Is the Google Toolbar spyware (tracks your navigation)?

[Vanguard]

I was having problems getting to some web sites, like
http://www.creative.com. IE6 would time out with a page not found or
DNS error. Going through http://www.anonymizer.com proved the site was
up and responsive. A DNS lookup worked okay, too. A local traceroute
showed that I could reach that site. I cleared my firewall's logs and
then tried another connect. What I saw for the URL for the connect was:
http://216.239.37.104/search?client=...ative%2Ecom%2F

This showed that I was first getting sent to the IP addressed site which
then redirected me to the URL that I had specified. The IP address
often changes but a check on them at ARIN's WhoIs showed they were
allocated to Google. I used BHO Demon to disable the Google toolbar BHO
(browser helper object) but the URL still showed that I was going
through Google's host first. I then uninstalled the Google Toolbar and,
voila, the URL used for the connection as evidenced in my firewall log
showed the URL that I had entered instead of going through Google's
hosts.

Originally I thought the problem with reaching the web site was caused
by Norton Anti-Virus (NAV) because of the "navclient" in the URL
parameters. Disabling NAV didn't help. As I was searching through the
registry to find references to "google", I found "nav" subkeys. That's
what triggered me to uninstall Google and retest to see if the URLs used
were what I specified instead of getting redirected through their hosts
(and it worked).

I did NOT have the Page Ranking or Categories options enabled. This
incurs privacy concerns as Google mentions in that the sites you visit
will get recorded (so they can update their rankings and determine what
other sites might be like the one you just visited, and why they have to
know where you visited). With these privacy divulging options disabled,
Google should have no idea to where I am navigating, especially when not
using anything of their service.

SpyBot's threat list only mentions that the tracking list leaves you
susceptible to someone else prying on your computer to check the Google
history list to see where you have been. I could not post to their
support forum (because I never got the confirmation e-mail letting me
validate a new registration) but sent the SpyBot folks an e-mail asking
if the Google Toolbar should be updated to reflect that the Google
Toolbar can and will track your web navigation. I uninstalled their
Google Toolbar and now the URLs for the connects are just what I
specified and no longer go through Google's hosts. I can also now get
to sites that were unreachable before (because their host was somehow
screwed up).

So until Google responds as to why my URLs are getting forced through
their servers (when no privacy divulging options are enabled), I
consider their toolbar as spyware in that it lets them record where you
have navigated. I'll still use Google for searches but only by opening
a page to their web site and NOT by using their toolbar. I used their
toolbar for a long time and found it quite handy. It's still handy if
you don't mind them recording everywhere that you navigate.

--
__________________________________________________ __________
** Share with others. Post replies in the newsgroup.
** If present, remove all "-nix" from my email address.
__________________________________________________ __________

[Doug]

Can't you reason that one out for yourself - Here's a hint. . .

If they can they will and if there's money in it you can damn well bet
your ass they already are.

[Vanguard]

But tracking your navigation is NOT mentioned as the danger in the
threat defined at SpyBot. The only threat mentioned is the history, if
you leave it enabled, that resides on your host that someone else could
look at. Also, I'm not sure that version 1 of the Google Toolbar was
directing me through their hosts. This seems a recent problem that I
encountered and suspect that version 2 now does this, but I cannot
download the old version to see what happens with it. Google should
only track your navigation when their Page Ranking and/or Categories
options are enabled, as that is what they claim.

When you install the Google Toolbar, you have 2 options:

Enable advanced features (anonymous information sent to Google)
Disable advanced features (no information sent to Google)

The "advanced" features include the Page Ranking and Categories options
and might include the Page Info option. I uninstalled, cleaned up any
remnant files and registry entries, and reinstalled. This time the URLs
recorded in the log files of my firewall showed the URL that I entered
so they no longer were going to Google's hosts. Okay, so perhaps
something got screwed up in Google. I did have the Categories option
enabled at one time but choose later to disable it and maybe the Google
Toolbar screwed up by not fully disabling that option. So my suspicion
of the Google Toolbar has somewhat been calmed. It does seem rather
stupid that their advanced features which sends "anonymous" information
to
Google has to go through their servers which means you put more between
you and the target site. You'd think they would send that information
in a separate windowless HTTP connection.

