Google Releases Google Browser Sync Extension

Pneuma ROCKS writes "Google has just released the Google Browser Sync extension for Firefox. This extension allows you to save your bookmarks, history and passwords on Google servers, effectively giving you a 'roaming profile,' which you can sync on any computer running Firefox (and the extension, of course)."

Comments

Encrypted?

[Buran]

This says nothing about whether the data is encrypted in transit or, more importantly, on the servers. I don't like the idea of Google or anyone who might hack in snooping on this data.

Re:Encrypted?

[0racle]

Well if you already use GMail, what's a little more personal information? Of course Google can index it and add it to the increasingly large profile of you.

Re:Encrypted?

[zburner07]

Actually it tells you right here in the FAQ.

Re:Encrypted?

[TrippTDF]

I was going to agree with you and ad that I don't like the idea that they have acess to all my bookmarks... seems like they would know a LOT more about me than I would want them to know.

THen I remembered they've had the majority of my personal email for the last two years.

Re:Encrypted?

[Anonymous Coward]

Actually, it does say it will be encrypted:

http://www.google.com/tools/firefox/browsersync/fa q.html#q9

Why do I need to provide a PIN?

The PIN you create during setup is used to encrypt information that's synced between your computers, which may include sensitive information such as your passwords for websites. We use your PIN to unlock that information. Without your PIN, no one will be able to read the information that's being transmitted between your computers via Google Browser Sync.

Re:Encrypted?

[Xhris]

Really why woud you care? If your keeping sensitive information in your bookmarks list then your a fool. Personally I have been copying my bookmarks.html to ~/publcic_html for years. Its very handy when using someone elses computer and trying to remeber a URL. (Actually it was more useful in the pre-google days. These days I mostly find the URL via goodle anyhow).

Re:Encrypted?

[tftp]

Well if you already use GMail, what's a little more personal information?

It depends on how much of correct data you provided when you signed up.

Re:Encrypted?

[tftp]

From that link:

in a format that is nearly impossible to interpret without the PIN

I think by saying "nearly" they confessed that this PIN won't stop them.

For all I know, they take an arbitrarily long PIN, generate a 256-bit hash out of it, and for example zero the first 250 bits. The result is used as your secret key. Enjoy!

Re:Encrypted?

[Anonymous Coward]

The parent is just some paranoid malcontent who will never be happy with anything including "just don't use it if you don't like it".

Re:Encrypted?

[spir0]

GMail (including GMail for hosted domains) is not encrypted. Logins are, but once you're in it's not. How many emails do you receive that contain passwords to sites you registered with? Every time you open one of those messages, the data has the potential to be sniffed.

I don't believe this is any worse than that.

You can't hide in the shadows your whole life. You've gotta come out of your closet and let someone sniff you once in a while. It's very liberating.

Honest.

Re:Encrypted?

[Jah-Wren Ryel]

Actually, it does say it will be encrypted:

Its not really clear about how much of your information is encryped. Your passwords yes, but your browsing history? Your bookmarks?

I would expect google to want to datamine both of those things, but I would not feel comfortable giving it to them in a form that they could use because it means that someone else, like our friendly NSA for example, could use it too.

With that in mind - does anyone know of an extention that does the same sort of sync, but encrypts everything and lets you store it on the website or ftp server of your choice (presuming of course that you have write permission there)?

Re:Encrypted?

[Random Destruction]

by saying nearly, they saved themselves a world of hurt if someone manages to crack one some day. Pretending encryption is 100% secure is foolish.

Re:Encrypted?

[Overly Critical Guy]

For all I know, you've got two heads and seven titties. For all I know, Slashdot is run by Steve Jobs. For all I know...

Re:Encrypted?

[Kadin2048]

The "nearly" is just them doing the usual corporate CMA.

If I were overseeing a high-profile company who was releasing a product that in any way used encryption, you can bet I would couch every claim about its security with some sort of qualifier.

No intelligent person ever uses superlatives when discussing encryption, unless you want to be on the hook in case it ever gets broken.

Re:Encrypted?

[tmjr3353]

Actually, I'm pretty sure there's both an encrypted an unecrypted version. Once actually inside G-Mail both https:/// and http:/// will work -- and there is a difference; when they first released the messaging inside the webmail page it only worked in the unsecure page.

Re:Encrypted?

[MobileTatsu-NJG]

"It depends on how much of correct data you provided when you signed up."

I don't think it's as simple as that. If you're using GMail, you're likely logged in to Google every time you do a search. Do a bunch of porn viewing, and Google has the means to link that to your login. Take it a step further and keep your bookmarks there.. well... they certainly have more to draw on.

Personally, I'm not so worried about what Google sees. I'm worried about the recent moves by the gov't to collect that info. Google is unintentionally setting up a nice little trap for a bunch of people. (No, this isn't a Google is evil statement, just pointing out the dangers of centralizing all this stuff.)

Re:Encrypted?

[Tacvek]

Its not really clear about how much of your information is encryped. Your passwords yes, but your browsing history? Your bookmarks?

That would be "It's".

Anyway, the source is avalable. All of the relevent code can be found in the file named browserstate.js.

Interesting function names: "SHA1", "ARC4", "RSAEP", "G_Base64".

What worries me is the mention of RSA. SHA1 could be used for many things, but is probably used for hashing the PIN. ARC4 is most likely the encyption used. But what is RSAEP doing there? That is the primative used for full fledge RSA encryption. Is Google perhaps using the PIN to generate an RSA key on the fly, which is used to encypt a random symetric key used for ARC4ing the main data? Except for generating the key on the fly, that is how OpenPGP works, although OpenPGP does not use ARC4.

Re:Encrypted?

[Dan Berlin]

If you look at the extension, you will see you can choose to encrypt any/all of what it can sync.

Re:Encrypted?

[tftp]

If you're using GMail, you're likely logged in to Google every time you do a search.

Why should I do that? No, of course I don't stay logged in any more than it is necessary.

Google is unintentionally setting up a nice little trap for a bunch of people.

I don't believe that founders and managers of a multi-billion dollar enterprise are so dumb that they don't realize what they are doing. I am convinced that they are perfectly aware of all the implications - they know them better than we do, it's their business after all. Also, the government is not silent on the matter - it approached Google already, so claiming innocence won't work. Google knows damn well what it is doing, and that is to become the ultimate data warehouse for, and about, everyone on the planet. And all that data will be for sale.

Re:Encrypted?

[wolenczak]

kool!, now they can profit on the all the p0rn I see.

Re:Encrypted?

[Anonymous Coward]

I actually thought you were talking about the summary not mentioning if the data was encrypted or not.

With that assumption I just want to drift away a little here to criticize submitters about something.

I can live with incomplete information cause I do RTFA if it seems interesting (e.g. neglecting to mention encryption here). What I really (REALLY) hate is when someone submits an article about some obscure product/event/whatever and assumes that the whole universe knows about it.

It's a safe bet that everyone browsing slashdot knows about Google and Firefox, but some summaries really cry out loud for a little background.

I don't have the time to look that up right now, I'm at work.

Just thought I'd share that.

Re:Encrypted?

[elyk]

Try Foxmarks Bookmark Synchronizer. At first it appears to only work with their servers, but if you look at the advanced settings it allows you to specify your own ftp server. I'm not sure if it encrypts it, but you could get a reasonable level of security by storing it in a non-web-accesible ftp folder, and there might be a setting to use secure ftp or https; I forget (I uninstalled it because I realized I didn't really need it).

Re:Encrypted?

[jrockway]

Yes, and the encryption is done client-side, not server-side. Unfortunately without the source code, we can't really be sure that the crypto works.

Re:Encrypted?

[aussie_a]

Do they store the PIN on their systems? Of course they do. Therefore they can unencrypt your info any time they want.

Re:Encrypted?

[Zemran]

anyone who might hack in

You do not have to worry about that as Google will quite happily give your data to anyone that asks saving them the trouble of hacking. O.K., I am going a little overboard about the Chinese incident but I would think that Google is now one of the last companies that I would trust with my personal data. I live in Thailand were it is a crime to criticise the King and it can still gets you into trouble if you say the wrong thing about the government. I am stopped from using proxies etc. I have to be careful if I am saying something that they do not want me to say and Google have a Thai site - www.google.co.th. Would I trust them not to let the Thai gov read all my data? You must be having a laugh.

Re:Encrypted?

[ahxcjb]

tcpdump anyone..? ;)

Re:Encrypted?

[ahxcjb]

Oh well, I quickly captured the packets google sends to its servers when you exit Firefox -- the whole session is encrypted going out via https on 443.

Re:Encrypted?

[Anonymous Coward]

I would use a randomly generated key/Personal Identification Number/PIN.

Re:Encrypted?

[nacturation]

It depends on how much of correct data you provided when you signed up.

And of course you never have your friends send you *real* email nor mention any personal information, right? Your Gmail account is just for spam collection?

Re:Encrypted?

[Mozk]

The point is to prevent network sniffers, not stop Google from looking at your stuff.

Re:Encrypted?

[MobileTatsu-NJG]

"I don't believe that founders and managers of a multi-billion dollar enterprise are so dumb that they don't realize what they are doing."

I was not trying to imply that. They obviously feel very comfortable with what they're doing, but that alone will not protect their users. In theory, the gov't shouldn't have even asked them for the records, yet it still happened. Worse, we've got a monkey in the white-house that may bend the rules a bit to try even harder. Now maybe my imagination's getting ahead of me, but just because they think they know what they're doing doesn't mean anybody's safe. Once you've commited the data to Google, that's it, you cannot undo it.

Re:Encrypted?

[tftp]

You are correct, I am using my GMail account for very specific, well defined purposes. Not for spam, though - it's Yahoo for that :-) For example, I use gmail for some quite public mailing lists - which don't reveal anything that you can't learn from other public records.

Re:Encrypted?

[the100rabh]

Its clear that its a HTTPS thing...so how security is not much of concern.....I browse in office and home....Now I have the bookmarks perfectly synchronised....whats better for me than this...Its just a matter of trust thats all...the day trust is broken its all over

Re:Encrypted?

[Red Alastor]

And what prevents you from unzipping the extension and looking inside ?

Re:Encrypted?

[DisKurzion]

And? So does your bank, ebay, and countless other services.

Play it smart, and don't have it sync the passwords or history if you don't want.

Bookmarks and browser settings, that I can live with.

Re:Encrypted?

[RealGrouchy]

I would expect google to want to datamine both of those things

Why would they? Google's business model is based around exposing you to ads as you view things.

They would not need to datamine your bookmarks/passwords etc. any more than they "datamine" every single e-mail you read in your G-mail account.

This, of course, is notwithstanding your concern about whether all or only some content is encrypted, which has been responded to already.

- RG>

Re:Encrypted?

[Anonymous Coward]

Check out the privacy statement http://www.google.com/tools/firefox/extensions_pri vacy.html

"You can choose to encrypt Google's stored copies of your settings"

Re:Encrypted?

[Firehed]

You must be using this Google Thai.

Re:Encrypted?

[Jah-Wren Ryel]

They would not need to datamine your bookmarks/passwords etc. any more than they "datamine" every single e-mail you read in your G-mail account.

I guess you haven't been paying attention to your g-mail account. I have a couple of them that I use for very specific and distinct purposes - and I make sure never to cross-contaminate them via persistent cookies or the like. Each one shows me ads that are obviously targetted to the email in that specific account - and not necessarily to the message I may be currently reading.

In other words, Google does mine your g-mail in order to build a profile that they can then use to try and match advertisements against. Your bookmarks and browsing history provide just as much, if not better, detail about you than your google search history does - they would be foolish to ignore it if you don't encrypt it.

If you think google isn't building and storing profiles for each user - then you are just being willfully ignorant - the evidence is there in the results if you just look for it.

Re:Encrypted?

[azuretek]

I'm pretty sure from what I read of their FAQ that the encryption/decryption is all client side. I wouldn't imagine they keep the PIN on their server.

I haven't looked at the actual firefox extension but it wouldn't make sense to offer encryption and still store the PIN.

Re:Encrypted?

[suckmysav]

hehe. It's funny that I've been using gmail for over a year and I have not even noticed what is being advertised to me at all. I couldn't care less if they target me with datamined ads or just random ads, I don't look at either.

Re:Encrypted?

[Schraegstrichpunkt]

Depends. Is this enforceable?

Google grants you a personal, non-transferable and non-exclusive right and license to use the object code of its Software on a single computer limited strictly to non-commercial use only by you; provided that you do not (and do not allow any third party to) copy, modify, create a derivative work of, reverse engineer, reverse assemble or otherwise attempt to discover any source code, sell, assign, sublicense, grant a security interest in or otherwise transfer any right in the Software.

Re:Encrypted?

[Anonymous Coward]

Who says you have to agree?

Re:Encrypted?

[vux984]

I haven't looked at the actual firefox extension but it wouldn't make sense to offer encryption and still store the PIN.

It would if the point of encryption is to keep it private *in-transit*. Just as HTTPS doesn't prevent the site you are interacting with to get all that data you submitted, the encryption prevents bystanders from seeing it.

So all this encryption does is give you some security that nobody but google will be able to see it. So if you value your privacy at all the question remains, do you trust google with it? Do you trust google to look out for your interests, even under government pressure?

Just for Now? or Always and Forever?

I'm with that other individual: Is there any extension that does this with an ftp/webdav/... server of *my* choice?

Re:Encrypted?

[Anonymous Coward]

trying to remeber a URL

Somehow I suspect you "forget" alot of URLs because you mistype them?

Re:Encrypted?

[hopethisnickisnottak]

Or you could be logged into Gmail and use Yahoo to do your searching!

Re:Encrypted?

[bblboy54]

Once actually inside G-Mail both https:/// and http:/// will work -- and there is a difference; when they first released the messaging inside the webmail page it only worked in the unsecure page.

While this may be true, this is not what is in question. The https only indicates that the transmission is using SSL but the client and the server both (most likely) contain unencrypted information. Should Google's servers ever become compromised, your data is not safe. This is not a problem with gmail or google, however. The same scenario is true just about anywhere you go on the web except (hopefully) your bank who would encrypt data stored as well.

Re:Encrypted?

[grammar fascist]

Its not really clear about how much of your information is encryped. Your passwords yes, but your browsing history? Your bookmarks?

I've just downloaded and installed it. It automatically encrypts your cookies and passwords (it doesn't let you change this setting), and gives you the option of encrypting history, bookmarks, and tabs and windows if you choose to synchronize them. Additionally, it's all optional.

And if you were really security-conscious, you could tell it to not synchronize anything at all.

Assuming it keeps working (it has so far), I really like it. It makes keeping bookmarks actually worthwhile.

Re:Encrypted?

[minuszero]

If you're using GMail, you're likely logged in to Google every time you do a search.
Why should I do that? No, of course I don't stay logged in any more than it is necessary.

clear all your google cookies in between?
change your IP address?
they potentially could still know it was you!

*runs off to shops to buy tin foil*

Re:Encrypted?

[LostInBrittany]

There is Foxmarks, from foxcloud.com Right now it only does bookmarks, and it allows you to store them in their servers OR in a server of your choice. And it doesn't seems very difficult to modify the extension to do the same thing with other info fro Firefox profile...

Re:Encrypted?

[Yvanhoe]

In fact I believe they are very conscious of these facts and that they are ready to fight trial after trial if the government give them orders to hand over some data. I think they might consider every personal information as a bullet in their fight against privacy invasion. Sure, these datas are better in their hand than in some other's but still, I won't freely give them mine.

Re:Encrypted?

[Inda]

Let's cut to the chase Google. My password is 12345. Knock yourselves out.

Funny thing is that the majority of people use the same password for gmail as they use for everything else. I'd put money on it.

Re:Encrypted?

[moro_666]

Encrpytion here encryption there.

