 · Score: 5, Insightful

...it becomes easier to see the "security through obscurity" really doesn't work. It's not that a desktop search compromises security, it's that the security wasn't there in the first place.

--
I am not your blowing wind, I am the lightning.
library users? by Texodore · 2004-10-21 08:02 · Score: 5, Funny

What is someone going to find if they install this on a library computer? livejournal.com pages? Orlando Bloom pictures? Lyrics to an Eminem CD? chat sessions with pinkkitty5555?
Re:Mod down that troll by RealityMogul · 2004-10-21 08:10 · Score: 5, Insightful

A few points here:

GDS runs as a system service and has access to everything.
Google got in bed with MS on this one as they only cache MS Office type docs.
GDS could easily cache file security attributes and filter accordingly based on the logged in user.
You'd all be having a fit if this happened on Linux.
Re:Lurking privacy concern by savagedome · 2004-10-21 08:14 · Score: 5, Funny

You are blaming the violet light maker when it finds those 'stains' on your bed sheet. The stains were already there. You just didn't know and now you are pissed that everybody found out!

--

Free XBox, PS2
Price? by cbr2702 · 2004-10-21 08:15 · Score: 5, Insightful

By the way. . . maybe if the computers were cheaper people would put money into security. . .instead of spending it all on the cost of the PC.
Computers are now at $400 . When computers were $1500, people had no money for security, and they still don't.

--

This post written under Gentoo-linux with an SCO IP license.
Re:Mod down that troll by cthrall · 2004-10-21 08:24 · Score: 5, Informative

> Google got in bed with MS on this one as they only
> cache MS Office type docs.

MSFT released filters allowing developers to get at the content of Office docs. Office is the prevalent productivity suite used. Why is GOOG in bed with MSFT?

> GDS runs as a system service and has access to
> everything.

No, there's an entry in HKEY_CURRENT_USER\...\CurrentVersion\Run that starts everything. That means it runs as the current user.
What I want to know... by Ayanami+Rei · 2004-10-21 08:29 · Score: 5, Insightful

How is it possible the users can install ANYTHING (not just Google Desktop) on public internet terminals or in libraries?

Seems to me focusing on the WRONG problem.

--
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
Stupid Humans by turnage · 2004-10-21 08:59 · Score: 5, Insightful

Ok, you guys are amazing. Let's put this into context. Microsoft comes out with this great tool called ActiveX. It allows all kinds of wonderful things to happen, especially rich content in emails. Uh-oh, someone finds out that this technology is a great way to F around with folks' email since it's so integrated in Outlook (just using Outlook as an example, won't even go there with Windows). Bad, M$, no bone. Nevermind the users who don't know to simply turn off active scripting, they're not the problem - it's Microsoft - since software manufacturers should understand that all users are dumb. Enter Google. All data that's currently on the PC is presented in a highly searchable manner, even to people who have no idea about privacy issues involving electronic data. Stupid users, you shouldn't put such data there, don't you know how every application you've ever used persists data? It's obviously not Google's fault you're so stupid.

Allow me to describe for you living-in-yo-mamas-basement geeks how 6 billion people operate:

The average user has no idea of the security implications of simply going to a public computer and using the facilities provided for them.

If they've ever bought a computer before, they did not buy it from a store with a sales rep that gave them a book listing out every privacy/security vulnerability in the OS installed on it, and if they did they didn't read it. They may have never even talked to anyone knowledgeable about it.

Average users don't have conversations with geeks, sitting around talking about why M$ fscking sucks today and how 3l337 they are or how they 0wn3d U or whatever the hell they say. Average users have conversations with other average users about sports and knitting.

It is doubtful the user has a college degree in computer science, engineering, or even went to a technical school.

Not every kiddie is a script kiddie. I would venture to say most kids who use a library aren't script kiddies - script kiddies have computers at home. If you don't believe me, go to any public library with computers in south Atlanta and ask if their parents own a computer.

In a perfect world, it would be awesome if everyone understood the problems with computer privacy, but we have to deal with all those fucking ignorant lusers who don't read slashdot every hour. If Google doesn't understand this, rest assured they will be hounded by privacy counsils until they learn.

Ok, off do to some google credit card searches ;)