Questioning Google's Privacy Reform 134
JagsLive makes note of a story questioning whether Google's recent commitment to anonymize IP logs faster is really as good as it sounds. We discussed their announcement a few days ago. CNet's Chris Soghoian takes a closer look:
"While the company hasn't said how it de-identifies the cookies, it has revealed in public statements that its IP anonymization technique consists of chopping off the last 8 bits of a user's IP address. As an example, an IP address of a home user could be 173.192.103.121. After 18 months, Google chops this down to 173.192.103.XXX. Since each octet (the numbers between each period of an IP) can contain values from 1-255, Google's anonymization technique allows a user, at most, to hide among 254 other computers. ... Google has now revealed that it will change "some" of the bits of the IP address after 9 months, but less than the eight bits that it masks after the full 18 months. Thus, instead of Google's customers being able to hide among 254 other Internet users, perhaps they'll be able to hide among 64, or 127 other possible IP addresses. By itself, this is a laughable level of anonymity. However, it gets worse."
Hide (Score:4, Interesting)
I'm on IPv6, so I hide behind ::1/128
Anonymizing IP info properly. (Score:4, Interesting)
I have something that actually does anonymize IP data. I need a roughly unique identifier for web sites for load balancing and queuing purposes, but don't need to identify the remote site. So I run the IP address through MD5, the cryptographic hash, then take the absolute value, then reduce mod 1,000,000. So the world of IP addresses is mapped into 0..999999. About 4000 IP addresses map to each number, but they're spread pseudorandomly across IP space.
So there's no real problem doing this if you just need enough info to make your server farm run smoothly. Of course, Google wants more.
It only gets worse (Score:1, Interesting)
It only gets worse if you believed it was "good" in the first place. These revelations don't make it worse for me since I don't believe they're committed to my privacy at all. Never have been, never will be. Sheesh, I swear some of you people will believe anything! The "do no evil" myth has been one of the most pervasive and unfounded ones of the last decade. Watch what they do, not what they say.