However, I still run into the problem that when the Google Toolbar is
installed that I cannot get to some web sites, like
http://www.creative.com or http://www.soundblaster.com. I can get to
http://www.americas.creative.com/ but often the links there will take me
back to one of the other sites that I cannot reach when the Google
Toolbar is installed. So this BHO (browser helper object) is
interfering with my browser's ability to navigate to some web site.
That in itself qualifies its removal.

--
__________________________________________________ __________
** Share with others. Post replies in the newsgroup.
** If present, remove all "-nix" from my email address.
__________________________________________________ __________


"Doug" <DeliverSpam@CityDump.Com> wrote in message
news:r6btlvsdh9m326eadjssc682l8oeq5j4q9@4ax.com...
>
> Can't you reason that one out for yourself - Here's a hint. . .
>
> If they can they will and if there's money in it you can damn well bet
> your ass they already are.

[Data64]

"Vanguard" <rztqf6v02-nix@sneakemail-nix.com> wrote in news:vXQ7b.415338
$uu5.74857@sccrnsc04:

I am not trying to be a troll, just curious. Why exactly do you use
google bar ?

To search google I go to the address box and type
"g spyware" to search for spyware. If I wanted to search in google groups
then I would type "gg spyware" and so on.
This works in IE too (although I use it in Mozilla) using the QuickSearch
web accessory from Microsoft.
http://www.microsoft.com/windows/ie/...cess/ie5wa.asp




data64

[Dick Justice]

"Data64" <me@privacy.net> wrote in message
news:Xns93F2E606A1DBFData64Bigfootcom@130.133.1.4. ..
> "Vanguard" <rztqf6v02-nix@sneakemail-nix.com> wrote in news:vXQ7b.415338
> $uu5.74857@sccrnsc04:
>
> I am not trying to be a troll, just curious. Why exactly do you use
> google bar ?
>
> To search google I go to the address box and type
> "g spyware" to search for spyware. If I wanted to search in google groups
> then I would type "gg spyware" and so on.
> This works in IE too (although I use it in Mozilla) using the QuickSearch
> web accessory from Microsoft.
> http://www.microsoft.com/windows/ie/...cess/ie5wa.asp

I wasn't aware of that search feature!

[Jay T. Blocksom]

On Tue, 09 Sep 2003 23:36:23 GMT, in <alt.privacy.spyware>, "Vanguard"
<rztqf6v02-nix@sneakemail-nix.com> wrote:
>
> Subject: Is the Google Toolbar spyware (tracks your navigation)?
[snip]

<http://www.google-watch.org/bigbro.html>

See bullet-point #6, in particular.

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[Vanguard]

I have the IE5 Web Accessories installed (for IE6). Entering "g
<anything>" just brings up the MSN search results. For me, that
technique doesn't work to use Google. Then I hunted around a bit more.
I opened the Search pane and clicked the Customize button. I saw the
Autosearch Settings buttons and clicked on that. You then get a
drop-down listbox of providers to use for the auto-search where you can
then select Google. However, entering "g firewall" and "gg firewall"
resulted in both just doing a Google Web Search; i.e., the "gg firewall"
did not display a search result from Google Groups. In fact, using "g
firewall" resulted in a Google Web Search on "g firewall" and using "gg
firewall" resulted in a search on "gg firewall". It looks like you are
still expected to use "? <string>", "go <string>", or "find firewall" to
do the auto-search from the Address bar. All the [Google] search will
default to using the Google Web category. You have to click the
QuickSearch link that the Web Accessories install put into your Links
toolbar and add the definitions:

