Google-Android: privacy issues?
 

Hi everybody,

I just bought one of these new semi-smart phones yesterday (an LG 540 in case anyone cares). Anyway, I wanted a phone with GPS and this has it, but it seems to involve a heavy tie-up with Google, because whenever I try to use it, I get pop-up dialogues from Google (whether I am on or off-line) asking for permission to share this that and the other information with them. It seems you have to answer "yes" to letting them keep tabs on your movements yourself before the GPS becomes enabled. For example, here's one such nag-screen:

"Location consent - Allow Google's location service to collect anonymous location data? Collection will occur even when there are no applications running. Agree/disagree"

Maybe I am more cautious than usual due to the bad publicity recently surrounding Google packet-sniffing and geo-cashing MACs whilst they compiled their Street View service, but this constant information leakage just gives me the creeps, to be honest. That's why I use Linux rather than Windows. That is why I chose Android. But here's Google, once again, fishing for more and more info. Who knows what might eventually be done with it and by whom?

What does the Panel think?

Here's another little pop-up I just got from Uncle Google:

"Allow Google to use location for improved search results and other services?"
What do they mean precisely by "other services"? This term isn't defined anywhere.

If Google think I am going to happily run about as some cost-free, wardriving bot for them, slavishly collecting MAC addresses and their matching geo-locations whilst doing my daily commute, along side untold thousands of other unwitting saps they may through this combination of the Android OS+LG phones recruit, which may enable them to constantly update the covert list of geo-cached MACs they obtained whilst creating Street View, the database of which is already being abused, then they can forget it. This hunk of spyware is going straight back to the store.

A bit late but... Other services can be loosely defined as advertising. Google's ad provider like to serve location specific ads in the hopes of getting more clicks.

As for collecting anonymous location data, it could be a tie-in to your second post. or allowing the phone to display your location against their maps (from maps.google.com). Or just aggregating data on # of android users by location.

Privacy issues with Google software? Seriously?! To Google, that's not a bug but how the software was meant to work!

@Completely Clueless:
It is your decision to decide how much personal information you decide to "share".

I believe it is Google's intention to collect, collate, store, cross-reference and ultimately redistribute personal data to customers of Google who will pay Google for the information that they have collected from you.

If you do not agree to this, then do not use their services, however attractive they might seem at the time.

@Kenny_Strawn,
You post:

My School
My Home City

Maybe you should remove these links, because I could find you, in real life. (Don't worry too much, as I have better things to do and am many miles away, and do not care). But other mad people might. Then you should be rightly worried.

Google now knows exactly where you live, and what websites you read.

Do you really want that, or agree to it?

No one seems overly worried as it's Google (one of the web's greatest-ever lovable do-gooders and providers of Free Stuff). But if it were governments doing this amount of snooping, I dare say the degree of unease would spike massively.

It would be foolish not to proceed on the basis that Google shares all the data it gleans with governments and police forces, in my view.

I also have to agree with CompletelyClueless in that last post: Even though Google isn't that good with keeping secrets, they are good with FOSS.

Technically, GPS is a system whereby the piece of equipment gets signals from those satellites and calculates a position. So far, so anonymous. But you probably want mapping and, on one of those Android phones, the phone does not have complete maps in memory. In effect, the phone uses Google maps, and for that to work, the phone has to tell Google where it is so that Google can send it the right section of the map.

Could Google have done more to obfuscate the 'phone's actual position? Don't know the exact details of what they do, but probably. But from their point of view, they must have thought that either not many people were bothered about it or (probably true, but not a good argument), because by their own internal definition they are not evil, that it can't be an issue.

Even if you don't have GPS, your mobile provider has information on your location while your phone is switched on, perhaps not to the same accuracy (but probably within 50 - 75 metres, most of the time). So, whatever you are worried about Google doing now, Telefonica (or T-mobile, or Voda or whoever) probably could have done all along, and they never asked you for permission and you probably never turned the phone off out of a sense of 'paranoia'/careful protection, did you?

OTOH, you are right that the situation with Google is becoming a little concerning. If someone who didn't have Google's access to the information on who searches for what, was wardriving and collecting data on all the wireless networks out there, it would be a bit worrying, even if only because you'd worry why they were doing it. Google? Then it becomes even more worrying somehow, even if it is difficult to define how.

I mean if it turns out that one day they say 'Actually, we had a problem with the motto. It should have said "Do be evil." but we had a problem at the printers.' there wouldn't be much that you could do about it, apart from switching search engines. And that's what keeps them honest (could keep them honest/should keep them honest/ maybe will persist in keeping them honest, if we are lucky); if everyone decides that Google crosses a line, all their business could walk away overnight.

This should lead to them being careful, but maybe it won't. Most people, most of the time, will choose convenience and ease of use over 'hypothetical' security concerns. And dancing pigs over convenience...

Point taken on the tech aspects.

As for convenience, yes, every browser I have seen comes with a Google search box on the toolbar, so most folks won't even bother to open up another tab for Alta Vista or whatever. BTW, I wonder if there's a way to configure Firefox so the search box is not Google by default?

yesnomaybe, depending on exactly what you mean. Firefox, at least when I've tried it, defaults to 'the last search engine that you used from the search box' when it is restarted. As far as the 'first time, out of the box' is concerned, I believe that is set by your distributor or whoever built your firefox package.

