Author: Silicon Valley Sleuthhound

Posted in Menacing Monopoly

Bloomberg shines a spotlight on Google’s anti-competitive business practices

Posted on by Silicon Valley Sleuthhound

Props to Bloomberg for running this article — it’s timely and needed.

Most major browsers are now built on the Chromium software code base that Google maintains. Opera, an indie browser that’s been used by techies for years, swapped its code base for Chromium in 2013. Even Microsoft is making the switch this year. That creates a snowball effect, where fewer web developers build for niche browsers, leading those browsers to switch over to Chromium to avoid getting left behind.

This leaves Chrome’s competitors relying on Google employees who do most of the work to keep Chromium software code up to date. Chromium is open source, so anyone can suggest changes to it, but the majority of programmers who approve contributions are Google employees, and any major disagreements get settled by a small circle of senior Google employees.

The authorities move slowly or not at all, so this problem will get worse before it gets better. Do your part to resist hegemony on the Web by using Firefox or a Firefox-derived browser instead of Google Chrome or a Chrome clone.

Posted in Menacing Monopoly

Google uses Gmail to track a history of things you buy — and it’s hard to delete

Posted on by Silicon Valley Sleuthhound

A must-read from CNBC:

Google tracks a lot of what you buy, even if you purchased it elsewhere, like in a store or from Amazon.

Last week, CEO Sundar Pichai wrote a New York Times op-edthat said “privacy cannot be a luxury good.” But behind the scenes, Google is still collecting a lot of personal information from the services you use, such as Gmail, and some of it can’t be easily deleted.

A page called “Purchases ” shows an accurate list of many — though not all — of the things I’ve bought dating back to at least 2012. I made these purchases using online services or apps such as Amazon, DoorDash or Seamless, or in stores such as Macy’s, but never directly through Google.

But because the digital receipts went to my Gmail account, Google has a list of info about my buying habits.

Read the whole thing.

Posted in Shoddy Security

Flaw discovered in Google’s Bluetooth Titan security key, prompting a recall

Posted on by Silicon Valley Sleuthhound

Embarrassing, but not surprising, considering Google’s shoddy record on security.

Google today disclosed a security bug in its Bluetooth Titan Security Key that could allow an attacker in close physical proximity to circumvent the security the key is supposed to provide. The company says the bug is due to a “misconfiguration in the Titan Security Keys’ Bluetooth pairing protocols” and that even the faulty keys still protect against phishing attacks. Still, the company is providing a free replacement key to all existing users.

Google’s recent introduction of Titan was its latest entry into a product category it has no need to be in. Google is increasingly selling hardware of various kinds, from phones (like the Pixel) to so-called “smart home” gadgets (its Nest line of products) and even Google Clip, an always-on camera.

YubiKey maker Yubico already makes high quality security keys with wireless functionality (NFC is used as opposed to Bluetooth because it’s more secure). There was no need for Titan, especially given that it’s an inferior product.

And yet, since Google bigwigs have this ridiculous desire to compete in pretty much every product category, they went ahead and made the Monster of Mountain View a competitor of Yubico. Perhaps now they’ll reconsider that decsion.

Posted in Shoddy Security

Google tries to strengthen security with over-the-air Android updates… but manufacturers can opt out

Posted on by Silicon Valley Sleuthhound

With its latest version of Android, Google is signaling it’s going to try to copy what Apple has done with respect to keeping control over mobile software updates pushed to end users. But its policy has a loophole big enough to throw a galaxy through.

Devices shipping with Android Q will receive over-the-air security patches without having to go through device manufacturers.

[…]

Devices updating to Android Q will not work with over-the-air security updates and some manufacturers can opt-out altogether, according to The Verge, which first reported the news, rendering the feature effectively useless. The new feature will also not be backported to earlier versions of Android.

According to distribution data, close to half of all Android users are still on Android 5.0 Lollipop and earlier, it could take years for Android Q to match the same usage share.

