4 ms·

David's 5th point is the most important, at least in my opinion. By Google running DNS, they can potentially collect your complete browsing behavior (since you

by phsr 17y ago

David's 5th point is the most important, at least in my opinion. By Google running DNS, they can potentially collect your complete browsing behavior (since you'll go through their server all the time, not only when you search with them).

robotron 17y ago
http://code.google.com/speed/public-dns/privacy.html http://code.google.com/speed/public-dns/privacy.html
- tptacek 17y ago
  Compare to: http://www.opendns.com/privacy/ http://www.opendns.com/privacy/ Heh.
  - rimantas 17y ago
    What's interesting, David links only to OpenDNS policy, but does not provide a link to Google's which would make an easier to compare…
    - sriramk 17y ago
      Wow - OpenDNS's privavy policy is much worse than Google's!
- chris100 17y ago
  Not to be paranoid, but where does it say that their privacy policy won't change? Right now, the privacy policy looks great on the surface. They are launching a new product. But you can't deny that Google's entire DNA is to extract monetizable information from huge amount of seemlingly unrelated raw data. That's why you have to take their privacy policy with a grain of salt.
  - bm98 17y ago
    If Google deletes all of its personally-identifiable data within 48 hours, then the risk to current users of any future privacy policy change is small. The real problem is when a service collects -- and never purges -- data under the guise of one privacy policy, but leaves the door open to adopting a different privacy policy which could be retroactively applied to the data already collected. I'm no lawyer, but the OpenDNS privacy policy does appear to fall into that category: "Your continued use of our sites and services after any change in this Privacy Policy will constitute your acceptance of such change." Right, and if I stop using the service when the policy changes, will my old data be automatically flagged so that it still falls under the old policy?
    - pyre 17y ago
      Privacy Policy Changes OpenDNS may change its Privacy Policy from time to time, and in OpenDNS' sole discretion. OpenDNS encourages visitors to frequently check this page for any changes to its Privacy Policy. If changes are made, notice will be given in the OpenDNS sites and the OpenDNS blog at http://blog.opendns.com/ and we *may* send an email to registered using to notify them of the change. Your continued use of our sites and services after any change in this Privacy Policy will constitute your acceptance of such change. So you may have a notice pushed out to you, but you may not. If you use OpenDNS to make the DNS request to to view their blog to read the new privacy policy, technically you have already made use of their service under the new terms. Oops. Edit: emphasis in the quote was mine
tptacek 17y ago
The funny part about this claim is that 90+% of Internet users use DNS solely to get to Google. It's really a choice between having one big company tracking your habits, or two, one of which is small, under intense pressure, and hungry.
- marltod 17y ago
  That isn't how DNS works. It is true that 90% of users go directly to google, but once there they click on Search results, news results, etc... The browser takes the link and the OS does a DNS lookup to get the ip address of the server hosting that url. Then the browser connects to that server, google is no longer in the picture.
  - dmnd 17y ago
    The point was that, for most users, Google is an abstraction over URLs, just like DNS is an abstraction over IP addresses.
    - Kadin 17y ago
      Exactly. A lot of people don't remember domain names anymore, they remember the words they need to type into Google in order to bring that site up as the top link. E.g., if they want to get to Dell's website, rather than typing "dell.com" into the URL field, they type "dell" or "dell computer" into the search box and then click on the first result.
      - Retric 17y ago
        Oddly enough this relates to all the domain squatters out there. If you misstype something into the search bar you don't know what you get, but by clicking on the first link in Google you are taken the to the "reputable" site. So a reputable DNS service that did this automatically would be a direct threat to Google.
        tptacek 17y ago
jeff18 17y ago
Sadly, it's just FUD, and it appears to be spreading.
Kadin 17y ago
I'm not sure how much of a concern that is for most users, who use Google to get to all the content on the Internet anyway. Having DNS records wouldn't buy Google much that they don't already have from search queries and results. It's getting to be a very rare (non-technical) user who actually types URLs directly into their browser; most people go through Google, even to get to sites where the domain name and site name are exactly the same. They're hitting Google for every single site they visit already.
eli 17y ago
I honestly don't think they would be that evil (and the privacy policy as currently stated would forbid that), but they can collect aggregate data and infer what sites are popular at what times and from what geographic/network locations. That's useful data. I bet you could use it to create web stats that are at least as good as Alexa (admittedly a low bar).
earl 17y ago
Um, they already have Google Analytics and their search toolbar. I rather doubt there is much they don't see.

