Author: Silicon Valley Sleuthhound

Posted in War on Privacy

The Monster strikes again: Google to give marketers the ability to target people via email address

Posted on by Silicon Valley Sleuthhound

The latest salvo in Google’s never-ending war on privacy has just been fired. Via Naked Security:

Let’s say you’ve joined a travel company’s rewards program. In doing so, you handed over your email address.

As you plan your next trip, maybe you’ll do a Google search on “non-stop flights to new york,” much to the delight of the advertising-engorged company.

If you’re logged in to any Google account, you may very well see ads from that same travel company, whether you’re watching your favorite videos on YouTube, running a Google search or catching up on your Gmail inbox.

Google’s Senior Vice President of Ads and Commerce, Sridhar Ramaswamy, announced a new tool that will enable that advert penetration – Customer Match – in a post on Sunday.

Customer Match will enable advertisers to get to us via our email addresses, which can be matched to signed-in users of its search engine, Gmail or YouTube in what the company says is a “secure and privacy-safe way.”

There’s no such thing as secure, privacy-safe targeted marketing, just as there’s no such thing as clean coal. They’re oxymorons. Targeted marketing is, by its very nature, intrusive. It has to be.

Facebook and Twitter already sell targeted ads. Google has long wanted to be in that game, but has held off. Until now, that is. Now, they’re going to allow advertisers to upload lists of email addresses and sell those advertisers targeted access to users of their YouTube and Gmail properties, as The Wall Street Journal reported months ago.

In its early years, Google was described as a search engine, and Google is still synomous with search today. But while Google may have been search-focused as a startup, it is today a mature advertising company with some curious sibling businesses. Undercutting privacy is part of Google’s business model. Google’s so-called free offerings aren’t really free at all. The price people to pay to use Gmail, YouTube, and other Google products is the surrender of their privacy.

Posted in Shoddy Security

Google partner Samsung’s “smart” refrigerator turns out to be a hackable refrigerator, too

Posted on by Silicon Valley Sleuthhound

Whoops:

A team of hackers recently discovered a man-in-the-middle vulnerability in a Samsung smart refrigerator that can be exploited to steal Gmail users’ login credentials, The Register reported this week.

Hackers from security company Pen Test Partners discovered the flaw while participating in an Internet of Things (IoT) hacking challenge at the Def Con security conference earlier this month. The smart refrigerator, Samsung model RF28HMELBSR, is designed to integrate the user’s Gmail Calendar with its display. Samsung implemented SSL to secure the Gmail integration, but the hackers found that the device does not validate SSL certificates, opening the opportunity for hackers to access the network and monitor activity for the user name and password used to link the refrigerator to Gmail.

This story neatly demonstrates the folly of adding Internet connectivity to refrigerators, washing machines, toasters, coffeemakers, and other home appliances. Not everything that draws electric current in a home needs to be able to browse the Web and talk to Google’s data centers. But companies like Samsung are so obsessed with catching the next trend in consumer electronics (the next trend being the so-called Internet of Things) that they are adding extra, unnecessary, gee-whiz features to the appliances they’re making.

Our advice: Steer clear of tricked-out, IoT branded home appliances. You’ll save on energy costs, and you won’t end up with a home full of hackable devices in every room.

Posted in Menacing Monopoly, War on Privacy

Big Brother Google gets into the business of making and selling routers

Posted on by Silicon Valley Sleuthhound

When it comes to hardware and software, there’s pretty much no device category or software segment the Monster of Mountain View doesn’t want to play in:

Google is making a Wi-Fi router as part of its ambition to provide better Internet connections that make it easier for people to access its digital services and see more of its online advertising.

Pre-orders for the $199 wireless router, called OnHub, can be made beginning Tuesday at Google’s online store, Amazon.com and Walmart.com. The device will go on sale in stores in the U.S. and Canada in late August or early September.

Google is touting the cylinder-shaped OnHub as a leap ahead in a neglected part of technology.

The Mountain View, California, company is promising its wireless router will be sleeker, more reliable, more secure and easier to use than other long-established alternatives made by the Arris Group, Netgear, Apple and other hardware specialists. Google teamed up with networking device maker TP-Link to build OnHub.

This is supposed to be an Associated Press news article? It reads more like a press release!

This being a Google product, it comes with spyware built right in.

Google is pledging not to monitor any of the information transmitted over OnHub except for visits to its search engine or other services, such as YouTube or Gmail, with the user’s online privacy controls set to permit the data collection.

That’s a worthless pledge. Google predictably exempts itself from its own privacy promise, then says, don’t worry, we won’t spy on you when you visit non-Google websites.

We here at LGB prefer not to be spied on by Google at all, and that’s why we don’t use any Google hardware or any of Google’s online offerings.

Good software already exists for upgrading routers, like DD-WRT, for those unsatisfied by what’s provided by the manufacturers of their networking hardware. Most Internet users get their router from their Internet service provider and won’t have any desire to pay Google for the privilege of having a new router that phones home to Mountain View. Tech-savvy users are the only conceivable market for OnHub, and they already have better options right now.

POSTSCRIPT: Ars Technica has a brutal review of the OnHub, which it calls a “mystery box”.

