News for hackers. Stuff that matters.
Re:“We are only collecting the list of applications you have... by fny on Friday May 29, 2015 @11:07PM (#9628732)
Raise your hand if you feel like this is an unwarranted breach of privacy, but you have a gmail account and heavily depend on Google services.

<ashamed>Raises own hand.</ashamed>

I was so trusting and willing to give away my emails to Google when I was a kid (despite being fully aware of their intentions), but now, even though privacy infringements from all these other companies disturb me, I'm still a hypocritical sheep in Google's herd.

Time to make some pretty heavy changes...

Re:“We are only collecting the list of applications you have... by FlaceBook on Saturday May 30, 2015 @12:17AM (#9628944)
I have around 10 gmail accounts, each of which only receives random junk from various sites and mailing lists. I create compressed, encrypted archives that contain only random data, and use them to fill my "drive".

Google is welcome to analyze as much of that as they want.

Re:“We are only collecting the list of applications you have... by copsarebastards on Saturday May 30, 2015 @12:44PM (#9630716)
That's just slacktivism.

Google is quite capable of detecting and ignoring chaff, and they wouldn't be giving away free space if they couldn't afford to host a small number of people doing stuff like you're doing.

Further, if you think that behavior doesn't contain any data about you, you're wrong. They can extrapolate from that behavior that you're interested in privacy and have some technical understanding of the problems with corporate surveillance. You've almost certainly received targeted ads for computer products, particularly stuff like Lenovo or Yubikeys, which are popular in security-conscious crowds. You may have ad-blocked these ads, but you've probably been tracked anyway, even if you used something to block trackers.

Right now you're totally ineffectual. If you want to actually do something, you should write your senators and stop using Google products entirely.

Re:“We are only collecting the list of applications you have... by FlaceBook on Saturday May 30, 2015 @01:29PM (#9630895)
You make many assumptions.
Re:“We are only collecting the list of applications you have... by copsarebastards on Saturday May 30, 2015 @02:43PM (#9631257)
That's not a very convincing counterargument if you don't say what assumptions you think I'm making.
Re:“We are only collecting the list of applications you have... by madez on Saturday May 30, 2015 @12:35AM (#9628992)
That behaviour is damaging. What is your reasoning and justification for it?
Re:“We are only collecting the list of applications you have... by FlaceBook on Saturday May 30, 2015 @12:52AM (#9629040)
Because it upsets people like you.

It's also the way I personally choose to protest the corporate and government surveillance state we're living in.

Re:“We are only collecting the list of applications you have... by cherry_su on Saturday May 30, 2015 @12:46AM (#9629016)
Why is it damaging?
Re:“We are only collecting the list of applications you have... by Beltiras on Saturday May 30, 2015 @01:59AM (#9629206)
It actually isn't. Sometimes data has too much purity. Noise can actually help.
Re:“We are only collecting the list of applications you have... by pdkl95 on Saturday May 30, 2015 @02:27AM (#9629267)
db poisoning can help, but just having an account (10 is even worse) inflates their numbers and strengthens the perception that people should use gmail.

A long time ago, before the PC, market share perceptions lead to the idea that "Nobody got fired for buying IBM". It was a very effective trump card a salesman could use with managers to scare them away from the competition. In the PC era, "Nobody got fired for buying Microsoft" was abused in the same way.

This is really just a consequence of Metcalfe's Law-style network effects, which is why it is usually a bad idea to use anything that is known to be a problem; even if you use it maliciously, just the fact that someone gets to legitimately claims they have a larger clientèle becomes an additional barrier in the path of any competitor.

Re:“We are only collecting the list of applications you have... by dorgo on Saturday May 30, 2015 @04:53AM (#9629526)
Is there one program which can create such archives? Or do I need one for generating, one for encryption and one for compression?
Re:“We are only collecting the list of applications you have... by mgraczyk on Saturday May 30, 2015 @12:01AM (#9628884)
> despite being fully aware of their intentions

Those being....? Google earns its revenue by selling ads. They make more money when they show you ads that are likely to earn your business for the advertiser. Is it really so horrendous for Google to use information about you to show you ads for products you are more likely to purchase? Or are you concerned about something else?

Re:“We are only collecting the list of applications you have... by caseysoftware on Saturday May 30, 2015 @12:52AM (#9629041)
Their stated goal is to "organize the world's information" but notice there's never a qualifier of the world's public information.

While they've been able to determine a ton of information about social circles from interactions (gmail, voice, gchat, hangouts), the real understanding comes from G+ where we've categorized our contacts.

