5 ms·

Genuinely curious here: what additional data would Google get as an ISP that it doesn't already get via search, Gmail, ads, etc? Or do you mean "man-in-the-mid

Genuinely curious here: what additional data would Google get as an ISP that it doesn't already get via search, Gmail, ads, etc? Or do you mean "man-in-the-middle" in the cryptographic sense, and you think Google is playing mini-NSA and start spoofing Facebook certs so it can eavesdrop on SSL connections or something? See also Google Fiber's privacy policy: Other information from the use of Google Fiber Internet (such as URLs of websites visited or content of communications) will not be associated with the Google Account you use for Fiber, except with your consent or to meet any applicable law, regulation, legal process or enforceable governmental request. https://fiber.google.com/legal/privacy.html https://fiber.google.com/legal/privacy.html

yummyfajitas 11y ago
MITM attacks. Verizon currently injects tracking headers into HTTP pages. https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh A variety of ISP's (Comcast, MTNL, IDEA) also run MITM attacks and inject ads in pages, sometimes on behalf of law enforcement. I imagine they inject tracking as well. https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-altering-your-web-traffic/ https://blog.ryankearney.com/2013/01/comcast-caught-intercep... https://medium.com/@sushubh/delhi-police-is-literally-doing-a-mitm-attack-on-all-mtnl-broadband-subscribers-in-delhi-these-days-e26e4d673e50 https://medium.com/@sushubh/delhi-police-is-literally-doing-... Google could either do these things or block others from doing them.
stephenr 11y ago
with your consent - when's the last time you actually read a the terms and conditions of your account? Honestly even if you take that as meaning they won't ever track history of internet access to a google account, why would you assume they need to do that, just to have more information on you? It's not like you escape their privacy invating antics if you just use google search (or a site with google ads) without an account.
xienze 11y ago
Well the problem with info gathered via search, GMail, etc. is that they can only capture info about things that go through their servers. With access to the Internet connection you can gather info about other sites the user visits, when they're typically online, how long they spend playing XBox, etc.
pdkl95 11y ago
While they certainly can pull a man-in-the-middle in the cryptographic sense (DJB gave an outstanding talk[1] that discusses this problem), you seem to be assuming a lot. Google doesn't get much data from me at all (spyware like google analytics is blocked at the router, and I started blocking ads before Firefox existed). Even if you ignore that, there is a lot of traffic that Google normally doesn't have access to that they would be able to log as the ISP. They get some of this already when people choose to hand Google their DNS traffic, but being the ISP makes this complete. You may want to also watch Aral Balkan's talk posted just above DJB's at the same URL; he does a better job than I can at describing how Google (and Facebook, etc) are using surveillance-as-a-business-model. > Google Fiber's privacy policy The risk of a national security letter (which the part you quoted includes as an exception) is already enough of a reason to limit how much personal data is in a single database, that's not the main problem. That policy isn't a binding contract. Do you really think it won't be changed the moment someone at Google decides it would be profitable? They promised "Nest" data would stay separate, too, which quickly changed to sharing "limited" data. Sorry, but promises not to snoop don't mean much when the promise contradicts their business model. [1] https://projectbullrun.org/surveillance/2015/video-2015.html#bernstein https://projectbullrun.org/surveillance/2015/video-2015.html...
- IshKebab 11y ago
  You are not typical.
a3n 11y ago
Just knowing that I visit the sites that I do is more than google gets now. Although I have a legacy google account, I'm never logged in. I don't use gmail. So the only thing they know about me is when I visit a site displaying their ads. If they were my ISP, they'd know everywhere I go, they'd know who I use for email, they'd know my address and my payment reliability. Probably lots more, I'm not as smart as they are.

yummyfajitas 11y ago

MITM attacks. Verizon currently injects tracking headers into HTTP pages. https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh A variety of ISP's (Comcast, MTNL, IDEA) also run MITM attacks and inject ads in pages, sometimes on behalf of law enforcement. I imagine they inject tracking as well. https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-altering-your-web-traffic/ https://blog.ryankearney.com/2013/01/comcast-caught-intercep... https://medium.com/@sushubh/delhi-police-is-literally-doing-a-mitm-attack-on-all-mtnl-broadband-subscribers-in-delhi-these-days-e26e4d673e50 https://medium.com/@sushubh/delhi-police-is-literally-doing-... Google could either do these things or block others from doing them.

stephenr 11y ago

with your consent - when's the last time you actually read a the terms and conditions of your account? Honestly even if you take that as meaning they won't ever track history of internet access to a google account, why would you assume they need to do that, just to have more information on you? It's not like you escape their privacy invating antics if you just use google search (or a site with google ads) without an account.

xienze 11y ago

Well the problem with info gathered via search, GMail, etc. is that they can only capture info about things that go through their servers. With access to the Internet connection you can gather info about other sites the user visits, when they're typically online, how long they spend playing XBox, etc.

pdkl95 11y ago

While they certainly can pull a man-in-the-middle in the cryptographic sense (DJB gave an outstanding talk[1] that discusses this problem), you seem to be assuming a lot. Google doesn't get much data from me at all (spyware like google analytics is blocked at the router, and I started blocking ads before Firefox existed). Even if you ignore that, there is a lot of traffic that Google normally doesn't have access to that they would be able to log as the ISP. They get some of this already when people choose to hand Google their DNS traffic, but being the ISP makes this complete. You may want to also watch Aral Balkan's talk posted just above DJB's at the same URL; he does a better job than I can at describing how Google (and Facebook, etc) are using surveillance-as-a-business-model. > Google Fiber's privacy policy The risk of a national security letter (which the part you quoted includes as an exception) is already enough of a reason to limit how much personal data is in a single database, that's not the main problem. That policy isn't a binding contract. Do you really think it won't be changed the moment someone at Google decides it would be profitable? They promised "Nest" data would stay separate, too, which quickly changed to sharing "limited" data. Sorry, but promises not to snoop don't mean much when the promise contradicts their business model. [1] https://projectbullrun.org/surveillance/2015/video-2015.html#bernstein https://projectbullrun.org/surveillance/2015/video-2015.html...

IshKebab 11y ago
You are not typical.

a3n 11y ago

Just knowing that I visit the sites that I do is more than google gets now. Although I have a legacy google account, I'm never logged in. I don't use gmail. So the only thing they know about me is when I visit a site displaying their ads. If they were my ISP, they'd know everywhere I go, they'd know who I use for email, they'd know my address and my payment reliability. Probably lots more, I'm not as smart as they are.