Posted in Shoddy Security, War on Privacy

How fitting: The NSA has been *pretending to be Google* in order to covertly capture user data

There’s no low the NSA won’t stoop to in order to snoop:

[I]n some cases GCHQ and the NSA appear to have taken a more aggressive and controversial route—on at least one occasion bypassing the need to approach Google directly by performing a man-in-the-middle attack to impersonate Google security certificates. One document published by Fantastico, apparently taken from an NSA presentation that also contains some GCHQ slides, describes “how the attack was done” to apparently snoop on SSL traffic. The document illustrates with a diagram how one of the agencies appears to have hacked into a target’s Internet router and covertly redirected targeted Google traffic using a fake security certificate so it could intercept the information in unencrypted format.

Documents from GCHQ’s “network exploitation” unit show that it operates a program called “FLYING PIG” that was started up in response to an increasing use of SSL encryption by email providers like Yahoo, Google, and Hotmail. The FLYING PIG system appears to allow it to identify information related to use of the anonymity browser Tor (it has the option to query “Tor events”) and also allows spies to collect information about specific SSL encryption certificates.

GCHQ, for those who don’t know, is the British equivalent of the NSA.

So much for Google’s security measures. Forced SSL may deter petty man-in-the-middle attacks from amateur hackers, but it doesn’t shield anyone from the likes of the NSA.

This isn’t to say that SSL is useless and shouldn’t be used. HTTPS is better than HTTP. But if Google was serious about security and protecting its users, it would make Gmail like Hushmail, offering the ability to encrypt entire user accounts and encrypt messages. There are enough Gmail users that offering encryption by default would have an immediate and huge effect on email security.

But, of course, if Google were to offer such encryption, it would no longer be able to read its users’ emails and place targeted ads within Gmail. Messages would be scrambled and unreadable by Google’s algorithms. So Google is never going to do what Hushmail does. It would interfere with their ability to offer “free” Gmail.

Posted in War on Privacy

Google tells court that Gmail users have no legitimate expectation of privacy

At last, the truth is starting to seep out of Mountain View:

In a stunning admission contained in a brief filed recently in federal court, lawyers for Google said people should not expect privacy when they send messages to a Gmail account. Consumer Watchdog said today that people who care about their email correspondents’ privacy should not use the Internet giant’s service.

Google’s brief said: “Just as a sender of a letter to a business colleague cannot be surprised that the recipient’s assistant opens the letter, people who use web-based email today cannot be surprised if their emails are processed by the recipient’s [email provider] in the course of delivery. Indeed, ‘a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.’”  (Motion to dismiss, Page 19)

Consumer Watchdog has posted the motion to dismiss in its entirety here.

The admission is stunning in the sense that it contradicts the facade on privacy Google has long tried to publicly maintain. Worker bees at Google have tried to paper over statements by the likes of Eric Schmidt about the company policy being to get “right up to the creepy line” but not cross it. Google claims users are always free to leave, and it has a project called the Data Liberation Front, which is intended to facilitate allowing Google users to take their data somewhere else if they choose.

In response to Consumer Watchdog’s unveiling of the court filing, Google said:

We take our users’ privacy and security very seriously; recent reports claiming otherwise are simply untrue. We have built industry-leading security and privacy features into Gmail — and no matter who sends an email to a Gmail user, those protections apply.

Sure. And we here at LGB always take Google at their word!

Seriously, though, if that’s the case, what’s with the court filing then? As John Simpson says:

“If they take privacy seriously, then they must amend their brief and stop reading and analyzing the content of email we send to their system,” said Simpson.  “If Google stands by the claim of no expectation of privacy it asserted in the court filing, they cannot claim to respect users’ privacy. These two claims are obviously incompatible.”

Or are they? Google is such a behemoth now that perhaps the legal department isn’t always acting in concert with the public relations and marketing division. It certainly appears that the position Google has taken in court was not one that the marketing division is comfortable representing to the public. And no wonder: it undermines all the false and misleading claims Google has made over the years about user privacy in its offerings, Gmail included.

