Forgot your password?
typodupeerror
Google Businesses The Internet Privacy

Questioning Google's Privacy Reform 134

Posted by Soulskill
from the how-private-is-private? dept.
JagsLive makes note of a story questioning whether Google's recent commitment to anonymize IP logs faster is really as good as it sounds. We discussed their announcement a few days ago. CNet's Chris Soghoian takes a closer look: "While the company hasn't said how it de-identifies the cookies, it has revealed in public statements that its IP anonymization technique consists of chopping off the last 8 bits of a user's IP address. As an example, an IP address of a home user could be 173.192.103.121. After 18 months, Google chops this down to 173.192.103.XXX. Since each octet (the numbers between each period of an IP) can contain values from 1-255, Google's anonymization technique allows a user, at most, to hide among 254 other computers. ... Google has now revealed that it will change "some" of the bits of the IP address after 9 months, but less than the eight bits that it masks after the full 18 months. Thus, instead of Google's customers being able to hide among 254 other Internet users, perhaps they'll be able to hide among 64, or 127 other possible IP addresses. By itself, this is a laughable level of anonymity. However, it gets worse."
This discussion has been archived. No new comments can be posted.

Questioning Google's Privacy Reform

Comments Filter:
  • Well (Score:5, Insightful)

    by mindstrm (20013) on Sunday September 14, 2008 @01:40PM (#24999351)

    Do all those whining about this anonymize their own server logs? Because I sure don't.... they are doing this to keep the mob away, that's it.

    • by Dolda2000 (759023)
      Well, I do let logrotate throw away old logs a lot faster than 18 months, though.
    • Re: (Score:2, Insightful)

      by rtfa-troll (1340807)

      I'm shocked. Terrified in fact. If your site, with all the traffic you see, is keeping logs then we should just completely give up on trying to get Google to improve it's privacy policy and make you priority numero uno. After all, what Google knows about the web and it's users can probably be stored on one cylinder of one plater of the tiniest server in your data centre which extends to every horizon.

      sorry; which site?

      P.S. if you RTFA, you might find out that Google, whilst maybe not particularly wel

    • Re:Well (Score:5, Insightful)

      by TubeSteak (669689) on Sunday September 14, 2008 @02:26PM (#24999717) Journal

      Do all those whining about this anonymize their own server logs? Because I sure don't.... they are doing this to keep the mob away, that's it.

      What do our server logs have to do with Google's?

      The principle may be the same, but the scale is so vastly different that the practical consequences cannot be plausibly compared to one another.
      Subpoenaing logs for IP 123.456.789 from Google is not the same as getting logs from icanhascheezburger.

    • Re:Well (Score:5, Insightful)

      by lysergic.acid (845423) on Sunday September 14, 2008 @02:35PM (#24999803) Homepage

      yea, also i don't think the author of this article understands statistics.

      if Google changes random bits in the IP address even before they remove the last byte at 18 months, that would already make guessing the original IP address near impossible since you don't know which bits were changed.

      if they only changed 1 bit in the entire address, then there would be 32 possibilities, but if they changed 1 bit in each octet, then there would be 4096 possibilities. if they changed 2 bits in each octet, there would be 61,4656 possibilities. if they changed a random number of bits in each IP address, then the possibilities grow even larger. and this isn't a login password or encryption scheme. there's no way to brute-force the original IP address from the anonymized IP address even if only a single bit was changed.

      this is just more unwarranted alarmism. google has stated that they are working on developing a method of anonymization that would protect user privacy while retaining the useful characteristics of their log data. frankly, as long as they're not giving up user data to 3rd parties anonymization is a non-issue.

      • Re:Well (Score:4, Insightful)

        by figleaf (672550) on Sunday September 14, 2008 @02:54PM (#24999977) Homepage

        I didn't see any mention of random bits being changed in the article.

        • Re: (Score:3, Insightful)

          by TubeSteak (669689)

          I didn't see any mention of random bits being changed in the article.

          Not to mention that, IMHO, 'anonymizing data' is not the same as 'making the data anonymous'.
          Anonymizing data = preventing it from being personally identifiable
          Anonymous data = scrubbed of all context

          http://www.answers.com/anonymous [answers.com]
          3. Having no distinctive character or recognition factor

          You can anonymize data and still retain geographic and/or demographic data.

    • Do all those whining about this anonymize their own server logs? Because I sure don't.... they are doing this to keep the mob away, that's it.

      You must have very little traffic, or lots of storage space, I take it.

