Slashdot Log In
Questioning Google's Privacy Reform
Posted by
Soulskill
on Sun Sep 14, 2008 12:35 PM
from the how-private-is-private? dept.
from the how-private-is-private? dept.
JagsLive makes note of a story questioning whether Google's recent commitment to anonymize IP logs faster is really as good as it sounds. We discussed their announcement a few days ago. CNet's Chris Soghoian takes a closer look:
"While the company hasn't said how it de-identifies the cookies, it has revealed in public statements that its IP anonymization technique consists of chopping off the last 8 bits of a user's IP address. As an example, an IP address of a home user could be 173.192.103.121. After 18 months, Google chops this down to 173.192.103.XXX. Since each octet (the numbers between each period of an IP) can contain values from 1-255, Google's anonymization technique allows a user, at most, to hide among 254 other computers. ... Google has now revealed that it will change "some" of the bits of the IP address after 9 months, but less than the eight bits that it masks after the full 18 months. Thus, instead of Google's customers being able to hide among 254 other Internet users, perhaps they'll be able to hide among 64, or 127 other possible IP addresses. By itself, this is a laughable level of anonymity. However, it gets worse."
Related Stories
[+]
Your Rights Online: Google Will Anonymize IP Logs Faster 97 comments
An anonymous reader writes "The BBC reports on some changes to the data retention policy at Google in response to pressure from European authorities, but also included in the article is information about why Google claims they need to retain non-anonymised data for so long. Improving services, sure, but preventing fraud? Aiding 'valid legal orders'?"
Reader s0ckratees points to some commentary on the change at Google's official blog. The upshot: IP addresses in Google's logs will be anonymized after nine months, rather than 18 as previously.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Well (Score:5, Insightful)
Do all those whining about this anonymize their own server logs? Because I sure don't.... they are doing this to keep the mob away, that's it.
Re: (Score:2)
Re:Well (Score:5, Insightful)
That's kind of the point. We want to make an informed decision about the costs here.
Without hearing about "this bullshit", you cannot make an informed decision. Imperfect information damages capitalism; and the more imperfect the information, the more damage is done.
There's also another aspect. Just about everybody wants everything to be better than it is now. This is a way this could be better. So we ask for it to be better. The argument can be paraphrased as:
A: Good enough is good enough
B: Yes, but better would be better.
Parent
Re: (Score:3, Insightful)
+1 Insightful, cuts right to the heart of the matter.
As Google's presence on the Internet becomes more and more significant, specific details on how their operations can affect us become more important.
Re: (Score:2, Insightful)
I'm shocked. Terrified in fact. If your site, with all the traffic you see, is keeping logs then we should just completely give up on trying to get Google to improve it's privacy policy and make you priority numero uno. After all, what Google knows about the web and it's users can probably be stored on one cylinder of one plater of the tiniest server in your data centre which extends to every horizon.
sorry; which site?
P.S. if you RTFA, you might find out that Google, whilst maybe not particularly wel
Re:Well (Score:5, Insightful)
Do all those whining about this anonymize their own server logs? Because I sure don't.... they are doing this to keep the mob away, that's it.
What do our server logs have to do with Google's?
The principle may be the same, but the scale is so vastly different that the practical consequences cannot be plausibly compared to one another.
Subpoenaing logs for IP 123.456.789 from Google is not the same as getting logs from icanhascheezburger.
Parent
Re:Well (Score:5, Funny)
Subpoenaing logs for IP 123.456.789 from Google is not the same as getting logs from icanhascheezburger.
I'm not sure whether you're qualified to talk about IPs giving this example IP.
Parent
Re:Well (Score:5, Insightful)
yea, also i don't think the author of this article understands statistics.
if Google changes random bits in the IP address even before they remove the last byte at 18 months, that would already make guessing the original IP address near impossible since you don't know which bits were changed.
if they only changed 1 bit in the entire address, then there would be 32 possibilities, but if they changed 1 bit in each octet, then there would be 4096 possibilities. if they changed 2 bits in each octet, there would be 61,4656 possibilities. if they changed a random number of bits in each IP address, then the possibilities grow even larger. and this isn't a login password or encryption scheme. there's no way to brute-force the original IP address from the anonymized IP address even if only a single bit was changed.
this is just more unwarranted alarmism. google has stated that they are working on developing a method of anonymization that would protect user privacy while retaining the useful characteristics of their log data. frankly, as long as they're not giving up user data to 3rd parties anonymization is a non-issue.