Posted in Poor Quality Assurance

Proprietor of leading technology news site: “I No Longer Have Any Trust In The Nest Protect”

Posted on by Silicon Valley Sleuthhound

Michael Larabel, who runs the well-known free software news and reviews hub Phoronix, has a post up about an awful experience he recently had with Google-owned Nest’s Protect, a souped-up, Internet-connected smoke detector. Larabel writes:

Earlier this year I wrote about protecting our Linux test farm with the Nest Protect. While I own ten of these “high tech smoke detectors” and initially recommended, I no longer trust them after a long night.

In the middle of the night I was alerted to “smoke in the bedroom” by all ten Nest Protects going off with the alert and siren, plus alerts going into mine and Fataima’s phone. Quickly investigating, there was no smoke to be found in the bedroom or any other room… Nor anything resembling smoke or any other causes for concern. The fire alarms tied to the security system also hadn’t sensed any smoke.

The unit continued to malfunction:

At first pushing the Nest button I thought the silencing worked, but nope, it came back to broadcasting across all of the Nest devices that there was smoke — when there was not. I disconnected that particular Nest Protect from the AC power, took it to another room, still reported smoke. Putting the Nest Protect in a kitchen pot with lid still claimed of smoke and produced warnings… This particular Nest unit was bought just earlier this year and was going insane in the middle of the night.

In the end, Larabel says he had to resort to a sledgehammer (literally) to shut the Nest Protect up. He still doesn’t know what caused the Google-made device to go crazy, and is going to let Nest know what happened.  He would be wise to stay away from Nest gizmos in the future.

Larabel is not the only person to have encountered this problem. There is a video on Google-owned YouTube, posted by a Google employee, documenting a malfunctioning Nest Protect. Video creator Brad Fitzpatrick says, “Do not buy a Nest Protect. You will regret it. You can stop or mute this video if it’s annoying, but you cannot stop a Nest.”

Posted in Shoddy Security

Security researcher exposes Google’s double standard on responsible disclosure of exploits

Posted on by Silicon Valley Sleuthhound

Via Ars Technica:

Vulnerabilities in the Google App Engine cloud platform make it possible for attackers to break out of a first-level security sandbox and execute malicious code in restricted areas of Google servers, a security researcher said Friday.

Adam Gowdiak, CEO of Poland-based Security Explorations, said there are seven separate vulnerabilities in the Google service, most of which he privately reported to Google three weeks ago. So far, he said, the flaws have gone unfixed, and he has yet to receive confirmation from Google officials. To exploit the flaws, attackers could use the freely available cloud platform to run a malicious Java application. That malicious Java app would then break out of the first sandboxing layer and execute code in the highly restricted native environment.

What’s interesting about this is that Google has previously disclosed flaws in Apple and Microsoft software before patches could be released, which made folks in Cupertino and Redmond very angry. Now Google’s getting a taste of its own medicine, except in this case, the researcher who delivered Google’s comeuppance waited a generous period of time without even getting so much as an acknowledgement from the Monster of Mountain View.

Posted in Menacing Monopoly, War on Privacy

Google becomes a wireless carrier – or more specifically, a mobile virtual network operator (MVNO)

Posted on by Silicon Valley Sleuthhound

The Monster of Mountain View has entered another market. Now it wants to be your wireless carrier:

Google has just launched the site for “Project Fi,” its heavily rumored MVNO service. The service combines Sprint and T-Mobile along with Wi-Fi and will seamlessly switch between the networks. Google has an interactive coverage map here.

The up-front pricing seems pretty standard. It requires a “Fi Basics” plan, which is $20 a month for unlimited talk and texting, plus taxes. Data is an additional $10 per gigabyte a month. So a $20 basics plan plus 3GB a month would be $50, $5 more than Straight Talk charges for the same thing—but that’s only if you actually use the data. The unique aspect of the billing is that you “never pay for unused data.” Your account gets credited, in money, for data you don’t use. The example shows an unused 0.6GB of data gets you $6 back, so credits aren’t limited to 1GB increments; overages work the same way, with no extra fees. Google also allows Wi-Fi tethering.

For the time being, the “service” is only available to people who buy a Nexus 6 device through Google. And it’s worth noting that Google did not build its own network infrastructure to become a wireless carrier – it’s piggybacking on T-Mobile and Sprint,  the two smaller national carriers, with both companies receiving financial compensation in return. But, as with past Google experiments, it’s the beginning of something Google wants to make bigger.

It’s not enough for Google to be dominant in search and mobile advertising. It wants to dominate in every area that it can. Google wants to be the provider of your browser, desktop operating system, mobile operating system, Internet service, DNS service, email, and everything else.

Jackdaw’s founder has some observations on what Google may trying to accomplish in the near term with Project Fi.

Posted in Menacing Monopoly

Europe preparing to go after Google

Posted on by Silicon Valley Sleuthhound

Finally!

The European Commission is said to be planning to charge Google with using its dominant position in online search to favor the company’s own online services over others, in what would be one of the biggest antitrust cases here since antitrust regulators went after Microsoft.

