Slashdot Mirror
Security Fears Over Google Accelerator
Espectr0 writes "A software tool launched by Google on Wednesday that speeds up the process of downloading Web sites (covered recently on Slashdot) has caused some users to worry about their privacy.
A ZDNet article discusses problems that users have been experiencing with the information that is cached by the software. On a Google Labs discussion group, one user said that 'I went to the Futuremark forums and noticed that I'm logged in as someone I don't know...'" Commentary also available on Signal vs. Noise and BlogNewsChannel.
our new Google Overlords
Hulk SMASH Celiac Disease
'I went to the Futuremark forums and noticed that I'm logged in as someone I don't know...'
thats not a bug, its a feature.
Starsucks
How does caching your cookies to the internet help speed up your local browsing?
Its true its true! People are logging on this account and acting like me on this account on /. but it really isnt me! Imposters!
B
/.
E
T
A
You'll get better results filing a report with Google as opposed to complaining on
As for me, I used the 3.7 minutes I've saved so far to spend some quality time with my friends.
Perhaps this is just Google's way of finding morelinks to add to it's search index? Imagine gathering millions of websites that it may not have indexed or found yet. All from links that users of the GWA have visited... possible?
Hmmm.
I found it a bit amusing that when I clicked the story link, the destination site, as well as three other sites, each attempted to save a cookie on my computer. Four cookies. To read a news story. That's necessary.
You probably shouldn't click this.
Its a caching proxy server for crying out loud. It caches web pages and feeds you the cached version. This is not new nor is it surprising, especially for a new service offering.
Feed the need: Digitaladdiction.net
Comment removed based on user account deletion
It doesn't just cache your cookies, it acts as a proxy that compresses the data as you browse, much like the ISPs that offer "high speed" compressed modem surfing.
-Jesse
Nothing says "unprofessional job" like wrinkles in your duct tape.
Not only that, but Google will conceal real web statistics from websites.
Remember acquisition of Urchin? Here is my concern about Google Webaccelerator.
my sstream of consciousness
Do you think Slashdot will ever arive to a time where a joke about the error message '"Move along. Nothing to see here.' Isnt made on /every/ single article and modded +5 /every/ single time?
I had to remove it from my system. It hijacked my browser, and I was not able to browse my companies internal websites because it over-rode our proxy. Bummer too...it worked great
I'm not a troll, but I play one on Slashdot.
I ran it for about an hour; turns out it's lumpy when one deals with multiple proxy servers (work vs. home) and it broke Rhapsody in a BIG way. I'm sure the good folks at Google will sort it out eventually.
OTOH, one must consider whether or not one trusts Google with one's information that way. I wanted to check it out, but probably, in the long run, wouldn't have used it. But it's worth noting that millions of people use ISP proxy servers without even knowing it (think transparent proxies) or without understanding it (think "proxy.isp.com"). I can't imagine that Google's Accelerator would expose one *more* than that.
Thinking outside my Head
Answer:
No. This isn't the article your'e looking for. You can go about your business. Move along, move along. :P
The accelerator prefetches the links on web pages, in effect clicking on all of them (except ads), which includes links that say 'delete this' or 'unsubscribe' etc. Many webpages use GET links to do these actions, and this is causing pages to disappear. Until web apps are rewritten to take note of the prefetch header, it's probably unsafe to use the accelerator. (Which seems to be offline at the moment - the page redirects you to the toolbar)
"When the only tool you own is a hammer, every problem begins to resemble a nail." - Abraham Maslow (1908-1970)
this site was pretty useful for information. So was AOL webmaster resources info.
AC comments get piped to
For more info about these known issues with HTTP caching, see the following
Build it, and they will come^Hplain.
From a users point of view:
1 - Ignores hosts file, so I end up seeing ads I normally wouldn't see
2 - Cookies work weirdly if at all, a lot more sites that I visit frequently appear to use cookies, and I've noticed some definte weirdness
3 - The time saved on a broadband connection really seems minimal, after an hr or two of surfing it takes a few seconds
4 - The pre-fetching it supports is already in firefox and probably other browsers
From a webmasters point of view:
1 - No way to limit caching of certain pages outside of moving them to SSL. Robots.txt isn't being followed (although probably rightly so, based on the application ).
