[kwlug-disc] [OT] Google sniffing wifi, collecting emails and passwords.

[Chris Irwin]

On Fri, Jun 25, 2010 at 13:45, unsolicited <unsolicited at swiz.ca> wrote:
> My guess is you're forgetting, and Glenn can confirm ... Google remembers
> every search / lookup done. Combine their knowledge of your MAC address and
> your IP (from the searches), and you now become a potential victim for
> targeted advertising. You always have been, but now they know where you
> were, so the local plumbing  store's ads now come up.

Google doesn't know your MAC address. They don't even know your
machine's private IP address. They only know your public-facing IP
address. All Google can tell from that is a rough geographic region.
Rogers and Bell are fairly localized, but on Teksavvy I could be
anywhere between Chatham and Hamilton as far as Google can tell.

Nobody knows exactly where you are unless you tell them. *You* decide
to use Google's Lattitude, or include geotags in your tweets.
Disclosing your location is entirely opt-in. Well, unless you have an
iPhone[1].

1. http://mashable.com/2010/06/21/apple-stores-iphone-location/

Mobile phones have been doing their best to locate you before they had
wifi. They include this data when you call 911. They can already get
rough location based on cell towers. Many phones have GPS as well now.
Not having wifi in that list does not make that much of a change. If
you disable wifi but allow location services, it's still going to be
pretty accurate. Again, the security issue is you, your apps, and who
you disclose that data to. The exact method of location acquisition is
somewhat minor.

> Further, perhaps?, the local plumbing store knows from Google who's in the
> area, and rather than inevitably sending some ads to China instead of New
> Hamburg, they all go to New Hamburg. And they're crackable. (i.e. X number
> of ads sent, etc.)

Isn't this good? If I'm going to see ads for plumbers, at least show
me ads for plumbers in London. I don't want to know about plumbing in
San Francisco.

If I'm going to see an ad for a restaurant, show me an ad for a
restaurant in my area. Physical places (such as restaurants,
electronics shops, etc) and region-specific services (such as
plumbers) are something we want to keep, right? Keep things local?
They are essentially completely unable to advertise online to people
since 99% of folks they paid to advertise to would never come within
100km of their establishment. If I can get an ad that says "1/2 price
pasta lunch on thursday at retauraunt-in-your-area" instead of "You
have a ViRuS!!1 Click here to SCAN!", I'd consider that a win.

The above is already possible to a degree. Does Google AdWords, or any
other advertising service allow you to limit region distribution based
on IP address? Why not?

> Perhaps much of the noise is FUD, but it seems to me there is more and more
> distrust of Google.

Google is the new 800kg Gorilla. I currently have my email and
calendar going through Google. I also keep local backups, because my
account could close, be cracked, go down, etc. I'm aware of what I'm
giving up and what I'm gaining with their service. Currently it is a
benefit, so I use them.

> In reading this thread I guess I have made the assumption that Google will
> be able to correlate mac address and physical location (from Google Maps
> data acquisition), with your internet searches. Perhaps I have made a leap
> from mac addresses to IP here that is not evident.

Only if you let them. Within a browser, any website can't tell the MAC
address of the AP you're connected to. Browser makers are adding APIs
to acquire this geolocation data. In Firefox and Opera, an infobar
will appear to let you know that this website is requesting it. You
can click to allow it. (Yes, I want Google Maps to know where I am,
*this time*, so when I search for "Pizza Hut" it shows me the closest
one. No, I don't want whitehouse.gov to know where I am and *remember
that*.).

My phone prompts me every time an app requests access to location
data. It also allows me to disable google's wifi service as a backend.
Support in other phones may differ (I've got a Palm Pre).

For the paranoid in us: If I don't trust google with my location based
on my wifi access point, why do I trust them with searches like [2]?
They could just as easily pull back my search history and see that I
search for stuff in East London a lot. What was the first place I
checked on Street View? Probably my house.. Not to mention
ego-searches...

2. http://maps.google.ca/maps?q=pizza%20hut%20near%20huron%20%26%20highbury,%20London%20Ontario

-- 
Chris Irwin
<chris at chrisirwin.ca>