If someone has the tools to hack on your connection, gmail is one of the least of your concerns.

  People that have access and sufficinet skill and the motivation, find much more profitable ways
to exploit their power than to read your ultimately important personal data from gmail. I find
it interesting that people have such an ego boost that they imagine that from the half a billion
interactive net users, they and their pocket money are the targets of all the hackers. Net thieves
prefer companies and computer unaware rich dummies as their targets. On a regular unprotected
windows box which is full of keyloggers and malware, gmail encryption or unencryption won't save
anyone, that's why it's targeted by worms all the time.

  Honestly, if you have information that is worth to keep private, you can own your own server for it,
for anything less the hackers won't even bother. Catch one big fish and get the f out of the hacking
business, this is the motto for the people that know what they are doing. Small fishes that get
money more easily from "please enter your paypal password here foo bar".

  Ps. if you are familiar with how SSL or any exchangeable keypair based encryption protocols work,
you should realize that people who have constant access to your network traffic, will find out your
information anyway. They just have to be right on spot when the keys are being exchanged. If they can
fake your packets at the same time too (obviously you don't need to be genius to do that) the agony
gets even deeper (with smalltime ISP-s, i wouldn't rise my eyebrows if that'd be the case).

  Security on the net is a bliss and illusion by the standards and tools that we use today. Ofcourse
you should do your best to keep smalltime hackers off your back, but try to put a limit on your paranoias.

  I use gmail, but all important stuff i keep somewhere closer to me.

All-in-all, enjoy your life as it is today, you may not have it all tomorrow.

Re:Encrypted?

[jrockway]

The real question is, is this a GPL violation? According to RMS, any plugin that uses the internals of a GPL'd application has to be GPL'd.

Then again, Firefox is tri-licensed or something, so the GPL probably doesn't apply in this instance.

Re:Encrypted?

[tehcyder]

I don't like the idea of Google ... snooping on this data

Well obviously Google wouldn't think of using this information for anything, they are Not Evil TM.

Re:Encrypted?

[Andrzej Sawicki]

Well if you already use GMail, what's a little more personal information?

The big deal for me would be information connected to my work, i.e. password to extranet sites and the like. Not likely I will ever let anyone keep those.

Re:Encrypted?

[MSZ]

All your saved passwords are belong to Google?

Re:Encrypted?

[Dominic_Mazzoni]

From the FAQ (emphasis added by me):

What's the point of encrypting my information?

By encrypting your information, it will be transmitted to and stored on Google's servers in a format that is nearly impossible to interpret without the PIN. That means that without the PIN, no one, not even Google, will be able to read your data

Re:Encrypted?

[Anonymous Coward]

Your being nonsensical, all of the data exists in database fields, it doesn't need to be mined. The ads are the product of a matching algorithym, making a seperate "data mine" database unnessesary and redundant.

Re:Encrypted?

[Anonymous Coward]

http://www.scroogle.org/cgi-bin/scraper.htm Solved the search bit for you.

Re:Encrypted?

[neoform]

It goes even further than that.. google tracks you even when you're not on their site, ever see google adsense? Every ad they display makes a call to: http://pagead2.googlesyndication.com/pagead/show_a ds.js and guess what, burried in that, i can bet you they not only track how long you're looking at that page (with AJAX), but they're tracking where your mouse is, and what you type.

Re:Encrypted?

[MPHellwig]

That's the stupidest password I've ever saw in my life! The kind of thing an idiot would have on his air shield!

Re:Encrypted?

[blirp]

> If you're using GMail, you're likely logged in to Google every time you do a search.

Why should I do that? No, of course I don't stay logged in any more than it is necessary.

Unless you make sure to clear all Google-cookies after logging
out and before logging back in GMail, it won't really matter
if you're logged in at the time you're searching or not.

M.

Re:Encrypted?

[ergo98]

People that have access and sufficinet skill and the motivation, find much more profitable ways
to exploit their power than to read your ultimately important personal data from gmail. I find
it interesting that people have such an ego boost that they imagine that from the half a billion
interactive net users, they and their pocket money are the targets of all the hackers.

I'm amazed that anyone would still say something this stupid (and that others would actually moderate it up). I seem to get several dozen phishing attempts per day, with people trying to gain access to my PayPal, Ebay, bank accounts, and other online services. I guess I must be stupid and rich to gain the attention of such target limited hackers, right?

No, of course not. Not only are there countless hackers out there with nefarious intentions, but usually their dirty work can be automated -- e.g. a simple trojan that your cousin has on his laptop, which then takes over your router in a method only possible from the inside (or installing a net listener), then automatically relaying whatever information they want. This is ignoring the fact that carriers aren't exactly the pinnacle of security, and it's entirely possible that curious or criminal employees have net monitors, and that's not even including the whole government angle.

The "security doesn't matter because no one cares about you" angle was dumb when people were saying it in the 90s. Now it just strikes me as unbelievable.

I have zero trojans of viruses on my PC (despite your defeatist "why bother fighting them?" attitude), and I want sensitive communications to be encrypted. Everyone should demand the same.

Ps. if you are familiar with how SSL or any exchangeable keypair based encryption protocols work,
you should realize that people who have constant access to your network traffic, will find out your
information anyway.

Wow, really? Care to enlighten us on how that could be, apart from some temporary implementation defects in a couple of clients (such as Internet Explorer). I call bullshit, and say that the entire foundation of your argument is ignorant nonsense.

Re:Encrypted?

[TCM]

PIN sounds like it's gonna be a short number, instead of a fully-fledged passphrase. Your ATM code may be a 4-digit number, because brute forcing doesn't really work there (slow to try and locked after 3 attempts), but using it to encrypt data on a computer would be royally stupid. That'd be only 10000 combinations.

So, question: is it really a _number_ or a passphrase?

Re:Encrypted?

[thanasakis]

Google is not a spyware company and apparently selling personal information is not their business model. Besides, they are making a shitload of money already, why would they want to try such risky stuff?

From your own words, it is obvious that the real problem is the monkey you are reffering to. If the head honcho doesn't give a rats ass and pisses on your rights, well, good luck waiting for Google to resist their court orders.

All these posts about Google wanting to undermine peoples privacy neglects to see the fact that the real danger lies elsewere.

Re:Encrypted?

[smittyoneeach]

Catch one big fish and get the f out of the hacking business, this is the motto for the people that know what they are doing.

Oh, really?

While I have no background in criminal psychology, I'm curious how people can "know what they are doing" in the one-shot scenario you posit.

OTOH, hubris has melted the wings of more than one Icarus...

Re:Encrypted?

[Giometrix]

Its a regular password. I really think they should have called it a "password" instead of a PIN, as many people will associate this with an ATM pin and pick a 4 digit numeric password.

Re:Encrypted?

[glesga_kiss]

Generally, transport encryptions don't have passwords/pins, it's unneccessary. Public/private keys are just fine. If it was purely for transport encryption, they'd just use SSL or something similar.

Re:Encrypted?

[Anonymous Coward]

you "forget" alot of URLs

But I'll bet he doesn't mysteriously concatenate a lot of his URLs together.

Re:Encrypted?

[BigDogCH]

Not that I diagree with you, but how do some people get so much spam and phishing scams in email? I hear so much about the spam problems and phishing problems, yet I don't see it. I have had the same email address for many years, along with everyone else I know, and none of us ever get spam or scams. I think I once started recieving some junkmail, so I clicked the dredded "unsubscribe" button, and it stopped coming.

I have no spam, scam, virus , whatever filters. I have used the same address for many years, using it to sign up on hundreds of websites. I have a very common ISP, with a short and simple address. I use ebay, paypal, and every other online service under the sun. Seriously, I don't get it? How do people get on these lists? I must be in dozens of address books by now....many of which are users that I know don't have decent security.

I have a rather robust firewall, use Firfox and Tbird. I just finally installed SP2 a few weeks ago, and probably am still months behind on patches. I run no antivirus, or anything of the sort (an annual housecall scan, after my nephew uses my computer for a weekend).

To stay on-topic. I don't worry much about google creating a profile about me, they don't need to. They have an archive of the actual emails.

Re:Encrypted?

[mysticwhiskey]

That would be "It's"

*Rolls eyes* - if you're gonna be a grammar nazi, then dammit, do it properly:

avalable - that would be available
relevent - that would be relevant
encyption - that would be encryption
primative - that would be primitive
encypt - that would be encrypt
symetric - that would be symmetric

Remember, this is for your own good.

Re:Encrypted?

[Chabil Ha']

There's a gotcha, though. If we read further, there's this little interesting part:

You can recover your PIN quickly and easily. Just log on to a computer where you've installed Google Browser Sync, then follow these steps:

1. Open a Firefox window.
2. Open the "Settings..." menu under your username in the upper-right corner of the page.
3. Click the "Show" button in the "Security settings" section of the page.

So, this says to me that, sure my info is encrypted, but if someone with a lot of muscle (like my Big Brother) then that information can be decrypted.

Re:Encrypted?

[Anonymous Coward]

if you are familiar with how SSL or any exchangeable keypair based encryption protocols work,
you should realize that people who have constant access to your network traffic, will find out your
information anyway. They just have to be right on spot when the keys are being exchanged.

The SSL client sends a challenge to authenticate the host and compare with the local certificate. If you are familiar with how SSL or any exchangeable keypair based encryption protocols work, you know it protects against a MiTM attack which you are describing (unless a flaw is found in the encryption protocol, but even then there are other safeties against this).

Re:Encrypted?

[wilcosworld]

Firefox plugin- customisegoogle.

Re:Encrypted?

[Earered]

> I'm with that other individual: Is there any extension that does this with an ftp/webdav/... server of *my* choice?

https://addons.mozilla.org/firefox/1989/

or

http://extensions.geckozone.org/BookmarksSynchroni zer

though only https, no sftp or ftps

Re:Encrypted?

[Anonymous Coward]

You're probably not active on mailing lists (or at least those which don't hide your email).

Re:Encrypted?

[shellbeach]

I don't think it's as simple as that. If you're using GMail, you're likely logged in to Google every time you do a search.

Solution: use your country's google search address (google.com.au in this case) and block cookies from that address - result: no saved search history, whilst Gmail stays logged in.

I have to admit that the idea of storing firefox profiles on Google's web server scares me just a bit ... I guess that until there's evidence of misuse by one of the big free email providers, or Microsoft, or Google, people are going to (perhaps naively) trust those big corporations to secure their data.

Re:Encrypted?

[Anonymous Coward]

>> Ps. if you are familiar with how SSL or any exchangeable keypair based encryption protocols work,
>> you should realize that people who have constant access to your network traffic, will find out your
>> information anyway.
>
> Wow, really? Care to enlighten us on how that could be, apart from some temporary implementation
> defects in a couple of clients (such as Internet Explorer). I call bullshit, and say that the entire
> foundation of your argument is ignorant nonsense.

In a corporate environment we were recently evaluating devices to intercept and monitor SSL connections.
An extension to our existing transparent proxy to MITM the connection; the proxy server uses the server's
certificate to encrypt and decrypt the external path and generates a new fake server cert signed by our
internal CA that is a trusted root for the clients to handle the internal path. Theoretically, any ISP
could do the same thing as long as they can get you to trust their CA; a feat that could easily be done
when you run their "special" installation program (and most consumers would never notice).

Re:Encrypted?

[AngusSF]

If you use the NoScript extension (http://noscript.net/) and block googlesyndication.com, those tracking scripts can't execute.

Re:Encrypted?

[RevDobbs]

No shit.

Re:Encrypted?

[AngusSF]

Anyone know what encryption algorithm is used?

Re:Encrypted?

[TheRequiem13]

I agree with you, except the phrase "in case it ever gets broken." It's more a matter of "for when it eventually gets broken." Encryption is temporary.

Re:Encrypted?

[jdbartlett]

Just tested your theory using "personalized search". If they are logging search results of logged-out users, they aren't displaying them in the "personalized search" database. It'd also give them pretty inaccurate data - people logging out of a public machine aren't necessarily going to wipe all cookies in the browser for the next user (unless a very sensitive sysadmin has set the machine up to do this every time the browser closes).

I call tinfoil hat.

Re:Encrypted?

[Anonymous Coward]

Take a look at http://www.sitebar.org/

This does pretty much exactly the same as Google offering, except you can run it on your own server.

You can even set it up with different accounts to allow friends to use it.

Re:Encrypted?

[nacturation]

So the information you're revealing is your personal interest in the subject matter of those mailing lists. Marketers don't necessarily care what your name is... they just want to know what to market at you. If you buy, they'll get your particulars then.

Re:Encrypted?

[Bill_the_Engineer]

Pretending encryption is 100% secure is foolish.

While your statement may be technically true, it misses the mark.

The purpose of encryption is to protect data during its transport not by making it impossible to read, instead its to make it where that when said data is decrypted enough time has passed to make the contents worthless.

Re:Encrypted?

[ergo98]

If you're on someone's machine, there are many things you could do to circumvent the checks and securities, so that's pretty much game over.

However the GP post is claiming that simply having access to network traffic was sufficient to mount a MITM attack. Of course it isn't (apart from flawed implementations), and that scenario was specifically design against.

Re:Encrypted?

[MobileTatsu-NJG]

"All these posts about Google wanting to undermine peoples privacy neglects to see the fact that the real danger lies elsewere."

Heh. That was the point of both my posts.

Re:Encrypted?

[jac89]

The sync program does automatically encrypt the sensitive data (eg. passwords/cookies) and gives the option to encrypt the other data you send. I personally trust google more than one of the other browser sync programs out there

Re:Encrypted?

[Pollardito]

vast resources, a new hot algorithm out of nowhere to launch the company with. maybe they're not just working for the government, maybe Google is run by the NSA. sure would make it easier to get legal approval to search our stuff if we opt into their mail service and download their desktop search :)

Re:Encrypted?

[thanasakis]

Um, sorry, I can see that now. I was already pissed with all the previous posts and by the time I got to yours, I couldn't read it right.

Re:Encrypted?

[Numbstruck]

I seem to get several dozen phishing attempts per day, with people trying to gain access to my PayPal, Ebay, bank accounts, and other online services. I guess I must be stupid and rich to gain the attention of such target limited hackers, right?

No, actually you're just getting spam. Heard of it, yes? I receive phishing attempts also. Most of them are for places, banks usually, with which I've never done business and do not hold an account. Please don't imply that because you get phishing spam that hax0rz are trying to get all your personal data. That's really a terrible example to use for your argument. Most of the phishing email I've seen relies on you to give out your information.


Just for reference...

Phishing - A method of identity theft carried out through the creation of a website that seems to represent a legitimate company. The visitors to the site, thinking they are buying something from a real business, submit their personal information to the site. The criminals then use the personal information for their own purposes, or sell the information to other criminal parties.

I'm amazed that anyone would still say something this stupid (and that others would actually moderate it up).

Ditto :)

Re:Encrypted?

[drew]

Well, since Firefox extensions are just zip files full of javascript and xml, there's nothing stopping you from downloading this extension and changing sync.google.com to (or whatever url they use) to sync.vux984.com.

For that matter, you could also look at the source and figure out whether the PIN is ever sent to their servers or just the data.

Re:Encrypted?

[ergo98]

No, actually you're just getting spam. Heard of it, yes? I receive phishing attempts also. Most of them are for places, banks usually, with which I've never done business and do not hold an account. Please don't imply that because you get phishing spam that hax0rz are trying to get all your personal data. That's really a terrible example to use for your argument. Most of the phishing email I've seen relies on you to give out your information.

Are you retarded? The fact that you gave the definition of phishing really takes the cake -- Did you think anyone is unsure what phishing is?

The point, which you so amazingly missed, is that phishing casts a wide net, via the amazing capabilities of automation, to try to gather personal information (yes, that's the point of phishing) from a large number of small targets. The "one-off rich guy" target is absolutely inane, and absolutely contrary to the reality of hackers.

