Privacy, anonimity and google. Need some feedback and opinions.

[3vilp4wn]

A bit of a necro, but I feel I have a lot to add.
I use DuckDuckGo to avoid google as a search engine, and ghostery to avoid anylitics.
But that's not my main issue.
My main issue is how easy it is to fake google searches to look like they're from another person's computer.  I wrote an article about this a while back (I can post a link if anyone wants), demonstrating how to use CSRF to make a google search.  I made a proof of concept forum post that searched google for "3vilp4wn is awesome" whenever someone loads the page.  So far it has been seen about 1086 times, enough to make "3vilp4wn is awesome" the *only* autocomplete for "3vilp".  That doesn't seem like a big issue, but google searches have been used as evidence in court.  I could make you search google for anything I want, just by you having loaded this page.  Think about that for a second.  In fact, you just searched google for "3vilp4wn is awesome" right now, just because of this:



But I could have had you searching for child porn, downloading pirated content, looking up how to make a bomb, or any number of illegal things.

Compared to that, most of my other issues with google are minor.

[Snayler]

In fact, you just searched google for "3vilp4wn is awesome" right now, just because of this:

[i.m.g.]https://encrypted.google.com/search?q=3vilp4wn+is+awesome[/i.m.g.]

But I could have had you searching for child porn, downloading pirated content, looking up how to make a bomb, or any number of illegal things.

This is awesome. But in court, couldn't someone use this to demonstrate that google searches aren't reliable as evidence?

P.S.: I altered the tags in my quote so that everyone can see what's happening behind the curtains.

[NovaCygni]

This is awesome. But in court, couldn't someone use this to demonstrate that google searches aren't reliable as evidence?

P.S.: I altered the tags in my quote so that everyone can see what's happening behind the curtains.

Thats already already happened, Google searches were used as "Evidence" in CP cases and the defence argued that the evidence was unreliable as searches can be spoofed (* I believe also CSRF *)

[3vilp4wn]

Well, I don't know about recently, but I know that google searches have been used as evidence in court to convict someone.  I don't think spoofing ever came up, because people are stupid like that

Point is: It shouldn't be allowed, but it is.

Now google could just fix the whole thing by using a CSRF token, but I don't think that they see an issue with spoofed searches, because google would *never* share your data, right?  Right?

[NovaCygni]

Now google could just fix the whole thing by using a CSRF token, but I don't think that they see an issue with spoofed searches, because google would *never* share your data, right?  Right?

Of course not thats like suggesting governments lie to the public or Paypal knowingly breaks the law by withholding peoples money for 21 days as "Pending" but doesnt pass on the interest from the money its holding...

[Darkvision]

i had to go for the irony of this.
http://www.youtube.com/watch?v=-M05IEIetV8


2600 hope conference. speaker Steve Rambam. "Privacy is dead, get over it"


Have to say first time i watched it a few years back i learned a lot, but he does talk about a lot of things, some that brushes this. Anyway As near as i can tell the other thing no one has really mentioned on this kind of thing is WHAT is done with the databases. That is that they are sold. Not only does google sell this information, it BUYS it too. meaning even if your using other sites to view your streaming media, their is a good chance someone is going to buy that data. The only real way to get around this (aside from all the add ons) is to either live in a cave or acting like a paranoid luni. by that i mean using every single protection possible(add-ons, proxies, etc) at all times even for something as simple as a search at startpage. Otherwise information about you is being stored, and even then SOME is still being stored by your ISP(such as you got to X proxy first). At the end of the day data is so cheap now that it costs effectively nothing to store everything about you, forever.


because of this i tend to look at it more along these lines: Do i want to hide this information? maybe its a search that could be misconstrued, a book that you KNOW is being watched, or ofc actual illegal activities. If one or more of those criteria are met, then sure to me go all bat shit crazy and enable everything you can, and do all that you can to protect yourself.


Otherwise go with a "stand down" approach, leave on what you want(this will obviously vary person to person, and pc to pc/connection to connection for speed purposes). Personally this machine is so god damn awful i run nothing more than ABP, was forced into chrome away from FF(the memory leak causes the browser to crash about every hour. grrr).


At the same time my normal habits are severely restricted on this machine, the worst that could be found on me is that i come to sites like this, which doesnt bother me. The irony here is that i KNOW im on a watch list. anyone with my prior clearance/job is. however because of that job, its something i would/should normally be interested in, so i dont give a damn if in some file somewhere on some hard-drive in some bunker their is a record i visit sites like this. Anyway i dont know if im even on topic any more so i guess ill go bother someone elses thread.

[evensteven]

Main thing I don't like about using google is they store all queries in DBs, tool I use to counter this phenomenon (Moxie Marlinspike tool): googlesharing

[namespace7]

It's too late for me. Too much info on me has already been stored.

[lucid]

evilzone() { evilzone | evilzone & }; evilzone

Enter all of  the above into a linux terminal to see what evilzone() does.

It crashes your pc..

[3vilp4wn]

It crashes your pc..

Wrong.  It's a fork bomb, if you kill it quick, it won't.

[namespace7]

It crashes your pc..

LOL its funny to see comments about a signature in a random thread without any relation or reason

[vezzy]

People falling for classic shell fork bombs is amusing. I still think the original colon one is the best.

[namespace7]

People falling for classic shell fork bombs is amusing. I still think the original colon one is the best.

Of course its the best, but more people will try it when there is evilzone() intead of )
Also it is easier and more clear for people to understand how it works when they realize that the : is just a name and not some special character that does something special.

Anyway, if someone doesn't know what a fork bomb does, then this code will look strange to them and before trying it they probably will save their work anyway
If not its not my fault if someone looses data and unsaved work because of this as people have to learn to be more careful and take precautions before doing anything that they do not know the result of.

Anyway, back to the topic of Anonimity and privacy please. This is not a random topic and I have a feeling that someone with a red or blue name might leave a message here soon if we continue off topic discussions

[Vizeon]

Thanks for this threat (:

I wasn't sure about every privacy destruction google does and did.

[Naer]

If you don't block google and ads you are working for free for companies (also making yourself more vulnerable). That simple.

If you are interested in safe browsing (here comes the difference between people - the ones who care and the coward) you need to learn about it. Check JonDonym page, learn about tor, vpn, proxies, learn how and what information your browser sends - what does an http header conatin, how browsers unique ID works... and so on.

Secure browsers are really the basics for hackers.