Nice try, Google, but you still haven’t solved your Android device fragmentation and abandonment problem.

Posted in War on Privacy

Tracking phones, Google is a dragnet for the police

Posted on by Silicon Valley Sleuthhound

A must-read from The New York Times:

When detectives in a Phoenix suburb arrested a warehouse worker in a murder investigation last December, they credited a new technique with breaking open the case after other leads went cold.

The police told the suspect, Jorge Molina, they had data tracking his phone to the site where a man was shot nine months earlier. They had made the discovery after obtaining a search warrant that required Google to provide information on all devices it recorded near the killing, potentially capturing the whereabouts of anyone in the area.

Because of Google’s ubiquitous, privacy-destroying data collection practices, it has become one stop shopping for law enforcement, just as foretold by Google’s critics.

The warrants, which draw on an enormous Google database employees call Sensorvault, turn the business of tracking cellphone users’ locations into a digital dragnet for law enforcement. In an era of ubiquitous data gathering by tech companies, it is just the latest example of how personal information — where you go, who your friends are, what you read, eat and watch, and when you do it — is being used for purposes many people never expected. As privacy concerns have mounted among consumers, policymakers and regulators, tech companies have come under intensifying scrutiny over their data collection practices.

Some people — some of us — foresaw that this would be a problem.

This site is now ten years old and has been calling attention to the awfulness of Google’s business practices for a decade. And it will continue to.

Props to The New York Times for publishing this story. It’s much needed.

Posted in Menacing Monopoly

MUST-READ: “I tried creating a web browser, and Google blocked me”

Posted on by Silicon Valley Sleuthhound

The Monster of Mountain View stomps on competition again.

For the last two years I’ve been working on a web browser that now cannot be completed because Google, the creators of the open source browser Chrome [actually, Chromium; Chrome isn’t open source], won’t allow DRM in an open source project.

The browser I’m building, called Metastream, is an Electron-based (Chromium derived), MIT-licensed browser hosted on GitHub. Its main feature is the ability to playback videos on the web, synchronized with other peers. Each client runs its own instance of the Metastream browser and transmits playback information to keep them in sync—no audio or video content is sent.

Without a license for Widevine, Samuel Maddock cannot finish his browser.

But of course, Google doesn’t care.

If someone is creating a browser that wants to playback media, they’ll soon discover the requirement of DRM for larger web media services such as Netflix and Hulu. There are a few DRM providers for the web including Widevine, PlayReady, and FairPlay.

As far as I’m aware, Widevine is the only available DRM for a Chromium-based browser, especially so for Electron. Chromium accounts for roughly 70% market share of all web browsers, soon to include Microsoft’s upcoming Edge browser rewrite. Waiting 4 months for a minimal response from a vendor with such a large percentage of the market is unacceptable.

When this site was created, Google Chrome didn’t exist.

Today, Google Chrome is the most dominant browser. It is the new Internet Explorer. And in fact, even the once mighty-Microsoft has acknowledged this, because it is redeveloping Edge to use Chrome’s underlying parts, including the Blink rendering engine. Other browser makers have already done this; Opera is also a Chromium-derivative. Only Mozilla has held out, although its version of Firefox for iOS uses WebKit, an an ancestor of Blink, because Apple won’t allow Mozilla to use its own rendering engine (Gecko).

When you’re practically a monopoly, you can pretty much do whatever you want (including brutally stifling the competition) and there are no consequences.

Google is too big and too powerful. It’s a giant, faceless corporation that needs to be broken up.

Posted in Shoddy Security

Android ecosystem of pre-installed apps is a privacy and security mess

Posted on by Silicon Valley Sleuthhound

We’re shocked, shocked, shocked to… oh wait, actually, no, we’re not shocked at all by this:

An academic study that analyzed 82,501 apps that were pre-installed on 1,742 Android smartphones sold by 214 vendors concluded that users are woefully unaware of the huge security and privacy-related threats that come from pre-installed applications.