Re:Encrypted?

[DragonWriter]

In theory, the gov't shouldn't have even asked them for the records, yet it still happened. Worse, we've got a monkey in the white-house that may bend the rules a bit to try even harder.

The problem here is not with Google. Its with an out-of-control government and and apathetic public that fails to reign in the government. Google allowing users to store data or not allowing users to store data makes little difference in that.

Re:Encrypted?

[blugu64]

That and the fact that firefox isn't (or wasn't back when I read up on it) a GPL'ed project. Rather they use the MPL, (again IIRC).

Re:Encrypted?

[Anonymous Coward]

No worries, man. Have a good weekend. :)

-MobileTatsu

Re:Encrypted?

[DragonWriter]

Not that I diagree with you, but how do some people get so much spam and phishing scams in email?

Having your real email address posted on the web helps.

Re:Encrypted?

[MBGMorden]

Encryption isn't quite as temporary as you'd think. If the algorithm is matehmatically sound, you're left only with brute-forcing it. Computers could be 1000x faster than they are now and it still wouldn't be practical to brute force a suitably long key.

Re:Encrypted?

[MBGMorden]

Google never gave away any data in China. You must be confusing them with Yahoo.

Re:Encrypted?

[Dominic_Mazzoni]

By your definition, it's a passphrase.

Re:Encrypted?

[DonChron]

The Mozilla suite, now SeaMonkey, has had user-profile sync'ing to FTP servers for about a year. SeaMonkey 1.0.2 has roaming profile functions to HTTP or FTP servers as a native feature.

-Don

Re:Encrypted?

[Anonymous Coward]

From the FAQ:

By encrypting your information, it will be transmitted to and stored on Google's servers in a format that is nearly impossible to interpret without the PIN. That means that without the PIN, no one, not even Google, will be able to read your data. Therefore, it's important to choose a good PIN (at least 8 characters including both numbers and letters) that's hard to guess and to keep your PIN safe. Note that encrypting all of your browser settings may affect the performance of Google Browser Sync and Firefox.

(emphasis mine)

So the real question is, do you trust Google to implement the extension and encryption correctly. Fortunately, I believe you can check the code for the extension yourself if you want.

Re:Encrypted?

[unicode]

I use omni-web ( os-x only ) to sync bookmarks.....this works great. You can run your own book mark sync-server. However it costs a fair bit. Each omni-web licnece is approxiuamly $30.

Have been using for about 3 years, no problems. Using Apache WebDave Module for the server.

Hope that helps.

Re:Encrypted?

[unicode]

I use omni-web ( os-x only ) to sync bookmarks.....this works great. You can run your own book mark sync-server. However it costs a fair bit. Each omni-web licnece is approxiuamly $30.

Have been using for about 3 years, no problems. Using Apache WebDave Module for the server.

Hope that helps.

Re:Encrypted?

[Kaa]

Well if you already use GMail, what's a little more personal information? Of course Google can index it and add it to the increasingly large profile of you.

The easy way out is to use Gmail *only* on Internet Explorer, and use Firefox for all the other web browsing, including Google searches. Setting Firefox to specifically deny any and all Google cookies also helps.

Re:Encrypted?

[Anonymous Coward]

No.

Re:Encrypted?

[Numbstruck]

Are you retarded? ... Did you think anyone is unsure what phishing is?

"No" followed by a "Yes". You presented yourself as someone who did not know.

The point, which you so amazingly missed, is that phishing casts a wide net, via the amazing capabilities of automation, to try to gather personal information (yes, that's the point of phishing) from a large number of small targets. The "one-off rich guy" target is absolutely inane, and absolutely contrary to the reality of hackers.

It's easy to automate the process of sending out email to a large number of people in an effort to get them to hand over their account information? Really? As I said before, I receive spam/phishing email, and I'm well aware of how the general process works.

Are you retarded? Of course the "one-off rich guy" scenario is inane when applied to phishing. My point, which you so amazingly missed, is that phishing is NOT hacking. It's an email asking you to give me your personal information. I didn't steal it from you. I tricked you into giving it to me. Since when has this been considered hacking? Social engineering or a Con perhaps, but hacking? Would you like a definition for hacking as well?

So, since it's not considered hacking, then what purposes does it serve in making your point? The GP was talking about hackers. More specifically, a hacker using their talents to gain unauthorized access to a specific target. I would imagine this process is nothing like phishing.

So let me recap...


GP: Hackers don't care about you. They're after the big fish.

You: Nah-uh! I get phishing email, which is automated. Also, security is important.

Me: Who cares?

Re:Encrypted?

[jrockway]

Firefox is GPL'd, but it's also licensed under BSD and MPL.

Re:Encrypted?

[NaDrew]

maybe Google is run by the NSA. sure would make it easier to get legal approval to search our stuff

Since when did the NSA care about legal approval?

Re:Encrypted?

[pdbaby]

They use HTTPS for transport security for all messages and the PIN encrypts data client-side and isn't transmitted to google. Have a look at the source code some time :)

Re:Encrypted?

[pdbaby]

Complete javascript source code in the archive anyone? Who needs tcpdump when you have the source?

Re:Encrypted?

[ergo98]

Ah. Yes, you are retarded. Listen, I'm sorry about being a bit mean in the other email.

You see, young one, phishing is considered "hacking" because the culprits almost always (if not -always-) used hacked or maliciously obtained websites to host the fake site. Not to mention that it usually uses some technical client hack to deceive the user about the site in question.

Every non-retard on the planet calls phishers hackers. In practice, non-idiots realize that phishers are almost exclusively hackers.

So again, I apologize for being so mean.

Re:Encrypted?

[tftp]

Yes, I use CustomizeGoogle extension for ages, and it is set to maximum privacy in all option tabs.

Re:Encrypted?

[Anonymous Coward]

Ah, you failed the test! You have never understood that spellinggrammar. You lose!

Re:Encrypted?

[Fullaxx]

It's in the FAQ, there is a PIN that encrypts your information

Re:Encrypted?

[vivtho]

I don't see why providing the GMail service and using usage information should be mutually exclusive. I don't work for Google or have any affiliation with them, but expecting them to provide the services they do for free is going too far.

Using GMail or www.google.com/ig is optional. Nobody is forced into doing it. And in my opinion, Google does a very good job about being upfront about the fact that it uses your information to target advertisements. Also, keep in mind that Google also provides the basic search service without the need for anyone to login or provide any personal information.

The moment you depend upon a third party to provide a service of any kind you are giving up a little bit of your privacy. That third party can be anyone, from Google to the shop around the corner. It is upto you to decide upon whether you value your perivacy or your convenience more, whenever you perform a transaction, and this is something most of us do naturally. For example, if you're a kid, and want to buy a pack of cigarettes (or anything other forbidden article), there's no way you're going to buy them from the store across the street, you'd go to the vending machine as far away from anybody your parents might know.

And with regard, to the Government getting access to that data... wouldn't they get it anyway? If not from Google, then from your ISP, your bank, your credit card, your employer or the stores you frequent? If you want to deny the Government access to your information, I'm afraid you'll need to move... into the rainforest perhaps, and limit your communication to face-to-face conversations with nothing written down.

Re:Encrypted?

[tftp]

I don't see why providing the GMail service and using usage information should be mutually exclusive.

Because I like it this way, so for me it is mutually exclusive.

expecting them to provide the services they do for free is going too far.

I don't expect anything; it's Google who provides the service, and if Google decides to stop doing so (by servicing only logged in users) then it's their right.

And with regard, to the Government getting access to that data... wouldn't they get it anyway?

Well, we are all going to die anyway, so why don't I see people jumping off of tall buildings all the time? A girl is going to lose her virginity sooner or later anyway, so why not now? Your question is a fallacy.

If not from Google, then from your ISP, your bank, your credit card, your employer or the stores you frequent?

I fail to understand how my bank would know what searches I run on Google or some other search engine? Besides, these risks need to be understood and mitigated one at a time. If your house has three entrances you lock them all, as it is proper for each door and gate, instead of saying "one of these three may be unlocked accidentally, so why bother to lock the other two?"

If you want to deny the Government access to your information...

Then it won't have that information, period. Sure, it's always possible to send some HUMINT in and tail me, and put spy bugs in my home - but admit it, this is not likely to be done if the person in question is not a suspect already. Nobody in the government will sign on an authorization of such a massive fishing expedition against a boring simple citizen. So if the Government does not know that you, for example, out of curiosity searched for "Natalie Portman address" two days before her house was burglarized (again, for example) you will not become a suspect in such a crime. Otherwise it would be very easy for the police to step into the groove and work on you like they did on Richard Jewell.

Ads will conveniently follow your bookmarks

[atlacatl]

Google's brand, I think, is being devalue with their main revenue stream being advertisement.

You know that all that information about bookmarks and favourites will be of use to marketers.

From my part, for now, I will pass...

Re:Ads will conveniently follow your bookmarks

[generic-man]

Google can already follow you around the 'net using their ad network. Blogs, photos, news sites, etc., all have Google Adsense. That same cookie builds up a wealth of data about you. If this offends you, putting your bookmarks up on Google shouldn't be any worse -- what could you possibly be telling them that they don't already know?

(Besides your passwords to other sites...)

Re:Ads will conveniently follow your bookmarks

[Anonymous Coward]

it beats the penis enlargement ads, now google will allready know I have a large member & don't need such herbal enhancements

Re:Ads will conveniently follow your bookmarks

[RedWizzard]

The data is encrypted before being sent to Google's servers. Nice knee-jerk reaction though.

Re:Ads will conveniently follow your bookmarks

[rainwater]

Of course if you choose click the checkbox to encrypt your bookmarks, then Google has no way of knowing anything about your bookmarks since they never have access to your key you choose

Re:Ads will conveniently follow your bookmarks

[Anonymous Coward]

But now, everyone at /. knows your boyfriend has a large member, ma'am.

Re:Ads will conveniently follow your bookmarks

[bergeron76]

He's actually right. If your main source of revenue is advertising dollars, your biggest asset is your "client base" and all the information you have about them - basically a big database about who likes what and how you can contact them. Put those two things together, and you have a goldmine for corporate marketing/advertising departments. They even have a very ubiquitous software application called "Goldmine" (a CRM app).

Joe Q. Public likes Jessica R. Abbit, but he's a high-schooler on a budget. Instead of sending him the add for the Tacori Diamond bracelet, let's send him the advertisement for the CVS box-o-chocolates. He's more likely to respond to that ad, which results in increased revenue for GOOG.

Information is valuable. Organized information that no one else has is "invaluable"!

Re:Ads will conveniently follow your bookmarks

[jhoger]

Yes, because as everyone knows, businesses being able to more effectively communicate and accurately target the right customers is the worst thing that can happen.

Really, marketing is not a dirty word...

-- John.

Re:Ads will conveniently follow your bookmarks

[killjoe]

Any information Google can collect, MS can collect. They own the OS remember?

Re:Ads will conveniently follow your bookmarks

[Stop Or I'll Noop]

The data is encrypted before being sent to Google's servers. Nice knee-jerk reaction though.

Mod parent down. So what if it's encrypted iF Google has the encryption key. From the FAQ:

Why do I need to provide a PIN?
The PIN you create during setup is used to encrypt information that's synced between your computers, which may include sensitive information such as your passwords for websites. We use your PIN to unlock that information.

Re:Ads will conveniently follow your bookmarks

[kfg]

Joe Q. Public likes Jessica R. Abbit. . .He's more likely to respond to that ad. . .

She's not ad, she's just dawn that way.

KFG

Re:Ads will conveniently follow your bookmarks

[Anonymous Coward]

OMGZ!!!! When I put in my PIN at the bank, I can get money!! Do you think the Bank is going to steal my money?!?!?

really... why can't you people get over yourselves?

Re:Ads will conveniently follow your bookmarks

[DeXOR]

Keep grandparent modded up, mod parent down. Google doesn't have your key, atleast according to their FAQ:

That means that without the PIN, no one, not even Google, will be able to read your data.

Re:Ads will conveniently follow your bookmarks

[1u3hr]

The data is encrypted before being sent to Google's servers.

So it's encrypted en-route. How about when Google gets it? Seeing as how they mine GMail for hooks to serve ads, it seems likely they'd similarly analyse your bookmarks.

Re:Ads will conveniently follow your bookmarks

[spencer1]

The "we" that it is referring to the the browser extension. The extension has to store the pin to decrypt the settings.

Re:Ads will conveniently follow your bookmarks

[RedWizzard]

According to the FAQ it's encrypted on their servers and they can't read it. You may choose not to believe them, of course.

Re:Ads will conveniently follow your bookmarks

[Anonymous Coward]

With all of the unnecessary account fees banks charge, some might argue that yes, they are in fact stealing your money.

Re:Ads will conveniently follow your bookmarks

[RedWizzard]

He's actually right. If your main source of revenue is advertising dollars, your biggest asset is your "client base" and all the information you have about them - basically a big database about who likes what and how you can contact them. Put those two things together, and you have a goldmine for corporate marketing/advertising departments. They even have a very ubiquitous software application called "Goldmine" (a CRM app).

All of which is completely irrelevant to this discussion because the information you are givng them is encrypted and they can't read it.

Re:Ads will conveniently follow your bookmarks

[RedWizzard]

So what if it's encrypted iF Google has the encryption key.

Did you not read the rest of that FAQ? Or are you being deliberately misleading? From the FAQ:

What's the point of encrypting my information?

By encrypting your information, it will be transmitted to and stored on Google's servers in a format that is nearly impossible to interpret without the PIN. That means that without the PIN, no one, not even Google, will be able to read your data.

Re:Ads will conveniently follow your bookmarks

[Solra Bizna]

Well said.

-:sigma.SB

Re:Ads will conveniently follow your bookmarks

[tftp]

That means that without the PIN, no one, not even Google, will be able to read your data.

This must be written by a lawyer. It does not say if Google has the PIN or not.

Re:Ads will conveniently follow your bookmarks

[krunk4ever]

This can really be interpreted in 2 ways:

We, Google Server, will use your PIN to unlock that information
OR
We, Google Client App, will use your PIN to unlock that information.

I personally don't see why Google would ever need to unlock the encrypted information on their side (unless they want to be evil), and obviously, it won't be you who's unlocking the information, but the firefox extension (we, google client app) will be.

Re:Ads will conveniently follow your bookmarks

[nacturation]

Of course you could read between the lines:

We use your PIN [within the software extension that runs on your computer and does all the encryption/decryption] to unlock that information.

It's the "royal we".

Re:Ads will conveniently follow your bookmarks

[tftp]

businesses being able to more effectively communicate and accurately target the right customers is the worst thing that can happen

Worst or not, ads are capable of taking money away from you, and many people are weak-willed and thus vulnerable. Would you agree to be hypnotized for no good reason? Ads are just a lighter version of brainwashing.

Given that people don't need 99.99% of all advertised products, isn't it better to just say no to all ads and think for yourself when you need something?

Re:Ads will conveniently follow your bookmarks

[NoMaster]

Yes, because as everyone knows, businesses being able to more effectively communicate and accurately target the right customers is the worst thing that can happen.

It's a bit hard to explain without rising to hyperbole - but imagine if we'd all been happily using riaasearch.com for the last few years. Everyone has riaasearch textads all over their blogs, torrent sites ask you to click one before entering, and every second person has a riaasearch toolbar in their browser.

Now, imagine if riaasearch turned evil...

Really, marketing is not a dirty word...

You're right. It's not a dirty word; it's a weasel word...

Like those cat parasite things; Toxoplasma. Supposedly makes some people feel good, more outgoing and warmhearted. But a parasite is still a parasite...

Re:Ads will conveniently follow your bookmarks

[azuretek]

I don't watch TV (unless it's recorded or a DVD) or listen to the radio and I realized I don't know what's going on with new movies and products. Oddly it's kind of like being disconnected from the world, I don't know what to use.

