Slashdot Mirror
NSA Uses Google Cookies To Pinpoint Targets For Hacking
Hugh Pickens DOT Com writes "For years, privacy advocates have raised concerns about the use of commercial tracking tools to identify and target consumers with advertisements. The online ad industry has said its practices are innocuous and benefit consumers by serving them ads that are more likely to be of interest to them. Now the Washington Post reports that the NSA secretly piggybacks on the tools that enable Internet advertisers to track consumers, using 'cookies' and location data to pinpoint targets for government hacking and to bolster surveillance. The agency uses a part of a Google-specific tracking mechanism known as the 'PREF' cookie to single out an individual's communications among the sea of Internet data in order to send out software that can hack that person's computer. 'On a macro level, "we need to track everyone everywhere for advertising" translates into "the government being able to track everyone everywhere,"' says Chris Hoofnagle. 'It's hard to avoid.' Documents reviewed by the Post indicate cookie information is among the data NSA can obtain with a Foreign Intelligence Surveillance Act order. Google declined to comment for the article, but chief executive Larry Page joined the leaders of other technology companies earlier this week in calling for an end to bulk collection of user data and for new limits on court-approved surveillance requests."
The EU is right on this one...
Big data monopolies like Google are the stuff of nightmare for privacy-minded individuals.
But there's a silver lining to that particular cloud: as the most important player in the field, they're the most visible target for abuse of all kinds. Which means that you have a better chance of dodging the abuse if you simply don't put yourself in the center of the target, by not using any Google product.
Kind of like when Windows had the lion's share of the OS market, and you could avoid most viruses by running another OS, not because the other OS was more secure, but because virus writers had a better return on investment writing viruses for Windows and left your fringe OS alone.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
A CEO of one of the most successful US Corporations in the entire world wants to put an end to data gathering, and doesn't somehow fucking get that their company exists only because they are in the business of data gathering.
Oh, I love how they pander to us while continuing to shake hands with the devil. You act like they're going to turn away one of their largest customers.
Don't get me wrong, businesses like Google almost have to take this stance "against" the enemy of the People, else they risk losing other portions of their customer base. I simply don't like being lied to by them any more than I like being lied to by my own government.
In the end, nothing will change. Nothing. The US government won't allow it. You're a fool to think otherwise.
Personally, the collection of privacy relevant information by private companies like Google is way more scary than what a government fools around with.
And don't come, it's voluntary. It's anything but, considering how many sites include elements from Google/Facebook/... (e.g. ads or like buttons), and they DO track you even if you are not a registered user. And the end user tools to customize browser behavior (to suppress unwanted elements of a webpage) are mostly non-available on mobile platforms
Worse, as is the "fundamental law" of privacy & data collection, any data collected will be abused. (Classical example, when the truck toll system in Germany was introduced, it was only allowed by the data privacy commissioner because it's absolutely illegal to use the data for anything but tolling. Couple years later, new government, and immediately "let's use the toll data for law enforcement" is a nice idea in the back rooms.)
So Google might be collecting "anonymous" data about person X, not knowing who X is, but that does not mean that the identity of X cannot be revealed later on, or be known by a third party.
Worse, anonymizing data (removing the parts that identify the user and potentially replacing them by a random id) is way harder, e.g. an interested adversary can usually reconstruct the identities, sometimes even trivially.
I've said it once, and I'll say it again: We gave you a decentralized network capable of self-healing in the face of thermonuclear war -- Packets routed around cities moments after they've vanished. Then you took the Internet, and built centralized data silos with it like fools. There is no such thing as a client and server, there are only peers that wear those hats. From here you look silly with them glued firmly in place.
There's no reason not to have your own recommendation engine in your own home. There's no reason to send personal messages and pictures to a third party just so your friends and family can see them too. As I've said: You will decentralize services, or the web will die by the folly. It may yet be too late. It would be wise to plan on a re-beginning.
Repent. The end is incredibly fucking nigh!
till some hacker group uses NSA backdoors to cause mayhem in in US computers. Cookies are more or less harmless, as most of the privacy you lost with them is already lost by some other NSA program. But the NSA (and associated groups) backdoors are a bit more versatile, they are prepared to go into offensive mode, and probably a lot of US citizens have them installed (I don't think it is limited to just Tor, or social networks users).
And yes, they can cause mayhem in non-US computers, but how you know that it wasn't intended to happen by the NSA or some related company? The bombs are already in place.
This firefox plugin deletes the PREF cookie and all the others as soon as you close a tab. This means that it's created again every time with a different value.
