5 ms·

As noted in the comments this is hardly an oversight, the plugin page acknowledges the behavior: "In addition to the practices described in the Google +1 Butto

by ot 15y ago

As noted in the comments this is hardly an oversight, the plugin page acknowledges the behavior: "In addition to the practices described in the Google +1 Button Privacy Policy, by installing this extension, all of the pages and URLs you visit will be sent to Google in order to retrieve +1 information. Examples of this information include whether you’ve previously +1’d the page and how many people have already +1’d the page. Google’s use of this information is described further in the following help center article (http://www.google.com/support/profiles/bin/answer.py?hl=en&answer=1319578 http://www.google.com/support/profiles/bin/answer.py?hl=en&#...). " Tracking HTTPS traffic is really the big deal and it will probably be patched. For the rest, it is just like Google Toolbar, Internet Explorer, Bing Toolbar, etc... Search engines need desperately this kind of data, it is not surprising that they try sneak "trackers" in any browser/extension, it is just unfortunate that they are not clear about it.

esrauch 15y ago
The link that you put in your post is in it's entirety about how they are not tracking you and not logging these requests for each user. The quoted portion you mentioned is just pointing out that in order to get a count of the +1's on a page you have to send a request to google to see that count. There is no conceivable way for it to show information without requesting it first. This isn't some sneaky side effect of the button, it is literally just the only functionality of the extension. They will probably still patch this to at least have a setting to not display +1's on https websites, but I don't really see where all this tracking talk came from.
- roryokane 15y ago
  Google could still uniquely identify sites while protecting your privacy by sending a hash of the URL from your browser, rather than the full URL itself, and comparing that hash to the hashes of all +1ed sites. People are talking about tracking because Google hasn’t chosen to implement their extension like this.
  - arebop 15y ago
    Would the hash scheme you have in mind be vulnerable to rainbow tables?
  - eneveu 15y ago
    A problem with sending a hash of the URL, is that you cannot canonicalize the URL on the server side anymore. A simple example: the hash of "http://www.foo.com/bar/ http://www.foo.com/bar/ would differ from the hash of "http://www.foo.com/bar http://www.foo.com/bar. I guess you could do some canonicalization on the client-side, though...
  - esrauch 15y ago
    I don't really understand how you imagine it to work. You want them to just have a huge dumb store of hash -> count mappings without them having any meaning? That would completely defeat the purpose of +1s, they couldn't put what +1s you had on your profile or use it for recommendations or whatever. Even if this was the case, it would be trivially easy for them to get the hash -> url mappings at any time since they already effectively crawl the entire internet or a daily or weekly basis, all they would have to do is add a single entry to the pipeline. If you are saying that they should have a database where the columns are (url, hash, count) and just have the browser send the hash, that is exactly the same as just encrypting the url, and the request is being sent of https. What sort of security do you think you would have from hashing that is lacking in SSL?

by ot 15y ago

esrauch 15y ago

The link that you put in your post is in it's entirety about how they are not tracking you and not logging these requests for each user. The quoted portion you mentioned is just pointing out that in order to get a count of the +1's on a page you have to send a request to google to see that count. There is no conceivable way for it to show information without requesting it first. This isn't some sneaky side effect of the button, it is literally just the only functionality of the extension. They will probably still patch this to at least have a setting to not display +1's on https websites, but I don't really see where all this tracking talk came from.

roryokane 15y ago
Google could still uniquely identify sites while protecting your privacy by sending a hash of the URL from your browser, rather than the full URL itself, and comparing that hash to the hashes of all +1ed sites. People are talking about tracking because Google hasn’t chosen to implement their extension like this.
- arebop 15y ago
  Would the hash scheme you have in mind be vulnerable to rainbow tables?
- eneveu 15y ago
  A problem with sending a hash of the URL, is that you cannot canonicalize the URL on the server side anymore. A simple example: the hash of "http://www.foo.com/bar/ http://www.foo.com/bar/ would differ from the hash of "http://www.foo.com/bar http://www.foo.com/bar. I guess you could do some canonicalization on the client-side, though...
- esrauch 15y ago
  I don't really understand how you imagine it to work. You want them to just have a huge dumb store of hash -> count mappings without them having any meaning? That would completely defeat the purpose of +1s, they couldn't put what +1s you had on your profile or use it for recommendations or whatever. Even if this was the case, it would be trivially easy for them to get the hash -> url mappings at any time since they already effectively crawl the entire internet or a daily or weekly basis, all they would have to do is add a single entry to the pipeline. If you are saying that they should have a database where the columns are (url, hash, count) and just have the browser send the hash, that is exactly the same as just encrypting the url, and the request is being sent of https. What sort of security do you think you would have from hashing that is lacking in SSL?