For Google Web Search: g = http://www.google.com/search?q=%s
For Google Groups Search: gg = http://groups.google.com/groups?q=%s
For Google Images Search: gi = http://images.google.com/images?q=%s
For Google Directory Search: gd =
http://www.google.com/search?cat=gwd%%2FTop&q=%s
For Google News Search: gn = http://news.google.com/news?q=%s

Note the doubled percent sign ("%%") in the URL specified in the
QuickSearch definition; it is needed to escape the "%" used for the
"%2F" hexadecimal value for the "/" character needed in the resultant
URL (the original URL was
http://www.google.com/search?cat=gwd%2FTop&q=%s). That's a lot of work
and a bit of research to find the shortest URLs that you can use just to
replace the Google Toolbar. Also, you know have to remember all the
prefixes (g, gg, gd, gi, gn) to know where you will be searching, or
just use g for the search and then click on the other tabs in the
results page (which will then double the amount of time to do the search
since it gets performed again). And to understand what the Quicksearch
does, you'll have to visit http://snurl.com/ie_tools to get a glimpse on
how to use it from the terse description.

While you can select Google for the search engine used for the
AutoSearch feature in the Address bar, it doesn't appear as a choice for
a search engine in the Search pane. Google will let you select it as
the default search engine for the entire Search pane but not as a
selection of an additional search engine to include with other search
engines.

Other features that I like about the Google Toolbar:

- Search through the current site (instead of a Google search).
- Search for a dictionary definition of the search string.
- The Highlighter button to instantly highlight the search string in the
results page or in a page you navigate to from a Google search result
link. Lets you know where in the document the search string appears
without having to use Ctrl+F to do a find on the string.
- Word Find buttons (one for each word in the search string) that let
you walk through the results page or through a page you linked to from
the results page. You don't have to hit Ctrl+F nor is the Find dialog
window in your way.
- Having a separate history for searches (in the Google Toolbar) rather
than messing up the URL history list in your Address bar. In fact, I
had autosearch disabled in the advanced options because I didn't want
the search strings polluting my URL history in the Address bar drop-down
list, so Quicksearch wouldn't work anyway.
- Block popups, handy if you don't already have a popup blocker (I use
PopUp Cop). I suspect it is rather simplistic, however.
- Page Ranking (if you don't mind divulging "anonymous" statistics on
where you navigate, and that you don't have a problem getting the
intended target site through their server).

So there is enough handy extra features in the Google Toolbar that make
it desirable over using the more simplistic Address bar, having to
install the IE5 Web Accessories, and then having to manually configure
all those search prefixes and remember them. My big concern was that
they were recording my navigation to web sites even when all the
privacy-divulging options were disabled. An uninstall and reinstall
(using their downloadable installer rather than doing an on-demand
install) fixed that. The problem with not getting to some web sites
after installing the Google Toolbar went away after doing a re-install
of all components of IE6. There is also some suspicion that a Windows
Update occurred and got installed but required a reboot to complete and
might've contributed to the problem of some sites being unreachable. I
seemed to have slammed enough updates and reinstalls on my computer to
whack IE back into working now.

--
__________________________________________________ __________
** Share with others. Post replies in the newsgroup.
** If present, remove all "-nix" from my email address.
__________________________________________________ __________


"Data64" <me@privacy.net> wrote in message
news:Xns93F2E606A1DBFData64Bigfootcom@130.133.1.4. ..
> "Vanguard" <rztqf6v02-nix@sneakemail-nix.com> wrote in
news:vXQ7b.415338
> $uu5.74857@sccrnsc04:
>
> I am not trying to be a troll, just curious. Why exactly do you use
> google bar ?
>
> To search google I go to the address box and type
> "g spyware" to search for spyware. If I wanted to search in google
groups
> then I would type "gg spyware" and so on.
> This works in IE too (although I use it in Mozilla) using the
QuickSearch
> web accessory from Microsoft.
> http://www.microsoft.com/windows/ie/...cess/ie5wa.asp
>
>
>
>
> data64

[Vanguard]

I'm always leery of any "news" article, review, or anything analytical
that does not provide a datestamp. Notice that nowhere on this page is
a datestamp so the reader won't know if this is old or new news. There
is mention of July 2003 so the article had to written after that, and
based only on that tells you how recent is the information on this page.
I've seen online news or information web sites that don't put datestamps
in their articles so you do not know how relevant is the article. Old
news isn't necessarily bad unless it has become supplanted by more
recent events that makes that old news obsolete or inaccurate.

