Hey look, it's an informationless comment in response to what may be an interesting find!

If you're worried about a Google VPN provided by the Google Operating System you run, I think you may have your knee-jerk circuits prioritizing incorrectly.

Arguably, that operating system is open source, and at the least, decently vetted. If you disable spyware like Google Play Services, it's likely to be reasonably safe. On the other hand, routing data through Google's servers is a distinctly different proposition.

And arguably logging everything that goes over a VPN doesn't increase the value of ads for someone that's already using you for search and email. What gain would there be there?

> Arguably, that operating system is open source, and at the least, decently vetted

The one provided pre-installed by Samsung and Verizon. Right.

> If you disable spyware like Google Play Services, it's likely to be reasonably safe.

Ah, so we're going with the "well it feels safer" school of computer security.

Do you work for Google? I don't know how you can actually argue that sending all of your traffic through Google's servers won't give them more chances to look at the traffic you are sending them.

"The one provided pre-installed by Samsung and Verizon. Right."

For the average user, yes. Developers can go deeper and install a version that's not just binary blob installed on your phone.

Google isn't holding a gun to anyone's head and making them use their services. If you feel that Google potentially having access to your data is worse than some other potential threat that can exist then by all means use that open wifi.

OR, you can use any other VPN service.

That is, if you believe the company that is operating behind it.

Like If you can really & absolutely trust any other VPN provider. The better thing to do is to have 10 VPN servers and re-route traffic among them :P

If you really care, just buy a VPN connection of your own. I did, for around $50 a year - and I can connect to it on port 80, so no firewalls even get in the way. Easy.

better them, who already have most of my info, than some random coffee house with who-knows-what for security.

Likelihood Google is collecting your info: High to Certain.

Likelihood Bob the Tomato's Coffee Shop is collecting your info: Low.

The Coffee Shop itself? Low. Other people in the coffee shop? High

Airport itself? Low Other people in the airport? High

It's not necessarily the place itself, but anywhere there's open (or easy to get) WiFi, the chance of nefarious users increases dramatically.

> Other people in the coffee shop? High

Citation needed. I get that it's trivial to actually do, but do you have any studies that show that a lot/any WiFi is being sniffed and/or MiTM'd? The most I've seen is airports and so on tracking people via MAC addresses or the WiFi AP names they request.

It's not Bob I'm worried about, it's the NSA prompting Bob's ISP to watch for my MAC to connect to any of their customer's routers.

And you think the NSA is having a particular difficult time monitoring what routes through Google servers?

Okay, let me be more clear: I don't expect the NSA to care much about me. I'm a Canadian citizen. I would rather my phone automatically suggest to me a VPN that ends up piping all my data to a country that doesn't have specific reason to be interested in me, than that I route my data in-the-clear over networks that are operated by governments who do have reason to care about me (because I'm one of their citizens and their laws apply to me, and they might want to figure out if I'm breaking them, etc.)

Android phones are sold globally, remember. There are much worse places to "moor your ship", data-wise, than the US. If this VPN circumvents Chinese Internet censorship, for example, then it's a win by sheer numbers, whatever it does to US domestic citizens.

In by that you're thinking Google could legally ship that in China without China having backdoor access to it?

Hell of a lot more difficult time than they are having monitoring the coffee shop's servers

There are thousands of VPN providers, some better some worse, but if you pick well your data can be safe from US government. By picking Google VPN, you are essentially giving away all your privacy to inspect to NSA. Kind of funny when you think about it :)

Think of it this way: this is worse than any other option, but still better than nothing. As such, it's great as an opt-out default: it steps in exactly where the users would otherwise be using "nothing", thus actually eliminating the "nothing" level as an option.

What if using google's service for your vpn would actually make it easier for them to get the data _you are trying to hide_ than compared to not involving GOOGLE as your _vpn service_ at all.

Honestly, how are everyone's alarms not going off right now? Google fiber, alright, at least I get fucking 1 gbps. Google VPN?? A VPN?? Keep Google/<substitute-3-letter-agency-of-the-day> in charge of what you use to hide your illegal torrents?? Genius.

I think it's because you're coming from a position of insufficient cynicism.

Are you torrenting, or planning terrorist acts, or whatever else, on your mobile connection? You're crazy. I would never do anything I'd want to hide from the government on my phone; it's already got that mysterious baseband coprocessor running god-knows-what with direct DMA access to main memory. Adding a VPN pipe directly to the manufacturer doesn't make me any more potentially-spied-on than I already was, since the ISP already, effectively, had arbitrary code execution and their own backchannel.

Security professionals don't avoid smartphones altogether, of course; they just use them only as conveniences for "unclassified" day-to-day operations.

>doesn't make me any more potentially-spied-on than I already was

That's the logic that brought us ads plastered all across the web, with nothing sanctified, including the _content_ of the web page. 'I mean, we _already_ see them anyway, what's the difference if they're blinking/videos/popups? I mean, we don't have to look.'

And yes, I pretty much use my mobile as less as I can, just for these reasons. I'd never use it willingly as long as there's even a trace of google in android. However, can you elaborate more on the coprocessor? Maybe some additional reading? I'm very interested in what possible surveillance do they have in the hardware itself.

P.S - At this point, I'd rather use apple than google. At least apple can't tie my activities to my search results, which is an insanity that the world will come to terms with several years down the road, and then repent.

VPN is a better tool for mass-surveillance, DMA access is better for targeted attacks., no ?

From the screenshots, this seems more like something built into a future version of Android that might automatically engage when joining unsecured networks.

It's hard not to see an offer of at least some form of security to be a net positive in that case.

>automatically

If they don't provide an easy and apparent way to turn that off, this is the word that always sets off alarm bells in my head.

Don't question the Google Surveillence Machine. You'll rile up the Google Apologists.

It's quite sad actually into what future we're running into, so many people just don't care.

I know. :( I make a comment, and it gets a bunch of upvotes, and then the Google fans roll in, and downvote it back into oblivion.