How Do I Keep My Privacy While Using Google?

hubert.lepicki writes "I use Google all the time. I keep two GMail tabs open when I'm online (one is private, another is a corporate account), I use Google search, and recently I switched to the Chromium browser. Google's services are fast, easy to use and usually reliable. At the same time, I know Google is tracking everything I do; I can see it in search results or their ads on web pages, which tend to match my interests. After the recent post by Mozilla's community director suggesting Bing has a better privacy policy (a response to questionable comments from Google CEO Eric Schmidt), I started to... 'google' ways of keeping my private data safe while browsing and using Google services. The results weren't very helpful, so I ask you, Slashdotters: how do I stay anonymous to Google while using their services?"

Comments

Ideas

[ilovegeorgebush]

TrackMeNot for Firefox is useful for masking your real search engine queries with randomised search terms. That's a start. Not sure if there's a Chrome equivalent. Is Chrome that much of a necessity? Firefox does the job (though it freezes far too often for me). Otherwise, why not exercise some self-constraint and try products from Yahoo, or even host your own? (First post? :P)

Re:Ideas

[Anonymous Coward]

This is like a steer asking, "how can I keep getting this free food and board without being taken to the slaughter house later?"

To Google, you are the product. They are selling advertising. More specifically, they are selling your attention to marketers. Giving you privacy is contradictory to the entire purpose of their existence. They give you nice, fast, free stuff to keep you hooked in to their services and to keep collecting more data so that they can sell more advertising.

There is no privacy using Google services. There never will be. They will keep encroaching into your private info as far as you let them.

Re:Ideas

[Z00L00K]

Spread the confusion by always killing your cookies and use different browsers.

But personally I run my own mail server and use only Google for searching.

Re:Ideas

[Scrameustache]

Open two different browsers, say Chrome and Firefox. Use one to log in to your email, but nothing else. In the other, never log in to Google services. It certainly doesn't solve the whole problem, but it is trivially easy and has no serious drawbacks.

Same IP address at the same time...

Re:Ideas

[Maxo-Texas]

Wow!

Your post is so specific and yet almost completely unhelpful at the same time.

Re:Ideas

[quickgold192]

Yes, I've thought about this problem and I've also read about TrackMeNot. Unfortunatly, TrackMeNot has some serious flaws:

1. It randomizes search terms instead of following believable search patterns. Example 'search stream': Shoes, virus protection, Hannah Montana, flamethrower "do it yourself", Hawaii, spark plugs, military surplus, speaker system, Exhaust Flame Thrower Kits... It's pretty easy to see what's real and what's fake.
2. People tend to use search engines in bursts. When I last used TrackMeNot it sent off search queries at regular intervals. The decoy queries would be easy to filter out.
3. Nobody would really be willing to let queries like "donkey sex" or "how to kill the president" get fired off by the software. For true privacy, those would be the most important terms to make the list, so that if someone really *did* search for those, he could just say that it was the software making automatic requests.

I had an idea to fix this:
1. The software would have to monitor your search engine usage and match your searching bursts and searching frequency. Those things can't be hardwired into the software or else algorithms would so some fingerprint-matching on your search queries.
The next part is a little fuzzy:
2a. For every 'search burst' you make, the software can ananomously post the search terms to a central server that other clients read and use as decoys. The problem is filtering out truly private data such as address and names.
2b. If not that, maybe the software can just go loose on the web and look up possible related search terms to search for.

Of course, I'm thinking beyond simple privacy against advertisers. More like legal protection.

Re:Ideas

[roc97007]

...which would make it the perfect Slashdot post.

Re:Ideas

[rm999]

Careful with TrackMeNot - I used it for awhile, and Google started blocking my real searches, returning an error screen that indicated my searches may not be legitimate. They clearly know when you are using it (who sends in dozens of searches every hour of the day?), and may consider it a violation of their TOS. I don't know about you guys, but if they decided to shut down my account it would be pretty devastating - I backup a lot of information and important e-mails only on gmail.

Re:Ideas

[AHuxley]

http://wikileaks.org/wiki/EU_social_network_spy_system_brief%2C_INDECT_Work_Package_4%2C_2009
Is just what IP tracking is for. You can have all the IM and browsers you want, over time the database logs 'you' and your friends once a set of "dictionary" words are tripped.
Every search and IM is now "Signals intelligence" to the gov and marketing to the .coms.
Or you can sell the 'data' to the gov too while running a marketing front :)

Re:Ideas

[Anonymous Coward]

They do have extra info - flash cookies. I can safely bet 99% of you never remember to clear them, and for example Gmail/Google's services explicitly uses them to match IP changes (or use of proxies) with a single computer.