2 - Because of the flawed cookie support (at least right now) a lot of affilate and different advertising methods have to be modified to support this.
I'm a big google fan, and I use most of their applications daily, but this one defintely needs some work. :)
http://www.somethingawful.com/articles.php?a=2858
Really insightful.
Has anyone read how google will deal with adsense clicks? Since all users of the accellerator will come from the same IP, will that IP decrease in value? (It's well known that the same IP can't just click again and again and generate revenue).
Shouldn't those sites be using the NoCache directive and shouldn't Google be honoring it? I wonder which side is at fault. At any rate, fears about information leakage are kind of silly because of the volume of traffic that Google services. The accelerator allows them to see link patterns, but no one could store, let alone process, an entire day's worth of data after the fact. The same is true for Google Mail: no person ever sees your email; an algorithm does, and tailors simple, pertinent advertising in exchange for an otherwise free service. The accelerator can only make the search engine better for everyone. Anyone that uses it is giving back, contributing to the synergistic knowledge of Google.
The business with appearing to be logged on isn't quite as serious as it sounds (although it is still bad).
The problem appears to be that you will sometimes be given a page that was personalised for someone else. However if you attempt to do anything from that page (for example if you find yourself looking like admin of a web board) you'll find that it doesn't work, any more than it would if someone emailed you a copy of a page where they were logged in as admin and you clicked on links (if you are on a website where doing that would work, you already have serious security problems). It also doesn't occur with SSL as google doesn't doing anything with SSL pages (as you would hope)
This is still a problem if that page shows something private of course, and should be fixed. (a password of course being the worst case, but how often do you see your actual passwords printed on a webpage?)
Combination - fun iPhone puzzling
Read about all of the username, forum, and security risks?
7 6
Since such activity could pose both a security risk to web surfers and site owners, there are some web sites which are interested in not having Web Accelerator pick up their material.
A very fast and efficacious method of denying Google Web Accelerator (GWA) funneled traffic access to your web site is blocking the IPs it is calling your pages from:
http://www.searchenginejournal.com/index.php?p=16
Did you Read The Fine Article?
"I went to the Futuremark forums and noticed that I'm logged in as someone I don't know. Great, I've used Google's Web Accelerator for a couple of hours, visited lots of sites where I'm logged in. Now I wonder how many people used my cache. I understand it's a beta, sure, but something like that is totally unacceptable."
I frankly don't know a ton about it since it fucked up my firefox install but others are giving the example of user X who has mod status browses www.popularforum.com/modforum/userspasswords and now google has a cache of that page that anyone can access. I don't know if that's true but this is exactly why companies don't knowingly open their proxies to the outside world. Here you have the Entire World granted access to almost any page a user running Google's software goes to.
If those claims are true then Google has a duty to pull this from the market immediately which they may very well do.
If you wanna get rich, you know that payback is a bitch
lowtax of SomethingAwful makes some interesting points amidst all his fuming but I'll have to defer to the /. tech wizards to vet his technical claims.
Don't use it! Google is a public corporation, everything they make is designed to somehow make a profit (which i see nothing wrong with, btw)...even if it doesn't cache your personal information like the article claims, there is some angle to it that will make money for them, maybe they will look at your web surfing habits and target ads to you. If you're one of those people who blindly trusts google because of their "don't be evil" mission statement, then use it and trust that Google is taking care of you. I personally don't trust them, so I won't use it. There is no free lunch.
Who said it was a cookie that was cached, and not the page content? Much of the discussion thusfar seemed based off what an anonymous quote in a ZDnet article. Far as I can tell, the guy saw "Welcome back, Bob!" and freaked, when he wasn't -actually- logged in as Bob. Furthermore, who says it isn't Futuremark (or their forum software- because we all know how security-conscious PHP/MySQL forum software is) tagging their pages as cacheable when they shouldn't be? If Google is ignoring "don't cache this page", now yes, we have a problem- but the ZDnet story is of a technical level I'd expect of a community newspaper, so it's kind of hard to tell. It's like a story in your city newspaper that read "somebody killed by a cop!" and going off on a rant about police brutality...only to find out later the guy was a bank robber with an Uzi.