So, you can set it up so that the rapid search box 'defaults' to your favourite search engine, except for the first time that it is run, if you think that most people stick with whatever search engine that box points to, whatever that is, then it probably won't help, because people won't ever reset it....I've just set it to eccellio just to check, and most people would reset it from that, although maybe alta vista or bing would survive would a little longer.

The trouble is (and what I was originally meaning with the word 'convenience', although this other aspect is good too) the 'Google' search engine is pretty good product for the very large majority of the people, most of the time. This gives Google a disproportionate share of the search market and even if respected tech commentators, whoever they are, said 'You really ought to watch this lot; you are giving them power to do all sorts of things that you wouldn't really want, either because a local law pressures them to, or because they think that they can get away with it' hardly anyone would change their own behaviour, unless and until the threat became a lot closer to them, becomes more personal.

Hi, Salasi,

Actually, Google is one of the worst search engines out there. Granted it's as fast as f/%&$, but it just throws up so much rubbish. Unless your inquiry result is on the first page of hits, you are in trouble.
A MUCH better engine (among many others much better) comes in the form of the majestic12 distributed search engine: http://www.majestic12.co.uk/ It is my tip for the next real BIG one. It takes a few milliseconds longer to return your result, but you don't have to flick through page after page after page of garbage to get to what you want. The down side? You really should sign-up for the full experience, or your searches will just expire on their servers. Check it out today. BTW, I have NO financial, nor any other interest whatsoever in this outfit. These folks give up their spare computer cycles for free for the betterment of mankind. It is international so there is no censorship as would happen with an engine registered for business in any one jurisdiction. Hope you like it, join it and add to it....

I'm not as concerned about Google knowing geo location information as long as that information isn't retained. One can always click no. Your phone provider also tracks your phones location (tower signal triangulation) and retains this info. I'm curious if they told you and gave you a choice in the matter.

Companies and organizations try to tie in google to everything just because its "popular". It somewhat ok to put it at the top of the search box in Firefox but it really becomes creepy when it's also the default search engine for keywords. Put google in the search in about:config in Firefox to see how many times it's hardwired into the browser. Putting in the wrong url that doesn't exist redirects you to a google search with that url. Perhaps it's practical for some but I don't want google to know what I wanted to visit, so I always change that preference to redirect to about:blank. The same problems exist with search engine suggestions.

By the way, to change the default search engine in firefox you go to manage search engines and move up and down the list whichever you see fit. You must also go to about:config and change the value browser.search.defaultenginename from Google to something else.

This kind of happy go lucky promotion and association with for-profit companies by Mozilla really bugs me.

If it is turned on, your phone IS an information leak, and you can't prevent that. As has been mentioned, your carrier knows where you are.

I have an android phone, and there is a lot that Google wants to know. In order to use certain features, I did have to establish a gmail account - something I had avoided doing. Well, it's OK; I am not using the gmail account for anything at all except to keep Google happy, so they are not catching any of my information or any knowledge of my other communications.

I have installed tcpdump on my droid (which is rooted), and I have left it plugged into my computer for extended periods with tcpdump running through an adb shell, so that I could capture all information being sent over the wireless link to...whoever. Google doesn't appear to be doing anything underhanded.

Google knows what apps are on my phone; unavoidable since I deal with the Google app store. I don't sync my phone with gmail, though I would like to be able to sync with my linux workstation.

I have installed ad blocker software on the phone. I turn off GPS except when I need Google maps. I'm careful what information gets on the phone.

What bothers me worse than google are a lot of the third party apps. Facebook, for instance, is spyware. In spite of my better judgment, I use facebook as a way to keep in touch with my cousins (they all use it). Keeping the android facebook app from synchronizing my phone with my facebook account took some doing. Keeping information that is on my phone from getting to my facebook account (which I flatly FORBID!!!!) also took some effort.

Other third party apps are promising they WILL collect information about you...some of which MAY NOT be anonymous...and if you install the app you agree to this. Check the terms of service carefully. Myself, when I run across such an app, I uninstall it and give as the reason that it is malicious.

Other things...the voice recognition features use remote servers. This is needed because the phone doesn't have the capacity. I have been using Vlingo which works very well at voice recognition. Quite impressive, actually. But my voice statements are processed remotely and the results are returned to my phone over the internet. This is OK...but will cause me to avoid doing really sensitive things using voice recognition technology.

Then there is shop savvy...a VERY useful app. Scan a barcode with your phone, the app talks to the remote servers...you get back an identification of the product. If your GPS is on, then the app knows where you are and tells you other stores nearby that sell the same product...and the price they sell it for. This is incredibly useful. But it also is an information leak.

The capabilities of these smart phones are truly formidable. They are useful in all kinds of ways. But when you get down to it, they are small computers optimized for communications. And they do communicate. Oh, yes, they do. They communicate with everyone.

The trick, I think, is to keep them from giving away the store while they communicate to provide positive benefits. At this point in time, the only way I see to do that is to avoid putting the store on the phone. Keep the personal or sensitive information to a minimum, keep GPS turned off except when specifically needed, read the TOS for the apps and don't accept if information is given away that does not absolutely need to be given away to perform the function.

seriously, while I was writing Android apps, I haven't problems with privacy settings and etc. before I stucked with the problem of many users sessions in one activity writing widget for freelance writing
Edit: commercial link removed.