Slashdot Mirror
Questioning Google's Privacy Reform
JagsLive makes note of a story questioning whether Google's recent commitment to anonymize IP logs faster is really as good as it sounds. We discussed their announcement a few days ago. CNet's Chris Soghoian takes a closer look:
"While the company hasn't said how it de-identifies the cookies, it has revealed in public statements that its IP anonymization technique consists of chopping off the last 8 bits of a user's IP address. As an example, an IP address of a home user could be 173.192.103.121. After 18 months, Google chops this down to 173.192.103.XXX. Since each octet (the numbers between each period of an IP) can contain values from 1-255, Google's anonymization technique allows a user, at most, to hide among 254 other computers. ... Google has now revealed that it will change "some" of the bits of the IP address after 9 months, but less than the eight bits that it masks after the full 18 months. Thus, instead of Google's customers being able to hide among 254 other Internet users, perhaps they'll be able to hide among 64, or 127 other possible IP addresses. By itself, this is a laughable level of anonymity. However, it gets worse."
Do all those whining about this anonymize their own server logs? Because I sure don't.... they are doing this to keep the mob away, that's it.
Everyone makes it much easier than matching IP addresses... As the article discusses, many people use Google logins for e-mail and other services. This is a much more reliable way to track all of your information.
What I'd like to see is some significant differentiation between logged-in and logged-out states and the level of anonymity that is provided in each case.
But really, if you're voluntarily storing your stuff on someone else's server with the known understanding that they're parsing it for ad matching, what kind of privacy expectations do you really have?
--
Hey code monkey... learn electronics! Powerful microcontroller kits for the digital generation.
I'm on IPv6, so I hide behind ::1/128
Take Nobody's Word For It.
What benefit does Google have to semi-anonymize after 9 months, then "fully" anonymize after another 9 months? Does it really make any difference? I guess it does give you a bit more privacy after 9 months as opposed to waiting 18 months for the full anonymization process, but it makes no sense to me why they wouldn't just totally get rid of the IP information after that long. I mean, it's data; data must be stored. It's just sitting somewhere taking up space.
Dont trust anybody what they say about your "privacy".
Install Firefox 3, AdBlock+, noscript, and torbutton.
You want complete anonymity, click torbutton (you have to set up tor). You're now damned hidden. No cookie leaks and stuff;.
I don't get it. I'm sure I'm not the only one looking for a good Google substitute, and the number of skeptics will just grow, unless Google gets it privacy protection act together. It's just a matter of time that another AOL-type leak happens.
In the internet age, companies' luck can change quite quickly. Please Google, just get rid of those logs quickly and completely..
except, of course, that with Tor, the egress routers can (and probably do) look at your unencrypted communications, which often can be traced back to you, too.
If you want reasonable anonymity, you need to buy VPN access from a source using a non-traceable payment method. And, of course, they can still correlate your online activity on various sites. A single unencrypted Yahoo Mail or GMail session will unlock your entire usage history.
Sure-- it's a great thing. But Google and Yahoo and myriads of other online sites live and die for your IP address, so that they may serve you better-- after running you through great behemoths of analyticals. Anonymizing after such a time serves no one's real privacy interest. Anonymizers have the ability to help you peruse privately, but even those are becoming easier to predict-- making anonymizing increasingly difficult. It's best to start your own botnet if you really want to be anonymous these days and this is just what a few good anonymizers do. Face it folks, Google's not trying at all and is financially compelled not to do so.
---- Teach Peace. It's Cheaper Than War.
OK, I thought it was strange that there was an "Apple is Evil" story about sneakers earlier today. But now there's a "Google may be evil" story! What's next? A story about how "SCO was right about Linux all along"?
I'm a big tall mofo.
That is a harsh and forced way to get things done. A better way would be to ask for donations, and then buying dedicated (or non dedicated) machines in different parts of the world, using connections from different ISPs (therefore different IPs) and then using these machines solely towards serving as Tor relays.
RutSum.com
A class C subnet is 253 addresses, not 254. Zero and 255 are, last time I checked, reserved.
Do no evil, unless you can fool the public?
Google has been getting away with identity murder for years and years. For anyone that finds this whole thing 'new' or 'odd' needs to slap themselves and research the marketing company that is Google.
They don't provide services or features, they sell identity information and ads.
The services and online features are just the bait in the trap.
"Google, making Microsoft look non-Evil for years."