Before you get all excited about bank sites etc- keep in mind those often use very unique URLs for each page and other tricks.
Please help metamoderate.
SEE?!!! I told you that if these corporate identity thefts kept up, we'd all end up having the same identity!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
I just deleted the accelerator from my system after trying it for the last day, and I must say that it is much less mature than most of the "Beta" products google releases. It caused several significant issues with Firefox on my system, including:
1. Links that open another window stopped working entirely (although they worked if I right-clicked and selected "open in new tab")
2. Even after closing all Firefox windows, a firefox.exe process would remain running, and prevent any new firefox windows from being opened until it was manually killed
3. "Proxy not available" errors when opening several pages at once, such as when using the Firefox "open in tabs" on a folder of bookmarks.
And I haven't even checked into some of these cookie / privacy issues. Perhaps these issues are unique to my system, but my environment is pretty vanilla... I just run a few of the more popular Firefox plugins. Removing the GWA cleared up all of the problems cited above.
Up to this point, I've always been very impressed with the level of testing that has gone into Google software products before they enter Beta. In this case, I'm not. Hope this isn't a sign of things to come.
-R
How long has Google Groups been labelled Beta now, two years maybe? How many users does it have?
If a wide number of even adventurous, risk-taking users could be exposed to a potentially significant security hole, then word should get out more widely than just Google's "thanks for the feedback" e-mail addresses.
Beta is not the Greek word for "without responsibility." As much as we criticize Microsoft for making the idea of a "release date" (or "security") meaningless, I think Google's well on it's way to making the idea of the "Beta Release" meaningless.
They act like a small, groovy coding lab with Beta releases and all, but seemingly aren't simultaneously recognizing that because of their prominence in consumer's minds, *anything* they do has widespread impact on ordinary Net consumers. So a true, uncontrolled Beta release? That's fine for me when I just coded a little midi tool and want to run it past my friends, but there's really no such thing when you're Google.
I think that the number of users that adopt even their least publicized tools takes them out of the realm of the real intent of a Beta release, especially when security issues are involved.
The only acceptable defense of scientific results is to say that they were the product of the Scientific Method.
Here are the headers that the Futuremark forums give me when I am logged in:As you can see, neither "Cache-Control: private" nor "Vary: Cookie" is given. In fact, the server doesn't even give an expiration date for the content. Under these conditions, the HTTP/1.1 protocol says that it is perfectly OK for a cache to keep this page for awhile and serve it to other people.
This problem is firmly the fault of the people who wrote Futuremark's forums. This constitutes a major security hole in the WWWThreads forum package, because this problem will occur when using any standards-compliant HTTP cache. I would strongly recommend against the use of these forums on any web site until they fix their security problems.
(I do not know if other forum software has this problem, but frankly it would not surprise me. It seems lots of PHP developers and other high-level web programmers have no idea how HTTP/1.1 works, and assume that headers are completely unimportant. I have written a web server and forum software myself, though, and I made damned sure that mine produces the right headers.)
I'll stop when people stop deserving it. I haven't missed the whole point of this discussion at all, infact I was the one who originally instructed the parent why he was wrong. Google caching might cache cookies, but not ONLY cookies; understand, comprende?
-Jesse
Nothing says "unprofessional job" like wrinkles in your duct tape.
Here's some code to add to your web pages to block GWA. This will leave static media alone, which is fine.
] ))
PHP:
if(array_key_exists($_SERVER['HTTP_X_MOZ'
{
if(strtoupper($_SERVER['HTTP_X_MOZ']) == 'prefetch')
{
header("HTTP/1.x 403 Forbidden");
header("Content-Type: text/html; charset=iso-8859-1");
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Cache-Control: no-store, no-cache,
must-revalidate");
header("Cache-Control: post-check=0, pre-check=0",
FALSE);
header("Pragma: no-cache");
header('Accept-Ranges:');
exit();
}
}
CFML:
Damien
Why is Google doing this?
