News

Posted in War on Privacy

Stay away from Google and Google+ if you value your privacy

A Network World editor who normally writes about Microsoft has chronicled several alarming tales which describe how the Monster of Mountain View is taking its data-mining to the next level. Here’s story one:

For a few months, whenever this editor used Google search, Google would show him relevant tweets from people he was following on his Twitter account within search results. But, he never actually gave Google his Twitter handle. In fact, it would always ask him to verify his Twitter name even as it served up the Tweets. Google was guessing about his Twitter identity, probably using the fact that the editor gave Twitter his Gmail account. Google saw messages from that Twitter account coming into his Gmail, correlated the two and started serving up unasked for Tweets. Yes, Google is correlating your Google profile with data from public social networks. You must opt out if you want it to cut it out.

Story two:

As for my story, a couple of weeks ago I fired up my Gmail and noticed my name with a little “plus” sign at the top. It turns out it was a Google+ account and Google had filled what it could of my public profile with the data I had shared when I tried out Buzz. This was not my full real name but the name I had been using with all my Google accounts. No one I knew was on Plus yet, so a few days later, I returned, found a few co-workers and tried to post a “hello world” status update. I got an error message. The message didn’t tell me I was banned … it simply said that it couldn’t post my status at this time and I should try again later. Which I did, several times … to the same effect.

After trying everything I could think of, I thought Plus was either ridiculously hard to use or just plain broken (when in truth, the answer was neither, as my account had been suspended).

A few days later, when it still wasn’t fixed, I tried to update my profile and when I hit save, I was finally told what the problem was. It didn’t like my name. I was told the account was being investigated for possible violations for Google’s profile policies.

Story three:

So I posted a photo. I was horrified to discover that although I had set the privacy settings on my photos to default to be visible only to specific circles, the photo was marked as publicly visible. No amount of searching or clicking would get Google to declare that photo not public. I was even more horrified to discover that the photo somehow geolocated itself to the exact location it was taken … which is amazingly creepy as it was taken on a trail in a state park on the iPhone of a friend and sent as a text to my Android phone.

What Julie (the author of the above stories) calls “watching” or “correlating”, we call data-mining. Data-mining is the harmful, invasive activity that underpins pretty much Google’s entire business model. Data-mining means stitching together publicly-available information about people with information that people have volunteered to either Google or its partners at some point to create nearly complete profiles. The commercial purpose of the profiles is to make it possible to serve up behavioral advertising.

Google believes that by destroying the privacy of billions of people, it can reap more than a tidy profit. Its settings to allow people to opt out are just a sop to pacify people who would be otherwise critical of the company.

Google knows it doesn’t have any chance of mollifying its real critics. But right now, it’s not too concerned about this since it has more (deluded) fans than critics.

As long as Google can get away with quietly encroaching upon people’s privacy and making loss of privacy the new norm, it will.

Google chairman Eric Schmidt has already admitted that the Monster of Mountain View has developed facial recognition technology it hasn’t released because it is too creepy. But of course, that research hasn’t been destroyed. It’s still there. Google could start putting this technology into its Picasa offering anytime it wanted – or create new offerings that use it. It’s likely only a matter of time before that happens.

Posted in War on Privacy

Microsoft skewers Google’s Gmail for insensivity to privacy with parody video

Microsoft may not be a privacy watchdog, but somebody inside the company definitely agrees with us that Gmail is creepy:

On July 20 during the MGX opening sessions, the Softies showed off their “Gmail Man” spoof, meant to spur the troops selling Office 365 against Google Apps, and specifically, Gmail. In the video, Gmail man riffles through mail to find keywords for serving up ads. The message: Google cares more about advertising revenues than privacy.

ZDNet’s Mary Jo Foley couldn’t get Microsoft to confirm that the video is legit. But it seems to be. It would have more credibility coming from an organization like Consumer Watchdog than a Google rival (in this case, Microsoft, which has its own free, ad-supported email service – Hotmail).

The video itself is well-done, and manages to be funny and sobering at the same time.

Posted in War on Privacy

Google confirms it will forcibly make all Google Profiles public by the end of the month

Google is adopting another privacy-encroaching, opt-out, Facebook-style policy:

The purpose of Google Profiles is to enable you to manage your online identity. Today, nearly all Google Profiles are public. We believe that using Google Profiles to help people find and connect with you online is how the product is best used. Private profiles don’t allow this, so we have decided to require all profiles to be public.