I went to youtube and got this (I must split the values with spaces because /. complaints about long strings of letters)
google.com PREF ID=b59d89f696da3efa:FF=0: TM=1386759139:LM=1386759139:S=mRC2qiDMZ3ir_5JK
google.com NID 67=c1dV2B25sq3P2XdfPrBzGx9yb89H089A9yORn8UeoYGlGbjOUIbHPs03t_7JesDo_7NcnT UlDm90BZEpoSPX9A7FmbYORqBl5WwLmUiCzjreycq2wGE1rAMOSuXlFaZg
I closed the tab, waited for the cookie destruction message, went to google.com:
google.com PREF ID=024924c1c44d8beb:U=9b9ed7f900bfc1f0:FF=0: TM=1386758246:LM=1386759139:S=GCtQO6AoyqL-fqze
google.com NID 67=lPuV792TXm6MLVCnzVYUN-U2Q7B-XRd1d5xCYp7DXjvXvKzEjxtn99DTIbvaFFIg9a8uk2 AmkokD1TaYRnXL3iNA9SrPc1hj3611xY66gObS6pCY4jTTMeQpF6YHLJnn
Different. Well, mostly different. That LM=1386759139 in both PREF worries me. I should understand what it is for.
if you continue to use google for searches, discontinue this practice immediately and instead use duckduckgo.com
Keep a whitelist of cookies you're willing to accept, and accept them only for the session in which they are generated. this type of limitation can be controlled in Firefox's preferences under privacy. you should routinely delete the whitelist, as a periodic audit of what you need is more expensive than simply rewhitelisting your most visited sites and discarding the one-time stuff you no longer need.
at one time there was a slashdot article on 4 things you can do to increase your privacy as outlined by the EFF, however i cant find it and see no harm in reposting it.
1. use adblock plus
2. use noscript
3. use HTTPS everywhere
4. block any and all cookies, as mentioned above, with strict whitelisting for banks and reputable online merchants.
newer nerds to slashdot may reconsider the virtues of using mutt, cone, or alpine for email as they effectively render tracking pixels and malicious http content an exercise in futility on the part of the sender. RMS uses links/lynx for all of his web browsing, and while that may be a bit extreme for most of us, it certainly cant hurt to use it for opening email links should you be faced with the necessary evil of a questionable URL.
Good people go to bed earlier.
How about someone develop benign virus that spreads easily, then browses everywhere similar to a spider or crawler and resets it's own cookies (and/or built in creds for various data gathering sites), frequently. With a relatively low CPU and network footprint, a big enough botnet doing just this would make just about all data collection pointless, as the SNR would become problematic.
Silence is a state of mime.
The reality is that Government and Corporations are on the same side and none of them want to get rid of the tracking.
We do need to understand this --- tracking can NOT be totally eliminated.
Cookie tracking is but one of the various ways they use to track us. The report @ http://truththeory.com/2013/12/10/how-to-see-what-government-agency-is-spying-on-your-phone/ tells us about another way (they hack the prepaid phones and track the unique IPs).
No matter if you are an idiot or a tin-foil hatter, you gotta understand that there is only so much you can do.
The world we live in a FREE WORLD for the Big Brothers (commercial or otherwise) to do whatever they want with us.
Even if you only use cash / bitcoin to do purchases, they _still_ can find ways to "understand" you.
I may sound like a defeatist, I may sound as if I have given up. I am not.
I am a realist, though.
No matter what step (or steps) I take to minimize my exposure, they know who I am, where I am, with whom I am, my favorite watering hole, the usual kind of food I take, my regular schedule, and so on...
In one of my previous posts (some moons ago) I mentioned that we need to keep alert 24/7, and someone replied that if I keep on doing that I'm going to go bonker.
Perhaps I have already gone bonker, but then, that's what Big Brothers want anyway.
Muchas Gracias, Señor Edward Snowden !
No, the advertising industry wants to target ads to us to benefit themselves, and in the process they've made everything we do tracked, monitored, cataloged, and neatly bundled up for sale to someone else.
And since I am not willing to provide them with this, I feel no compunction about blocking cookies, beacons, analytics, and a host of other things.
For website owners who rely on this, too fucking bad. Because your precious content isn't worth trading my privacy for, and I do not give a damn. It's like going to an Italian Restaurant and being told that Vinnie here also needs to get a cut.
I don't believe Google is really interested in stopping collecting user information. They may want to limit what the government can access, and they want to give the appearance of fighting for the consumer. But the big companies like Google who have really made this widespread have a huge financial interest in continuing this practice.
Once you have things like Ghostery and the like installed, and realize just how much crap is on every web page, it's astounding. Hell, right now, on Slashdot I've blocked "Google Analytics", "Google AdWords Converter", a "Scorecard Research" beacon, and whatever the hell "Janrain" is, and something called rpxnow.com -- and Slashdot isn't the "worst" site I've seen. But absolutely none of those sites is entitled to (or is actually receiving) any of my information.
Fuck the lot of them. I've more or less determined the internet is a place where 80% of the big players can't be trusted, so as much as possible, I just deny them the information they want in the first place.
Because, let's face it, doubleclick.com and the like have been douchebags for better part of 15 years. Why would we assume that would ever change?
Lost at C:>. Found at C.
the problem HERE lies with the National Security Act which allows them to get this data from Google without having to jump through the hoops of having to provide due cause and a proper warrant. National Security Letters should be outlawed...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
And this article is amusing in light of the fact that Slashdot has been using Google Analytics and other tools that are feeding this data to Google.