Posted in War on Privacy

Google touts tighter integration between Gmail, Search, Drive, and other offerings

Everything shall be indexed! Quoting from an announcement made today by Google:

Ever had trouble checking your flight’s status on the go because it meant digging through your email for the flight number? Or wanted to just quickly see whether your package would arrive on time, without having to look up the tracking info first? You’ve told us it would be much easier if you could skip the fuss and just ask Google.

Soon you’ll be able to find this info instantly in Google Search if it’s in your Gmail, Google Calendar or Google+. For example, just ask or type, “What’s my flight status?” or “When will my package arrive”?

Over the next several days, we’ll be rolling this out to all U.S., English-speaking users on desktop, tablet and smartphone, with voice search (so you don’t have to type).

The announcement should have – but did not – go on to say: And we won’t ask your permission, either. We’re just going to do it, because that’s how we roll here at Google. Your privacy is not important to us. Your data is. At Google, we view *you* and your personal information as our most important asset, and we are constantly working to monetize *you* so we can bolster our bottom line. Ain’t data mining grand? Think about all the money we can make with your cooperation!

We foresaw this kind of integration by default across Google’s offerings years ago. Google claims, of course, that this is a “pro-user” change. But they’re really just offering up excuses for imposing new defaults on everyone. If you don’t like personalized search, you have to opt out or sign out, because if you do nothing and you have a Google account, the Big G will mine your data to its heart’s content.

 

Posted in Menacing Monopoly

FTC reviewing Google’s anticompetitive purchase of Waze

Good news:

Google’s $1.1 billion acquisition of social mapping startup Waze has drawn the attention of the Federal Trade Commission after all. The Wall Street Journal reports today that Google has been contacted by FTC lawyers intending to conduct an antitrust review of the acquisition. Google declined to comment but did confirm to the WSJ that it has been contacted by the FTC over the deal.

The Monster of Mountain View should not be allowed to acquire Waze. There isn’t enough competition in the mapping space. The only significant other players today are Google, Microsoft + Nokia’s NavTeq, and TomTom/TeleAtlas (which powers BlackBerry Maps and Apple Maps). Aside from those and OpenStreetMap, that’s it.

If Google buys Waze, there is one fewer competitor in the market, which is a real problem. Google’s intention is to own the space, and they can’t be allowed to do that. That’s why it’s a good thing the FTC has launched a review of this unacceptable proposed acquisition.

Posted in Menacing Monopoly

Google: Give us all your photos… we’ll use our invasive facial recognition tech to pick the best ones!

As we have long predicted, Google is starting to roll out facial recognition technology.

They obviously don’t want to hype its deployment. Instead, they’re tucking it into something larger, apparently in the hopes it won’t draw much of an outcry.

The “something larger” is a new suite of photo management tools for Google Plus, the Monster of Mountain View’s social network, which promise to automate the process of choosing selects. (Selects are photography-speak for “pictures I want to keep and share”).

The automatic photo selection is done by calling upon Google’s knowledge of the elements that make up a visually pleasing picture, coupled with facial recognition technology and a vast database that helps tie together the relationships of people appearing in a photo. Google says its computers will recognize the best photos featuring family members or close friends of a person who uploads a bunch of pictures to Plus.

“You have amazing images of the most precious image of your life,” Gundotra told a software developers conference Wednesday as he discussed the additions to Google Plus. “But if we are honest with each other photos are very labor intensive.”

If the photos don’t look quite right, Google is promising to enhance them, taking over a job that typically requires people to buy and master special photo editing software such as Adobe System Inc.’s Photoshop, Apple’s iPhoto or Google’s Picasa. Computer-controlled editing tools will automatically remove red eyes, soften skin tones, sharpen colors and adjust contrast.

In an effort to get more photos onto the Plus network, Google is offering to back up all pictures taken on a mobile device, as soon as they’re snapped. To accommodate the increased volume, Google Plus will now provide each accountholder with up to 15 gigabytes of storage for full-resolution photos.

