Schneier on Security

Roger • October 30, 2006 5:51 PM

I am starting to get fed up with the anti-Google stuff.

Google is a search engine, which makes it easier to index all the stuff which you (or someone else) has made publically available about you.

There are many other search engines. All have privacy policies. Google has the best privacy policy. Yet strangely enough, there is a constant barrage of insinuations against Google, and nary a whimper about MSN Search, Yahoo Search, Ask Jeeves, or AltaVista.

The most obvious conclusion is that these “stories” are being planted by Google’s commercial rivals. So when you complain about Google, just remember you are a cat’s paw for Uncle Bill.

Now, if we delete the word “Google” everywhere above and write “search engine” instead, there is more of a story. But note, there isn’t an awful lot about Sergey Brin’s personal life on Yahoo Search, either. I suspect that the reason isn’t some vast Googloid conspiracy, but rather that the guy groks the web and is careful with his privacy.

As, indeed, we all need to be in this age. In that sense, discovering private facts about yourself through a search engine isn’t really the search engine’s fault; it is, after all, just indexing stuff that someone else leaked (most likely, you). In fact, you could say that the search engines are just Vulnerability Full Disclosure for the rest of us. You’re already leaking private information; Google just warns you about it, giving you more of an incentive to fix those buggy form-filling policies.

Roger • November 2, 2006 8:26 PM

@J.

Change “search engine” to “service providing a service similar to what search engines provide”, and Scroogle fits.

No, it doesn’t. All Scroogle does is proxy your searches to Google, stripping out cookies on the way. It has no search capability of its own, at all.

In other words, you can achieve exactly the same effect by surfing via a multiuser web proxy or NAT proxy (some very large % of surfers already do so for performance or network reasons), and rejecting Google cookies (trivial to do in any modern browser.) Further, for various reasons that we have discussed here in the past, it is actually unlikely that Google uses IPs for analysing search data, so step a) (the proxy part) is probably superfluous; just turn off cookies.

In fact, using a multiuser web proxy or NAT proxy is much better than using Scroogle since it obscures your IP from all the other sites you visit as well (oddly, privacy activist Brandt is happy just blocking Google, and doesn’t seem to care about the personal information you might be leaking to all those nice ethical mafia-run pr0n sites).

Oh, actually Scroogle does do one other thing: it also strips out the little text ads that Google puts on the top right of your results page. This is not surprising, since Brandt hates Google so much he probably sees this method of hitting them in the pocketbook as the main benefit. Most people, however, would regard this as seriously unethical.

Please provide documented evidence Ixquick and Clusty do what you claimed all search engines do.

OK, no problemo. (BTW, Ixquick and Clusty are both metasearch engines, not search engines. The difference is not insignificant but I won’t go into it here.)

Cookies: Ixquick and Clusty both set cookies. The longest lived Ixquick cookie lasts for 4 years; 5 others last for one year after the last time you use Ixquick. The longest lived Clusty cookie lasts the maximum time possible, until 2038 [1], just like Google (source: use them, and check your cookies.) Both Ixquick and Clusty note that their cookies do not contain a UUID, however they do contain quite a lot of other information which could potentially be used for data matching[2].

Apart form the lack of (optional, pseudonymous) user accounts, the Clusty privacy policy is extremely similar to Google’s privacy policy. Unlike Google they eschew a UUID in their cookies (but see above about what they DO put in.) They explicitly acknowledge logging everything including IP address and referrer data, and by using the site you agree that they can share non-personally identifiable information with business partners (source: Clusty privacy policy at http://clusty.com/privacypolicy )

The Ixquick privacy policy is quite good but it is NOT totally non-tracking. Contrary to the impression some people have received from their press releases, Ixquick also does this same sort of standard logging; the difference is their retention policy. Until recently, Ixquick retained all search logs indefinitely, same as everyone else; but for the last three months, they have started purging only IP addresses from logs after 48 hours. This is better than retaining IPs in their logs indefinitely, but not at all the same as not logging at all, and definitely not the same as deleting the whole log; in particular, search terms are kept indefinitely, same as everyone else (source: Ixquick’s privacy Q&A, http://us.ixquick.com/eng/protect_privacy_qa.html )

Also, like most other metasearchers, Ixquick’s revenue model is paid advertisements at the top of some pages, which have embedded referrer information (source: try some searches, “copy link location” on some of the URLs, and decode them somewhere.)

Please provide documented evidence he still makes his living editing and selling databases of the private details of public people.

OK. Here’s one of his order forms:
http://www.namebase.org/order.html

Simple facts are:
a) Google’s privacy policies may not be perfect but are fairly typical for a reasonably ethical internet company, and are a heck of a lot better than the real bottom-feeders;
b) true anonymity on the internet is almost impossible to obtain without serious technical measures; however
c) from most people’s point of view an adequate degree of privacy can be achieved by three simple practices and one hard one:
** surfing through a standard web proxy (a simple config setting in any browser, but you need to find the address to use first);
** accepting no third party cookies (in Firefox, a simple config setting);
** deleting all cookies at end of session (in Firefox, a simple config setting);
and the hard one:
** being very careful about entering personal information into web forms.

1. There’s a lot of hype about 2038 cookies. If you spend any time maintaining PCs for the security-clueless, you will see that there is a very low probability of any cookie lasting more than about 2 or 3 years. So in practice, there is negligible difference between a 2038 cookie and a 2010 cookie. Further, cookie expiry dates get updated every time you visit the site, so a 12 month cookie will last just as long as a 2038 cookie if you visit the site at least once a year. If you use a site where cookies are obligatory, but don’t want them to link sessions, the only solution is to delete them all at the end of every session, regardless of expiry date.
2. In particular the main Clusty cookie is opaque encrypted data over 300 bytes long, while Ixquick includes 6 long lived cookies, including two timestamps accurate to the second (Ixquick claims to average 4 queries per second, so two timestamps are likely to be a unique ID just by themselves) and an encoded prefs cookie with a minimum of 5 subfields and the invitation to set 7 others, including your home postcode.