Keep in mind that your full name and gender are the only required information that will be displayed on your profile; you’ll be able to edit or remove any other information that you don’t want to share.

If you currently have a private profile but you do not wish to make your profile public, you can delete your profile. Or, you can simply do nothing. All private profiles will be deleted after July 31, 2011.

What they really meant to say was that private profiles – and privacy in general, for that matter – just don’t fit in with their business model of monetizing people.

People who care about their privacy should stay away from Google’s offerings.

Our front page provides a pretty exhaustive guide which explains how users can Leave Google Behind. Many of the alternatives to Google’s products aren’t well known, which is why we’ve gone to the trouble of listing some of them. We encourage you to try them out for yourself. The Web’s a big place… discover how much fun it is to explore it without Google.

Posted in Shoddy Security

Google’s “Chromebooks” have gaping security holes, researcher says

Surprise, surprise:

Google may see its Chrome operating system as more secure than traditional alternatives, but one security researcher believes the cloud-based OS is vulnerable, according to a Reuters story published yesterday.

WhiteHat Security researcher Matt Johansen said he found a flaw in a Chrome OS application that he was able to exploit to gain control of a Google e-mail account. Though Google fixed the flaw after it was reported, Johansen claims to have discovered other applications with the same flaw, Reuters said.

In citing the security holes in Chrome OS, Johansen specifically pointed to the ability of hackers who can steal data as it moves between the cloud and the Chrome OS browser instead of hacking directly into a user’s PC.

“I can get at your online banking or your Facebook profile or your e-mail as it is being loaded in the browser,” he told Reuters. “If I can exploit some kind of Web application to access that data, then I couldn’t care less what is on the hard drive.”

Google’s “Chromebooks” are basically nothing more than glorified computer security terminals providing access to Google’s opaque datacenters with sod-all security. People concerned about their privacy and security would do well to stay far, far away from Google’s offerings.

Google, of course, reacted very defensively when asked for comment about this. They’d like people to believe their products are secure. But reality has proved otherwise. Security seems to be an afterthought as far as Google is concerned. That’s because Google’s business isn’t security, it’s data-mining.

Posted in War on Privacy

Google tries to build a social network again with “Google+”

Well, we knew this was coming.

Today, the Monster of Mountain View finally unveiled its latest effort to create a data-mining Facebook clone:  Google+, which appears be an amalgamation of older Google products (Wave, Buzz, Voice) combined with some Facebook-like features and wrapped in a slick interface.

Basically, what Google is trying to do with Google+ is get people to give it all the information they currently provide willingly to Facebook… like activities, interests, relationships, and so forth. Google already has a good guess as to what people who naively use its search engine like or do, but having a user confirm his or her preferences in a Google profile is better.

Google+ will be incorporated into all Google properties through a toolbar, which will encourage people to populate their Google profiles with lots of personal information and identify their friends to Google. A “feature” called Circles supposedly makes it easy to categorize contacts that already exist in Gmail into groups – the examples Google provided were “Family” and “Bike Geeks” and “Friends”. Google wants people to fill out these relationship webs so it can dramatically improve its data-mining abilities. (It doesn’t have access to Facebook’s internal data, which is why it is so desperate to build its own Facebook clone).

There’s also an app which integrates with Android and automatically uploads photos a user shoots with the phone to Google’s servers, and pushes those photos into Google+.

As you might expect, Google+ will not respect the wishes of people who want to have nothing to do with it.

Another twist is that people in your circles don’t have to be members of Google’s social net. If Aunt Mary refuses to opt in, you can include her anyway, and she can still get the pictures you post to the circle via e-mail.

Amusingly, none of the promotional materials we’ve seen for Google+ even attempt to talk about protecting user privacy. That’s because the whole point of Google+ is to help Google do a better job of waging war on people’s privacy. What Google is asking is that people trust it with all the information they currently give to Facebook in addition to what Google can automatically collect from people using its products.

That’s just too much data for one company to have, period.

People concerned about Google opting them in to Google+, as it did with Buzz, should take this opportunity to Leave Google Behind.

Posted in Legal Troubles

FTC on the verge of launching a major antitrust investigation of Google

Finally!