These issues concern me, but I admit I do not know much about this. How about I do a search and you keep nothing? Does any search engine provide that?
I have something that actually does anonymize IP data. I need a roughly unique identifier for web sites for load balancing and queuing purposes, but don't need to identify the remote site. So I run the IP address through MD5, the cryptographic hash, then take the absolute value, then reduce mod 1,000,000. So the world of IP addresses is mapped into 0..999999. About 4000 IP addresses map to each number, but they're spread pseudorandomly across IP space.
So there's no real problem doing this if you just need enough info to make your server farm run smoothly. Of course, Google wants more.
HAHAHA... That's-a-funny...
Maybe, possibly you might get some privacy if you can randomly change your public IP address a few thousand times a second in some "spread spectrum" type fashion. But for now, real privacy on the net is but a pipe dream.
What?
It only gets worse if you believed it was "good" in the first place. These revelations don't make it worse for me since I don't believe they're committed to my privacy at all. Never have been, never will be. Sheesh, I swear some of you people will believe anything! The "do no evil" myth has been one of the most pervasive and unfounded ones of the last decade. Watch what they do, not what they say.
But their search sucks... :/
I would just delete all of the IP addresses. That would be a better example of anonymity.
I created a new email account (I have my own domain) and signed up for another gmail account. Soon afterward, to an email address I had never, ever used... I got spam! That's when I realized Google wasn't as non-evil as they claim to be.
I simply searched for I2p on Google to get the homepage and it gave me the IP link... But the IP link seems to be out of date so thank you for the correction.
The problem is that to enter I2P you need an i2p gateway to connect to. It's like TOR but reversed: TOR nodes let you get from the anonymous net to the outside world... I2P gateways let you get from the outside world to the anonymous net. So what happens when these addresses get banned?
No matter how you look at it, if it ever gets popular it will be declared illegal by governments for supporting "terrorism or other illegal activities" (such as p2p, doh) and they'll come out with "if you have nothing to hide...".
My conclusion is that I2P will *ALWAYS* be in "beta" and therefore it will never be announced to the world. And because of that, not many people will cooperate and try to install their own i2p nodes. The result: A VERY VERY slow anonymized network.
First off, I was running ISP's back in the 90's, and even then my dynamic pools for Radius were bigger than a /24, unless the location was a tiny remote dial up. Nowadays, there probably is no large ISP assigning single /24's for dynamic IP addressing. Heck, /20, /19, and even /18 are being used by my ISP, a large cable provider. I haven't asked anyone there lately, but I'm betting they have bigger pools than that.
Now, if you have a static block, that's different, but if we're talking about the masses in general, the number of possibilities are going to be larger than 1 in 253, and if you also consider DHCP timeouts, the possibilities become even larger.
This sounds a bit like alarmism, and the author apparently doesn't bother to map any of this into actual real-world.
Even if IP and cookies were scrambled, that would still leave search terms and google analytics. If your IP or cookies have at least short-term persistence, the pattern of associated web use seems likely sufficient to establish a chain of identity. Though one more computationally expensive to mine (but more expensive only if you never login to google services).
A class C subnet is 253 addresses, not 254. Zero and 255 are, last time I checked, reserved.
Let's see, there are 256 possible numbers from 0 to 255 inclusive, and two of them are reserved. Your skill testing question was to calculate how many remain by subtracting 2 from 256, and you got it wrong...
If all the people making such a big fuss of this would just tell users
(1) dont stay logged in to gmail
(1.1) if you have to stay logged in for IM, use Pidgin or something to do that
(2) set your browser to clear cookies every time the browser is closed
wouldn't that be a lot shorter and more useful. Google has to do what they have to do for their business model, and if you don't like it, you either stop using their servers or do what you can on your side to limit the damage.
Whatever you do, our governments be it US or UK under pretext of WarOnTerror, France under pretext of MusicAuthorsRightsProtection, China for... just because, and most others : they all pledge meaning no offence to your privacy but all pass laws to make Internet a better and more secure BigBrother world.
If you're really serious about privacy protection, look in Sweden : real laws are there to protect privacy, real political movements protect it at the parliament, real solutions like Relakks are developped to help people from InternetTotalitarianCountries to keep they privacy.
Use Relakks and discuss with your neighbours to enlight them about Internet freedom !
Looks like R e l a k k s related posts are filtered on Slashdot ?