4 ms·

I am always amazed when people can't figure out that google is doing this because their business model is based on "targeted advertising", which necessarily req

by pdkl95 11y ago

I am always amazed when people can't figure out that google is doing this because their business model is based on "targeted advertising", which necessarily requires gathering as much personal information as possible. All of their products are designed to give them different kinds of data, and being the man-in-the-middle to the entire internet on a per-household basis gives Google an incredibly fine-grained picture of the patter-of-life of the people that use their ISP service. Being able to steal Comcast's market is just a nice side benefit.

jpatokal 11y ago
Genuinely curious here: what additional data would Google get as an ISP that it doesn't already get via search, Gmail, ads, etc? Or do you mean "man-in-the-middle" in the cryptographic sense, and you think Google is playing mini-NSA and start spoofing Facebook certs so it can eavesdrop on SSL connections or something? See also Google Fiber's privacy policy: Other information from the use of Google Fiber Internet (such as URLs of websites visited or content of communications) will not be associated with the Google Account you use for Fiber, except with your consent or to meet any applicable law, regulation, legal process or enforceable governmental request. https://fiber.google.com/legal/privacy.html https://fiber.google.com/legal/privacy.html
- yummyfajitas 11y ago
  MITM attacks. Verizon currently injects tracking headers into HTTP pages. https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh A variety of ISP's (Comcast, MTNL, IDEA) also run MITM attacks and inject ads in pages, sometimes on behalf of law enforcement. I imagine they inject tracking as well. https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-altering-your-web-traffic/ https://blog.ryankearney.com/2013/01/comcast-caught-intercep... https://medium.com/@sushubh/delhi-police-is-literally-doing-a-mitm-attack-on-all-mtnl-broadband-subscribers-in-delhi-these-days-e26e4d673e50 https://medium.com/@sushubh/delhi-police-is-literally-doing-... Google could either do these things or block others from doing them.
- stephenr 11y ago
  with your consent - when's the last time you actually read a the terms and conditions of your account? Honestly even if you take that as meaning they won't ever track history of internet access to a google account, why would you assume they need to do that, just to have more information on you? It's not like you escape their privacy invating antics if you just use google search (or a site with google ads) without an account.
- xienze 11y ago
  Well the problem with info gathered via search, GMail, etc. is that they can only capture info about things that go through their servers. With access to the Internet connection you can gather info about other sites the user visits, when they're typically online, how long they spend playing XBox, etc.
- pdkl95 11y ago
  While they certainly can pull a man-in-the-middle in the cryptographic sense (DJB gave an outstanding talk[1] that discusses this problem), you seem to be assuming a lot. Google doesn't get much data from me at all (spyware like google analytics is blocked at the router, and I started blocking ads before Firefox existed). Even if you ignore that, there is a lot of traffic that Google normally doesn't have access to that they would be able to log as the ISP. They get some of this already when people choose to hand Google their DNS traffic, but being the ISP makes this complete. You may want to also watch Aral Balkan's talk posted just above DJB's at the same URL; he does a better job than I can at describing how Google (and Facebook, etc) are using surveillance-as-a-business-model. > Google Fiber's privacy policy The risk of a national security letter (which the part you quoted includes as an exception) is already enough of a reason to limit how much personal data is in a single database, that's not the main problem. That policy isn't a binding contract. Do you really think it won't be changed the moment someone at Google decides it would be profitable? They promised "Nest" data would stay separate, too, which quickly changed to sharing "limited" data. Sorry, but promises not to snoop don't mean much when the promise contradicts their business model. [1] https://projectbullrun.org/surveillance/2015/video-2015.html#bernstein https://projectbullrun.org/surveillance/2015/video-2015.html...
  - IshKebab 11y ago
    You are not typical.
- a3n 11y ago
  Just knowing that I visit the sites that I do is more than google gets now. Although I have a legacy google account, I'm never logged in. I don't use gmail. So the only thing they know about me is when I visit a site displaying their ads. If they were my ISP, they'd know everywhere I go, they'd know who I use for email, they'd know my address and my payment reliability. Probably lots more, I'm not as smart as they are.
mseebach 11y ago
And I'm always amazed at the lengths people will go to in pushing the "Google is an ad company" trope. Your argument doesn't make sense, especially not with the rapid migration of traffic to SSL (and no, Google aren't MITM'ing SSL connections). The lifetime value of a single family's worth of ad-eyeballs simply isn't there to justify an undertaking of the size of Fiber. Yes, they are ultimately an ad-company, but that doesn't mean that there is always a single-hop connection between any Google activity and ad revenue. If there's an ad angle here, it's in enabling end users to consume much larger quantities of ad-supported content.
- exelius 11y ago
  > And I'm always amazed at the lengths people will go to in pushing the "Google is an ad company" trope. When 95% of your revenue comes from ad sales, you're an ad company.
  - mseebach 11y ago
    And I conceded as much. But for all its truth, it just doesn't give you a useful analytical framework for reasoning about Google and what they do.
    - roymurdock 11y ago
      Always a good idea to weigh financials heavily when analyzing a company's strategy. After all, that's what the C-suite and investors are doing. Granted, they have more info than us, the public, but sources of revenue are an important part of the framework for sure. Perhaps it makes more sense that Google is investing in high-cost infrastructure because they want to move away from the ad-model business. It's risky to have 95% of your revenue coming from a single industry. Google can eat a lot of the costs of setting up a better network, which is a great investment in the future if you're betting that a majority of people will need high speed internet access 10-20 years from now. Then they can start extracting monopoly profits just as AT&T, Verizon, Comcast etc. do now.
      - 11y ago