  • by compumike (454538) on Sunday September 14, 2008 @01:42PM (#24999375) Homepage

    Everyone makes it much easier than matching IP addresses... As the article discusses, many people use Google logins for e-mail and other services. This is a much more reliable way to track all of your information.

    What I'd like to see is some significant differentiation between logged-in and logged-out states and the level of anonymity that is provided in each case.

    But really, if you're voluntarily storing your stuff on someone else's server with the known understanding that they're parsing it for ad matching, what kind of privacy expectations do you really have?

    --
    Hey code monkey... learn electronics! Powerful microcontroller kits for the digital generation. [nerdkits.com]

  • Hide (Score:4, Interesting)

    by Wowsers (1151731) on Sunday September 14, 2008 @01:44PM (#24999391) Journal

    I'm on IPv6, so I hide behind ::1/128

  • What benefit does Google have to semi-anonymize after 9 months, then "fully" anonymize after another 9 months? Does it really make any difference? I guess it does give you a bit more privacy after 9 months as opposed to waiting 18 months for the full anonymization process, but it makes no sense to me why they wouldn't just totally get rid of the IP information after that long. I mean, it's data; data must be stored. It's just sitting somewhere taking up space.
    • by DanZ23 (901353)

      It's just sitting somewhere taking up space.

      Do you really think Google isn't doing anything internally with this data, and it's "just sitting someplace"? Because I sure don't....

      • Duh, I should have thought of that. Thanks for pointing out the obvious to me. Lazy Sundays...
    • by pbhj (607776)

      What benefit does Google have to semi-anonymize after 9 months, then "fully" anonymize after another 9 months?

      They get 9 months longer to attempt to tie that data to a username on some other Google service.

      Once they have it hooked to a username, ie if you logged into any Google service during use of that IP then they can throw away the IP (once they've tied it to the ISP and location of course) - so they know your @gmail.com email address (and your profile data) and can link that to your usage pattern, location and ISP .. why do they still need to keep your IP address then?

  • by Creepy Crawler (680178) on Sunday September 14, 2008 @01:48PM (#24999423)

    Dont trust anybody what they say about your "privacy".

    Install Firefox 3, AdBlock+, noscript, and torbutton.

    You want complete anonymity, click torbutton (you have to set up tor). You're now damned hidden. No cookie leaks and stuff;.

    • Re: (Score:1, Insightful)

      by Anonymous Coward
      Yah, but it is unbearably slow.
      • by Bragador (1036480)

        If more people set relays, no.

        Also, I2P is coming out eventually. They need more developpers though so... heard that, Slashdot?

        I2P: http://66.111.51.110/ [66.111.51.110]

        • Re: (Score:3, Informative)

          And you linked to an IP address, why?

          http://www.i2p2.de/ [i2p2.de]

          The picture sucks, though -- I think I know how it's supposed to work, but looking at that, I have no clue what it's trying to say.

          • Your link worked. Downloading I2P now. Cheers.

            • The problem is that to enter I2P you need an i2p gateway to connect to. It's like TOR but reversed: TOR nodes let you get from the anonymous net to the outside world... I2P gateways let you get from the outside world to the anonymous net. So what happens when these addresses get banned?

              No matter how you look at it, if it ever gets popular it will be declared illegal by governments for supporting "terrorism or other illegal activities" (such as p2p, doh) and they'll come out with "if you have nothing to hide

              • TOR nodes let you get from the anonymous net to the outside world... I2P gateways let you get from the outside world to the anonymous net.

                So, if you combine the two, you'd get a poor-man's Freenet?

          • I simply searched for I2p on Google to get the homepage and it gave me the IP link... But the IP link seems to be out of date so thank you for the correction.
        • Well, I've tried downloading I2P several times already in the past n months and I always encounter the same roadblock - the download link for the I2P installation from dev.i2p.net always takes too long to respond. Has anybody got around this?

        • by centuren (106470)

          Tor get a vote of confidence as it's endorsed by the EFF, which has an established reputation for privacy.

          I don't know anything about I2P. If it's a better-than-Tor network, I hope they have the good sense to get trusted organizations on board.

          • by Pathwalker (103) *

            I've played with i2p a bit; the focus is different than that of TOR.

            Whereas TOR aims at anonymity in accessing the internet at large, i2p aims at a double blind internal network. You and a site can communicate, but neither of you knows the identity of the other; you only know each other's public keys.

            There are a few gateways between i2p and the internet (in both directions), but that doesn't appear to be the intended focus.