Not saying it's a bad thing, just that I don't know when new things are going on.

Re:Ads will conveniently follow your bookmarks

[Simon Donkers]

Google has said they are looking into syncing this with Google Bookmarks and hence they need this data unencrypted. It also means that if they are working on this they currently already have that access.

I've also once heard from Google that they are not currently using Google bookmarks for PageRank but that they are thinking about doing so in the future. While the Google Bookmarks are now still pretty empty with such a solution it will be very easy to fill it making this a useful option to calculate PR.

Re:Ads will conveniently follow your bookmarks

[KiloByte]

Google can already follow you around the 'net using their ad network. Blogs, photos, news sites, etc., all have Google Adsense.

Since all of Google's tracking uses 3rd party servers, ypu cam trivially avoid it except for when you explicitely use one of their services. All you need to do is to get and train Adblock, do the equivalent on your Squid proxy or cut them off on your DNS and/or firewall.

For Adblock, you do know where to get it from.
For Squid, there are packages like adzapper. I'm not sure if Privoxy cuts away Google's spying, but I hope it can do it as well.
For DNS-based blocking, let me plug my own database: (no pretty page, sorry) -- on your DNS server, put deb http://angband.pl/debian sarge main into /etc/apt/sources.list and apt-get install dnscruft. It should be in the official repository once I bum an upload off a DD.

Of course, the best idea is to have more than one layer of defense. This is a form of spying that can be easily thwarted, so there is no reason we shouldn't fight for ourselves and our networks.

Re:Ads will conveniently follow your bookmarks

[XMyth]

Or, it'd simply be an option to sync with Google Bookmarks at the time of synchronization from the clients? Why compromise the security of the rest of your synchronized items (passwords, etc) by storing the PIN on their servers when it's perfectly fine to store it on the client(s) only? It wouldn't make any sense. They do not need the PIN on their servers to sync with Google Bookmarks.

Re:Ads will conveniently follow your bookmarks

[chiskop]

Worst or not, ads are capable of taking money away from you

I don't know about the ads where you're from, but no ad has ever taken my money. If I'm going to trade my bookmarks for convenience I'll trust google before anyone else. About the only ads I still see online these days are google's. They're discreet and occassionally useful.

I don't know if I'm particularly strong-willed and thus invunerable to the ads' powers but I can think of only once that I've spent money as a result of a google ad, and that was for a hosting package that was ideal for my needs.

Re:Ads will conveniently follow your bookmarks

[LostInBrittany]

That's one of the reasons why I prefer my Ubuntu...

Re:Ads will conveniently follow your bookmarks

[Anonymous Coward]

Really, marketing is not a dirty word...

But would you want your daughter to marry someone in advertising?

Re:Ads will conveniently follow your bookmarks

[Mikelikus]

The trolls, the trolls... "Mod parent down." I'll reply instead:

If you read the FAQ you would know that the PIN is only known client side. So Google uses your PIN - in your extension - to unlock that information. Or would you rather to have it forever encrypted?

Re:Ads will conveniently follow your bookmarks

[EnglishTim]

But how big is the PIN? If it's anything like a credit card PIN, it'll only be 4 numbers or so. There's nothing stopping Google trying every PIN combination, which they could do in the blink of an eye.

Re:Ads will conveniently follow your bookmarks

[adtifyj]

Information is valuable. Organized information that no one else has is "invaluable"!

This is precisely why I dont mind giving my information to Google in exchange for very good services. Google's business plan depends on being very careful with my information; their assets plummet the moment they share my information with another organisation.

Re:Ads will conveniently follow your bookmarks

[jrockway]

I used a passhprase. PIN is a misnomer here (as with smartcards, you can use a full ASCII "PIN").

Re:Ads will conveniently follow your bookmarks

[john83]

Read the parent. "We use your PIN to unlock that information."

Re:Ads will conveniently follow your bookmarks

[Spliffster]

Google says in their FAQ that all data will be transferred and stored encrypted. Only you have the PIN Code (as they call it) to decrypt it. Wether this is true or not is anotehr question.

Re:Ads will conveniently follow your bookmarks

[walt-sjc]

Lets put it another way...

How many computers does google have?

How easy would it be to setup a low priority cracking job on their server farm?

How much trust do you want to put in a company that has proven it will cooperate with the government when pressured - even just a little pressure?

Re:Ads will conveniently follow your bookmarks

[RedWizzard]

That's a worrying case of paranoia you've got there, you might want to get it looked at.

Seriously, are you trying to say that Google have gone to the trouble of announcing encryption, built a client convincing enough to fool security researchers (who will inevitably check), but are really planning to read my bookmarks for their own nefarious purposes? Why wouldn't Google just not mention encryption? This way they're opening themselves up to lawsuits.

Or do you just mean that the government has a burning desire to log in to websites using my accounts?

Re:Ads will conveniently follow your bookmarks

[geoffspear]

Actually, the FAQ doesn't say they don't have your PIN. It says that if they don't have it, they can't encrypt your data. You're assuming ((p -> q) -> p).

Re:Ads will conveniently follow your bookmarks

[4D6963]

You know that all that information about bookmarks and favourites will be of use to marketers.

From TFFAQ "That means that without the PIN, no one, not even Google, will be able to read your data"

In other words, no Google won't use your "bookmarks *and* favourites" (that's the same thing IIRC) for marketing since they won't be able to read them.

Re:Ads will conveniently follow your bookmarks

[Anonymous Coward]

Microsoft owns OS X?

Re:Ads will conveniently follow your bookmarks

[generic-man]

I thought the whole point of "do everything in JavaScript in a web browser" was to eliminate the need for you to be on one computer. I agree that what you suggest will work for your own computer, but the philosophy behind that pretty much eliminates the possibility of (for example) checking your Gmail on someone else's machine,* lest you be profiled there.

* unless that someone else is cool with you changing proxy settings and Firefox extensions, but many businesses and 'net cafes are not

Re:Ads will conveniently follow your bookmarks

[pbhj]

I have not checked TFA but AC said earlier that:

http://www.google.com/tools/firefox/browsersync/fa q.html#q9 [google.com] Why do I need to provide a PIN? The PIN you create during setup is used to encrypt information that's synced between your computers, which may include sensitive information such as your passwords for websites. We use your PIN to unlock that information. Without your PIN, no one will be able to read the information that's being transmitted between your computers via Google Browser Sync.

So you're right, but it seems they have the PIN.

Re:Ads will conveniently follow your bookmarks

[Abcd1234]

Like those cat parasite things; Toxoplasma. Supposedly makes some people feel good, more outgoing and warmhearted. But a parasite is still a parasite...

Err, no... it's a Symbiote, as both organisms benefit from the relationship.

Which is, I would argue, an excellent analogy to the relationship between me and Google.

History?

[sugapablo]

Great, now not only can Google know how many times I search for "MILF", but they can see all the pr0n sites I visit too. They're worse than the NSA. :)

Re:History?

[Mr. Freeman]

The data is encrypted before being sent to Google.

Although if you read the FAQ, you'd know this already.

Re:History?

[Infernal Device]

pr0n: it's what Opera is for.

Queue the privacy complaints

[Anonymous Coward]

It's encrypted at the client side, if you can't trust Google with your encrypted data then you should probably just disconnect from the internet right now

awesome

[Donniedarkness]

Google making firefox extensions? Maybe I'm retarded, but this is the first I've seen.

Anyways, this seems like a good idea, especially people who have several homes or places they browse the net. Also a good way to backup my favorites. Any clue how much slower this'll make Firefox?

Re:awesome

[ChowyChow]

The Googlebar for Firefox is another example of a Firefox extension. I'm using it right now and I didn't notice any lag. But my bookmark file only has around 75 bookmarks.

This is still amazingly useful. Integration with Google Bookmarks and Trends would be cool , since I have the tendency to search for things on Google rather than bookmarking them.

Re:awesome

[krotkruton]

Google making firefox extensions? Maybe I'm retarded, but this is the first I've seen.

Maybe I'm retarded, but that didn't seem sarcastic to me, so here are some other firefox extensions from google. The "beta" (yeah, google loves the beta) version of google toolbar for firefox was released on July 7th, 2005.

Re:awesome

[tonyr1988]

Just to clarify, this is not the first Google Firefox extension.

http://www.google.com/tools/firefox/index.html

• Google Toolbar
• Google Browser Sync (how relevant.....)
• Blooger Comments
• Send to Phone

They also used to have:

• Google Safe Browsing
• Google Suggest

But they are both incorporated into Google Toolbar now.

Re:awesome

[Anonymous Coward]

Personally, I just use Portable Firefox and copy my profile over to that every once in a while. Sure, the one on my USB stick might not have the very latest bookmarks added or the absolute newest extensions installed, but I can live with it until I sync it up again.

Re:awesome

[Hellsbells]

Don't forget the controversial Google Web Accelerator.

Re:awesome

[doti]

and don't forget the Google Notebook.

Something about this...

[gakon5]

Giving Google my passwords and browser history? Who knows what evil they could do with them?

Re:Something about this...

[pilot1]

I suggest you RTFA before posting. The data is encrypted, and cannot be decrypted without your PIN.

Re:Something about this...

[Anonymous Coward]

Google's motto: DO NO EVIL.
I trust them, and will continue to trust them until several years down the track when all current exec's have been replaced by slightly less moralistic people, and replaced again by slightly etc etc etc etc.
For now? Let them take over the world. I like my warm security blanket and Google is better than SkyNet.

Re:Something about this...

[rainwater]

All passwords are encrypted with the key you choose when you setup the extension and this setting can't be changed. Encrypting your history is off by default. Google has no access to the key you choose to encrypt it with.

Re:Something about this...

[Anonymous Coward]

Right, because so far Google has shown that they eat babies and sleep with your mom. First... RTFA, second, stop puttin out hate just because they make more money then you, Im tired of this zomg they suck cuz they are big crap.

Re:Something about this...

[Anonymous Coward]

Giving Google my passwords and browser history? Who knows what evil they could do with them?

Your secret is already out. We *all* know that you read slashdot.

Re:Something about this...

[LQ]

The data is encrypted, and cannot be decrypted without your PIN.

Great. So now google wants my pin. (Don't most people only have one?) What's wrong with a password?

Pr0n

[pete-classic]

Wait, I don't want all my bookmarks from home in my work browser!

-Peter

Re:Pr0n

[TrippTDF]

hear hear! one of my co-workers had the yahoo equivelent of this. One day when on their computer, they tried to play off like someone else put them there, but they didn't know how to get them out...

Seriously... some data should just stay at home.

Re:Pr0n

[Zathrus]

Wait, I don't want all my bookmarks from home in my work browser!

And I don't want all of my work bookmarks in my home browser. I have a number of work-related bookmarks that point to local files (such as Oracle docs) and to places on the corporate intranet. Both are useless to me from home (the intranet ones may be useful if I was VPN'd, but that's exceptionally rare).

I would love to find a bookmarks synchronizer that allows you to exclude bookmarks and still work through the regular bookmarks menu.

Ultimately I'd like to have "groups" of bookmarks and be able to synch particular groups between systems. I've seen some that have this concept, but they don't work through the regular bookmark menu.

Re:Pr0n

[dubiousmike]

"Ultimately I'd like to have "groups" of bookmarks and be able to synch particular groups between systems."
 
Well, each "group" should have a different Google login. Ultimately this account for the type of security you want that separates home and work bookmarks.

Re:Pr0n

[Zathrus]

Well, each "group" should have a different Google login. Ultimately this account for the type of security you want that separates home and work bookmarks.

And then how are you supposed to synch bookmarks that are common between the two? When I add a general use bookmark at work, how is it going to appear on my home systems?

You're completely and utterly missing the point. In fact, for the simple case (1 work system, 1 home system) you're "solution" does nothing at all.

passwords?

[Anonymous Coward]

Saving your passwords on Google servers?

I will now light myself on fire...

Spiffy

[Fo0dNippl3]

So does that mean we can finally use our Google(TM) Browser Sync to save our settings on Google(TM) Search and Google(TM) Mail anywhere on the Google(TM) Earth?

BookmarkRank?

[rjamestaylor]

BookmarkRank to augment PageRank?

Hmmm.....

Re:BookmarkRank?

[jrockway]

> BookmarkRank to augment PageRank?

Ever hear of "del.icio.us"?

For those who are loathe ...

[El Cubano]

Google has just released the Google Browser Sync extension for Firefox. This extension allows you to save your bookmarks, history and passwords on Google servers, effectively giving you a 'roaming profile,' which you can sync on any computer running Firefox (and the extension, of course).

For those who are loathe to continue shovelling their personal info at Google ...

scp ~/.firefox/default/<random_letters>/bookmarks.html my_web_host:~/public_html/

Then, from any computer:

wget -O ~/.firefox/default/<random_letters>/bookmarks.html http://mywebhost/bookmarks.html

If the system you are on doesn't have wget, you can just visit the URL and use the links in the browser or save the file to your profile on the machine. If you don't want it so easily accessible on the 'net, then you can use a different file name or put it in some randomly named directory.

Re:For those who are loathe ...

[RedWizzard]

those who are loathe to continue shovelling their personal info at Google ...

Need not get their panties in a bunch - the data is encrypted on the client side.

Re:For those who are loathe ...

[mcrbids]

scp ~/.firefox/default//bookmarks.html my_web_host:~/public_html/

Then, from any computer:

        wget -O ~/.firefox/default//bookmarks.html http://mywebhost/bookmarks.html

It's just stupid that this isn't thoroughly embedded into the browser, accessable via a webDAV shared directory. I mean, the technology has been around since like 1996 or so!

We use WebDAV as a backup file store/network drive that our sales dept. uses. By running webDAV on Linux, we can build in easy virus scanning a-la stupid , one-liner script run via cron every 5 minutes:

/usr/local/bin/scan `find /path/to/dav -type f -newer /path/to/touchfile`; touch /path/to/touchfile;

Why aren't more people doing this? CentOS comes config'd for WebDAV RIGHT OUT OF THE BOX. Just add a certificate...

Re:For those who are loathe ...

[Anonymous Coward]

C:\>scp
'scp' is not recognized as an internal or external command,
operable program or batch file.

C:\>wget
'wget' is not recognized as an internal or external command,
operable program or batch file.

C:\>

WTF?

Re:For those who are loathe ...

[Blakey Rat]

When he says "any computer" he means "any computer except the 95% running Windows." Just clearing that up for you. :)

Re:For those who are loathe ...

[Korgan]

Or just install Cygwin and get both OpenSSH and wget without a hassle. Easily updated too via a GUI program.

Or just get the Windows native ports of both apps. Its not exactly hard.

Just because Windows doesn't come with them bundled already, doesn't mean they're not available to Windows users that might want them.

Re:For those who are loathe ...

[jim3e8]

We use WebDAV as a backup file store/network drive that our sales dept. uses.

At the risk of going completely offtopic, what is the advantage of using WebDAV in this case rather than, say, Samba?

Re:For those who are loathe ...

[ticklemeozmo]

Read closer:

Why do I need to provide a PIN?

The PIN you create during setup is used to encrypt information that's synced between your computers, which may include sensitive information such as your passwords for websites. We use your PIN to unlock that information. Without your PIN, no one will be able to read the information that's being transmitted between your computers via Google Browser Sync.

Your information IS NOT encrypted from Google. This may be fine for some. But remember, they caved to the U.S. Justice Department and gave them Gmail.

Re:For those who are loathe ...