Funny thing is their ToS "Google may store cookies" probably covers flash cookies too, even if everybody would think they wouldn't use such tactics. And who said Google is not evil?

Re:Ideas

[ScrewMaster]

I don't know about you guys, but if they decided to shut down my account it would be pretty devastating - I backup a lot of information and important e-mails only on gmail.

Well, that's your problem right there. No online service should be treated as a backup system, nor should you allow yourself to become totally dependent upon it. Period. Store your stuff on your own equipment, and burn it to a disc now and then if it's that important. I don't trust Google or any other corporation that offers free services to be there tomorrow: remember, anything free is worth exactly what you paid for it. Take steps to preserve your data: that's your responsibility, not Google's.

Re:Ideas

[maxwell demon]

Blocking Flash should be the default for anyone concerned about privacy, anyway. And with the BetterPrivacy Firefox add-on can in addition clear your Flash cookies between browser sessions, so even for things like YouTube where you absolutely need Flash the tracking ability is at least reduced (of course you'll have to regularly close the browser for it to be effective).

Re:Ideas

[jimmyharris]

Try Optimize Google instead. It's a far more actively maintained fork.

If you asked me...

[ls671]

If you asked me I would say resistance is futile unless you are ready to commit illegal actions.

You could always use anonymous services like scroogle fro searching but if I was a intelligence gathering organization, I would run such "anonymous services" myself so there is a risk that you might be followed even more by using such services.

Hacking into 10 machines and forwarding your connections through all of them might be a solution that will get you into trouble but that can be an efficient way to stay anonymous. But then again, intelligence gathering organizations might set up honey pots that you will end up using and you will bring even more attention to yourself this way.

So anyway:
> how do I stay anonymous to Google while using their services

is a really hard to answer question: There might be solutions for anonymous services like searching but for gmail and all other services that require you to log in, I would say forget it.

Intelligence gathering organizations have come to fully realize the potential of the Internet to track people, in contrast to the situation in the early 90s. Maybe Google CEO knows all about this and that he was just saying; you will be tracked anyway so you may as well be tracked by us ! He kind of screwed up on this because he is now stuck, unable to further explain his point of view, he would have to admit that Google, Bing and many other track you for business and marketing reasons but that they also "share" information with security oriented intelligence gathering organizations.

So in the end, I would choose who I want to be tracked by for marketing purposes and forget about not being tracked for other purposes unless you want to risk getting into trouble. You may be safer just acting as a normal day to day user thus making the amount of traffic play into your advantage in order to stay anonymous.

Re:If you asked me...

[SBrach]

Or you can just Opt Out

TrackMeNot

[the linux geek]

Look up the TrackMeNot Firefox extension. It spams Google and the other search engines with randomly generated but plausible search queries, so there's no real way that any of these companies can build a profile on you. If you browse with ads, however, prepare for some really bizarre ones.

Re:TrackMeNot

[couchslug]

"If you browse with ads, however, prepare for some really bizarre ones."

No problem. I Googled "blocking Google Ads" then set Firefox accordingly. :)

http://www.lancelhoff.com/blocking-google-adsense-ads/

Tor?

[rvw]

Why not use Tor for search queries? Your gmail is obviously a different story, because using Tor wouldn't make much difference for Google. So set Opera or Chrome to use Tor, and you're set for that part.

Re:Tor?

[eulernet]

Or use OperaTor: http://archetwist.com/en/opera/operator

Re:Tor?

[Gothmolly]

Except for the fact that most Tor nodes are trojaned DoD machines, with all sorts of data->disk logging features. Or not. But how could you tell?

You don't

[Anrego]

Seriously.. despite all the controversy it has stirred up.. if you don't have anything to hide.. who cares

It's not that black and white.. but chances are unless you have some very disturbing fetish.. chances are "the stuff you don't want your boss to know" is fairly similar to 10 million other people.. to the point where you are just a tiny blip in a stats bucket. Your just search #234521 for "sex with staplers".

They arn't publishing your search history in the newspaper .. they are using it to increment a counter that you might be interested in office supply ads.

If you are really paranoid though.. use adblock.. route everything through tor.. disable cookies.. and be sure to encrypt your hard-drive with a 20 gazillion bit cypher.

Re:You don't

[Anonymous Coward]

20 gazillion bit cypher

where can I get one of these? I am doing lots of illegal things, and I dont want to ask Google - for obvious reasons :-)

Re:You don't

[Scrameustache]

They arn't publishing your search history in the newspaper ..