      • I noticed that, too. Maybe we could convince Google to create a TOR service?

        Just kidding.

        • by centuren (106470)

          I laughed (and then cried a little). Not really, but I do find it ironic that the only successful mainstream XMPP instant messenger client is done by Google.

          I was quite excited when it came out. Google was smaller than today, but still a big force, and I thought it might be a step towards not having to beg people to use Jabber so I wouldn't have an empty contact list.

          Now I have a few contacts that use Google Talk, primarily due to their Gmail integration and it's easy way around corporate firewalls, and for

    • by speedtux (1307149) on Sunday September 14, 2008 @01:57PM (#24999493)

      except, of course, that with Tor, the egress routers can (and probably do) look at your unencrypted communications, which often can be traced back to you, too.

      If you want reasonable anonymity, you need to buy VPN access from a source using a non-traceable payment method. And, of course, they can still correlate your online activity on various sites. A single unencrypted Yahoo Mail or GMail session will unlock your entire usage history.

      • by Bragador (1036480)

        This is only true if you give personnal information out which is rarely the case. Also, Tor scrambles the relays each 10 minutes.

        Anyway, for managing your funds I wouldn't recommend Tor. Just directly go to the website.

        • by tirnacopu (732831)
          A nod to the parent poster. In any financial transaction, made with your own money, you do NOT want to be anonymous. If you are in a hotel in Las Vegas, or in a coffee shop in Amsterdam, that's OK. The company handling your purchase must have enough measures to monitor and repair eventual damages, and whether they do or not - when the police comes asking why you just bought a brand new limousine you would be off the hook simply by showing them a plane ticket and saying "hey, I was in Vegas, Mercedes - that'
    • Re: (Score:3, Insightful)

      If only we had more relays in the Tor network than the leeches. That's why Tor is really really slow these days. We need a restructure or major change in protocol for Tor to survive. A lot of people seem to be hopping onto the network these days, with companies becoming increasingly nosy.
      • by Bragador (1036480)
        What about a ratio system like they use on private torrent websites? One could have a ratio of upload and download and if you don't give back to the community, your IP is temporarily banned from using the network. That wouldn't pose a problem since knowing that IP adress is wants to use the network doesn't mean they know where it is going when it connects. You are still anonymous.
        • That is a harsh and forced way to get things done. A better way would be to ask for donations, and then buying dedicated (or non dedicated) machines in different parts of the world, using connections from different ISPs (therefore different IPs) and then using these machines solely towards serving as Tor relays.
          • by Bragador (1036480)

            Yes but will the leechers really give money? They are leechers you know...

            Also, I kind of understand most of them. I would have no problem with setting a relay for the Tor network if I used it but owning a relay that is also an exit point to the Internet would be a problem.

            I wouldn't want to be responsible for everything my own IP would do on the net...

            • Just like public trackers on BitTorrent, Tor is surviving on the good will of a few people who will fight for anonymity on the internet. Its just that it needs a little advertising, so that the load from the few relays can be distributed and make the Tor network faster. Doing what you said would make Tor fall.
            • I'd be happy to send $20 to a good cause like that, but for legal reasons I can't run an exit node myself. I do run a relay though, for all the good that does.

          • Seems like a bad idea to have a single organisation providing a significant number of servers. Although placing them in several countries reduces the risk of bad guys (the gubment) to get hold of all of them.

        • by centuren (106470)

          What about a ratio system like they use on private torrent websites? One could have a ratio of upload and download and if you don't give back to the community, your IP is temporarily banned from using the network. That wouldn't pose a problem since knowing that IP adress is wants to use the network doesn't mean they know where it is going when it connects. You are still anonymous.

          Tor is for everyone to use, even those that don't meet Tor's bandwidth standards for a relay.

    • How does Chrome compare in this regard to "ask.com" "AskEraser"?

    • by McGiraf (196030)

      "Dont trust anybody what they say about your "privacy".

      Install Firefox 3, AdBlock+, noscript, and torbutton.

      You want complete anonymity, click torbutton (you have to set up tor). You're now damned hidden. No cookie leaks and stuff;.
      "

      I do not trust you. So I will not do this :)

    • by msormune (808119)
      You would get better anonymity if you wrote your own browser.
  • by wandm (969392) on Sunday September 14, 2008 @01:49PM (#24999427)
    I don't get it. I'm sure I'm not the only one looking for a good Google substitute, and the number of skeptics will just grow, unless Google gets it privacy protection act together. It's just a matter of time that another AOL-type leak happens.