[krunk4ever]

I mean many solutions to this have already existed:

Bookmark Sync and Sort
https://addons.mozilla.org/firefox/2367/

Online Bookmark Manager Synchronizer
https://addons.mozilla.org/firefox/2469/

Foxmarks Bookmark Synchronizer
https://addons.mozilla.org/firefox/2410/

More here:
https://addons.mozilla.org/search.php?app=firefox& q=synchronize&cat=null&type=null&appfilter=null&pl atform=null&date=null&sort=newest&perpage=10&app=f irefox

Don't like Google or others having access to your bookmarks, the 1st one listed allows you to sync to any ftp or webdav server, so you control both the server and client. No need to manually do wgets or expose all your bookmarks to the world by putting it on a public http server.

Re:For those who are loathe ...

[Korgan]

Actually, it is encrypted from Google. The PIN used is only used on my machines. The data is encrypted by my computer before being sent to Googles servers, and I have the option of selecting what information is and is not encrypted.

By default, all cookies and saved passwords are encrypted. All Google sees is the resulting hash, which from what I can tell is a standard SHA1 hash. For those even more paranoid, the communication between my browser and the Google servers is secured using SSL.

Its as secure as you want it to be. Probably even more so than most people seem to suspect. Most people trust the technology they use to do their banking online, yet that information is (for the most part) only encrypted with SSL. This is encrypted in such a way that not even Google could read your information if you chose to encrypt it all.

Re:For those who are loathe ...

[NoMaster]

Yes, because nothing protects your bookmarks more from the prying eyes of the world's biggest web-crawler than dropping "bookmarks.html" into a publicly-viewable web directory...

(I just tried it on your site, Roberto Sanchez; noticed you haven't done it ;-)

Re:For those who are loathe ...

[Bluesman]

That can't be right. If they use a hash to encrypt saved passwords, there would be no way to recover them on a different client.

A hash is a one way trip, since for any hash there are going to be an infinite number of collisions, so an infinite number of starting points will lead you to the same hash.

If they're encrypting data at all, they're using some other algorithm.

Re:For those who are loathe ...

[Anonymous Coward]

But shelling out to run commands that overwrite (probably) open files in windows is hard.

Re:For those who are loathe ...

[Al Dimond]

If you're just doing network storage, there are many ways to skin a cat and they all work. WebDAV, like any of them, has some nice points (it's an open protocol, retrieval is a simple HTTP request) and some downsides (advanced versioning support still on the way, it's still in progress, setup on both client and server sides might be unfamiliar to many users). Go to www.webdav.org and learn more...

For the purposes of doing a centralized bookmark system (to steer us back on topic) the fact that retrieval is an HTTP request means that the much code is already in the browser if browser coders choose to write an extension. The upload part, IIRC, is along the lines of an extention to HTTP, so the code would be similar to code that's already in the browser. Since it runs over HTTP it'll be available just about everywhere that regular web access is, since most firewalls don't block standard web ports (yeah, I know, you can run any service on port 80).

Re:For those who are loathe ...

[mcrbids]

At the risk of going completely offtopic, what is the advantage of using WebDAV in this case rather than, say, Samba?

Samba's security over the public Internet is teh sux0rz on the public Internet. Ditto for NIS/NFS. But WebDAV on SSL/HTTPS is pretty damned good, using just .htaccess passwords.

It's stupid simple, good security, decent reliability, and works anywhere. What's not to like?

Re:For those who are loathe ...

[Korgan]

Someone with that kind of issue is probably not going to care too much about whether their bookmarks are encrypted or not. They're probably not concerned if someone has access to their bookmarks or not in general.

They're not likely to even consider the OPs option and will use something like Google Browser sync because it just works and they don't have to do anything significant to use it.

Any solution that involves something like FTP or even WebDav is not going to be what the average Joe Q Public will want or use. They don't want to have to go out and pay for access to an FTP server accessible to where ever they're likely to want to be. They gotta learn what those mean in the first place in many cases. google.com servers are available to them anywhere (within reason, China is out) and thus far more likely to be an attractive offer. All they have to do is install the "plugin," follow a few prompts the first time and then just use their browsers.

Same could be said of del.icio.us, but thats even more public again.

Re:For those who are loathe ...

[rikkus-x]

Google's service encrypts your stuff before sending it to Google, so they don't look at it - according to them. The others you pointed out don't do this.

The Bookmarks Sync extension doesn't work too well. It keeps losing bookmarks which I recently added. This is not a good thing.

Re:For those who are loathe ...

[fm2503]

"Then, from any computer:

        wget -O ~/.firefox/default//bookmarks.html http://mywebhost/bookmarks.html"

A cunning plan with only one small flaw.
The intent is to not shovel this data to google yes?
So instead we post it on an open public web site
thus making it readable to the entire world
(including of course the google search bots.....)

Re:For those who are loathe ...

[glesga_kiss]

Yeah, lets put our bookmarks on the web. That way Google will never find them! ;-)

Re:For those who are loathe ...

[955301]

pgp
scp
wget
pgp

There. Now the bookmarks.html is encrypted on the site. Simply add your private key to ~/public_html/secret and you can unencrypt from any of your computers.

Re:For those who are loathe ...

[Ludedude]

Just how exactly do you expect Google to find that page? Unless you're dumb enough to link it from another indexed page, it just ain't gonna happen.

Re:For those who are loathe ...

[GrenDel Fuego]

Simply add your private key to ~/public_html/secret

Heh. I can't tell if you're making a joke, or are just stupid.

Re:For those who are loathe ...

[Anonymous Coward]

Of course relying on the name to be unknown while leaving the document itself world-readable is royally stupid in either case.

Re:For those who are loathe ...

[955301]

So, you are suggesting that I have to tell you that fixing the security of a bookmarks file by publicizing your secret key is a joke, yet I'm the stupid one?

Interesting....

Eggs in one basket

[RapedByKateMorrow]

Even with Google's recent show of contrition over their actions with the Chinese Government, I'm not sure I'm willing to trust them to know which sites I think are worth visiting repeatedly. Granted, they have many details on me already - I have a gmail account and it's not a secret to them which IP I use when I search for, um, educational material, but I'm not ready to put my personal documents in Google's hands, and I consider my list of favorite sites very personal (for educationl reasons, of course).

Re:Eggs in one basket

[Anonymous Coward]

Lately that's like the most reduntant type of comments. if you have trust issues, don't fucking use their products. it's really that simple.

Too Late

[Curunir_wolf]

Nice idea, but too late. I keep all my bookmarks on del.icio.us now. It would be nice if they offered a better way to make off-line backups, though.

Re:Too Late

[iluvcapra]

If you are using Mac OS X, you can download your del.icio.us bokmarks into Safari with the freeware delicious2safari.

If you aren't on a mac or don't want to bother with del.icio.us, you can always curl http://del.icio.us/rss/$USERNAME > bookmarks.xml, which will pull your bookmarks down from del.icio.us as an RSS XML file.

Re:Too Late

[friedmud]

I have also migrated to del.icio.us and it was actually for the same reason this Google Sync was created... to keep my bookmarks up to date between my _many_ computers I use throughout the day.

I use Foxylicious to pull down my del.icio.us bookmarks automatically. It creates a great hierarchy out of my tags that makes my bookmarks easy to use in firefox.

Give it a whirl,
Friedmud

PS: As a del.icio.us user I think it's funny that people are so up in arms over this Google plugin... I mean thousands upon thousands of people put their bookmarks out on the web for everyone to see everyday... let alone google. What are all these people afraid of showing the world?

My del.icio.us: http://del.icio.us/friedmud

Re:Too Late

[maxume]

Do you mean something like the api:

https://api.del.icio.us/v1/posts/all

or do you mean some software to pull from the api for you?

saved passwords

[Awol411]

it seems a lot like del.ici.ou.us for the bookmarking, but sorry google, i love you, but you're not going to be getting my passwords for anything besides my google account

Re:saved passwords

[Anonymous Coward]

Passwords and cookies and whatever else you select are encrypted on the client side before being sent to Google's servers. Unless you think Google will surreptitiously modify the client side code to reveal your PIN later (a possibility shared with any programs with auto update features, including your OS) then this seems secure.

I wish more web services worked this way.

Trust

[Ajehals]

If you trust Google then this could be great! if you don't then feel free to bash this as a blatant grab for yet more personal data.

Either way you cant say Google aren't pushing to see what users want, and integrating it into whats good for Google. My opinion? I don't know, I like and trust goggle as much as I trust any corporation, but do I want them to have yet more information about me? Probably not. So personally I will give it a miss, although it might be useful in the future, and if it takes off in internet kiosks (and why not) then all the better. It has some serious benefit to people who travel regularly and don't own laptops and PDA's.

Cue the "tin foil hat" posts, closely followed by the "there is no privacy anyway" posts possibly followed by some random "I don't like the new layout" posts.

Re:Trust

[RedWizzard]

I like and trust goggle as much as I trust any corporation, but do I want them to have yet more information about me? Probably not. So personally I will give it a miss,

Cue the "tin foil hat" posts, closely followed by the "there is no privacy anyway" posts possibly followed by some random "I don't like the new layout" posts.

You forgot to cue the "the data's encrypted" posts. So you don't need to worry about handing over any more personal information.

Re:Trust

[Ajehals]

I'm not so confident - again I trust Google however they do appear to have left themselves with some room for maneuver. I would simply ask whether you would be as confident if Google were taken over by a less scrupilous competitor in 3 months time. - If you read the associated T&C's you will find:
--
3. GOOGLE PRIVACY POLICY
For information about our data protection practices and the data that may be available to Google when you use the Firefox Extensions, please see the Google Privacy Policy at http://www.google.com/privacy.html and the Firefox Extensions Privacy Notices at http://www.google.com/tools/firefox/agreement.html . By using the Extensions, you acknowledge and agree that Google may access, preserve, and disclose information regarding your use of the services if required to do so by law or under other conditions set forth in the Google Privacy Policy http://www.google.com/privacy.html. Google will not be responsible or liable for the exercise or non- exercise of its rights under the Terms of Service.
--
Emphasis mine... So Im sure you could read into that a little - however as I said I do trust Google, however the usual issues apply, and Google may well be leaving themselves access (for the reasons above..). Then from the linked privacy policy:
--
Uses

        * We may use personal information to provide the services you've requested, including services that display customized content and advertising.
        * We may also use personal information for auditing, research and analysis to operate and improve Google technologies and services.
        * We may share aggregated non-personal information with third parties outside of Google.
        * When we use third parties to assist us in processing your personal information, we require that they comply with our Privacy Policy and any other appropriate confidentiality and security measures.
        * We may also share information with third parties in limited circumstances, including when complying with legal process, preventing fraud or imminent harm, and ensuring the security of our network and services.
        * Google processes personal information on our servers in the United States of America and in other countries. In some cases, we process personal information on a server outside your own country.
        * Read more in the full privacy policy.
--
Again emphasis mine, IANAL but that does appear to broaden the scope wouldn't you say? I am not suggesting Google would use this data for their own benefit but it appears they could, up to and including passing it on to a third party.

Re:Trust

[HotBlackDessiato]

Cue the "tin foil hat" posts, closely followed by the "there is no privacy anyway" posts possibly followed by some random "I don't like the new layout" posts.

I'd write a response combining all three, but I actually like the layout.

Re:Trust

[RedWizzard]

But all of that is irrelevent if the data is encrypted and they can't access it, as they claim. They don't have your personal data to share (rather, not via this service). Now maybe they're lying and the data isn't encrypted (or they are able to decrypt it), but I think we've got to take them at their word until evidence to the contrary turns up.

Re:Trust

[RealGrouchy]

Amusingly, I scrolled up to see how your post was moderated so that I could see it (whether it was rated "funny" or something else). As I looked to the right of the bar, I see that they've finally moved the damn mod rating back to where it belongs--on the left!

- RG>

Re:Trust

[astrosmash]

Cue the "tin foil hat" posts, closely followed by the "there is no privacy anyway" posts possibly followed by some random "I don't like the new layout" posts.

Let me take a shot, here...

Tin foil hats

You know, there are laws and regulations that dictate how businesses collect and use data. Specifically, they must explicitly define the purposes for which they're using your data and cannot turn around and use that data later on for other purposes without consent. Google has to be very clear about what they collect and how they use it, because you're not the only "tin foil hat" out there watching Google, after all.

Or course, if anyone doesn't like Google's privacy policy they can always close their Google account and use others' services.

There is not privacy, anyway

It's funny how many people will cite privacy concerns with Google's services while, in the same breath, advocate alternatives which either do nothing to protect your privacy (e.g. Foxmarks) or require you to explicitly give up your privacy (e.g. delicious). Most people don't get privacy.

I don't like the new layout

Actually, I like the new layout, and it looks like they're still tweaking it. But it absolutely drives me nuts that they're using the Tahoma (a.k.a. the Windows system font). And that collapsable nav bar on the left, talk about a solution in search of a problem!

There, I think that about covers it.

Re:Trust

[Anonymous Coward]

...but I think we've got to take them at their word until evidence to the contrary turns up.

I've got this bridge. Long, pretty red one. You might have heard of it. It's in San Francisco. My wife has cancer. I can't pay the medical bills. I need to sell the bridge...

Re:Trust

[Ajehals]

Thet are not claiming they *cant* access it simply that its encrypted. These are not one and the same thing. And since they state that under certain circumstances they may access it I would suggest that it is likley that they will have retained a way of accessing it.

Re:Trust

[RedWizzard]

Thet are not claiming they *cant* access it simply that its encrypted. These are not one and the same thing.

They state in the FAQ that without the PIN they can't access the data. I admit the FAQ doesn't specifically say that Google doesn't have access to your PIN, however common sense leads me to believe that they can't. Because if they can access the data on the server, why bother with a PIN at all? They could have just stuck with SSL for the data in transit. It's not like most people are going to care about the encryption (after all plenty of people happily use gmail without encryption). Anyway I've emailed them for clarification so we'll see if anything comes of that.

And since they state that under certain circumstances they may access it I would suggest that it is likley that they will have retained a way of accessing it.

Where did you see that? If you're refering to FAQ question 9, then I believe they are talking about decrypting the data on the client side.

let me guess

[Anonymous Coward]

I'm going to take a guess and assume that Google analyses this information to create better targeted ads just like all their other software right?

it's amazing how acceptable spyware becomes when it has a known brand behind it.

Spyware

[smokeslikeapoet]

The difference between Google and most big spyware companies is that the Spyware makers promise a valuable service, while Google delivers unobtrusively

I have no problem answering surveys for those mall clipboard guys as long as I'm not in a hurry. I have no problem allowing Google tracking my web habits, as long as I'm getting something valuable, Gmail, Maps, Earth, Search, et. al. in return. When I quit finding their apps useful, I'll rescind my offer to be profiled.

Re:Spyware

[HotBlackDessiato]

When I quit finding their apps useful, I'll rescind my offer to be profiled.

They have your personal tendancies filed away at that point, right? But I'm sure they'll parse and remove all your personal info upon request...for a nominal fee, or say they did and not.

Worried about Privacy? Use Foxmarks instead.

[BrianWCarver]

For those who are worried about giving their browsing history and passwords to Google (or anyone for that matter), you can still reap the benefits of synchronized bookmarks with another Firefox extension: Foxmarks.

Foxmarks is basically the same thing, but just for bookmarks (and not on Google's servers). It's great for keeping bookmarks across multiple machines, and also really useful for those who dual (or triple) boot a single machine. My triple-boot MacBook keeps all its bookmarks in sync with Foxmarks!

Re:Worried about Privacy? Use Foxmarks instead.

[bubkus_jones]

+1 for Foxmarks. I just started using it a month ago and I don't know how ever I managed without. It's so nice not to have to remember to back up my bookmarks any time I want to install a new OS, it's done every time I use Firefox.

Re:Worried about Privacy? Use Foxmarks instead.

[RedWizzard]

For those who are worried about giving their browsing history and passwords to Google (or anyone for that matter), you can still reap the benefits of synchronized bookmarks with another Firefox extension: Foxmarks.