They are keeping it, and sharing it with secretive agencies. You may think you have nothing to hide, but you don't know which way the political wind will blow in the future. Maybe you'll be a dissident to those agencies later on...

Re:You don't

[bonch]

Seriously.. despite all the controversy it has stirred up.. if you don't have anything to hide.. who cares

Welcome to the new Slashdot, where everything Google does is great, and only people with something to hide would care about privacy.

Re:You don't

[selven]

only people with something to hide would care about privacy

An entirely correct position. The place where the argument breaks down is that there's nothing wrong with having something to hide. For example, I would very much prefer it if my Slashdot password remains a secret, and there's nothing wrong with that.

Re:You don't

[LockeOnLogic]

There was an old russian KGB adage which went something like "everyone has committed a crime, it's about who we decide to prosecute".

Re:You don't

[TubeSteak]

Welcome to the new Slashdot, where everything Google does is great, and only people with something to hide would care about privacy.

For people who don't 'get it', compare the situation to getting frisked by the police.
The principle is exactly the same, but the practical difference is that Google's invasion of privacy
causes you no inconvienence... which somehow makes it okay. Out of sight, out of mind.

Re:You don't

[causality]

They arn't publishing your search history in the newspaper ..

They are keeping it, and sharing it with secretive agencies. You may think you have nothing to hide, but you don't know which way the political wind will blow in the future. Maybe you'll be a dissident to those agencies later on...

Anyone who has studied history and actually learned from it would come to the same conclusion. I'm amazed that there is anything resembling controversy over this.

You Don't

[phantomcircuit]

If you are logged into gmail you cannot possibly retain your privacy.

Short of deleting all google cookies and changing your ip after using gmail you cannot retain your privacy.

Not exactly what you want, but

[paulthomas]

# cat > /etc/hosts
> google.com 127.0.0.1
> doubleclick.net 127.0.0.1
> youtube.com 127.0.0.1
> google-analytics.com 127.0.0.1
> # ...
> EOF

Truth is, there is no privacy anywhere.

[miffo.swe]

Thanks to 9/11 there arent anywhere on the world you can expect any privacy. Not online, not offline, not your medical records, your purchases, your bills or anything else thats in electronic form are private.

Weather you use Bing, Hotmail, Gmail, Google doesnt matter the least bit since ALL of them logs everything and have to keep it and release it at any governments whim. The differences between them are highly superficial and has zero importance in reality. The terms of service from the different vendors are worth about, not a damn thing. They have to log everything and have to release whatever a court or intelligence agency wants released.

If you dont want it read and scrutinized, dont put it online. Period.

Dear Slashdot

[pavon]

I use my butler Jeeves for everything. He arranges my travel, does my bills, and picks up anything I need from the store. He is fast, courteous and usually reliable. At the same time I know that he is aware of everything I do; I can see it in the way he can often provide suggestions which tend to match my interests. Do to some misplaced comments of his, I am now suspicious that he may not respect my privacy. How do I remain anonymous from my butler while still having him provide all the personal services that I am accustomed to?

You could do it yourself.

[NoYob]

Do a search on whatever you're interested in. Then precede those searches with something completely random,like airplanes and explosives. Do your search on whatever you want and then follow it up with a search on say, "Islam".

No one will pay any attention.

For a simple answer to the question...

[Old Flatulent 1]

Justs Google it....oops!

Re:Remember your tin foil hat

[rfernand79]

But you didn't! This is not about whether people are interesting or not. This is about privacy, which seems to be devalued in the public's opinion. 1984 was a cautionary tale, not a guidebook.

Re:What's the big deal?

[bonch]

As long as Google isn't selling my financial data to unscrupulous persons and having me get billed all kinds of money for things I don't want, or creating a dossier on all the weird shit I've searched for and forwarding it to my boss, what's the big deal?

My, my. Slashdot sure has changed.

If you let it slide that a company tracks everything you do, that then becomes the norm, and you no longer have any privacy anywhere. The opportunities for exploitation of this data are too numerous to list. You don't know whether or not Google is selling your data to unscrupulous persons, and with a CEO who says only wrongdoers have something to worry about when it comes to privacy, chances are that advertisers know all about you at this point.

What *does* freak me out is how my credit card company can ask me to confirm my height and weight when I talk to them on the phone, and when I ask them how the f**k they found out how much I weigh, they tell me that by law they're allowed to download all the information from the Department of Transit and so they know everything that's on my drivers license. THAT's the kind of stuff that I find extremely scary, and that's the kind of thing you can't do anything at all to prevent other than living in a shack in the mountains somewhere.