Parent
Re:Well (Score:4, Insightful)
I didn't see any mention of random bits being changed in the article.
Parent
Re: (Score:3, Insightful)
I didn't see any mention of random bits being changed in the article.
Not to mention that, IMHO, 'anonymizing data' is not the same as 'making the data anonymous'.
Anonymizing data = preventing it from being personally identifiable
Anonymous data = scrubbed of all context
http://www.answers.com/anonymous [answers.com]
3. Having no distinctive character or recognition factor
You can anonymize data and still retain geographic and/or demographic data.
Who cares about the IP? (Score:5, Insightful)
Everyone makes it much easier than matching IP addresses... As the article discusses, many people use Google logins for e-mail and other services. This is a much more reliable way to track all of your information.
What I'd like to see is some significant differentiation between logged-in and logged-out states and the level of anonymity that is provided in each case.
But really, if you're voluntarily storing your stuff on someone else's server with the known understanding that they're parsing it for ad matching, what kind of privacy expectations do you really have?
--
Hey code monkey... learn electronics! Powerful microcontroller kits for the digital generation. [nerdkits.com]
Re:Who cares about the IP? (Score:5, Informative)
What I'd like to see is some significant differentiation between logged-in and logged-out states and the level of anonymity that is provided in each case.
There's no difference.
Google sets a tracking cookie.
That cookie gets tied to your current IP.
If you log in, that gets tied to your login name.
Logging out doesn't undo the log entry saying IP 127.0.0.1 = cookie 34kl5j2345 = compumike@gmail.com
The spread of google-analytics makes avoiding their tracking cookie all the harder.
Parent
Hide (Score:4, Interesting)
I'm on IPv6, so I hide behind ::1/128
Re:Hide (Score:5, Funny)
If you're using google services from IPv6, it's even easier to figure out who you are.
I mean, it's either you or the other guy...
Parent
Uh huh, yeah, whatever. (Score:5, Informative)
Dont trust anybody what they say about your "privacy".
Install Firefox 3, AdBlock+, noscript, and torbutton.
You want complete anonymity, click torbutton (you have to set up tor). You're now damned hidden. No cookie leaks and stuff;.
Tor is not a solution either (Score:5, Insightful)
except, of course, that with Tor, the egress routers can (and probably do) look at your unencrypted communications, which often can be traced back to you, too.
If you want reasonable anonymity, you need to buy VPN access from a source using a non-traceable payment method. And, of course, they can still correlate your online activity on various sites. A single unencrypted Yahoo Mail or GMail session will unlock your entire usage history.
Parent
Re: (Score:2)
This is only true if you give personnal information out which is rarely the case. Also, Tor scrambles the relays each 10 minutes.
Anyway, for managing your funds I wouldn't recommend Tor. Just directly go to the website.
Re: (Score:2)
Soooo... a) don't visit sites with accounts you care about (may break the account) and b) particularly not with accounts tied to your real identity (breaks anonymity, which is the point of tor).
Not every cookie can be considered personal information. I may leak a Google cookie during a Tor session, but since it's a "temporary" one which is generated for this one session and deleted at its end, I couldn't care less.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Yes but will the leechers really give money? They are leechers you know...
Also, I kind of understand most of them. I would have no problem with setting a relay for the Tor network if I used it but owning a relay that is also an exit point to the Internet would be a problem.
I wouldn't want to be responsible for everything my own IP would do on the net...
Re: (Score:2)
Seems like a bad idea to have a single organisation providing a significant number of servers. Although placing them in several countries reduces the risk of bad guys (the gubment) to get hold of all of them.
Re: (Score:2)
"Dont trust anybody what they say about your "privacy".
Install Firefox 3, AdBlock+, noscript, and torbutton.
You want complete anonymity, click torbutton (you have to set up tor). You're now damned hidden. No cookie leaks and stuff;.
"
I do not trust you. So I will not do this :)
Re: (Score:2)
Whatever floats your boat.
That's why the source is open. Make your own decision.
Re: (Score:2)
"Make your own decision."
Shit! Now I can't make a decision! Damn you untrustworthy person!
Re: (Score:2)
Re: (Score:2)
If more people set relays, no.
Also, I2P is coming out eventually. They need more developpers though so... heard that, Slashdot?
I2P: http://66.111.51.110/ [66.111.51.110]
Re: (Score:3, Informative)
And you linked to an IP address, why?
http://www.i2p2.de/ [i2p2.de]
The picture sucks, though -- I think I know how it's supposed to work, but looking at that, I have no clue what it's trying to say.