Europe’s competition chief, Margrethe Vestager, is expected to make an announcement that Google has abused its dominant position on Wednesday in Brussels, according to two people who spoke on Tuesday on the condition of anonymity.

The U.S. government didn’t have the cajones to effectively stand up to Google, but it looks like Europe is ready to confront the Monster of Mountain View with antitrust charges. This is very good news, if true.

Posted in Menacing Monopoly

FTC staff wanted to go after Google, accidentally disclosed documents show

Posted on by Silicon Valley Sleuthhound

The Federal Trade Commission should have listened to its staff:

The Federal Trade Commission on Thursday faced renewed questions about its handling of its antitrust investigation into Google, after documents revealed that an internal report had recommended stronger action.

The 2012 report, from the agency’s bureau of competition, said that the agency should sue the Internet search company for anticompetitive practices, according to several people who saw the report but would speak about it only under the condition of anonymity. At least one other staff report, they said, recommended not to pursue a lawsuit. In early 2013, the agency unanimously voted not to bring charges after an investigation.

Google’s critics and competitors on Thursday jumped on the news, first reported by The Wall Street Journal, arguing that the F.T.C. had failed to take appropriate action. They called on Europe, which is now looking into the company’s practices, to pursue tough regulations.

European regulators must not fail to make the same mistakes that the Federal Trade Commission did. They must aggressively discipline Google for any violations of privacy and antitrust laws that they find through a comprehensive, meaningful investigation.

Posted in Undependable Support

Google shutting down Google Code

Posted on by Silicon Valley Sleuthhound

Woe to those who chose Google Code as the host of their open source projects. From the Monster’s mouth:

When we started the Google Code project hosting service in 2006, the world of project hosting was limited. We were worried about reliability and stagnation, so we took action by giving the open source community another option to choose from. Since then, we’ve seen a wide variety of better project hosting services such as GitHub and Bitbucket bloom. Many projects moved away from Google Code to those other systems. To meet developers where they are, we ourselves migrated nearly a thousand of our own open source projects from Google Code to GitHub.

As developers migrated away from Google Code, a growing share of the remaining projects were spam or abuse. Lately, the administrative load has consisted almost exclusively of abuse management. After profiling non-abusive activity on Google Code, it has become clear to us that the service simply isn’t needed anymore.

Beginning today, we have disabled new project creation on Google Code. We will be shutting down the service about 10 months from now on January 25th, 2016. Below, we provide links to migration tools designed to help you move your projects off of Google Code. We will also make ourselves available over the next three months to those projects that need help migrating from Google Code to other hosts.

TechCrunch’s Natasha Lomas notes:

In comments on Google’s blog post, some Google Code users express disappointment the company is not intending to continue hosting those projects that aren’t migrated — maybe because their maintainer has gone AWOL or passed away — in a read-only format, given that they will otherwise be entirely lost come final shutdown.

“Wouldn’t it be more responsible for Google to just host the projects that don’t move over indefinitely in a read only mode? I can’t imagine that it’s resource intensive and it’d instill more faith in Google products. It’s like watching GeoCities go away,” writes one.

“A complete copy of all projects should be handed over to archive.org so that we don’t lose history and important projects that are no longer maintained,” adds another.

Google’s plans in regard to Google Code demonstrate that Google doesn’t archive for the sake of history, it archives for profit. That’s why it will spend large sums of money maintaining vast quantities of user data in its data centers, but won’t keep open to the public read-only archives of a nearly ten year old project hosting service it has decided it’s no longer interested in.

Posted in Menacing Monopoly

Google buys Softcard; shutdown immiment

Posted on by Silicon Valley Sleuthhound

The Monster of Mountain View just had another meal:

Google has inked a distribution deal with the biggest wireless carriers in the U.S. to get the Google Wallet payments app pre-installed on their phones. At the same time, Google is buying technology from Softcard, the mobile payments app backed by the same carriers.

The deal will see Verizon Wireless, T-Mobile and AT&T pre-install Google Wallet on their Android phones in the U.S. later this year. Google Wallet allows shoppers to tap their phones to pay at checkout in some brick-and-mortar stores in much the same way Apple Pay does. The move also involves Google buying some intellectual property from Softcard, formerly known as ISIS. It doesn’t appear that any Softcard employees are joining Google as part of the deal.

In a blog post, Softcard said its users can use their mobile payments app for now. But I can’t imagine the wireless carriers behind the Softcard joint venture would agree to this deal if they planned to continue to invest in their own app. Sounds like game over for Softcard, a very expensive multi-year initiative that was essentially a flop for the wireless companies involved.

Softcard never really had a future, considering Apple has planned on entering the mobile payment space for sometime. iOS is Apple’s platform, and Apple wants to both control it and monetize it. It wasn’t about to let America’s three largest mobile carriers develop the mobile wallet that would be prevalent among iOS users.

Google feels the same way about controlling Android, of course. The carriers have evidently decided that since Apple doesn’t need or want their technology, they’ll at least recoup some money by selling it to Google. Google will probably shut it down within a few weeks, and that will be the end of Softcard.

POSTSCRIPT: Softcard will be dead by the end of March:

Softcard is dead

 

Goodbye, Softcard.