If you use Gmail you may have noticed a new feature called “Buzz”, which is Google’s attempt to create something like Facebook.
Email and Facebook-type social networking services are different in function and in their users’ privacy expectations. Google erred by 1) assuming that users of email, the less intrusive service, would want to be signed up by default for the more intrusive social networking service, and 2) configuring the privacy settings of the social networking service in a way that can casually expose a user’s private information before the user has a chance, or even knows, to change the relevant settings.
Here is an example of the kinds of problems Google’s new scheme caused.
Here are instructions for restoring the (relative) privacy of your Google account.
Google will probably correct its blunder soon if it hasn’t already. But it’s interesting that they blundered in this way in the first place. They showed a Microsoftian level of cluelessness about privacy and security. It’s as if the Google offices were a monoculture of young computer geeks for whom clever new features are first and foremost cool toys with business upside and no downside, rather than complex systems that sometimes interact in unexpected ways and may have the potential to harm people who have something to lose. Oh, wait…
Google’s “don’t be evil” motto, always a cynical joke, deserves at least as much ridicule as does the DHS terror-threat color code. People in China learned this some time ago.
Don’t be stupid. Don’t trust Google or other free Web-service providers with information that you can’t afford to make public.
UPDATE: An attorney offers scathing and insightful critique of Google here and here. The second linked post gives additional advice on deactivating your Buzz account, including a link to Google’s own instructions for doing this.
“May” have noticed? It popped up and screamed from the page!
Yesterday half of my “buddy’s band” @LJ was asking each other how to get rid of this crap. I cleaned all the traces of it before someone suggested the link you gave in this post, too. Or that what I thought.
A “stumble”? I don’t think so.
Google’s attitude toward user privacy boils down to “all your data belong to us” and we can do what we want with it. They are the most rapacious company on the earth in terms of gathering data about you, storing it and using it. When you deal with Google in any way, you simply have no privacy at all. Their “do no evil” can only be interpreted as a sick, twisted joke.
I refuse to have anything to do with Google. I never use Google’s search (I use Clusty, Bing or more specialized search engines). I hate even sending email to a Gmail account and avoid it if at all possible. An application with Google toolbar? Forget that–I’m not opening my entire computer to Google’s prying eyes! Google’s cloud? No way in hell! When Google was interested in Yelp, I was really disappointed because I use Yelp and didn’t want to have to give it up. But I would have, if Google had bought them.
I recently discovered that Firefox, behind the scenes (and certainly not well documented), sends data to Google’s Safe Browsing servers. I disabled it and I encourage all Firefox users to do so
(you have to muck with the about:config settings, so be careful).
Anybody who expects privacy from Google is a fool.
Webmail and other web based services are always privacy problematic because of their reliance on web browser which cannot really save a lot of data locally and must notify at least one server of their use.
For example, it is impossible for the web app provided not to know when and from where you used the app. They have to have that information to make it work. In principle, someone could track your movements using just that information.
The real power of computers comes from their ability to share information on peer-to-peer basis. This is true even between apps running on the same computer. Unfortunately, sharing data is like having sex, the more you hook up the more likely you are to catch something nasty.
A big reason that MS Windows suffered from security problems was due to MS decision to tie every app and function of the OS into every other app and function. This meant that one breach almost anywhere in the system could be exploited to infect every process.
Right now, the security model is to break connections. One of the reasons that the iPhone as survived without a breach for five years is partially owing to the sandboxing of iPhone apps. Only one app can run at a time and each app (with a few Apple provide exceptions) can only access data it creates. So, even if you got a malicious app past Apple’s review at the app store, you couldn’t use that app to hijack the iPhone itself.
The temptation to link everything together in web apps is even stronger than on hardware based apps. After all, linking is what the internet is all about. Moreover, since the provider controls the actual operation of the software, its easy for them to fall into the trap of believing them more secure than programs that run on end user’s hardware. Unfortunately, they forget that when they do make a mistake or get an exploit, it will rapidly spread to virtually all users of the system. The blackberry outages and MS cloud service failures are good examples of that type of failure.
I’m conservative in this regard. I use local apps despite the inconvenience that sometimes causes.