Odds are you have circles that represent locations, employers, family, friends, clubs, etc. By analyzing those groupings, they can determine the relationships that aren't obvious just from the interactions.

Now, combine that with the previous information and they know when you're talking with someone from HR from another company and how closely that company is linked to yours via shared/common circles. Sounds like a opportunity to sell an ad for 401k rollovers. :)

Re:“We are only collecting the list of applications you have... by fny on Saturday May 30, 2015 @11:24AM (#9630443)
That was my though exactly when I started, but I've realized that Google gains a greater power than showing tailored ads. Google remembers who I was better than I do, knows everything that I do today, and can probably guess who I will become. They have the power to shape the information I see and influence me to do things that will drive their bottom line with unparalleled precision.

We're really giving Google the power to read our minds: are you comfortable with that?

Aside from that, I'm vaguely concerned about keeping everything about me so centralized. There's too much to lose too easily if someone manages to hack me despite the 2FA and insane passwords.

Re:“We are only collecting the list of applications you have... by mgraczyk on Saturday May 30, 2015 @03:50PM (#9631533)
I'm a little biased because I currently work at Google (not on anything related to ads or user data).

Still, I am comfortable with giving Google enough information to understand and predict my behavior. The more I learn about the company from the inside, the more I trust them to do the right thing with my personal information to prioritize my quality of life over their bottom line. My perception is that Google genuinely believes that if they create high quality products that improve their user's lives, the revenue will follow.

As for centralization, I agree that it is good to diversify for robustness and security. Still I trust Google's security measures more than I would trust my own if I were to set up email servers myself. Plus now that Google properties have U2F support and Chrome autogenerates passwords, I don't mind putting all my security eggs in the Google basket.

Re:“We are only collecting the list of applications you have... by Animats on Saturday May 30, 2015 @02:57AM (#9629336)
I've never been able to understand why anyone with a clue uses Gmail. I just have all my devices sync to an IMAP server provided by an ISP. Android phones have a perfectly good IMAP client. No ads, reasonably good spam filtering, and reasonably good search capability.
Re:“We are only collecting the list of applications you have... by andybak on Saturday May 30, 2015 @07:03AM (#9629755)
All this talk of 'having a clue' - where exactly in my daily list of conflicting and competing daily priorities should I put "Worry about Google profiling me via my email content"?

Advertising aside, I also understand there's a valid argument that we should all use strong encryption and secure email to give (those of us that need it) the benefits of herd immunity against government snooping. However - once again it's a not terribly high up my list of things to worry about right now. That makes me a slightly worse person on par with not recycling enough and leaving my electronic devices on standby overnight.

I willingly - and I hope knowingly - accept the trade-offs in using GMail. At least 3 people in this thread think I'm lacking in clue. Can someone please explain to me why?

Re:“We are only collecting the list of applications you have... by vdaniuk on Saturday May 30, 2015 @03:25AM (#9629389)
Sorry, I don't understand your reasoning.

Why do you trust your ISP more than Google? ISPs have much more shady practices and are able to match your online and real persona with 100% accuracy.

If you care about privacy, why do you use Android(non-cyanogen I assume)?

Re:“We are only collecting the list of applications you have... by simon_vetter on Saturday May 30, 2015 @04:01AM (#9629446)
Note that he could be living in a jurisdiction where the law provides better protection for electronic communications (email being one of them), thus preventing his ISP from reading/analyzing/reselling his emails.
Re:“We are only collecting the list of applications you have... by vdaniuk on Saturday May 30, 2015 @04:09AM (#9629455)
Which jurisdiction would you trust in this matter?
Re:“We are only collecting the list of applications you have... by e12e on Saturday May 30, 2015 @11:15AM (#9630417)
For all the problems we've manage to create, I'll trust Norwegian provider Telenor much more than I do Google. If only because they share my jurisdiction (Norway) -- where I have rights. I have no rights in the US -- at least when I'm not physically there.
Re:“We are only collecting the list of applications you have... by enraged_camel on Saturday May 30, 2015 @04:45AM (#9629507)
>>Why do you trust your ISP more than Google?

Presumably because the ISP doesn't generate the vast majority of its revenue from targeted ads based on information it collects from them.

Re:“We are only collecting the list of applications you have... by aw3c2 on Saturday May 30, 2015 @03:59AM (#9629441)
Theoretically the ISP is being paid for providing the service, while Google ... well...
Re:“We are only collecting the list of applications you have... by vdaniuk on Saturday May 30, 2015 @04:08AM (#9629453)
The implicit suggestion that one stops "being the product"[0] if one is paying for the service has no roots in reality.