Re: (Score:2)
Your link worked. Downloading I2P now. Cheers.
I2P will never get out of beta. (Score:3, Insightful)
The problem is that to enter I2P you need an i2p gateway to connect to. It's like TOR but reversed: TOR nodes let you get from the anonymous net to the outside world... I2P gateways let you get from the outside world to the anonymous net. So what happens when these addresses get banned?
No matter how you look at it, if it ever gets popular it will be declared illegal by governments for supporting "terrorism or other illegal activities" (such as p2p, doh) and they'll come out with "if you have nothing to hide
Re: (Score:2)
Well, I've tried downloading I2P several times already in the past n months and I always encounter the same roadblock - the download link for the I2P installation from dev.i2p.net always takes too long to respond. Has anybody got around this?
Re: (Score:2)
I noticed that, too. Maybe we could convince Google to create a TOR service?
Just kidding.
Why does Google risk customer relations? (Score:4, Insightful)
In the internet age, companies' luck can change quite quickly. Please Google, just get rid of those logs quickly and completely..
Re: (Score:3, Informative)
That said, at least they are working on the issues rather than just ignoring them completely, as most companies do.
And second, that AOL leak wasn't really a leak. Instead they purposefully released the data for research purposes, thinking that a random,
I'm appalled that anyone expects privacy at all (Score:3, Insightful)
Sure-- it's a great thing. But Google and Yahoo and myriads of other online sites live and die for your IP address, so that they may serve you better-- after running you through great behemoths of analyticals. Anonymizing after such a time serves no one's real privacy interest. Anonymizers have the ability to help you peruse privately, but even those are becoming easier to predict-- making anonymizing increasingly difficult. It's best to start your own botnet if you really want to be anonymous these days and this is just what a few good anonymizers do. Face it folks, Google's not trying at all and is financially compelled not to do so.
Re: (Score:2)
"Anonymizing after such a time serves no one's real privacy interest."
Do we really want Google to become a one-stop shop for all of law-enforcement's "what did this person search for this year" needs?
What have you done with Slashdot? (Score:2, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Oh crap! I'm screwed then because I own my entire Class-C netblock! Stupid sexy last octet....
Re: (Score:3, Informative)
Err???
255.255.255.0 doesn't give 256 host addresses ;)
One for broadcast, one for network so 254 is the number you looking for...
Why do they keep them at all? (Score:2)
These issues concern me, but I admit I do not know much about this. How about I do a search and you keep nothing? Does any search engine provide that?
Re: (Score:2)
Ask.com has AskEraser. Here's the description. [ask.com]
Re: (Score:2)
These issues concern me, but I admit I do not know much about this. How about I do a search and you keep nothing? Does any search engine provide that?
Basically you're asking does any search engine spend millions of pounds and not expect to extract any financial worth our of its relationship with you ...
Maybe in Soviet Russia?
Anonymizing IP info properly. (Score:4, Interesting)
I have something that actually does anonymize IP data. I need a roughly unique identifier for web sites for load balancing and queuing purposes, but don't need to identify the remote site. So I run the IP address through MD5, the cryptographic hash, then take the absolute value, then reduce mod 1,000,000. So the world of IP addresses is mapped into 0..999999. About 4000 IP addresses map to each number, but they're spread pseudorandomly across IP space.
So there's no real problem doing this if you just need enough info to make your server farm run smoothly. Of course, Google wants more.
Re: (Score:2)
Re: (Score:2)
If you include zero, you're going 256 minus two, that's 254 usable, everyone says 253 usable because everyone's used to having the default gateway being "at the providers" and therefore unusable. But if you're delegating a /24 to internal use, you'll have 254 usable ips, counting the router you're using for that subnet.
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
And if it's part of a bigger block the 0 and 255 are possible usable, depending on where in the large block they are.
Re: (Score:2)
What benefit does Google have to semi-anonymize after 9 months, then "fully" anonymize after another 9 months?
They get 9 months longer to attempt to tie that data to a username on some other Google service.
Once they have it hooked to a username, ie if you logged into any Google service during use of that IP then they can throw away the IP (once they've tied it to the ISP and location of course) - so they know your @gmail.com email address (and your profile data) and can link that to your usage pattern, location and ISP .. why do they still need to keep your IP address then?
Re:It only gets worse (Score:4, Funny)
How are these "revelations"? A massive web-app provider HAS LOGS? No way! They might even do analysis of them for RESEARCH PURPOSES? How dare they! And if they are legally required to disclose them, THEY DO? The evil of it!
Parent