Likelihood Google is collecting your info: High to Certain.

Likelihood Bob the Tomato's Coffee Shop is collecting your info: Low.

The Coffee Shop itself? Low. Other people in the coffee shop? High

Airport itself? Low Other people in the airport? High

It's not necessarily the place itself, but anywhere there's open (or easy to get) WiFi, the chance of nefarious users increases dramatically.

> Other people in the coffee shop? High

Citation needed. I get that it's trivial to actually do, but do you have any studies that show that a lot/any WiFi is being sniffed and/or MiTM'd? The most I've seen is airports and so on tracking people via MAC addresses or the WiFi AP names they request.

It's not Bob I'm worried about, it's the NSA prompting Bob's ISP to watch for my MAC to connect to any of their customer's routers.

And you think the NSA is having a particular difficult time monitoring what routes through Google servers?

Okay, let me be more clear: I don't expect the NSA to care much about me. I'm a Canadian citizen. I would rather my phone automatically suggest to me a VPN that ends up piping all my data to a country that doesn't have specific reason to be interested in me, than that I route my data in-the-clear over networks that are operated by governments who do have reason to care about me (because I'm one of their citizens and their laws apply to me, and they might want to figure out if I'm breaking them, etc.)

Android phones are sold globally, remember. There are much worse places to "moor your ship", data-wise, than the US. If this VPN circumvents Chinese Internet censorship, for example, then it's a win by sheer numbers, whatever it does to US domestic citizens.

In by that you're thinking Google could legally ship that in China without China having backdoor access to it?

Hell of a lot more difficult time than they are having monitoring the coffee shop's servers

There are thousands of VPN providers, some better some worse, but if you pick well your data can be safe from US government. By picking Google VPN, you are essentially giving away all your privacy to inspect to NSA. Kind of funny when you think about it :)

Think of it this way: this is worse than any other option, but still better than nothing. As such, it's great as an opt-out default: it steps in exactly where the users would otherwise be using "nothing", thus actually eliminating the "nothing" level as an option.

What if using google's service for your vpn would actually make it easier for them to get the data _you are trying to hide_ than compared to not involving GOOGLE as your _vpn service_ at all.

Honestly, how are everyone's alarms not going off right now? Google fiber, alright, at least I get fucking 1 gbps. Google VPN?? A VPN?? Keep Google/<substitute-3-letter-agency-of-the-day> in charge of what you use to hide your illegal torrents?? Genius.

I think it's because you're coming from a position of insufficient cynicism.

Are you torrenting, or planning terrorist acts, or whatever else, on your mobile connection? You're crazy. I would never do anything I'd want to hide from the government on my phone; it's already got that mysterious baseband coprocessor running god-knows-what with direct DMA access to main memory. Adding a VPN pipe directly to the manufacturer doesn't make me any more potentially-spied-on than I already was, since the ISP already, effectively, had arbitrary code execution and their own backchannel.

Security professionals don't avoid smartphones altogether, of course; they just use them only as conveniences for "unclassified" day-to-day operations.

>doesn't make me any more potentially-spied-on than I already was

That's the logic that brought us ads plastered all across the web, with nothing sanctified, including the _content_ of the web page. 'I mean, we _already_ see them anyway, what's the difference if they're blinking/videos/popups? I mean, we don't have to look.'

And yes, I pretty much use my mobile as less as I can, just for these reasons. I'd never use it willingly as long as there's even a trace of google in android. However, can you elaborate more on the coprocessor? Maybe some additional reading? I'm very interested in what possible surveillance do they have in the hardware itself.

P.S - At this point, I'd rather use apple than google. At least apple can't tie my activities to my search results, which is an insanity that the world will come to terms with several years down the road, and then repent.

VPN is a better tool for mass-surveillance, DMA access is better for targeted attacks., no ?

From the screenshots, this seems more like something built into a future version of Android that might automatically engage when joining unsecured networks.

It's hard not to see an offer of at least some form of security to be a net positive in that case.

>automatically

If they don't provide an easy and apparent way to turn that off, this is the word that always sets off alarm bells in my head.