Since April when Bloomberg News reported that the Federal Trade Commission was contemplating a full-blown antitrust investigation of Google, people who follow the Internet giant have been waiting for the other shoe to drop.

It did on Thursday with the report in the Wall Street Journal that the five-member Commission is about to serve Google with civil subpoenas — known as Civil Investigative Demands — about its business practices.

The European Union and the State of Texas are already investigating, but word of the FTC probe raises the issue to a new level of intensity. It also makes it clear that millions of dollars spent on lobbying and the hobnobbing by Google executives at White House State Dinners will not prevent a long needed investigation.

This investigation should have been launched years ago. The FTC has been missing in action for some time, but better late than never. There are, of course, tech pundits out there mocking this announcement, suggesting that Google won’t be nearly as powerful as it is now by the time this investigation has been completed. Many have cited Microsoft as an example.

But part of the reason Microsoft’s influence diminished is precisely because of the antitrust probe and subsequent antitrust lawsuit. The very existence of this probe should serve as a check on Google’s power, and that is a very good thing.

Consumer Watchdog is asking the White House to keep its distance and not meddle with the investigation and other existing (but smaller) probes of Google’s business practices that are already going on.

Posted in War on Privacy

Google shuts down Google Health

But don’t think that means Google isn’t interested in people’s medical records:

Now, with a few years of experience, we’ve observed that Google Health is not having the broad impact that we hoped it would. There has been adoption among certain groups of users like tech-savvy patients and their caregivers, and more recently fitness and wellness enthusiasts. But we haven’t found a way to translate that limited usage into widespread adoption in the daily health routines of millions of people. That’s why we’ve made the difficult decision to discontinue the Google Health service. We’ll continue to operate the Google Health site as usual through January 1, 2012, and we’ll provide an ongoing way for people to download their health data for an additional year beyond that, through January 1, 2013. Any data that remains in Google Health after that point will be permanently deleted.

Translation: We couldn’t convince the masses to trust us with their sensitive medical records, so we’re done with this approach. When we figure out a better way to mine medical information, we’ll be back with a new offering.

Posted in War on Privacy

Google takes Android spying to next level with Google Wallet

When Google launched its Android phone operating system, it gained the ability to track the movements and activities of millions of gullible people who would eventually be persuaded by “Droid Does” advertising that they needed a Google-powered smartphone.

But spying is addictive, and Google is always looking for ways to do more spying. With Google Wallet, the Monster of Mountain View intends to leverage Android to track what people are buying:

Among other things, Google Wallet will be able to store your credit card information (Google’s launch partners include MasterCard and Citi) as well as loyalty rewards, purchase points, and any saved-up Google Offers that might apply. Then, users who have Near Field Communications (NFC) enabled Android phones will be able to simply whip out their devices when shopping and tap them on electronic payment processors in order to get deals and pay for their goods.

Google is also suggesting that makers of other phones and phone systems (Microsoft, Apple, Research in Motion) could integrate Google Wallet into their own offerings.

But that’s probably just wishful thinking on Google’s part.

Still, with Android as pervasive as it is, it won’t take Google too long to deploy its new spying capabilities. The average life of a phone, even a smartphone, is pretty short. Whether Wallet becomes as ubiquitous as Android remains to be seen. MasterCard is not an exclusive Google partner; it has other irons in the fire as far as the future of payment goes. And embedding credit cards into phones may simply be too uncomfortable for many people. Hopefully, it will be.

There is no particularly good reason why credit cards should be embedded in phones. Next, Google will be signing up governments to make driver’s licenses electronic and embedded in its phones.

Where does this end?

The contents of one’s wallet do not need to be in one’s phone. There are very good reasons for keeping both separate. Foremost is privacy and security. For instance, phones are only going to become more attractive to thieves if they contain more identifying information and means of payment.

Google Wallet provides an insignificant benefit to people who might use it. Like so many other Google products, it is primarily designed to benefit Google, and not users.

Posted in Shoddy Security

Researchers: 99% of Google’s Android devices are vulnerable to password theft

Surprise, surprise…. security on Android is sod-all:

The vast majority of devices running Google’s Android operating system are vulnerable to attacks that allow adversaries to steal the digital credentials used to access calendars, contacts, and other sensitive data stored on the search giant’s servers, university researchers have warned.

