Slashdot Mirror
Questioning Google's Privacy Reform
JagsLive makes note of a story questioning whether Google's recent commitment to anonymize IP logs faster is really as good as it sounds. We discussed their announcement a few days ago. CNet's Chris Soghoian takes a closer look:
"While the company hasn't said how it de-identifies the cookies, it has revealed in public statements that its IP anonymization technique consists of chopping off the last 8 bits of a user's IP address. As an example, an IP address of a home user could be 173.192.103.121. After 18 months, Google chops this down to 173.192.103.XXX. Since each octet (the numbers between each period of an IP) can contain values from 1-255, Google's anonymization technique allows a user, at most, to hide among 254 other computers. ... Google has now revealed that it will change "some" of the bits of the IP address after 9 months, but less than the eight bits that it masks after the full 18 months. Thus, instead of Google's customers being able to hide among 254 other Internet users, perhaps they'll be able to hide among 64, or 127 other possible IP addresses. By itself, this is a laughable level of anonymity. However, it gets worse."
Do all those whining about this anonymize their own server logs? Because I sure don't.... they are doing this to keep the mob away, that's it.
Everyone makes it much easier than matching IP addresses... As the article discusses, many people use Google logins for e-mail and other services. This is a much more reliable way to track all of your information.
What I'd like to see is some significant differentiation between logged-in and logged-out states and the level of anonymity that is provided in each case.
But really, if you're voluntarily storing your stuff on someone else's server with the known understanding that they're parsing it for ad matching, what kind of privacy expectations do you really have?
--
Hey code monkey... learn electronics! Powerful microcontroller kits for the digital generation.
I don't get it. I'm sure I'm not the only one looking for a good Google substitute, and the number of skeptics will just grow, unless Google gets it privacy protection act together. It's just a matter of time that another AOL-type leak happens.
In the internet age, companies' luck can change quite quickly. Please Google, just get rid of those logs quickly and completely..
Yah, but it is unbearably slow.
except, of course, that with Tor, the egress routers can (and probably do) look at your unencrypted communications, which often can be traced back to you, too.
If you want reasonable anonymity, you need to buy VPN access from a source using a non-traceable payment method. And, of course, they can still correlate your online activity on various sites. A single unencrypted Yahoo Mail or GMail session will unlock your entire usage history.
If only we had more relays in the Tor network than the leeches. That's why Tor is really really slow these days. We need a restructure or major change in protocol for Tor to survive. A lot of people seem to be hopping onto the network these days, with companies becoming increasingly nosy.
RutSum.com
Sure-- it's a great thing. But Google and Yahoo and myriads of other online sites live and die for your IP address, so that they may serve you better-- after running you through great behemoths of analyticals. Anonymizing after such a time serves no one's real privacy interest. Anonymizers have the ability to help you peruse privately, but even those are becoming easier to predict-- making anonymizing increasingly difficult. It's best to start your own botnet if you really want to be anonymous these days and this is just what a few good anonymizers do. Face it folks, Google's not trying at all and is financially compelled not to do so.
---- Teach Peace. It's Cheaper Than War.
Do no evil, unless you can fool the public?
Google has been getting away with identity murder for years and years. For anyone that finds this whole thing 'new' or 'odd' needs to slap themselves and research the marketing company that is Google.
They don't provide services or features, they sell identity information and ads.
The services and online features are just the bait in the trap.
"Google, making Microsoft look non-Evil for years."
The problem is that to enter I2P you need an i2p gateway to connect to. It's like TOR but reversed: TOR nodes let you get from the anonymous net to the outside world... I2P gateways let you get from the outside world to the anonymous net. So what happens when these addresses get banned?
No matter how you look at it, if it ever gets popular it will be declared illegal by governments for supporting "terrorism or other illegal activities" (such as p2p, doh) and they'll come out with "if you have nothing to hide...".
My conclusion is that I2P will *ALWAYS* be in "beta" and therefore it will never be announced to the world. And because of that, not many people will cooperate and try to install their own i2p nodes. The result: A VERY VERY slow anonymized network.
Damnit.. I wish there was a way to edit comments here. That was a typo on my part, and I didn't notice it until I saw 6 people beating me in the head with it. :p
Well... if you want to get technical about the number of possible anonymous addresses you need to keep in mind that Network Address Translation(NAT) and Protocol Address Translation (PAT) will multiply this number significantly. Assuming that Google only keeps the IP address and not the rest of the TCP header.
If your getting internet access from a major ISP and you didn't spend the extra $20 to get a 'static' or 'internet visible' IP address, your likely behind PAT.
I'm sure someone will correct me if I'm wrong.
--Magus Sartori