Regarding the points made on this page
(http://www.google-watch.org/bigbro.html):

1. Google's immortal cookie.

That's why it is important to use an *active* cookie manager. Not one
that you have to periodically run manually to do cleanup, but one that
runs all the time or whenever appropriate. Since the only appropriate
time is when you have your web browser open, it makes sense to use a
cookie manager that loads when you start your web browser. I use PopUp
Cop not only to eliminate popups but also because it has a cookie
manager that loads with IE (only works for IE, however). All cookies
will be deleted when you exit the last instance of IE unless you put
them in a whitelist to keep them. You also have the option to keep
non-whitelisted cookies from sites listed in the Trusted Zone, along
with the option to keep cookies that are not whitelisted in PopUp Cop
but are whitelisted in IE's cookie list with "Always Allow" status
(i.e., not whitelisted in PopUp Cop but whitelisted in IE).
[Per-]session cookies are supposed to expire and get deleted when you
exit IE but sometimes IE screws up (and sometimes you have to kill IE so
obviously it can't do the cleanup). Other cookies are supposed to have
an expiration but can put it so far into the future that they are
considered permanent. PopUp Cop's cookie management will eliminate any
cookies you haven't whitelisted when you exit IE. Poof, gone! All
non-whitelisted cookies are forced to be per-session cookies.

If you opt to not keep Google's cookie, you lose your Preferences
settings (configured at http://www.google.com/preferences), which means:

- You hope the correct language gets used to display the results page.
If Google has any intelligence in their web page design, they detect
your language and default to that one to show the results page, or maybe
you have to use a www.google.com.xx domain where xx is the TLD for your
country.

- SafeSearch defaults to moderate level. I prefer no filtering simply
because you don't know the mindset of whomever is judging what text and
images are "explicit". So some of my preference is lost without the
persistence of their cookie.

- The number of results shown per page is a measly 10. I would prefer
it at the max of 100. Google probably realizes that most users would
feel 10 is way too undersized and this would lure them to keep Google's
cookie. I do miss this preference.

- Opening search results in a new window. This is actually inaccurate.
It really means to open a link on which you click in the results page in
another window. But Google keeps reusing the same "other" window.
Usually I want them in separate windows for each result link that I
click, so I end up using the right-click and Open in New Window context
menu, anyway. No loss for me here by deleting their cookie.

2. Google records everything they can.

How does the author of this article know that Google collects the IP
address of the user connecting to their site? This would violate
Google's privacy policy which says that for the advanced options the
user would be sending *anonymous* data to Google, like to where they
navigated, when, search string, an possibly use Referrer to know from
whence you came to get to Google (if you don't block Referrer in your
firewall). Your IP address is clearly not considered truly anonymous
information regarding yourself (on the Internet) albeit it is not a
permanent identity. Since there have been other class action lawsuits
(which this article mentions) regarding the collection of uniquely
identifying information about users (remember RealPlayer which was
forced to make it optional?), this would open up Google to the same
penalization. The fact that Google has your IP address is not itself
newsworthy. Every site you ever visit will get your IP address. It's
part of IP so that to whom you connect knows where to talk back to so
that other host can send you status and their web page and image files.
If they didn't know your IP address, they wouldn't know to where to send
this stuff, and to you it would appear that site was dead.

3. Google retains all data indefinitely.

So do most companies. It's called backups. While a business may only
be liable for records dating back, say, 7 years, most will keep data
indefinitely (until they need to purge the really old stuff due to space
constraints).