Researchers found that many of these pre-installed apps have access to very intrusive permissions out of the box, collect and send data about users to advertisers, and have security flaws that often remain unpatched.

On top of this, many pre-installed apps (also referred to as bloatware) can’t be removed, and also use third-party libraries that secretly collect user data from within benign-looking and innocently-named applications.

The study is, by far, one of the most complex endeavors of its kind, and included both an analysis of device firmware, app behavior, and the internet traffic the apps generated.

Android has been repeatedly shown to be a security nightmare. What’s particularly ironic and absurd is that many Android device manufacturers lock the bootloader to prevent rooting, which stops savvy users from getting rid of the bloatware and keeping their devices current.

And thanks to the demise of Windows Phone and BB10 (the latter of which heavily emphasized security), the only practical alternative is iOS. While iOS is superior to Android, it’s a shame that there’s no other game in town anymore. We appear to be stuck with a duopoly for the foreseeable future.

Posted in Undependable Support

“Killed by Google” gets some love from the tech press

Posted on by Silicon Valley Sleuthhound

BGR is the latest to profile a site that serves as a reference for what Google has killed off over the years.

We’re still a few months away from the halfway mark of 2019, and already Google has sent some pretty high-profile products to an early grave — products that the company had high initial hopes for, like its Inbox email service and its failed Facebook killer Google+. But this, as we all know, is really par for the course when it comes to the search giant, which has tried so many experiments over the years with products, apps and services that didn’t quite work out as planned that it’s ended up building quite a crowded graveyard of failed ambitions.

“Killed by Google is a Free and Open Source list of dead Google products, services, and devices. It serves to be a tribute and memorial of beloved products and services killed by Google,” says its creator Cody Ogden. It is without question an extremely useful reference and we’ve added it to our blogroll, or link list, or whatever you want to call it.

Posted in Undependable Support

Analyst: Google Investors Are Expecting Too Much From Stadia

Posted on by Silicon Valley Sleuthhound

Slow down there, Monster of Mountain view backers. That’s the message from this SeekingAlpha contributor, who has a skeptical take on Google’s new foray into gaming:

It’s a near certainty that Stadia won’t win 100% of this game streaming business. Even if Stadia miraculously took 50% of this $28 billion opportunity, that means about $14 billion in additional sales for Alphabet.

Using analysts’ revenue estimates for 2020 as a starting point, and assuming a similar growth rate in 2021, suggest Alphabet revenue of about $225 billion by 2021. If Stadia generates $14 billion in sales at this point, that represents another 6% of additional year-over-year growth. There is little doubt there is a big opportunity in streaming gaming, but investors need to ignore the hyperbole in the headlines and temper their expectations.

Those are a lot of assumptions.

If people refuse to hand over money to Google for Stadia, Google will have to pull the plug on it before long because that is how the Monster of Mountain View rolls. That would be a fitting outcome.

Posted in Menacing Monopoly

Google yanks KDE Connect from Google Play for no good reason

Posted on by Silicon Valley Sleuthhound

Ridiculous:

The official KDE Connect Android app was briefly removed from the Google Play Store for “violating” app permission policies.

Google yanked the phone-side companion app, which works with desktop tools like GSconnect, from its Android app store on March 19. It said the app did not adhere to its new rules on apps that can access to SMS messages.

But that was nonsense. KDE developer Albert Vaca Cintora explains:

KDE Connect has been removed from Google Play for violating their new policy on apps that access SMS. The policy has an explicit exception for companion apps (like KDE Connect), but it was removed anyway and *there’s no way to talk to Google*.

Google only provides one-way forms to contact them. I’ve filled the forms regarding this policy change (including one they sent to existing apps before the policy was effective) but never got an explanation to why KDE Connect doesn’t qualify as a companion app.

Google is the best living personification of the faceless corporation that we know of.

Albert stripped the SMS integration out of KDE Connect to get it back on Google Play. After an outcry from free software enthusiasts, Google quietly reversed course and allowed KDE Connect back on Google Play, replete with SMS integration.