Does Foxmarks encrypt the data? If they don't you might feel more secure with Google (or you could run your own Foxmarks server).

Re:Worried about Privacy? Use Foxmarks instead.

[rm999]

I've been using Microsoft's foldershare to sync several folders I use for schoolwork between my laptop and desktop. I realized a couple of months ago that I could use it to sync my bookmarks by sharing the folder with bookmarks.html - works flawlessly. It doesn't store the file on any servers (because my desktop and laptop are acting as servers) and it encrypts all files going in and out.

I know this may not work for some because it doesn't sync when either computer if offline, because it is a bit heavier than an extension, and because it is Microsoft. But it works great for me.

Re:Worried about Privacy? Use Foxmarks instead.

[Cl1mh4224rd]

For those who are worried about giving their browsing history and passwords to Google (or anyone for that matter), you can still reap the benefits of synchronized bookmarks with another Firefox extension: Foxmarks.

Hah. I dropped by Mozilla Add-ons just now and guess what extension is being featured at the moment. Foxmarks.

Re:Worried about Privacy? Use Foxmarks instead.

[astrosmash]

Does Foxmarks encrypt the data

No.

Foxmarks does nothing to protect your privacy, but that won't prevent the tinfoil hats from citing privacy when offering alternatives to Google. Google, on the other hand, does support encryption, to the effect that your data is stored on their servers in encrypted form and is only decrypted locally using your key.

Re:Worried about Privacy? Use Foxmarks instead.

[fupeg]

Or just use del.icio.us and its Firefox extension.

Re:Worried about Privacy? Use Foxmarks instead.

[JoshuaMcKenty]

Go even one better - the Flock browser. Bookmarking = delicious or shadow account posting, with the added bonus of matching your typical Ctrl-D keystroke. You can post untagged, or Flock has a builtin form for capturing description and tags. Oh yeah, and the search box automatically searches through your favourites and bookmarks, along with the selected engine. Caveats - it's still alpha, unstable, etc. But so far, so good.

Re:Worried about Privacy? Use Foxmarks instead.

[Anonymous Coward]

Foxmarks does not need to encrypt your bookmarks on the server cos you can run your own server. You don't need to protect your privicy from yourself or do you?

My passwords trough the windows ?

[Mike Zilva]

I do store localy *some* passwords on my Linux's Firefox, but when I'm not home I don't even login to some websites just cos I don't trust all the software instaled on that machine (including the OS).
How can this extension protect in any way some personal data on forign computers from spywares and viruses? (not to mention they will be on an internet server somewhere)
Maybe I'll use it for the bookmarks, after all it might be very handy ;)

PageRank?

[cashman73]

I can see how they might be interested in the bookmarks and browser history information. This could help augment the PageRank algorithm to possibly cut down on all the scammers trying to increase their PageRank by google-bombing. If they can collect data on what sites people actually visit, based on their own browsers, this would be very useful. Of course, the NSA might want this information, too,... ;-)

Re:PageRank?

[Threni]

> I can see how they might be interested in the bookmarks and browser history information.

Yeah, the Chinese government made this a compulsory feature if Google is to operate in China. They might as well offer it as an optional feature in the West if they've gone to all that trouble to create it, I guess...

behind the curve

[noelo]

Google seem to be falling behind the curve when it comes to releasing new products. From a position a few years (months ??) ago when they rolled out GMail and google maps, it now seems that they are just reimplementing what others have already done. For example GCalendar is equivilent to Yahoo Calendar and this new extension is very like del.icio.us with the social part discarded. I like using Google and the majority of their offerings are good but there seems to be a "me too' approach to some of the latest stuff...

Re:behind the curve

[generic-man]

Google Calendar is nothing like Yahoo! Calendar. For example, Yahoo! Calendar works in browsers Google doesn't support (older versions of Mozilla/Netscape/IE, any version of Safari) and has been out of beta for years now.

The reason why your post was modded "funny" was because Yahoo! Calendar doesn't use mebobytes of JavaScript to approximate the feel of a native app. For that you'll need something like Kiko which predates Google Calendar as well.

Your anti-piracy pledge

[smokeslikeapoet]

By installing the extension you take an anti-piracy pledge:

* defame, abuse, harass, stalk, threaten or otherwise violate the legal rights (such as rights of privacy and publicity) of others;
* upload, post, email or transmit or otherwise make available any inappropriate, defamatory, infringing, obscene, or unlawful Content;
* upload, post, email or transmit or otherwise make available any Content that infringes any patent, trademark, copyright, trade secret or other proprietary right of any party, unless you are the owner of the Rights or have the permission of the owner to post such Content;
* upload, post, email or transmit or otherwise make available messages that promote pyramid schemes, chain letters or disruptive commercial messages or advertisements, or anything else prohibited by law, these Terms of Service or any applicable policies or guidelines.
* download any file posted by another that you know, or reasonably should know, cannot be legally distributed in such manner;
* impersonate another person or entity, or falsify or delete any author attributions, legal or other proper notices or proprietary designations or labels of the origin or source of software or other material;
* restrict or inhibit any other user from using and enjoying Google services;
* use the Extensions for any illegal or unauthorized purpose;
* remove any copyright, trademark or other proprietary rights notices contained in or on the Extensions or any Google services;
* interfere with or disrupt the Extensions or other Google services or servers or networks connected to Google services, or disobey any requirements, procedures, policies or regulations of networks connected to Google services;
* submit Content that falsely expresses or implies that such Content is sponsored or endorsed by Google;
* promote or provide instructional information about illegal activities or promote physical harm or injury against any group or individual; or
* transmit any viruses, worms, defects, Trojan horses, or any items of a destructive nature.

Wow, this should make the world a safer place. I guess I can sleep soundly tonight. How the hell are they going to enforce this?

Re:Your anti-piracy pledge

[TheRavenofNight]

Damn. Guess I can't download it now. All my e-mails by default go out with the Google logo as their sig. -_-

Great Googley moogley!

[greenguy]

Google is the only search engine I've used in the past, what, four or five years now, and I have a Gmail account that I check constantly. I use the translator to give me ahead start on my translating work. I know about the calculator feature. I use Google Maps all the time. I've checked the spreadsheet out and look forward to GoogleWritely. I look for jobs on Base (anyone need a bilingual CSS coder?). I use the personalized homepage to keep track of the three blogs I run and the 762 that I read every day. I'd use the Page Creator if I wasn't pretty good with Drupal. I've followed the Web Clip links and even a few GoogleAdWords links. At any given time, I have between three and seven tabs open to Google services.

I have just one question. When is it too much of a good thing, privacy or no privacy?

Re:Great Googley moogley!

[Anonymous Coward]

Sorry, but what does being bilingual have to do with CSS?

Re:Great Googley moogley!

[greenguy]

Nothing, or at least not directly. The two skillsets are orthagonal, but in the right niche, complementary. After all, it's all about content, and if you can both translate it and style it, all the better.

Oh, and by the way, I forgot to mention in my original post my heavy use of Google Calendar. I hope readers will understand my oversight.

Re:Great Googley moogley!

[ELProphet]

I'm in about the same position you're in, and I personally don't have a problem with Google having said information. I that it is *Google*'s information, and they will only use it to (try) to help ME. Having US citizenship and living in Switzerland, I know 1) that if any US government agents come knocking on Google's door, they'd better have a warrant if they want ANY information, and even then, it'd better be VERY specific, or Google will do everything possible to not give in. And in 2012, when the Awakening comes, I'll be one of the first thereafter to apply for Google citizenship.

Re:Great Googley moogley!

[alexhs]

(anyone need a bilingual CSS coder?)
three blogs I run and the 762 that I read every day.

I'm not sure I would want a CSS coder reading 762 blogs every day ;) Even if you're never sleeping it means more than 30 blogs an hour. AND you're reading Slashdot...

Re:Great Googley moogley!

[Anonymous Coward]

I think you need a girl.

Re:Great Googley moogley!

[RobertLTux]

nothing but it does help if you can take a page in either english or say spanish with no styling at all and build
a style sheet (good chances he probably knows a thing or two about both cultures also which helps in styles
(ie orange white and green are not good colors for a northern irish page)).

Re:Great Googley moogley!

[T-Ranger]

Perhaps with the exception of about:jwz, /. was the first 'blog'. Neither may conform to the current cookiecutter format that is a blog, but thats what they are.

Re:Great Googley moogley!

[e03179]

"anyone need a bilingual CSS coder?"

Maybe.

"I'd use the Page Creator"

Hrmm. Nevermind.

yahoo toolbar is better

[Anonymous Coward]

no crazy passwords kept on creepy google servers with y!toolbar

not just google

[sentientbrendan]

anyone who reads slashdot can take a good guess at what pr0n sites *you* visit.

THANK GOD!

[Urza9814]

It's about time! I HATE how I always lose all that crap every time winblows decides to be gay and crash. Also will be nice for those of us that use multiple OSes...

Server side settings are nice

[Craig Ringer]

I've long wished that Firefox would support LDAP+TLS or WebDAV+TLS (with client certificates) for storing at least bookmarks, if not history. It's amusing that Google seems to have done it for them - the downside being that I can't use my own servers, I have to use Google. I'll still bite.

To be honest, though, what'd be REALLY exciting would be a similar tool for Thunderbird that enabled a secure writeable server side (pref. LDAP) address book, not just the limited read-only LDAP address book support it currently has. If their calendar app added WebDAV+TLS or HTTPs WebDAV remote calendar storage, it'd start to feel like an app made for people who (*gasp*) use more than one computer.

Maybe Google's move here will show the mozilla folks that people are interested in these features.

Re:Server side settings are nice

[MikeBabcock]

There's a bookmark sync extension already; I've been using it for months in fact.

Bookmark sync

You can turn this option off.

[fmobus]

Which I actually did. Currently, I'm storing cookies, passwords, bookmarks and "tabs and windows saving". Bookmarks save works great time, solving conflicts in an elegant fashion: I installed it first at my work's PC (fewer bookmarks) and then at home. I was afraid it would mangle my home collection, but fortunately it merged then folder-by-folder and inside folders. Tabs and windows saving are great too (and yes, I know Opera had this since day zero): it asks you which tabs you want to reload (which is convenient if some of the older tabs were loaded with p0rn).

Great plugin, IMO. A must have, at least for me.

I, for one, welcome our new indexing, synchonizing, mailing, chatting, reading, spreedsheeting and advertising robot overlords!

Buggy!

[XBL]

I tried it on my Windows PC (Firefox 1.5). All of a sudden the menus and URL bar would not work properly. I type in a URL and it takes me to my homepage... I wanted to synch with my Mac mini, and now that machine is locked up where I can't hardly use the mouse, and I can't even close down Firefox! Very weird stuff.

Finally it would not synch anything for me. It kept giving me different errors related to how I have too much data, or to "try again later". Maybe their servers are being hit hard now.

I am uninstalling this stuff, maybe some time in the future I will reinstall when they have fixed the problems...

Re:Buggy!

[wolverine1999]

It didn't work for me too.
Too bad. It seemed like an interesting concept.

Re:Buggy!

[wolverine1999]

'Request timeout'...

Re:Buggy!

[skryche]

I had the same problem... the address bar got very glitchy: I couldn't use my keyworded bookmarks, and then when I switched to a new tab, the address bar kept the same broken keyword.

Re:Buggy!

[dvicci]

I got all the way through to generating keys. Then an "unknown error" occurred, and I can't get any further. I'll keep it around and try later in the day, in the hopes that it's a server-side issue.

Googles response

[Freaky Spook]

When I quit finding their apps useful, I'll rescind my offer to be profiled.

I'm sorry Dave, Im afraid I can't do that.

Re:Googles response

[smokeslikeapoet]

touché

Re:Googles response

[consonant]

you can check out anytime you like, but you can never leave.

Pretty much no security

[Anonymous Coward]

Google says you can encrypt your data with an 8 character password so that "not even Google" can see it [1].

Quick math. 26 lower case letters + 26 upper case + 10 numeric characters. (should cover most users)
62^8 possibilities. Google probably has about 100,000 servers [2], so that's about 2 billion combinations per server [3] - chump change.

AYPABTG.

8 character passwords work because servers can throttle bogus logins - few seconds delay after 3 failed attempts for example. There's very little security against an "adversary" like Google who is able to try all the combinations unabated.

Thanks for playing!

[1] http://www.google.com/tools/firefox/browsersync/fa q.html#q10
[2] http://www.intel.com/cd/ids/developer/asmo-na/eng/ 202679.htm?page=3
[3] http://www.google.com/search?hl=en&lr=&q=(62%5E8)% 2F100000

Re:Pretty much no security

[mabinogi]

"At Least" 8 characters. The FAQ doesn't say that's the maximum, and it very heavily impies you can have longer than 8.

It's to protect themselves

[FhnuZoag]

In a word, they won't. The data's encrypted, so there is literally no way they can enforce it.

The 'pledge' is basically legal protection, so that if someone did use the extension to do whatever bad things, (and really, most of them seem pretty impossible to use the extension to do) Google will not themselves be blamed. Realistically, this sort of measure probably won't get them very far in a real court case, but hey, every little helps.

Pleased so far...

[aitikin]

The only complaint I have is I wish it would check all the extensions possible, and or available. As long as I'm not giving my history away (which is optional) I feel safe using it. I'm not going to be bookmarking anything illegal or pOrn oriented.

Re:Totally Offtopic

[IHSW]

I'm already used to the old layout. Bad stuff. :(

Note: I hated it at first, but it sort of grew on me. Can I have the option to change it back? Please?

What's the excitement about?

[Omega Blue]

What's all this excitement about? There are already about half a dozen different Firefox extensions in existence that allows you to sync bookmarks. If you ask me I'd tell you to go check out the bookmarks extensions

Re:What's the excitement about?

[Anonymous Coward]

Because its from Google, period. You know the Slashdot crowd

conspiracy theory

[kbox]

This is just an attempt to replace the google bot with human beings...

Google Browser?

[Kuciwalker]

I had something obscuring FF and just saw "Google Releases Google Browser." I almost had a heart attack.

Way of the Future

[schabot]

This is the way the computer.

Soon Google will become the central computer, storing all data which we will pull through light terminals.

Look at Star Trek, especially starting with TNG: there are not multiple computers, but the Central Computer, which stores all data and processes on the ship. For even more expansive knowledge, it syncs with database on Earth, which itself syncs with Memory Storage Alpha.

Of course, next is Borg.

Try SiteBar if you don't trust Google

[BigCheese]

If you want to roll your own solution try SiteBar (http://sitebar.org), the SiteBar XBELSync plugin and the bookmark sync extension.

Another style change

[Trogre]

what's with the sudden change of /. style?

I was just getting used to scores at the far right of every message and was beginning to like it.

Re:Another style change

[Anonymous Coward]

word, dude.

del.icio.us?

[Dylan Knight Rogers]

By large, I find del.icio.us bookmarks to be more useful than this Firefox extension. I don't need to install anything, just click the browser button in Firefox telling del.icio.us to grab the current page and bookmark it for me.

But, I do appreciate the fact that Google's protecting our privacy.

NSA sue Google

[EEPROMS]

Seen on CNNNN

Today the NSA filed a anti trust suite againt Google inc
When a legal representative of the NSA was questioned about the case he replied, "Our case is based on Googles practice of gathering data in direct competition to the NSA, in such a manner that it's impossible for us to compete".

Our reporter was suddenly arrested before he could question Google on the matter, based on child sex porn bookmarks handed over to legal authorities by google.

Re:NSA sue Google

[BigFoot48]

Don't quit your day job.

Sorry but no.

[Turn-X Alphonse]

I'm not some paranoid freak but sorry Google, no dice. Google already have a truck load of info on more or less everyone, now I'm not saying that's a bad thing today. But sooner or later the Google guys are going to want to do new things or they're going to sell out for money. Then all this stuff will go into the highest bidders hands, now to me that means the guy who wants the data the most.. Which I'm positive is the guy I least want to have it.