[0] This oversimplification has to die.

Re:“We are only collecting the list of applications you have... by cm2187 on Saturday May 30, 2015 @03:23AM (#9629382)
To me that's even worse. You are stuck with your ISP. What if you move home to a place where this ISP isn't available?

There are commercial email providers in jurisdictions that do respect privacy. And it usually only costs the price of a couple of coffees per year.

Re:“We are only collecting the list of applications you have... by timthorn on Saturday May 30, 2015 @03:55AM (#9629435)
You're not locked in if you own the DNS registration.
Re:“We are only collecting the list of applications you have... by e12e on Saturday May 30, 2015 @11:12AM (#9630412)
This is an important point many overlook (despite being aware of Google Apps for Work (nee Business)) -- registering a personal domain in order to have at least one email that will follow you for as long as you want -- does not mean you have to run your own incomming/outgoing email servers!

Most domain registrars will forward email for free, and most offer some form of cheap, but reasonable email service (smtp+imap).

Re:“We are only collecting the list of applications you have... by Animats on Saturday May 30, 2015 @01:28PM (#9630893)
Right. I have several domains, and my email comes in via them. The IMAP server just aggregates them.
Re:“We are only collecting the list of applications you have... by Nullabillity on Saturday May 30, 2015 @05:00AM (#9629538)
You're still depending on the ISP's archives.
Re:“We are only collecting the list of applications you have... by TheOtherHobbes on Saturday May 30, 2015 @07:26AM (#9629802)
Building your own Postfix server isn't hard. (It's certainly not easy, but it's not too hard either.)

If you're paying someone for hosting anyway it's a few days of extra work from a cold start to set up a server on Linode or Digital Ocean and become your own ISP/hosting co.

Re:“We are only collecting the list of applications you have... by kuschku on Saturday May 30, 2015 @11:39AM (#9630501)
Remember that Digital Oceans’ ToS allow them to access "all and any information" in case they "consider it necessary".
Re:“We are only collecting the list of applications you have... by dade_ on Friday May 29, 2015 @11:16PM (#9628756)
It takes planning and plenty of work, but I have almost completed migration to my own domain and away from gmail. I wish I had done it sooner, everyone needs to make their own place on the net. No need to be a serf.
Re:“We are only collecting the list of applications you have... by innguest on Friday May 29, 2015 @11:26PM (#9628791)
Are you hosting your own email server?
Re:“We are only collecting the list of applications you have... by ironsides on Friday May 29, 2015 @11:36PM (#9628825)
and if you are rolling your own are you having any issues with spf or spam flags?
Re:“We are only collecting the list of applications you have... by spc476 on Saturday May 30, 2015 @12:04AM (#9628893)
I run my own email server [1] using Postfix. I use greylisting [2][3] and it easily stops 50% of all spam. I looked into adding SPF, but decided against it as the effective rate was too low [4]. I've also recently looked at RBL [5] and while there were a few false positives (enough that I decided against immediately adding it) what it did catch was quite impressive [6].

Oddly enough, if I simply drop email addressed to my domain registration email [7] that is NOT from my registrar, then the amount of spam I receive would drop about 70%.

But frankly, with the greylisting, the spam that does get through is easy enough to deal with. And I'm the only person who uses my domain for email.

[1] I started in the web hosting business in '96 or '97 so this is pretty much old hat for me.

[2] Definition: http://projects.puremagic.com/greylisting/

[3] Software I use: http://www.x-grey.com/

[4] http://boston.conman.org/2015/04/12.1

[5] http://en.wikipedia.org/wiki/DNSBL

[6] http://boston.conman.org/2015/05/11.1

[7] Yeah, I don't bother with the privacy settings on the domain registration.

Re:“We are only collecting the list of applications you have... by JimDabell on Saturday May 30, 2015 @07:41AM (#9629832)
I think ironsides was referring to sending email, not receiving it. Sending email from a mail server without a good reputation can often land your email in spam filters these days.

It's all very well saying that the amount of spam you get is manageable, but that doesn't really matter if your own outgoing email becomes unreliable because you aren't using a recognised provider.

Re:“We are only collecting the list of applications you have... by e12e on Saturday May 30, 2015 @11:08AM (#9630398)
This is sadly true. With just greylisting, spam isn't much of a problem. I get some spam, most of it to an address leaked from the adobe-hack (I don't drop mail to it, I just keep the few spam emails that get through greylisting, for possible future use for training a bayesian spam filter), and some sent to my publicly registered company email (mandated by law in Norway).