What’s wrong with photos being labor intensive? Isn’t part of the joy of photography going through photos? It seems like Google wants to automate and algorimithize everything it possibly can. The allure is that the computers will do the work. But when the computers do the work, the computers also make the decisions.

This is yet another Google technology that we just don’t need. There is already great free and proprietary software available for managing, organizing, and displaying photos. Google would like to be everyone’s repository for photo storage so it can know more about us.

That’s why Google’s offerings are free. When you use a Google offering, you are the product. Same goes for Facebook. That’s something you should think long and hard about when signing up for any social network. Google and its offerings, meanwhile, are best avoided… period.

Posted in Undependable Support

Must-read piece on Google’s undependable support

James Fallows:

Here’s the problem: Google now has a clear enough track record of trying out, and then canceling, “interesting” new software that I have no idea how long Keep will be around. When Google launched its Google Health service five years ago, it had an allure like Keep’s: here was the one place you could store your prescription info, test results, immunization records, and so on and know that you could get at them as time went on. That’s how I used it — until Google cancelled this “experiment” last year. Same with Google Reader, and all the other products in the Google Graveyard that Slate produced last week.

Fallows naively says he still “trusts” Google for search, because search and advertising is Google’s bread and butter. He would be wise to switch to other search engines.

Blekko is a good spam-free alternative, Twitter and Topsy are good real-time alternatives, and Bing is an acceptable all-around alternative. DuckDuckGo is good too – it makes use of Google, Bing, and Blekko results while protecting the privacy of searchers.

Posted in Menacing Monopoly, War on Privacy

Google reportedly working on launching music streaming offering

Google is reportedly developing an offering to compete with the likes of Spotify and Rhapsody, because its cyber empire simply isn’t big enough:

Dear Spotify, Rhapsody and any other music-streaming service out there: Here comes Google.

The Wall Street Journal and now Bloomberg are reporting that Google is planning to launch a worldwide music streaming service in Q3 of this year. Google is reportedly talking to music companies about licenses for the service, which mimics that of Spotify.

Record labels currently have a strained relationship with Google because they believe Google acts as a gateway for sites where people can connect to swap tunes without paying royalties to the labels. It will be interesting to see if Google can come to terms with the industry’s few remaining major players. At this point, except for the independent labels, the music industry is a triopoly – it’s just Universal, Warner, and Sony. (EMI was subsumed by Universal and Sony).

Executives at Google seemingly feel the need to compete in every product category with every other major technology company, and they have tried to grow the Google empire through acquisitions in addition to product launches. In recent years, Google has attempted to buy many of the emerging players in Silicon Valley, including Twitter, Facebook, Yelp, and the now-struggling Groupon. All of those companies walked away from Google’s offers and overtures, forcing the Monster of Mountain View to launch its own offerings (including Google+, Google Offers, and Google Places).

A music streaming offering is just another way for Google to increase its treasure trove of user data. Google wants people to keep people on its properties, and its executives think it can best do that by having an offering for everything.

Posted in Poor Quality Assurance, Undependable Support

Google suffers another major outage

Gmail and and many other Google offerings are down, and that’s got people upset:

Google’s Gmail experienced an outage this morning, with some users reporting that the problem extended to the search giant’s Chrome browser as well.

“We’re investigating reports of an issue with Google Mail. We will provide more information shortly,” Google wrote in a 12:30 p.m. Eastern note on its Google Apps status dashboard.

Google categorized the problem as a “service disruption” rather than a “service outage.”

Gmail started experiencing problems around noon Eastern. At PCMag, Gmail failed to load, and then produced a 502 error page. “The server encountered a temporary error and could not complete your request,” the error noted. “Please try again in 30 seconds. That’s all we know.”

This is a disruption *and* an outage. Google can try to sugercoat the downtime all it wants; it’s still downtime.