So thanks for the offer Google, but no. You don't need to know where I buy my stuff from, who's blogs I have in my favourites and I sure as hell don't want you know what porn sites I bookmark. I'll just keep a floppy in my draw with a backup on and update it once every couple of weeks. That way when you get bored of your current life, I don't get screwed in mine.

Portable Firefox?

[fiendy]

Why not use portable firefox to achieve most of that functionality? Bookmarks and other extensions at least.

Alternatively I guess you could combine these two and have a really roaming browser. Though I'd still rather my passwords stay in my head rather than on a third party server (albeit encrypted).

Re:Portable Firefox?

[huckin_fappy]

If you can keep all your passwords in your head, your passwords aren't very secure.

You can encrypt everything it can sync

[Dan Berlin]

If you look at the settings, next to every checkbox for "sync this", there is another check box for "encrypt this".
Literally everything it can sync can be encrypted.

Second, it syncs much more than bookmarks.
I for one, enjoy having my history, tabs, and windows saved between the laptop and desktops I work on.

Re:You can encrypt everything it can sync

[ergo98]

f you look at the settings, next to every checkbox for "sync this", there is another check box for "encrypt this".
Literally everything it can sync can be encrypted.

Nice that they added that, however the FAQ points seem to imply that it's a transport encryption, and that it is unencrypted once it's at Google headquarters (which seems confusing as I would expect just SSL). If that's the case, then there's a serious vulnerability for users who have saved passwords for their banks, etc -- I think Google is a great company, but there's no way I'm sharing such info with them. It just takes one criminal employee (because most data losses/thefts are inside jobs, not movie-style hackers), or a lost database tape, for trouble to begin.

Encrypting the Passwords

[KidSock]

Hopefully the extension encrypts the passwords block with a master key and prompts the user for it when saving/restoring. I don't care if they use by history to do marketing metrics or whatever but there's no way in hell I'm going to give them my passwords. Even if they are just "weak" ones.

personal wiki

[philo_enyce]

i just keep my bookmarks in a wiki. i can get to them from any computer, and it's my default home page on all my pcs. i can edit it from anywhere i can read it to add new sites. and i can even leave myself a note if i need to. sure it doesn't keep my history or stored passwords, but there's no scary factor either.

philo

Google to us - All your password are belong to us

[d_jedi]

Seriously, though, this is a good feature.. so long as there's strong encryption on all of it.

It is useful

[kahrytan]

Despite the security issues, the extension has it's uses. Like Syncing your different linux installs with same bookmarks. How many times have you switched to different Linux or Windows OS only to remember the bookmark you need is on the other OS install? I've done it. Sync your destops, laptops, and other OS installs with this extension.

Those worried over passwords or cookies, Would you share your encrypted password to your bank account to anyone else? No. Don't share it with Google.

But. . .

[CrtxReavr]

. . . but I don't want to give the Chinese my bookmarks and history!

-CR

Unfortunate flaw right now

[bogie]

"What does it mean when I see a warning message that tells me "you logged in on a different machine"?
Currently, Google Browser Sync only allows you to be logged in to one browser at a time"

The people would mostly likely use this proably have Firefox on 2 to 3 machines and it is certainly not uncommon to A) leave your computer running with a browser window open and then get on another machine running firefox B) be on firefox on say a laptop while your wife/girlfriend etc is on your main machine(and no they shouldn't all have to have seperate accounts).

I see they are "working" on having multiple accounts but personally this simply won't work for me and many others until then. On the positive side it's nice to have Google developing for Firefox and if the encryption is sound this sounds like a nice feature that maybe one day will become standard on Firefox.

if google REALLY wanted to do no evil...

[nfarrell]

... they would make this extension work with a configurable URL target.

After all, if everything is encrypted when sent to google, google isn't able to manipulate the data in any way; it's just a sequence of 0s and 1s.

So why not let you save it to your website (in a private folder), ftp site, etc. ? Sure, they can offer to HTTP-RPC it to their own server if you like, but why force you to store your data there?

I for one am a bit suss about them having more of my data, particularly when they claim they can't read it.

no evil?

[mikesd81]

Given that the gov't wants all information about what people search for, this calls into question the No Evil theme Google protrays? You know the gov't will be asking (see demanding) for this information.

I like it...

[xaoslaad]

It works well on my two Linux systems (granted one is a VMWare Virtual Machine) and my Solaris 10 SPARC system. Very simple, very nice for keeping the bookmarks the same on all of them. However, my Mac running Opera, which I prefer over both Firefox and Safari (just user preference) and Internet Explorer on my Windows laptop (no, I do not have skads of spyware or viruses; common sense prevails) must still be manually updated.

A very good start. But I would like to see it go a step further and include IE, Safari, Mozilla, Opera, and any other modern browsers within reason. Then it would fully live up to its potential.

How come...?

[Altanar]

Why is it that people cry "big brother" when bookmarks and histories are stored privately on a company's server, but don't care that anyone who wants to can view their digg.com/del.icio.us/last.fm/etc profiles which lists such information as what sites they like, what songs they listen to, etc? It's only bad when their information is not available to random browsers?

Re:How come...?

[Macthorpe]

I'm going to go right ahead and quote Dr. McNinja right now.

"You know, you and a few fat kids who like to dance and lip sync really need to learn that the internet is viewable by the public."

Wrongo!

[Dark Coder]

Mod parent down... Mod GRANDPARENT UP!

PIN + ACCOUNT back into a COOKIE HASH which is the MOTHER OF THE ALL tracking mechanism... Just try to use Google toolbar WITH a cookie cutter extension.

Need I say more?

So what if it's encrypted iF Google has the encryption key. From the FAQ:

Why do I need to provide a PIN?
The PIN you create during setup is used to encrypt information that's synced between your computers, which may include sensitive information such as your passwords for websites. We use your PIN to unlock that information.

It may be encrypted...

[flatface]

...But with a 4 digit pin, it's trivial to break. Go ahead and combine that with Google's server farm.

Not like I care, though. I'm using it right now; I've been looking for something like this for a long time now.

Re:It may be encrypted...

[GoulDuck]

My PIN is at least 11 and includes letters and numbers... you can do the same thing.

roll your own

[Anonymous Coward]

You're right, its an obvious information grab and for not much in return.

There is nothing this extension does that couldn't be done on any FTP server. It just needs a username, password, and file path.

Seamonkey roaming access

[T.Hobbes]

Mozilla already has this software - at least in Seamonkey, there is a roaming access feature (never tried it myself) that puts pretty much all the profile data you want onto a server you specify. The only thing I see Google bringing to the table is the free server space.

Default install doesn't encrypt bookmarks

[Centurix]

Encryption for everything switched on, assume the PIN doesn't get sent (!), client side encryption. I guess they just store a gump of encrypted data for me and they pick on the users who don't change the default settings. Could be a high percentage of users, say 80%, they can browse through the un-encrypted bookmarks for whatever purposes they choose. Users who know the risks involved and turned on the encryption feel good about it, users who don't know the risks still sleep well.

Well...

[Chuck Chunder]

If you don't trust those other machines then you won't be installing and activating the google plugin on them will you.

That doesn't mean it won't be useful on computers you do trust.

Your bookmarks, history and passwords. . .

[kimvette]

. . . have just been sopoenaed along with millions' of other users' bookmarks, history and passwords by Homeland Security. Now the Bush administration can enjoy visiting the same pr0n sites you do, oh, and yes, now they know about that Real Doll you've been eyeing. Remain where you are, the morality police will be by shortly, as soon as Bush can figure out how to justify it under the War Powers Act.

(If you don't find this post funny, then ignore this post. If you think I'm bashing Bush, then s/Bush/genericpolitician/ mentally. Thanks in advance.)

Pledge Of Allegance

[HotBlackDessiato]

Same enforcement mechanism as the Pledge Of Allegance


....

Moving away from the philosophical debate...

[93 Escort Wagon]

... and on to an actual comment about the extension itself.

On my Mac, this extension was rather problematic. It installed just fine, and syncs with Firefox on my Linux box just fine. But when I launch subsequent sessions of Firefox on my Mac, I get one window telling me it's connecting to the Google server - and it overlays (and 95% of the time prevents interaction with) the window that pops up asking for my master password (for FF's saved passwords feature). Can't type my master password, can't get past this point.

In order to actually run Firefox again, I had to manually remove the extension from my profile.

I'm used to Google's "betas" working quite smoothly - it's unusual to run into one with a big old flaw like this one.

Re:Moving away from the philosophical debate...

[RalphTheWonderLlama]

yes.. glad to see a comment about the extension :)

I haven't tried it but from TFA it seems a bit hassling to me. Slow startup time and have to install the extension in the first place on all the computers you use... if you can. Most of the features I don't really find desirable anyway (bookmarks or homepage might be it). This is however another little move to get things off the local computer and onto the web, sort of like Writely and the whole software as a service thing. Maybe someday we'll just have a bunch of dummy terminals all over and won't hardly need our own computer.

Right now I have a simple page of links that I use as my homepage, and I can use it or edit it from any computer, not just ones with the extension, or firefox for that matter. It's pretty fast too since it's just links (and a search on top). That's good enough for me. I made it with my humble project - http://www.ngumbi.com/

Re:Moving away from the philosophical debate...

[Anonymous Coward]

My experience with it:

I installed it at work in the hope of getting all my work bookmarks synced with my home computer, which had a fresh install of Windows. Then I installed it at home on a new install of Firefox with all bookmarks deleted.

It asked me if I wanted to open at home the tabs and windows that I'd left open at work. Nice feature, but it didn't get a single bookmark from my work computer. And worse, every time I re-open Firefox, it pops up a slightly annoying dialog box asking if I want to open the tabs that were open the last time I closed it.

Now, back at work, my computer had its Personal Toolbar Folder bookmarks cleared out apparently in a misguided attempt to sync it to my bookmark-less home computer. Needless to say, it is now uninstalled on both computers and a copy of my exported bookmarks has been emailed to my home email account.

Gooogle Giveth Sync...

[cmacb]

and Micrsoft taketh away

Mod THIS parent down

[Anonymous Coward]

From the same FAQ (emphasis added):

What's the point of encrypting my information?
By encrypting your information, it will be transmitted to and stored on Google's servers in a format that is nearly impossible to interpret without the PIN.

I look at bookmarks differently, I guess...

[IANAAC]

Granted, I won't give Google anything BUT my bookmarks, but I look at bookmarks as really nothing more than preferences.

I do, however, have an issue with giving them my history, cookies, passwords. But bookmarks? That's just a list of places I've visited (perhaps even in the distant past). My bookmark list is long and messy.

Another solution

[ems2]

Plan B comes with a P2P Single Sign-on system called SHAD. This solves the problem without having a central server, like Google, hosting the data.

Whats next?

[thevoice99]

Google releases new Gbin technology allowing users to access their recycle bin from anywhere. Hosted on Google's servers, Gbin makes it possible to empty your recycle bin from grandma's PC or on the go with Nokia's new Chuck-It one use disposable phone.

Durp

[Anonymous Coward]

Yeah more information for google to use against us someday.

Shocked This Hasn't Been Mentioned

[Enderandrew]

There are tons of services that host your bookmarks remotely. I use the Foxmarks extension for Firefox personally and love it.

http://foxmarks-extension.en.softonic.com/ie/51710

I'm not sure why this is newsworthy or surprising given that Google admitted they want to aggregate every bit of information in the world. I don't think Google will care or blackmail me for surfing porn. I think they want to know exactly what my fetish is so they can target specific advertising to me however.

And if you really want your browsing experience the same everywhere, then use Portable Firefox. I've made my own custom version of it, and I love it!

Cool, but it should be GPL'ed, not a service-based

[v3xt0r]

They should release these as GPL'ed web applications, instead of providing web application-interfacing services (which collects EVERYTHING you do).

I'd love to run some of these programs from my own site, but not using their API Web Services, and not allowing them to collect any info what so ever.

They collect to much information from people as it is. Most people trust services like these, using what amounts to spyware.

Ironically

[StarKruzr]

Personally I have been copying my bookmarks.html to ~/public_html for years.

This is precisely what a "home page" originally was.

Does it even work?

[Gadzinka]

Great tool. Doesn't work for me at all.

When I start it with default config after some thinking it tells me upload too large. try disabling some components and trying again. When I uncheck all the options (i.e. don't save anything) after some thinking it tells me settings change did not complete. please try again later.

As I said, great tool. Doesn't work.

Robert

Dual boot

[J4nus_slashdotter]

Huummm it's perfect to synchronize the bookmarks when you use a dual boot or if you are very mobile. I already tested the extension "Bookmarks Synchronizer" but it didn't work perfectly.

What does Google get out of this?

[drgonzo59]

Google doesn't do anything if it doesn't benefit Google. They in fact will gain access to everyone's bookmarks. That is one of the most valuable pieces of information they can get, because now they can do very focused, targeting advertising. Also, they will get another way "to pagerank" web pages. If a million people bookmarked Slashdot, SourceForge and PizzaHut, they'll have a good reason to increase the rank of those sites. It seems like a win-win situation to me and smart move on the part of Google.

Re:What does Google get out of this?

[Ph33r th3 g(O)at]

Except there are going to be a bazillion bots bookmarking online poker, porn, and ad farm sites.

Re:What does Google get out of this?

[14CharUsername]

Actually, this is an improvement to firefox. If more people use firefox this benefits google because google is the default search engine in firefox.

I guess its possible they could be using and algorithm they can decrypt once its on their servers, but if they did that someone will inevitably figure it out or an employee will leak it, and then there will be tons of bad publicity, people will be wary of their services. This would cost them more than anything they could hope to gain from data mining people's bookmarks and cookies.

Re:What does Google get out of this?

[mlewan]

"They in fact will gain access to everyone's bookmarks."

No.

they've turned evil I tell you!

[bazorg]

With this new tool delivered just a few days after 06/06/06 Google has finally made it clear they turned *E*V*I*L*!!! Want more proof?
this sync extension version number is (gasp) 1.0!!!! Back in the day they were not evil they would never do any product launch that wasn't alpha or beta!

EVIL, I tell you!

(damn, how do I wrap my browser in tinfoil?)

New "advanced search operators"

[unforkable]

Nice!! Soon a new search operator: findpasswordfor: , pagerank will do the rest

Common'

[DrYak]

The https only indicates that the transmission is using SSL but the client and the server both (most likely) contain unencrypted information. Should Google's servers ever become compromised, your data is not safe.

Common ! You're speaking about e-mail. You know ? E-MAIL : That stuff that is transmitted on the web thru several computers, completly clear almost the whole way.
How many people connect thru SSL encrypted links to their ISP's SMTP server from their Windows box ?
and do you think this server will always talk crypted with the other servers (out-going virus and/or spam filtering server, all e-mail forwarding servers - like bigfoot's -, recipient's incoming server, recipient's virus/spam filtering server, recipient's POP or IMAP repository) ?

An e-mail is just as secure as a post-card. anyone transmitting passwords in clear-text (not PGP or a-like encrypted) is just plain stupid.
Either transmit a temporary password and ask user to immediatly change it.
Or as last resort, transmit information split accross several un-related channels (like SMS and E-Mail) so if one channel is compromised, not enough information is stolen.

Arguing about wether the information is SSL-crypted between repository and home computer is like arguing about wether the postman peeked at the post-card before putting it in your mail box, when every else along the way could have read it.

What's wrong with del.icio.us?

