Slashdot Mirror
GoogleSharing, Now With No Trust Required
An anonymous reader writes "GoogleSharing, the popular Google anonymizing service created by well known privacy advocate and security researcher Moxie Marlinspike, has released a major new version today. The biggest change is leveraging Google's SSL search option to provide an anonymizing service which doesn't require you to trust either Google or GoogleSharing. This means that anyone who wishes to opt out of Google's data collection practices can now do so without having to trust the operator of the anonymizing service."
A great day for liberty!
What one fool can do, another can. (Ancient Simian Proverb)
Isn't there?
Let me refer you to the second sentence of the summary:
"The biggest change is leveraging Google's SSL search option to provide an anonymizing service which doesn't require you to trust either Google or GoogleSharing."
Kids today...
Copyright 2010. All rights reserved. This comment may not be copied in any way including, but not limited to caching.
Google search and news work fine without one.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
I do all my browsing in Google Chrome and don't want Google to know about me when I use my Gmail, Google Voice, Google Transit, Google Maps, or just plain Google. The fact that it's only supported in firefox doesn't help out people like me.
Somebody mod this guy up. I need more points.
"We are just a war away from Amerikastan. When god vs god the undoing of man." Dave Mustaine
The funniest thing about the second part of your comment is that your ID has more digits. HA HA HA!!! Well... not really.
"Obviously, you need to be an Einstein to navigate the Austrian Patent Office website." - platinumrat
From GoogleSharing's FAQ:
Why not use Anonymizer or any other anonymizing proxy service?
General purpose anonymizing proxies are designed for something else.
1. Most will mask your IP address, but not the identifying information in your HTTP headers. Google will still know who you are based on your Cookies, User Agent, etc...
2. If the proxy does attempt to anonymize HTTP headers, they will do it by completely stripping cookies from your request. Google does not like this, and will tag you as a SPAM bot (how convient for them to do), which will force you to type in a CAPTCHA every time you issue a Google search, and will prevent you from issuing Maps requests at all.
3. These types of proxies can be slow. It's not necessary to proxy all of your internet traffic if you're just trying to protect yourself from Google. Since GoogleSharing only proxies Google traffic, our bandwidth needs are much lower and thus our performance is much greater.
Let me refer you to the second sentence of the summary:
Look old man, if it was important, it would be in the FIRST sentence because that's how we kids do it these days even if it means run on sentences and now I'll get off of your lawn.
Bro, more than 140 characters? Gimmie a minute, I need to check like three other services.
Man who leaps off cliff jumps to conclusion.
Let me refer you to the second sentence of the summary:
"The biggest change is leveraging Google's SSL search option to provide an anonymizing service which doesn't require you to trust either Google or GoogleSharing."
Wow.
You are right. That says I don't have trust google or googlesharing. ... assuming I trust the entity that makes that claim.
Oh. The entity making the claim that I don't need to trust GoogleSharing is GoogleSharing. Neat.
So if I don't trust googlesharing, why would my distrust be satisfied by the fact that they claim I don't need to trust them? That makes about as much sense as a fly asking the spider if he can take a nap on the web... the spider said he wasn't hungry... I guess there's nothing to worry about. :facepalm
Now, if you had instead referred me to the googlesharing FAQ:
http://googlesharing.net/faq.html#faq6
"If you're still worried, remember that the GoogleSharing addon and proxy code is publicly available. So it's possible for you to run a GoogleSharing proxy yourself, or to find someone who you do trust."
That's at least a step in the right direction. I can inspect and run the software on a server I do trust.*
And if I use the GoogleSharing servers, than I do still need to trust GoogleSharing to be running the software they claim to be running. I expect they are worthy of that trust but you still have to trust them unless you are running your own server after inspecting the source.*
** And you will need to find a bunch of people who trust YOU using your server for you to derive any privacy benefit from running your own server. Bit of a catch-22 there.
Welcome to Slashdot, where people are too lazy to read the summaries, never mind the articles, and restating a sentence from the summary gets modded +5 Informative.
While I appreciate (the existence of) the service, methinks this is a trademark suit just begging to happen. I mean take a look at their logo [png graphic]. It really looks like an official Google site. In this age of massive information sharing, I have my doubts about patents and copyrights in general.
However with patents, I'd give the trademark owner the benefit of the doubt (you're not necessarily evil if you sue for trademark infringement), unless your trademark happens to be a pure (uncombined) dictionary word (in English or whatever language) or a common or well-etablished proper name (e.g. Smith or Madonna). Thus, I'd throw out any lawsuits involving Apple(tm) or Oracle(tm) but not Facebook(tm), Microsoft(tm), Apple Computers(tm) or Apple Records(tm). Obvious parodies are another matter, so there might be room for site names like Googlevil.
[*] I'm using trademark in the general sense to refer to symbols or names that make up the business identity of a company.
To refine this post's sibling, Scroogle sets an SSL between you and them, not you and Google, like GoogleSharing does (GS just anonymizes the encrypted connection).
Dilbert RSS feed
Download extension. Unzip it. Read the code.
Who exactly do you need to trust?
Dilbert RSS feed
googlesharing.net uses no javascript. Hurray!
I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.
they pass each keystroke in real time to the servers.
go ahead, type carefully..
they'll see each letter as typed and "fingerprint" you that way
the typing speed and corrected mispellings even without you hitting 'search'
every day http://en.wikipedia.org/wiki/Special:Random
Its hidden on your computer as the https, then sent up to google, google unpacks, NSA at some point has a look, google sends on as https.