The weakness stems from the improper implementation of an authentication protocol known as ClientLogin in Android versions 2.3.3 and earlier, the researchers from Germany’s University of Ulm said. After a user submits valid credentials for Google Calendar, Contacts and possibly other accounts, the programming interface retrieves an authentication token that is sent in cleartext. Because the authToken can be used for up to 14 days in any subsequent requests on the service, attackers can exploit them to gain unauthorized access to accounts.

“We wanted to know if it is really possible to launch an impersonation attack against Google services and started our own analysis,” the researchers in the university’s Institute of Media Informatics wrote on Friday. “The short answer is: Yes, it is possible, and it is quite easy to do so.”

The researchers’ findings are pretty damning. Although Google has supposedly released a patch to address the problem, it has only been made available for newer versions of Android. 99% of the Android devices currently in use run a version that hasn’t been patched. Android users are being advised to avoid public wi-fi networks to mitigate this incredibly serious problem.

But it’s unlikely that most of the people walking around with Google spyware-laden phones and tablets have even heard about this issue, or could taken action even if they knew (Google’s deals with major mobile carriers give them control over updates to Android devices, which prevents the Monster of Mountain View from delivering all updates directly to users).

For all of its sins, Apple at least refuses to allow carriers to have any say in when and how iOS updates are delivered. That’s not to say that the proprietary business model Apple has built is a good thing, but users should be able to update software for their devices when it is available, and it should be their choice. Smartphones and tablets ought to be under the control of the people who own them, not the giant corporations that sell them.

Posted in Poor Quality Assurance, War on Privacy

Google’s “Chromebooks” are the very definition of Treacherous Computing

Some years ago, free software pioneer Richard Stallman penned an essay asking users, “Can You Trust Your Computer?” He wrote:

Who should your computer take its orders from? Most people think their computers should obey them, not obey someone else. With a plan they call “trusted computing”, large media corporations (including the movie companies and record companies), together with computer companies such as Microsoft and Intel, are planning to make your computer obey them instead of you. (Microsoft’s version of this scheme is called Palladium.) Proprietary programs have included malicious features before, but this plan would make it universal.

He added:

In the past, these were isolated incidents. “Trusted computing” would make the practice pervasive. “Treacherous computing” is a more appropriate name, because the plan is designed to make sure your computer will systematically disobey you. In fact, it is designed to stop your computer from functioning as a general-purpose computer. Every operation may require explicit permission.

Emphasis is LGB’s.

Google has now officially joined the league of companies engaged in what Richard justifiably calls treacherous computing schemes. The Monster of Mountain View is planning to debut a device it calls the Chromebook, which is basically a dumbed-down laptop running Google software which obeys Google instead of the user it supposedly belongs to. H-Online notes:

It is currently unclear if the Chromebooks will have a “developer” switch on them as Google’s CR-48 device did; the switch allowed users to install different operating systems or modified versions of Chrome OS on the device. Chromebooks are designed to use the TPM chips on the motherboard to perform a Verified Boot on the device and if it detects tampering, it will replace the installed operating system with a known good instance automatically; the developer switch on the CR-48 prevented that from happening.

In other words, the hardware in the “Chromebooks” has been intentionally designed to prevent hacking. (Hacking, in the traditional sense, refers to a user’s freedom to tinker, it doesn’t mean harming anybody else’s equipment or services). Somebody who buys a Chromebook is thus not free to repurpose the hardware and use it for something else, because Google has programmed the motherboard to obey Google and not the user.

Even if the “Chromebooks” do contain a “developer switch” like the CR-48 prototype did, there’s no justification for putting hardware-based digital restrictions management into a computer.

Of course, the rationale for the restrictions is simple. Google wants to be sure that people who buy “Chromebooks” use them to access Google products and services.

That way, Google can continually spy on their “customers”.

Google’s behavior here is simply more proof that it is no better than Microsoft or Apple, the leading proprietary software companies (or Electronic Arts, which has stopped selling games and now only rents them out). But unlike Apple or Microsoft, Google is using free software to advance the evil of treacherous computing. What they are doing is outrageous and immoral.

It is time for the free software movement to rise up against Google and recognize it as the greedy, freedom-undermining, privacy-destroying corporation that it is.