[Keeper Of Keys]

I hardly ever bother using a browser's bookmarks these days - which tend to get lost anyway with changing computers, etc - but have the del.icio.us plugin on all my browsers. If I'm at a different computer, I can still get at, and search, all my bookmarks. Flock makes this even easier.

whats missing

[Xamedes]

is the ability to synchronize about:config and the extensions. By the way, i have a great idea (hope so). Why not create WebDav Folders for config - files, user directories and such?

heh

[crnbrdeater]

Because it is a good idea to store all your passwords on someone else's machine.

Besides this has already been done. Currently all my usernames and passwords are stored in a .txt file that I put in the root dir of my web site. Now it is cached by Google and Wayback. I can access them anywhere I want.

Won't install with post-1.5 nightly builds

[mstockman]

Just to save you the 15 seconds it takes to click the link, if you're running the nightly builds off the Firefox trunk, you can't (easily) install the extension... it asks whether to redirect you to the 1.5 download pages instead.

I suppose they restricted the extension to 1.5 to avoid potential conflicts, but I'd rather they said it's OK with 1.5 or later, and let users of nightly builds take their chances. But hey, to give them the benefit of the doubt, maybe they know of actual breakage, and disabled it to save us from ourselves...

Re:Won't install with post-1.5 nightly builds

[mstockman]

Replying to my own post, I forgot about Places being enabled on the trunk. So yes, there are perfectly good reasons why it's probably not compatible. Don't know about any branch builds, though.

Re:Google to us - All your password are belong to

[acurism]

I agree, I think this could be very useful and I trust Google, just not the govt.

What big tools you have!

[blankoboy]

"Oh Google, what magnificient tools you have!"

"All the better to spy on you my dear."

/all your information are belong to us - Google

Bookmarks

[Andrewkov]

I thought any geek worth his salt would have created a web page with all his links and uploaded it to a hidden location on a server somewhere on the 'net, then set this page as his homepage in Firefox on all his PC's. It's worked for me for 8 years, luckily my ISP allows me to run a web server on my linux box at home. I even added a google search box at the top of the page.

For as much as I like Google.....

[i_want_you_to_throw_]

I am not so sure I am ready to give any publicly traded company access to this kind of data. I will generally trust Google with all kinds of things, but their caving into Chinese censorship demands is probably just a beginning to the occasional compromise of principles.

"Do no evil" might change to "We do less evil than most other companies"

It is worth pointing out again that Google is a publicly traded company and despite their best intentions, their first and foremost responsibility is to their stockholders and making a profit.

de.licio.us

[klausboop]

This may be redundant, but I have to chime in and say how well de.licio.us delivers bookmark syncing for my needs. I do mix both work and home, professional and play bookmarks in my de.licio.us profile, and let them mix or not mix as appropriate through the tags I apply to them.

I'll definitely check out Google's offering, but I agree with other posters that there's some history that shouldn't be shared, and de.licio.us already meets my bookmarking needs in spades, including keeping "fun" bookmarks out of work..

Low-tech

[SamSim]

I have been using a very low-tech form of this to allow myself to have the same bookmarks on every computer. Basically - I don't have any bookmarks. I have a web page which I use as my homepage on every computer. This means 1) I can access all my bookmarks from everywhere (although not, to be fair, my browser history or cookies) and 2) I can arrange my bookmarks in a much more potentially sophisticated layout than just a stack of menus, using HTML.

I suggest y'all try it!

Comment removed

[account_deleted]

Comment removed based on user account deletion

SiteBar is the most secure

[Anonymous Coward]

I can't believe nobody has mentioned SiteBar yet.. it works with Firefox and IE, and it lets you setup *your own SiteBar server*, so if you do it behind some HTTPS, and you trust the machine the server is running on, you end up with a secure way of storing your bookmarks.

I looked at Foxmarks, and they don't even let you run your own server? Feh.

Tab Mix Plus

[XTbushwakko]

Tab saving really borks with Tab Mix Plus though... Doesn't really work :/

Titanium and "nitinol" a shape memory alloy

[OldChemist]

I was a little surprised - maybe I did not dig deep enough - not to see a comment about one of the interesting and almost unique things that can be done with titanium, that is to make so-called shape memory alloys of titanium and nickel called "nitinol." See http://www.stanford.edu/~richlin1/sma/sma.html This stuff has the interesting property that deformation followed by heating can cause it to return to its original shape. There are a lot of interesting things that can be done with such a material including cardiovascular applications. It is true, however, that even a fairly large decrease in the price of producing titanium will have little effect on the final price of nitinol, given the further work necessary to make nitinol from titanium.

Just don't see the need

[Chelloveck]

Curiously, ever since Google came on the scene I haven't had much of a need for bookmarks, let alone a need to keep them sync'd on different machines. I usually just have a few local files bookmarked and some intranet links at work.

And with the Google Toolbar I don't even need to bookmark www.google.com!

Running your own server

[TomatoMan]

I looked at Foxmarks, and they don't even let you run your own server? Feh.

You didn't look very hard, did you? Like, I don't know, in the FAQ? Yes, you can run your own server - any WebDAV or FTP server can be used.

Don't need this

[billhedrick]

I already have 2 extensions that do this, Foxmarks http://www.foxcloud.com/ and Chipmarks www.chipmark.com/.Google is late to the party on this, and besides one of these days Google will turn it's info over to the Government or a corporation that gives it enough money. FWIW, Foxmarks is more automated, Chipmarks seems static to me.

Comment about the extention's function

[jbarr]

I installed this extention into Portable Firefox v1.5.0.3 at work, then on my PC at home (again, Portable Firefox v1.5.0.3) and it worked like a charm. Install was simple, and congifuration was quick and easy.

One nice thing about Browser Sync's function is that it prompts you to restore the last session. I opened FF at home, opened several sites in several tabs, and then closed FF. I next opened FF at work, and was prompted to restore the last session. I restored, and voila! all tabs that I had open at home displayed at work. In fact, the last tab active at home was the active tab at work. Very nice! And because the restore is prompted, you don't have to worry about opening something you had open at home that may not be suitable at work (or vice versa.) If you choose not to restore, your default home tabs open.

I used to use the excellent "Bookmark Synchronizer" extention, but this will like ly replace it. Highly recommended!

FTP with plaintext passwords

[Craig Ringer]

Yeah, not a bad plan - but it does require FTP, and that pretty much means plain text passwords in the absence of Kerberos or SASL-ized FTP. Ugh.

Still, thanks for the tip. If I create a new special purpose account just for that with some unimportant password, it'd be ok.

Re:FTP with plaintext passwords

[MikeBabcock]

There was a version supporting WebDAV as a test too.

Secure WebDAV would be a nice way to handle this; using rsync would be even nicer.

Chipmark?

[955301]

An augmented version of chipmark.com? This is funny, because I just sent a suggestion to buy out chipmark.com to google labs.

I don't think they are as unpredictable as the trade and financial journals are suggesting....

who are loath or who loath

[dwayner79]

Loath is an adjective meaning "unwilling." It ends with a hard th and rhymes with growth or both.

Loathe is a verb meaning "to hate intensely." It ends with a soft th like the sound in smooth or breathe.

http://englishplus.com/grammar/00000238.htm

Manchurian Candidate

[CranberryKing]

I know they have the best intention. They think there aren't eyes watching and allowing them to become THE ALL SEEING EYE.

Which Star Wars was it when the Prime Minister got full wartime powers and promised to return it when the terrible conflict was over? He becomes Emperor. Google is NOT him. It's worse. They think they themselves can be trusted and that no one will control them once they have everything under wraps. "Co-founder Brin.. Co-founder Sergey Brin".

Believe it.

...does anyone think this is a good idea?

[big dumb dog]

Does anyone think this is a good idea?

Why not Google Bank?
Simply give all of your money to Google, then if you want something, just ask Google for it...

You mean...

[sud_crow]

... something like this could happen? ;)

Re:You mean...

[Kadin2048]

Pretty much.

My, that was stupid. "Unbreakable" encryption... (sigh)

Talking about web entanglement...

[zaphle]

Google's version of "we know what you did last summer"... on your other pc!

interesting search history

[halr9000]

I don't think it's as simple as that. If you're using GMail, you're likely logged in to Google every time you do a search. Do a bunch of porn viewing, and Google has the means to link that to your login. Take it a step further and keep your bookmarks there.. well... they certainly have more to draw on.

As if you don't have the porn URLs memorized!

That's great, but...

[Moofie]

Wake me up when I can package together all my preferred plugins and configuration mojo into a portable thingy. I hate re-un-mess-up Firefox every time I need to install it.

MacBook Pro Issues

[jcm]

Hrmph.

I installed the extension in Firefox v1.5.0.4 on my 15" MacBook Pro running Mac OSX v10.4.6 (fully patched). No go when I try and restart Firefox. The initial startup the extension came up I typed in the configuration information then when it was sending the settings to Google, it just sat there until I did a OpenApple-Q to quit Firefox.

I had to bring Firefox up in safe mode (run "/Applications/Firefox.app/Contents/MacOS/firefox -safe-mode") then remove the extension from the Help Menu->Extensions window. I'll give it another shot here in a bit.

This is cool!! But is it safe ?

[ravee]

"...that continuously synchronizes your browser settings - including bookmarks, history, persistent cookies, and saved passwords - across your computers."

Suppose there are 10 machines in ones office and you decide to use google sync on each of them. Now if you use say your gmail account to check your personal emails and by mistake tick the checkbox - "Remembers this on this computer". Won't it propagate the passwords you do not want the browser to remember to all the 10 machines ?
Now think of what happens if you have a 100 computers.....

I'm not really impressed

[kiddygrinder]

It does the same thing as foxmarks only half as good, foxmarks is nearly invisible and can use any server you want via ftp or webdav, google adds about 20 sec of synching time on booting, where as foxmarks synchs in the background while you surf. stick with foxmarks for now

Other Ways

[Anonymous Coward]

The argument here is whether or not Google is intentionally going to (mis)use the data colected on you and gov intrusion, and that's a great thing to discuss, but we're missing A point here. Are there other, more secure ways of doing this? Are the similar service elsewhere that we forgot about? Maybe Google isn't the first here, just the most noticeable. Personally, I really enjoy the services Google provides. On the other hand, I spread my data out to other services. For book marking, I export my Firefox bookmarks as an HTML file and save it to my Yahoo Briefcase. Need a link? I visit My Yahoo, open the briefcase, click on the file and a page full of well organized links opens for my use. Works great and (supposedly) Yahoo doesn't read the personal data stored there. Better not, I move tax data once a year there too! jk

400 ?

[OriginalCopy]

is it only me, or a bug in the extension ? I get a bad request while uploading the data

Re:400 ?

[OriginalCopy]

If you get the same problem try to reinstall it, it works

What's the big deal?

[kadathseeker]

Pivacy? What kind of bookmarks do you want to keep private, besides just to avoid spam? Use Bittorrent for that stuff.

Seriously, what will Google know? I'll post my bookmarks here to show how much I don't care.

I have some webcomics, a link to my website, a link to my gmail, a link to youtube (and some specific videos, nothing useful), The Best Page in the Universe, SIGForum, some Linux and computer sites, some wikipedia pages, and some humor pages.

WOW! Whoop-de-freakin-do you guys know sooo much now, I feel naked.

I'm much more concerned about gmail archiving all of my email forever than I am about this, and I got over it very simply: don't have anything you would especially care to keep private! I mean, sure, I wouldn't go handing out data just because it's not that important, but my only fear from that is spam and having ake a new email account. Unless your work involves alot of confidential information (in which case have a seperate work and home computer or even just accounts), or you have really weird fetishes or something, it's pretty much insignificant in terms of privacy worries. It's like those stories about laptops getting stolen that had tons of employee info on them. Why was it on a laptop, why was it just sitting in a guy's car instead or an armored truck, why wasn't it encrypted, etc.; what the hell were these people thinking?

If it weren't for %$*#!! Mozilla...

[Civil_Disobedient]

I'm glad Google has come to the rescue of such a serious oversight on Mozilla's part. They could solve all these portability problems if they just implemented a light database backend to store your data; instead you've got:

1. HTML files (bookmarks)
2. DB files (client certs)
3. CHROME files (browser prefs)
4. TXT files (signons, cookies)
5. DAT files (forms)
6. RDF files (download manager)
7. INI files (extensions)
8. XML files (roaming profiles)
9. JS files (user prefs)
10. et-fucking-cetera

THANK YOU GOOGLE for sorting all this shit out. Too bad it took an "evil-but-not-really" third party to figure out what the end-users have been clamoring on about for years.

And yes, I'm aware that the new, improved Mozilla will implement SQLite. Eventually, when it's released, probably, they think.

Where's My Konqueror Extension?

[Anonymous Coward]

If the KDE community is to keep up, why aren't I seeing ports of all the cool FireFox extensions to Konqueror? At least I would think the rabid Mac crowd would be porting these things to Safari (and hence maybe easier Konqueror). It seems that I'm going to need to abandon a tightly-integrated-to-the-desktop browser for a better-featured browser.

This makes it tempting to switch to Firefox

[GWBasic]

This makes it tempting to switch to Firefox. Now, if only I could host my bookmarks on my own server, (such as a platform-neutral IMAP account,) then I would REALLY enjoy this feature.

Sorry Google, nice try, but I will pass

[TheSkepticalOptimist]

Mozilla took great strides to make Firefox start up quickly, Google ended all that with one simple plug in.

I tried out Google Sync for a few hours, and had to uninstall it. The problem is that I don't want Firefox to take 30 seconds to launch like back in the pre 1.0 days. I also don't want to wait MINUTES for FireFox to exit. Honestly, not once did Google Sync actually finish syncing to its servers as I had to cancel the operation due to lack of patience.

Also, the stupid pop up tool tip that is displayed every time I launch FireFox is annoying. Windows has too many stupid popups, I kind of liked FireFox for being less stupid and annoying with popups.

I don't really need Google Sync either because I use Google homepage. I have all my bookmarks on Google's homepage, and FireFox on all my computers at work and home links to this home page, so technically, its all the SYNC that I need.

Its kind of a neat tool, but unless Google can dramatically improve performance (instant syncing and minimize in browser annoyances), this will be one of those tools from Google I will avoid like the plague (like Google Desktop).

I also have to question the "privacy" of having your history saved on Google Servers and passed around on the Internet between computers. I know its technically encrypted and you can turn it off, but really.

error 51 request timeout

[Anonymous Coward]

error 51 request timeout is what I get every time I try to synch.

How about an extension to sync extensions?

[cylcyl]

If this extension did that, then it would be perfect!

What about del.icio.us?

[bmcent1]

I may be too late to this story to get a reply, but I'll ask anyway: For just syncing bookmarks, how do you think Google's browser extension compares to http://del.icio.us? I started using that a long time ago to share bookmarks from a central web accessible place rather than having different local files to sync. It works well and offers tagging and searching by tag for each bookmark which can be very helpful.

Suprised I didn't see any del.icio.us references in this discussion. How do these to options compare? If you only need bookmark syncing, I'm leaning toward del.icio.us because I don't need to install a browser extension so it is browser agnostic.

Google = Pet project for the NSA?

[Anonymous Coward]

Bring out the conspiracy theories...

<tinfoil hat>
I think one of these days we're going to find out that Google was the result of a thinktank operation within the NSA. Over the years, Google has been slowly gathering all kinds of useful bits about people and their hobbies through web searches, and now with these new tools like GMail, Calendar, and this new Browser Sync extension.

I am more convinced of this based on several recent articles brought to light about the NSA's desire to wiretap our conversations and datamine personal information from Internet-based sources.

Google claims that they aren't evil, but I have a sneaking suspicion that these activities will only increase in frequency and scope, and that the government's role in this company will reveal itself in time.
</tinfoil hat>

Google could switch to Windows...

[lpq]

Google could do something though...they could just switch to Windows and our data retention worries would be over...:-) ..."Nice collection of data there, be a shame if that machine got 0wned, no telling what those script kiddies might upload into user accounts"... :O