    In the internet age, companies' luck can change quite quickly. Please Google, just get rid of those logs quickly and completely..
    • Re: (Score:3, Informative)

      by tylerni7 (944579)
      Well first, while I'm sure you aren't the only person looking for a Google substitute, that doesn't mean a significant amount of users are. With the percent of the market that Google already has, a few people going somewhere else won't even make a dent.
      That said, at least they are working on the issues rather than just ignoring them completely, as most companies do.

      And second, that AOL leak wasn't really a leak. Instead they purposefully released the data for research purposes, thinking that a random,
  • by postbigbang (761081) on Sunday September 14, 2008 @01:59PM (#24999513)

    Sure-- it's a great thing. But Google and Yahoo and myriads of other online sites live and die for your IP address, so that they may serve you better-- after running you through great behemoths of analyticals. Anonymizing after such a time serves no one's real privacy interest. Anonymizers have the ability to help you peruse privately, but even those are becoming easier to predict-- making anonymizing increasingly difficult. It's best to start your own botnet if you really want to be anonymous these days and this is just what a few good anonymizers do. Face it folks, Google's not trying at all and is financially compelled not to do so.

    • "Anonymizing after such a time serves no one's real privacy interest."

      Do we really want Google to become a one-stop shop for all of law-enforcement's "what did this person search for this year" needs?

      • Re: (Score:1, Troll)

        by Teun (17872)
        Yep, innocent perpetrators shouldn't use Google...

        As they say: "Do no evil".

  • OK, I thought it was strange that there was an "Apple is Evil" story about sneakers earlier today. But now there's a "Google may be evil" story! What's next? A story about how "SCO was right about Linux all along"?
    • Re: (Score:3, Funny)

      Shhhh! don't make them hunt the 256 of you down!
      • Re: (Score:3, Funny)

        by bigtallmofo (695287) *
        Shhhh! don't make them hunt the 256 of you down!

        Oh crap! I'm screwed then because I own my entire Class-C netblock! Stupid sexy last octet....
      • Re: (Score:3, Informative)

        by Arimus (198136)

        Err???

        255.255.255.0 doesn't give 256 host addresses ;)

        One for broadcast, one for network so 254 is the number you looking for...

    • by centuren (106470)

      "Successful tech-company is evil" is always headlining on slashdot. What's strange about that?

  • A class C subnet is 253 addresses, not 254. Zero and 255 are, last time I checked, reserved.
    • Re: (Score:1, Funny)

      by Anonymous Coward
      Fail.
    • by perlchild (582235)

      If you include zero, you're going 256 minus two, that's 254 usable, everyone says 253 usable because everyone's used to having the default gateway being "at the providers" and therefore unusable. But if you're delegating a /24 to internal use, you'll have 254 usable ips, counting the router you're using for that subnet.

    • Re: (Score:3, Insightful)

      Damnit.. I wish there was a way to edit comments here. That was a typo on my part, and I didn't notice it until I saw 6 people beating me in the head with it. :p
      • Gah.. actually I'm completely wrong from the start. My apologies..
      • Yah, if you're gonna correct someone you better re-read your post 18 times before you click submit. It won't help, (mistakes are invisible until they're irrevocable) but at least you can feel you tried.
  • Do no evil, unless you can fool the public?

    Google has been getting away with identity murder for years and years. For anyone that finds this whole thing 'new' or 'odd' needs to slap themselves and research the marketing company that is Google.

    They don't provide services or features, they sell identity information and ads.

    The services and online features are just the bait in the trap.

    "Google, making Microsoft look non-Evil for years."

    • by nog_lorp (896553) *

      What? Reference for when they have sold identity information please.

      And if you think being an ad provider makes them Evil you need to take a serious look at your system of ethics.

      • Sure data mining and collecting information on everyone is a 'good thing', just like the IBM punchcards Germany used in the 30s/40s...

        Consolidation of personal information without approval is not ethical, nor an 'ad provider'.

        When Windows XP started sending back crash information 'anonymously', people like you stepped up in numbers calling them evil and painting Microsoft as evil and looking over your shoulder, when all they wanted to do was fix the freaking crashes and identify bad drivers and software.

        So

        • by nog_lorp (896553) *

          You give Google approval when you agree to their privacy agreement, which is extremely open and clear and not just a giant blob of legalese.