by pdkl95 11y ago

jpatokal 11y ago

Genuinely curious here: what additional data would Google get as an ISP that it doesn't already get via search, Gmail, ads, etc? Or do you mean "man-in-the-middle" in the cryptographic sense, and you think Google is playing mini-NSA and start spoofing Facebook certs so it can eavesdrop on SSL connections or something? See also Google Fiber's privacy policy: Other information from the use of Google Fiber Internet (such as URLs of websites visited or content of communications) will not be associated with the Google Account you use for Fiber, except with your consent or to meet any applicable law, regulation, legal process or enforceable governmental request. https://fiber.google.com/legal/privacy.html https://fiber.google.com/legal/privacy.html

yummyfajitas 11y ago
MITM attacks. Verizon currently injects tracking headers into HTTP pages. https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh A variety of ISP's (Comcast, MTNL, IDEA) also run MITM attacks and inject ads in pages, sometimes on behalf of law enforcement. I imagine they inject tracking as well. https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-altering-your-web-traffic/ https://blog.ryankearney.com/2013/01/comcast-caught-intercep... https://medium.com/@sushubh/delhi-police-is-literally-doing-a-mitm-attack-on-all-mtnl-broadband-subscribers-in-delhi-these-days-e26e4d673e50 https://medium.com/@sushubh/delhi-police-is-literally-doing-... Google could either do these things or block others from doing them.
stephenr 11y ago
with your consent - when's the last time you actually read a the terms and conditions of your account? Honestly even if you take that as meaning they won't ever track history of internet access to a google account, why would you assume they need to do that, just to have more information on you? It's not like you escape their privacy invating antics if you just use google search (or a site with google ads) without an account.
xienze 11y ago
Well the problem with info gathered via search, GMail, etc. is that they can only capture info about things that go through their servers. With access to the Internet connection you can gather info about other sites the user visits, when they're typically online, how long they spend playing XBox, etc.
pdkl95 11y ago
While they certainly can pull a man-in-the-middle in the cryptographic sense (DJB gave an outstanding talk[1] that discusses this problem), you seem to be assuming a lot. Google doesn't get much data from me at all (spyware like google analytics is blocked at the router, and I started blocking ads before Firefox existed). Even if you ignore that, there is a lot of traffic that Google normally doesn't have access to that they would be able to log as the ISP. They get some of this already when people choose to hand Google their DNS traffic, but being the ISP makes this complete. You may want to also watch Aral Balkan's talk posted just above DJB's at the same URL; he does a better job than I can at describing how Google (and Facebook, etc) are using surveillance-as-a-business-model. > Google Fiber's privacy policy The risk of a national security letter (which the part you quoted includes as an exception) is already enough of a reason to limit how much personal data is in a single database, that's not the main problem. That policy isn't a binding contract. Do you really think it won't be changed the moment someone at Google decides it would be profitable? They promised "Nest" data would stay separate, too, which quickly changed to sharing "limited" data. Sorry, but promises not to snoop don't mean much when the promise contradicts their business model. [1] https://projectbullrun.org/surveillance/2015/video-2015.html#bernstein https://projectbullrun.org/surveillance/2015/video-2015.html...
- IshKebab 11y ago
  You are not typical.
a3n 11y ago
Just knowing that I visit the sites that I do is more than google gets now. Although I have a legacy google account, I'm never logged in. I don't use gmail. So the only thing they know about me is when I visit a site displaying their ads. If they were my ISP, they'd know everywhere I go, they'd know who I use for email, they'd know my address and my payment reliability. Probably lots more, I'm not as smart as they are.

mseebach 11y ago

And I'm always amazed at the lengths people will go to in pushing the "Google is an ad company" trope. Your argument doesn't make sense, especially not with the rapid migration of traffic to SSL (and no, Google aren't MITM'ing SSL connections). The lifetime value of a single family's worth of ad-eyeballs simply isn't there to justify an undertaking of the size of Fiber. Yes, they are ultimately an ad-company, but that doesn't mean that there is always a single-hop connection between any Google activity and ad revenue. If there's an ad angle here, it's in enabling end users to consume much larger quantities of ad-supported content.

exelius 11y ago
> And I'm always amazed at the lengths people will go to in pushing the "Google is an ad company" trope. When 95% of your revenue comes from ad sales, you're an ad company.
- mseebach 11y ago
  And I conceded as much. But for all its truth, it just doesn't give you a useful analytical framework for reasoning about Google and what they do.
  - roymurdock 11y ago
    Always a good idea to weigh financials heavily when analyzing a company's strategy. After all, that's what the C-suite and investors are doing. Granted, they have more info than us, the public, but sources of revenue are an important part of the framework for sure. Perhaps it makes more sense that Google is investing in high-cost infrastructure because they want to move away from the ad-model business. It's risky to have 95% of your revenue coming from a single industry. Google can eat a lot of the costs of setting up a better network, which is a great investment in the future if you're betting that a majority of people will need high speed internet access 10-20 years from now. Then they can start extracting monopoly profits just as AT&T, Verizon, Comcast etc. do now.
    - 11y ago