Re: Google Secure Access or "How to have people download a trojan."

[Paul Nickerson <pvnick () gmail com>]

Seriously, Yvan. You really don't know who it is you're talking to. That is
Mr. Berand-Jan Wever, creater of all that is more 1337 than you. If you and
him are debating about issues pertaining to hacking, more often than not he
will be right. I have never ever heard of you. What's the last security
advisory that YOU have come out with?
 I'm sorry, but before you can go calling someone as 1337 as Skylined an
"Ass-Clown", you need to build up some credibility for yourself. Until then,
good-day sir.
 Not to mention as Microsoft becomes better at everything it does and
becomes righteous, Google is turning into the new Microsoft. Google has
become all monopolistic and shit. 75% of website referrals come from google.
They are all cocky and think they can get away with everything, just like
Microsoft used to be. Fight the power!!!!
 Regards,
Paul
Greyhats Security
http://greyhatsecurity.org

 On 9/21/05, Yvan Boily <yboily () gmail com> wrote:
> Dear Ass-Clown (aka, skyline):
>  You have seriously mis-interpreted the privacy policy. Considering that
> most such documents are written in legalese and are similar to EULAs rather
> than a list of how the information collected is used, it is normal to be
> skeptical about published privacy policies.
>  >> 1. "Google may log some information from your web page requests ..."
> In Full:
> Google may log some information from your web page requests as may the
> websites that you visit. We do this to understand how Google Secure Access
> is being used and to improve our services. Google Secure Access does not log
> cookies and strips potentially sensitive query data from the end of requests
> to help better protect your privacy.
>  This roughly translates into 'If you use our service, we are going to
> track how you use it, and ensure that you are not exposing us to serious
> liability.'. Hmm.. sounds like any standard business practice, at least for
> any that plans to be more than a mom & pop.
>  >> 2. "Google also logs a small set of non-personally identifiable
> information ..."
> In Full:
> Google also logs a small set of non-personally identifiable information --
> such as routing information, session durations and operating system and
> Google Secure Access client version numbers -- in order to create your
> Google Secure Access connection, understand how people are using Google
> Secure Access and help us maintain the Google Secure Access client.
>  Hey Hey!! Good job skippy, you succeeded in snipping out the part that
> indicates that the information that is gathered is information that any good
> service provider tracks! Wow! Do you have a cell phone? Or a land-line? Or
> an internet service provider? Jackass. They all track this type of
> information so they can figure out wonderful things like technical support
> requirements, load management, and a number of other good things.
>  >> 3. "Google will not sell or provide personally identifiable
> information to any third parties except ..."
> In Full:
> Google will not sell or provide personally identifiable information to any
> third parties except under the limited circumstances described in the Google
> Privacy Policy <http://www.google.com/intl/en/privacy.html>.
>  And From the Privacy Policy... actually, too long to summarize nicely.
> But in short, unless they have your consent they will not share information
> they collect about you, except to business partners who provide information
> processing services (in which case they are legally bound to protect and
> preserve that informtion), and except in cases where they have a legal
> obligation (HELLO Patriot Act!) etc...
>  In other words, they will keep your information private unless you give
> them permission, and will only share information with business partners.
> Hmm, this sounds like a similar practice to what most banks do, except that
> the banks will sell your information! These business practices are very
> common, and virtually all businesses take on these sorts of practices.
>  >> 4. "... we may for a limited period of time preserve additional
> internet traffic or other information."
> In Full:
> If Google concludes that we are required by law or have a good faith
> belief that collection, preservation or disclosure of additional information
> is reasonably necessary to protect the rights, property or safety of Google,
> our users or the public, such as if we believe the Google Secure Access
> service is being abused, we may for a limited period of time preserve
> additional internet traffic or other information.
>  In other words, if you attack our systems, or our users, or break the
> law, or any number of other things that may trigger our IDS or IPS then we
> may track other information, and oh, by the way, if we are required to
> collect information by law, we will comply. In other words, we will protect
> our systems even though we are giving you free access.
>  Before you go off FREAKING out you might want to consider a few things,
> first:
>  1. This is a free, publicly available service. Without monitoring
> liablities to the service it would quickly become another example of a
> failed, free, publicly available service.
> 2. Google owns the network and therefore bears liability if someone uses
> the network for illegal purposes.
> 3. Google offers this service, not rams it down your throat.
> 4. Google offers uninstallers, and does not inject its software into other
> processes, nor to my knowledge, does it run multiple processes that share
> locks so that it can re-launch itself, and prevent deletion of core files.
> These are all traits of spyware.
> 5. Google has a strong history of balancing advertising capabilities and
> privacy. Although they are an advertising company and make money off of
> context-based advertising, they have done a good job of not hoovering
> information from peoples computers and selling it to the lowest bidder.
>  If you don't like the idea of the service, or you want to convince
> others, then try writing something worth reading rather than an adolescent
> sounding rant about how the MAN is going to invade your privacy, and steal
> your precious session durations and client version information. Either that
> or apply for a job with Minitrue, also known as CNN. Your style of
> "reporting" is strongly appreciated in those circles.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/