If the purpose is to speed up web access, then why couldn't all this gzip compression, prefetching, and so forth, be handled on your local drive without going through Google? Wouldn't that be faster? Not everyone lives next door to a Google data center (not yet, anyway), and there is latency when you hop around the web to get stuff from Google. The accelerator installation file isn't exactly lean (1.4 meg), so I don't understand why Google has to broker all of this stuff on their servers.
Google claims that there's no more of a privacy issue with this thing than there is with your ISP. However, I think most ISPs are a bit different than Google.
My ISP has no reason to store it's logs indefinitely. Google has every intention of storing everything about me forever. My ISP rotates their logs regularly, while Google indexes and compresses their logs using globally-unique IDs, and stashes it away for future reference. My ISP is not the world's largest advertiser, but Google is determined to "know more about you" (Eric Schmidt's words) for profiling purposes. My ISP has a real privacy policy, and I believe that they would demand a subpoena before giving out information about my surfing behavior. Google has never suggested that they even require a subpoena from officials, so I have to assume that they have a very cozy relationship with various governments.
All that is from the user's perspective. What about webmasters?
The web accelerator ignores robots.txt. The web accelerator ignores the NOARCHIVE meta. I believe, but have yet to confirm, that it ignores any no-cache pragma headers. It avoids prefetching anything with a question mark in the URL, but what about all those PATH_INFO dynamic links we've been installing for the last four years so that our dynamic pages look like static URLs? Google prefetches many of these, and there are numerous reports that this prefetching, along with some cookie mishandling by Google, is breaking sites out there. Does Google care?
Why isn't there a sitewide opt-out option for this monster? Heck, it's so bloody dangerous for both the user and the webmaster that it ought to be opt-in instead of opt-out.
All webmasters should block this thing. If a user cannot get to your site because of this block, then at least you as a webmaster won't be complicit. We have to protect users from Google's megalomania, because they've been so dumbed-down by Google worship over the last few years that they can no longer think straight.
Um, I'm an idiot. I was thinking of "Mrs. Thumb and her 4 lovely daughters", and not Rosie PALM and her five sisters.
I wanna go home.
Your ISP could do the same stuff people claim google can do (as far as tracking).
Except my ISP is much smaller and is in the internet service business rather than the advertising business.
It's not a bug with the proxy software, it's a bug with those forums.
Caching proxies have been around for several years now, and this is not a new problem. Any webmaster worth his salt should know about this, and any dynamic content (especially a piece of forum software) should know damn well to properly implement expiration dates and cache control directives.
If the WWWBoard software at Futuremark was doing the right thing in the first place, this wouldn't be a problem. It's Futuremark's and WWWBoard's security bug, not GWA's or any other caching proxy's.
The only reason people are bitching about this is because GWA is one of the first caching proxy systems out there to hit widespread use by people who've never used one before. The concept itself is not new by a long shot, and there are established guidelines to follow when you develop web software to deal with them. If you fail to follow these guidelines, then yeah, your site will break and you create a security risk like WWWBoard has clearly done. Upgrade/fix your forum software.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
The web accelerator is not a robot, so this is correct behavior.
NOARCHIVE is a Google specific extension to the robots.txt specification, and again, this is not a robot.
I'd be absolutely shocked if that were actually the case. I also believe it respects the Expires header as well as the Cache-Control header.
If they're following the proper standards, then it's not their place to care or not. If your website doesn't properly specify cache-control (many don't) then you get what you get.
For any pages with user-specific content, add the "Cache-Control: private" header and voila, problem solved for you.
If you want to opt out entirely, then a simple "Cache-Control: no-cache" header in your HTTP responses would do the trick, as would "Pragma: no-cache", I bet.
Furthermore, there is no cookie-mishanding I've actually seen, and I've tested it. It passes cookies through just fine, without caching them, near as I can tell.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.