4. Google won't say why they need this data.

Well, actually they do in their policies but as always these policies
are not detailed nor would the users care to read a 20-page document
delineating what all processes are implemented in handling, storing,
analyzing, or otherwise manipulating that data.

5. Google hires more spooks.

The real reason is probably to have an inside edge in developing their
technology. What company wouldn't take advantage of a legal avenue to
improve their product and/or bottom line?

6. Google's toolbar is spyware.

Yes (actually maybe), and for awhile I did get alarmed. I did not have
Page Ranking, Categories, or Page Info enabled but still saw my browser
getting directed to Google hosts and then redirected to the intended
URL. However, after some fix up, the problem went away and I figure
something screwed up Google, IE, Windows, or whatever or possibly the
software has a bug (perhaps fixed by uninstalling and resinstalling the
toolbar). Google tells you that some advanced options will divulge
anonymous information. If you want the advanced features, you also have
to help them in establishing and updating the information used in
providing those advanced features. So don't use the advanced features.
Personally I think it is stupid that Google routes you *through* their
hosts to reach your intended destination rather than send the anonymous
information via a separate connection. This seems to reduce reliability
that you reach the intended destination if their server has problems.

7. Google's cache copy is illegal.

I do agree that Google should NOT crawl across any web site unless the
robots.txt file permits it and/or the web site owner opts in to a Google
crawl.

8. Google is not your friend.

This section rambles a lot and I don't know the real intent of it. It
describes problems that are incurred with all search engines. Even
blacklists used by anti-spam products or the anti-spam filtering
products behave the same way. As far as trying to circumvent Google's
algorithms (which means you are trying to play unfair) and as far as
Google's non-disclosure of their proprietary property, well, gee, what
company does divulge this stuff and still survives?

9. Google is a privacy time bomb.

Since the only "personal" information Google ever gets from me is my IP
address, Google is hardly a time bomb waiting to divulge information
regarding every person that ever used them. Your IP address is not
permanent (unless you run a web site but that's not what this point
discusses). If you use dial-up, your IP address changes on every
connection. If you use DSL or cable, your IP address is leased for
something like 3 to 10 days (i.e., it is not permanent); you probably
will retain that IP address for a lot longer than the lease but once it
is past its expiration then your IP address can be changed (it changes
on your next connection, so if you power down and power back up then you
might get a different IP address). If you have a router that is always
on despite whether or not powering down and up your host then you
probably will retain the same IP address long after its expiration.
However, if you start getting abused on that IP address then you can
request your ISP to remove it from their pool for a period of time and
renegotiate with their DHCP server for a new IP address. If you're
inside a corporate network or other intranet then the only hazard
incurred by someone knowing your IP address is from someone within the
same intranet. This author hawks on a piddly "potential" abuse when
there are far larger and existing problems, like spam, viruses, zombies
and denial of service attacks, identity theft, and more. Rather than
worry about problems that *might* happen, focus on those that *are*
happening. My ISP also gets my IP connection on EVERY connect to them,
plus they have the "potential" to record everywhere that I navigate. Do
I consider them an even greater time bomb (for me) than Google? Of
course not.

The fix is easy: don't save their cookie and don't use the advanced
featues in their toolbar. As often remarked, "if it don't do what you
want, don't use it." Their toolbar is handy but it is non-essential
even for using their service. I'll have to see over time if their
toolbar screws up again and starts redirecting my URLs through their
hosts; if so then their toolbar cannot be trusted and will get
uninstalled, but I will continue to use the Google site for searches
(and continue to automatically delete their cookie). I don't see Google
being nearly as terrible a "potential" abuser as this author exhorts. I
*preferred* that my web navigation not be monitored, especially when not
even using their toolbar. Whether or not the "hiccup" that I
encountered was deliberate or not can only be discovered if it happens
again. My problem and complaint (at the time) was with Google's
toolbar, not with their service.


--
__________________________________________________ __________
** Share with others. Post replies in the newsgroup.
** If present, remove all "-nix" from my email address.
__________________________________________________ __________