          I just want to make the point that something can "seem scary" or "put you off" without being evil or unethical. In MY system of ethics, there needs to be either (1) intent to do harm, or (2) actual harm done. With neither of these, I can declare your puppy is evil with just about as much credibility as someone claiming "being an ad provider is evil".

          • You give Google approval when you agree to their privacy agreement, which is extremely open and clear and not just a giant blob of legalese.

            Not when viewing ads on a website. I have given no permission for the data they collect from my visit...

            Now run along and look up Google moving their data center to a freaking boat so they can avoid US regulations, taxes, and accountability to any governing body. (This means they can do whatever they want with the data and no court can touch them.)

            Do no evil my ass...

  • These issues concern me, but I admit I do not know much about this. How about I do a search and you keep nothing? Does any search engine provide that?

    • Ask.com has AskEraser. Here's the description. [ask.com]

    • by pbhj (607776)

      These issues concern me, but I admit I do not know much about this. How about I do a search and you keep nothing? Does any search engine provide that?

      Basically you're asking does any search engine spend millions of pounds and not expect to extract any financial worth our of its relationship with you ...

      Maybe in Soviet Russia?

      • by Sark666 (756464)

        No they can still run ads, and they can even do target specific ads based on my current search. But don't build up a profile history on me. What other form of advertising does that?

        A tv show on say sports might run ads about other sports stuff, athletic gear etc. That's as far as I want an advertising relationship to go.

  • by Animats (122034) on Sunday September 14, 2008 @02:35PM (#24999809) Homepage

    I have something that actually does anonymize IP data. I need a roughly unique identifier for web sites for load balancing and queuing purposes, but don't need to identify the remote site. So I run the IP address through MD5, the cryptographic hash, then take the absolute value, then reduce mod 1,000,000. So the world of IP addresses is mapped into 0..999999. About 4000 IP addresses map to each number, but they're spread pseudorandomly across IP space.

    So there's no real problem doing this if you just need enough info to make your server farm run smoothly. Of course, Google wants more.

    • by supersat (639745)
      How many of those 4000 IP addresses are valid and allocated?
    • by pbhj (607776)

      Of course, Google wants more.

      What you mean of course is that Google's customers want more, they're serving the market. That's big business but it's also everyone else that uses Googles Analytics or PPC or AdWords programs.

      I'm director of a small business - we use Google Analytics/Webmaster Tools to help track SEO efforts and to establish good site stats. It's valuable to me to see things like (approx, guesstimated) geographic location of users and the like.

      • by AlXtreme (223728)

        It's valuable to me to see things like (approx, guesstimated) geographic location of users and the like.

        Google could simply store the totals per region (they probably already do so). Anonymization is very much possible for Adwords/Analytics, as users simply get the big picture and not the unique IP addresses of every visitor anyway. I can't see proper anonymity after X months hurting Adwords in its current form.

        Perhaps Google wants to keep the whole IP address in order for Adwords-users to target specific g

    • by Fastolfe (1470)

      Your MD5 hashing trick is just about useless at actually hiding anything. All you've done is replace the IP address with something derived directly to the IP address, while chopping off ~12 bits of precision (likely much less since many of those IP addresses won't be valid or active unicast addresses). It's trivial to build up a lookup table from IP address to identifier. MD5 is nice if you can't reverse it, but you don't have to reverse it here. If someone subpoenas your logs, and they know the IP addr

  • HAHAHA... That's-a-funny...

    Maybe, possibly you might get some privacy if you can randomly change your public IP address a few thousand times a second in some "spread spectrum" type fashion. But for now, real privacy on the net is but a pipe dream.

  • It only gets worse (Score:1, Interesting)

    by PingXao (153057)

    It only gets worse if you believed it was "good" in the first place. These revelations don't make it worse for me since I don't believe they're committed to my privacy at all. Never have been, never will be. Sheesh, I swear some of you people will believe anything! The "do no evil" myth has been one of the most pervasive and unfounded ones of the last decade. Watch what they do, not what they say.

  • First off, I was running ISP's back in the 90's, and even then my dynamic pools for Radius were bigger than a /24, unless the location was a tiny remote dial up. Nowadays, there probably is no large ISP assigning single /24's for dynamic IP addressing. Heck, /20, /19, and even /18 are being used by my ISP, a large cable provider. I haven't asked anyone there lately, but I'm betting they have bigger pools than that.

    Now, if you have a static block, that's different, but if we're talking about the masses in

Never invest your money in anything that eats or needs repainting. -- Billy Rose

Working...