by phsr 17y ago

robotron 17y ago

http://code.google.com/speed/public-dns/privacy.html http://code.google.com/speed/public-dns/privacy.html

tptacek 17y ago
Compare to: http://www.opendns.com/privacy/ http://www.opendns.com/privacy/ Heh.
- rimantas 17y ago
  What's interesting, David links only to OpenDNS policy, but does not provide a link to Google's which would make an easier to compare…
  - sriramk 17y ago
    Wow - OpenDNS's privavy policy is much worse than Google's!
chris100 17y ago
Not to be paranoid, but where does it say that their privacy policy won't change? Right now, the privacy policy looks great on the surface. They are launching a new product. But you can't deny that Google's entire DNA is to extract monetizable information from huge amount of seemlingly unrelated raw data. That's why you have to take their privacy policy with a grain of salt.
- bm98 17y ago
  If Google deletes all of its personally-identifiable data within 48 hours, then the risk to current users of any future privacy policy change is small. The real problem is when a service collects -- and never purges -- data under the guise of one privacy policy, but leaves the door open to adopting a different privacy policy which could be retroactively applied to the data already collected. I'm no lawyer, but the OpenDNS privacy policy does appear to fall into that category: "Your continued use of our sites and services after any change in this Privacy Policy will constitute your acceptance of such change." Right, and if I stop using the service when the policy changes, will my old data be automatically flagged so that it still falls under the old policy?
  - pyre 17y ago
    Privacy Policy Changes OpenDNS may change its Privacy Policy from time to time, and in OpenDNS' sole discretion. OpenDNS encourages visitors to frequently check this page for any changes to its Privacy Policy. If changes are made, notice will be given in the OpenDNS sites and the OpenDNS blog at http://blog.opendns.com/ and we *may* send an email to registered using to notify them of the change. Your continued use of our sites and services after any change in this Privacy Policy will constitute your acceptance of such change. So you may have a notice pushed out to you, but you may not. If you use OpenDNS to make the DNS request to to view their blog to read the new privacy policy, technically you have already made use of their service under the new terms. Oops. Edit: emphasis in the quote was mine

tptacek 17y ago

The funny part about this claim is that 90+% of Internet users use DNS solely to get to Google. It's really a choice between having one big company tracking your habits, or two, one of which is small, under intense pressure, and hungry.

marltod 17y ago
That isn't how DNS works. It is true that 90% of users go directly to google, but once there they click on Search results, news results, etc... The browser takes the link and the OS does a DNS lookup to get the ip address of the server hosting that url. Then the browser connects to that server, google is no longer in the picture.
- dmnd 17y ago
  The point was that, for most users, Google is an abstraction over URLs, just like DNS is an abstraction over IP addresses.
  - Kadin 17y ago
    Exactly. A lot of people don't remember domain names anymore, they remember the words they need to type into Google in order to bring that site up as the top link. E.g., if they want to get to Dell's website, rather than typing "dell.com" into the URL field, they type "dell" or "dell computer" into the search box and then click on the first result.
    - Retric 17y ago
      Oddly enough this relates to all the domain squatters out there. If you misstype something into the search bar you don't know what you get, but by clicking on the first link in Google you are taken the to the "reputable" site. So a reputable DNS service that did this automatically would be a direct threat to Google.
      - tptacek 17y ago

jeff18 17y ago

Sadly, it's just FUD, and it appears to be spreading.

Kadin 17y ago

I'm not sure how much of a concern that is for most users, who use Google to get to all the content on the Internet anyway. Having DNS records wouldn't buy Google much that they don't already have from search queries and results. It's getting to be a very rare (non-technical) user who actually types URLs directly into their browser; most people go through Google, even to get to sites where the domain name and site name are exactly the same. They're hitting Google for every single site they visit already.

eli 17y ago

I honestly don't think they would be that evil (and the privacy policy as currently stated would forbid that), but they can collect aggregate data and infer what sites are popular at what times and from what geographic/network locations. That's useful data. I bet you could use it to create web stats that are at least as good as Alexa (admittedly a low bar).

earl 17y ago

Um, they already have Google Analytics and their search toolbar. I rather doubt there is much they don't see.