Let me get this straight. It's okay for a company to index all your information so that advertisers know everything you do, but it's "scary" when a credit card company does a good thing and uses info on your driver's license as a security confirmation over the phone? Are you for real?

I get cross gmail account ads

[stimpleton]

I work for a company that supplies a specific unique service(Laboratory Service). I use a work gmail account for testing/backup. My personal email is not gmail. To my surprise after using gmail I starting getting spam to my personal account to do with Lab stuff. And some ads in gmail clearly are oriented to my personal stuff. As far as I know I have never crossed the two and strickly keep personal matters out of Gmail.

As with a comment above, "if you have nothing to hide", I don't have anything to hide. But it is somewhat unsettling.

Handy Firefox Plugins

[Ziekheid]

Here are some addons I use in Firefox that might be of use for some: CookieSafe, permanently ban google in specific from setting cookies (for example): https://addons.mozilla.org/en-US/firefox/addon/2497 Ghostery, See who's tracking your web browsing and block them automaticly. (trackers like google analytics, quantcast, etc) https://addons.mozilla.org/en-US/firefox/addon/9609 Torbutton,Provides a button to securely and easily enable or disable the browser's use of Tor. It is currently the only addon that will safely manage your Tor browsing to prevent IP address leakage, cookie leakage, and general privacy attacks. https://addons.mozilla.org/en-US/firefox/addon/2275

Re:Ideas NOT IP -- proxy servers

[redelm]

Tracking HTTP by IP is extremely unreliable for Google and everyone else -- many corporations and other firewalled institutions run big proxy servers and funnel all their requests from that machine.

Here's what I do...

[Jah-Wren Ryel]

1) Use different browser profiles for different web applications.

If you start firefox with these options: -no-remote -ProfileManager it will allow you to run multiple copies simultaneously, each with a separate profile (different set of cookies, different set of plugins, different skins, different bookmarks, different histories, etc).

I create a specific profile for each major web app - I have one for IMDB, one for google searches, one for google mail, one for google voice, etc. And one for generic browsing.

Each profile has a couple of add-ons:
Adblock Plus - general catch-all to block things like doubleclick and the million other trackers
CookieSafe Lite - for fine-grained control of what sites can set cookies
NoScript - for fine-grained control of what sites can use javascript and flash
Redirect Cleaner - for removing those "bounce links" that a lot of sites use to track you when you follow a URL off their site, with the cleaner you go directly to the destination URL
RefControl - for clearing out or rewriting the referrer URL - prevents sites from knowing where you came from when you clicked a URL to their site, sometimes helpful in accessing poorly 'restricted' content
Targetted Advertising Cookie Opt-Out - sets special cookies that sites may choose to obey to say "don't profile me" since these TACOs are not unique-per-user, I figure it can't hurt although it probably doesn't do anything
User Agent Switcher - Lets your browser identify itself as a different browser - this is very important
Ghostery - Informational Only - tells you what tracking sites may be tracking you on any given page (does not block them, and you get false alarms on sites where NoScript blocks javascript, but it is still good for situational awareness)
Better Privacy - Blocks new stealth "super cookies" in Flash and DOM Storage Objects. VERY IMPORTANT

Using the above plugins, I do the following in each profile:
1) Set NoScript to only allow javascript from the one website the profile is intended for - and block flash as much as possible regardless due to cross-profile flash cookies
2) Set CookieSafe that same way and then only for per-session cookies
3) Block and/or auto-delete Flash and DOM Storage cookies with Better Privacy - note flash cookies tend to be shared across all profiles because they go in a folder under "Documents & Settings" on MS Windows and ~/.macromedia/ on Linux. I am still looking at ways to force each profile to use a different directory for flash cookies - until then, block flash as much as possible and auto-delete cookies frequently
4) Set the User Agent to be different in each profile - this gives the appearance of multiple users behind a firewall which is key
5) Load a different theme or skin for each profile to make it easy to visually distinguish between windows so you don't accidentally start browsing the web from your gmail window or vice-versa

All that is a little bit of a pain to set up, an hour or two total. But once in place, I think it is a reasonable compromise for reducing the risk of having your personally identifiable information gleaned in services like Google Mail from being automatically cross-referenced with your browsing habits. I am considering taking it a step further with FoxyProxy configurations to use

Re:Ideas NOT IP -- proxy servers

[EsbenMoseHansen]

Thank god for IPv6 ?

I had no part in that, and I resent the accusation.