Scott Eudaley,
I refuse to have anything to do with Google. I never use Google’s search (I use Clusty, Bing or more specialized search engines)
You’re concerned about privacy and you use Bing? Bing is nothing but a giant data harvester for advertisers. It makes Google’s data harvesting look miniscule by comparison.
All advertising supported search engines collect data on you. Perhaps they don’t track you by name but they do so buy IP or recent search history. A search engine companies customers are their advertisers, not their users. They don’t sell searches, they sell the attention of their users to advertisers.
I think it’s a mistake to interpret Google’s callousness about privacy as resulting from ideological or other control freakery rather than financial motives. IOW they aren’t likely to persist in doing things that outrage users, and MSFT et al are not likely to be better on average WRT privacy and may even be worse (remember how many Hotmail security exploits there have been?). Google stands out for having the best technology, which is why everyone uses them. Their mgmt also stands out for its attitude of smug immaturity, but they aren’t Blofeld. They want all Internet traffic to flow through their servers for the same reason that all of these Web companies do. None of the ad-driven business models does well from a privacy POV, and there’s a problem with information security even if you use a local client to read and send mail.
I have used Dog PIle for political topic searches for a while. I don’t know that the Google engine leans left but it has been gamed to the point that the first ten web sites that come up are usually lefties.
I didn’t know that about Firefox and will look into it.
Jonathan is exactly right. I assume any web site, including search engines, will track as much of my information as they can get away with. And I assume the motive for doing so is primarily pecuniary. That is the nature of the Internet. My primary search engine is Clusty because their privacy policy seems to be better than most.
I’m quite aware of who the real customers are for any advertising supported media. I use Adblock Plus and rarely see web-based advertising, so I guess I’m a free-rider. I strongly resisted using any ad-blocking software, but I eventually capitulated when it became obvious that the advertisements were taking four or five times as long to load as the page’s actual content. My browsing is much faster now.
Shannon’s assertion that Google is somehow better because Bing is just “a giant data harvester for advertisers” is simply laughable. In fact, Microsoft’s advertising revenue from Bing is “miniscule” compare to Google’s. How do you think Google makes any money? In 2009, total revenues were $23.65B, of which $22.89B was from advertising!
Google pioneered, and made acceptable to many users, the concept of scanning email for advertising purposes. The Google toolbar is nothing but a data harvesting mechanism that provides very little functionality that isn’t available elsewhere. Google’s enormous valuation is driven almost completely by the amount of user data they’ve collected and the resulting advertising they can sell. Microsoft’s valuation is primarily driven by the amount of software they can sell.
I’m no fan of Microsoft. As far as I’m concerned, Microsoft is a great marketing firm that happens to sell software. They’ve never innovated anything and are only good at mediocre copies of what others have developed. In 3+ decades of software development experience, I’ve consciously managed to avoid developing for Microsoft systems with the sole exception of a six month period many, many years ago. Note that my experience with the Internet is just as long, going back to Darpanet days when it was based on dial-up UUCP.
Google, on the other hand, scares me. Their appetite for user data is unparalleled and largely, to date, unconstrained. Their willingness to cooperate with governments to censor information is frightening. On occasion, they appear to manipulate search results for political reasons. The political causes that Google and the Google founders support (for example, they are the biggest Obama supporters in Silicon Valley) seem to indicate a desire for much greater government control of the economy.
Microsoft seems to want my data because they want to sell me something. Google wants that too, but seems to be willing to climb into bed with the government to get it in a way that Microsoft is not. (Could this be the reason Microsoft faces constant anti-trust litigation and Google does not? Who has the greater market penetration in their respective industries?) I don’t trust either, but given the choice between Microsoft and Google, I’ll choose Microsoft any day.
The only way to have a completely private computer is in a TEMPEST facility with absolutely no outside connections. Been there, done that.
“It’s as if the Google offices were a monoculture of young computer geeks for whom clever new features are first and foremost cool toys with business upside and no downside, rather than complex systems that sometimes interact in unexpected ways and may have the potential to harm people who have something to lose. Oh, wait…”
That’s funny.