To any non US state/federal/hacker your text https to google I think?
Domestic spying is now "Benign Information Gathering"
No you don't, that's the difference between this version and the previous version. (I know, I know, RTFS is for wimps...) Unless their servers are using a previously unknown SSL exploit* then all you need to do is make sure the cert is correct. That's the thing with SSL, you only need to trust the CA. For the same reason that you don't have to trust your ISP (and every shady goon working there) you don't need to trust googlesharing (now).
*Hmm... well this is Marlinspike...
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
I think it basically acts as NAT router: It makes your browser send the encrypted data to GoogleSharing, then GoogleSharing just replaces the IP addresses so that the destination is Google and the source is GoogleSharing. For the return packets the IP addresses are changed the other way, so you get the packet back from GoogleSharing. All other functionality (like not sending any information from your cookies or manipulating User Agent) can be implemented locally at your browser by the extension.
Disclaimer: I didn't read the code (nor did I see any good description on the page), so this is basically how I think it works. Maybe I'm completely wrong (but I cannot think of another way how it could work).
The Tao of math: The numbers you can count are not the real numbers.
I got an Android phone a month ago and that damned think does everything in its power to get you to enable "total information awareness" settings. Every time I use Google Maps I've got to proactively stop it from sharing my location information. Apps like this will be a blessing as soon as we see a more complete suite of pro-privacy variants come into being.
I swear to God...I swear to God! That is NOT how you treat your human!
for that matter: Welcome to Slashdot, where people think scepticism is a good replacement for education and intelligence.
It seems like half the commenter here may have at least RTFS, but simply don't know what SSL is.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
Well, you also have to trust the Firefox extension (or read and understand the code, and trust your ability to find issues if there are any).
The Tao of math: The numbers you can count are not the real numbers.
regular proxy ? Who is gifting the world a service? A front company, data mining, hacker, researcher? For profit or fun?
Anyway you look at it even if the proxy on offer is 100% safe, who is next door?
As for the " out-of-context quote" and the google MAC map making efforts, long term cookies, telco tracking ect it all its a pattern.
Domestic spying is now "Benign Information Gathering"
Yo Dawg! I heard you anonymize the non-anonymous SSL, so now anonymous can opt-out and be an anonymize anonymous.
Be seeing you...
Who exactly do you need to trust?
Ken Thompson? Reflections on trusting trust.
I think that it is confidential, because of Google's highly successful on the basis of increases in google, but google seems to be an organization of monopoly infrastructure, in doing so is very solid and high quality services by all existing popular Preferred access pt http://www.hakyolunda.com/
Just last year I explained all this Internet privacy concern to my father. I don't think he liked what he learned. Sometimes I really do wish I were just another one of the happy-go-lucky sheeple, because, given the state of the world, "being aware" is just so damn depressing. ... "if you had to choose, would you rather be smart or happy?" After having given that some thought, I'm convinced smarts has a negative impact on happiness. :-(
There's this choice
Perhaps, but the bliss of the ignorant will endure only as long as there are enough smart and educated people resisting the many tendencies to drive everyone into servitude and constraint.
"Liberty without learning is always in peril; learning without liberty is always in vain." - J.F.Kennedy, 18 May 1963.
Liberty and learning go hand-in-hand. Separate them, and you lose both.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
that if you want to kept things private then you must have something to hide... Some of us are just paranoid!
Looks like Google has a huge pool in which to gather generalized data on what "people who want privacy" tend to do with that privacy from.
"Now I am become Death, the destroyer of worlds"
Google know what the search term is, but they won't know where it's come from, since the whole point of the proxy is to make it appear that the proxy server is the origin.
tl;dr
Welcome to slashdot, where people incorrectly think there can be only one correct spelling for a word.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
Flowers would be nice...
From GoogleSharing's FAQ:
Why not use Anonymizer or any other anonymizing proxy service?
General purpose anonymizing proxies are designed for something else.
1. Most will mask your IP address, but not the identifying information in your HTTP headers. Google will still know who you are based on your Cookies, User Agent, etc...
2. If the proxy does attempt to anonymize HTTP headers, they will do it by completely stripping cookies from your request. Google does not like this, and will tag you as a SPAM bot (how convient for them to do), which will force you to type in a CAPTCHA every time you issue a Google search, and will prevent you from issuing Maps requests at all.
3. These types of proxies can be slow. It's not necessary to proxy all of your internet traffic if you're just trying to protect yourself from Google. Since GoogleSharing only proxies Google traffic, our bandwidth needs are much lower and thus our performance is much greater.
For reference, Scroogle strips the headers, addressing GS's point #1, and then generates dummy cookies that prevent point #2 from being a problem. There's no noticeable difference in speed between direct Google and use of Scroogle, which like GS doesn't proxy non-Google traffic, and has a for efficient default search result screen than Google itself.
The other responses to my reasonable question (which got modded troll because...well I have no idea) actually pointed out meaningful differences, though. Scroogle lacks image and map searching, for instance, and could feasibly spy on your traffic before they delete their logs in 48 hours.
"I zero-index my hamsters" - Willtor (147206)
Numbers 1 and 2 are lies. Tor insists you should use the Torbutton add-on for Firefox in order to address these problems. Cookies from Tor-mode and non-Tor-mode are segregated from each other. So cookies work fine while using Google anonymously - I just tested it and there were no CAPTCHAs.
Equivocate much?