People who don’t know better and use Google’s Chrome browser have also reported a spike in browser crashes this morning. That actually doesn’t seem strange, because Chrome is tied to Google’s centralized offerings. If Google servers go down and can’t synchronize or communicate with the Chrome client (Chrome could be more accurately called a client than a browser, considering how Google’s aim has been to turn it into a gateway to its offerings) that could cause Chrome to malfunction or quit working.

This outage is a good reminder that there are better alternatives out there. Cut ties with the Monster of Mountain View and switch away if you care about your privacy and the security of your data.

Posted in Menacing Monopoly, War on Privacy

Brazilian newspapers pull out of Google News

All of the major newspapers in Brazil have just quit Google News en masse:

Brazil’s National Association of Newspapers says all 154 members had followed its recommendation to ban the search engine aggregator from using their content.

The papers say Google News refused to pay for content and was driving traffic away from their websites.

Google said previously that the service boosted traffic to news websites.

“Staying with Google News was not helping us grow our digital audiences, on the contrary,” said the association’s president, Carlos Fernando Lindenberg Neto.

“By providing the first few lines of our stories to Internet users, the service reduces the chances that they will look at the entire story in our websites,” he said, in an interview with the Knight Center for Journalism in the Americas.

Though we’re not fans of Google, we fail to see exactly what these newspapers are trying to accomplish by pulling out of Google News. Google News is really just a twist on regular old Google search itself. The difference is that Google News draws its results from media sources instead of the larger Web. Essentially, it’s a filter that can be used to find recent content written by journalists and commentators.

Google News may not have been doing much for Brazil’s newspapers, but it’s very unlikely it was hurting them. The purpose of search engines is to help people find content on the Internet. While it’s true that Google has or is developing offerings intended to monopolize users’ time and attention (such as YouTube), Google News is more like regular old Google than YouTube. If Neto’s group believes that search engines reduce the likelihood that people will read newspapers online, they should be pulling out of Google altogether, not just Google News. But they haven’t, because they don’t want to lose the traffic.

Rather than delisting themselves from Google News, what the newspapers should do is end any participation in Google’s AdSense network. The papers should take charge of their own advertising so Google doesn’t get a cut of that revenue. That would be a sensible thing to do.

We allow Google to index this site because we want people who happen to be using Google to be exposed to criticism of the company. Google’s search engine has problems, but that’s small potatoes compared to the consequences of using offerings like Android, Gmail, Docs, and Drive. Those “services” collect and store a great deal of personal and sensitive information. Google’s search engine does log queries, but it is possible to use Google anonymously through tools like Google Sharing (which we recommend for people who can’t bring themselves to use an alternative like Blekko as their primary search engine).

Posted in War on Privacy

Google reportedly on the verge of making deal for facial recognition software

Google executives have publicly admitted on a couple of occasions that they have held back from introducing facial recognition technology into the Monster of Mountain View’s products, presumably because doing so would be an embarrassingly obvious jump over “creepy line” former CEO Eric Schmidt says the company avoids trying to cross (in order to prevent there from being a big public and regulatory backlash against Google). But that hardly means the company isn’t working on developing extremely invasive technologies behind the scenes, as this update from CNET shows:

Google is close to completing its deal to buy Viewdle, a Ukrainian maker of facial recognition technology that automatically tags photos, according to a person familiar with the deal.

The acquisition, which has been in the works for more than a year, is expected to close this week, the person said.

Representatives from Google and Viewdle declined to comment.

The move makes sense for Google because Viewdle’s technology provides a way for users of Google+, Android, Picasa, and other services on a range of devices to easily (even, automatically) tag photos of friends. Viewdle’s SocialCamera app automatically tags Facebook friends and the company has released an Android game called Third Eye.

Facebook also has made a play in this space, earlier this year buying Face.com along with its Photo Tagger auto-tagging app.

The reason Google and Facebook are so interested in facial recognition technology is that they want to be able to add faces to their rapidly growing databases, which contain profiles of millions of people. The companies already have access to a treasure trove of sensitive information, including names, phone numbers, addresses, credit cards, interests, relationships, and so forth. But they want more. The ability to associate photos of people with their profiles could be very lucrative.