It's unfortunately pretty hard to tell the difference between people being slow to reply to mails to gmail addresses, and google flagging your mail as spam for no discernibly good reason.

Anecdotally they don't care about anyone other than gmail users, so there's not much to do about it other than a) give up on the idea that gmail interops with standard email, b) hope that more people move away from gmail, or c) just tell people that you don't care that your email is filtered as spam because they're using an email provider (gmail) that doesn't deal well with email.

Re:“We are only collecting the list of applications you have... by spc476 on Saturday May 30, 2015 @03:55PM (#9631549)
That's not much of a concern for me. My email server also handles outgoing email as well. I'm fortunate in that I've been running my own server on that domain since 1998. And on the current IP address for probably a decade by now.

Over the years, there have been only two domains where my email had issues being delivered: AOL [1] and Google mail. For AOL, I had to inform AOL that I was responsible for the IP address of my server and promise not to send spam and that I take care of any spams from my IP address, etc. Annoying, but once done, no issues. Google on the other hand ...

I've had a few times where my email was being dropped by Google mail. Annoying, but the issues did seem to clear up on its own after time. I do have a gmail account [2] that I use for testing when I think there are issues but I don't recall the last time I had one. But I have had them.

[1] My dad is still on AOL.

[2] Google's spam catching ability isn't 100% either. I don't use gmail at all for email, so anything I get there is either 1) a mistake because someone is trying to email a person with my name at gmail or 2) spam. It's mostly spam [3]

[3] I just checked my gmail account. 140 new messages since I last cleaned it out in mid-October. All spam. Way to go, Google! (but to be fair, it shunted 726 messages to the spam folder).

Re:“We are only collecting the list of applications you have... by ironsides on Saturday May 30, 2015 @11:03AM (#9630385)
Jim, what can we do to increase the odds of our email reaching the intended destination on self-hosted domains?
Re:“We are only collecting the list of applications you have... by spc476 on Saturday May 30, 2015 @04:10PM (#9631584)
I'm not Jim, but what I've done is:

1) have a valid PTR record for the email server.

2) Set up SPF records.

3) Just run email on it. If you do run a webserver on the same server, DON'T RUN PHP! In my experience [1] the single most abused attack vector on webservers is PHP and about 60% of the time it's abused to install spam sending software on the server and that leads to the IP address getting marked as a spammer.

[1] About fifteen years in web-hosting.

Re:“We are only collecting the list of applications you have... by marcosdumay on Saturday May 30, 2015 @12:02PM (#9630575)
I run my email server (it actually does not provide any extra privacy, as it's on a linode), and 99% of the time, no, I don't have problems with spf and spam flags. (In fact, spf is great, I don't get the blame of sending spam anymore since I've set it.)

There's an odd email server here and there that suspects anything that isn't gmail, there was even a mail server once that required me to prove I exist, but those are very few, and normally single user installations.

The secret is that besides not sending spam, you must receive email. If you don't get enough email, other servers start suspecting you. And, of course, there are configuration problems - since I'm writing my own mail server, I get a few of them, but even on standard software you have to make sure you set it correctly.

Re:“We are only collecting the list of applications you have... by zxyzzxxx on Friday May 29, 2015 @11:26PM (#9628792)
For most people it is just search and email. Replacing email is easy, but search is harder since only Google has really accurate and relevant results( besides other giants that also snoop ). The best way to replace search is to use engines that respect privacy and if you need relevant results, those that convey Google's results to you.
Re:“We are only collecting the list of applications you have... by fny on Saturday May 30, 2015 @10:59AM (#9630364)
For me it's waaay more than just that. Email, search, stock Android, DNS, browser, texts, phone calls, GPS, calendar, tasks, file storage, music, stocks, and certainly more that I'm forgetting.

The most absurd bit is that, since I use stock Android, Google knows exactly what I've installed and even monitored my behavior while using their app store, and yet I get so irked by Twitter getting a list too. It's like I've completely forgotten that I've already thrown away my privacy.

Re:“We are only collecting the list of applications you have... by zxyzzxxx on Saturday May 30, 2015 @03:43PM (#9631507)
You can always start collecting it back.
Re:“We are only collecting the list of applications you have... by dredmorbius on Saturday May 30, 2015 @12:05AM (#9628901)
Search is the easier: DDG. I've been using it all-but-exclusively for nearly three years solid (and another couple on-and-off before). I do still make use of some Google special collections (Scholar, Books), and for time-bound searches (really wish DDG would support those).

Email took me a while longer to sort, but while I have a primary personal account somewhere safe, anonymous / pseudonymous accounts were harder to provision. Yahoo and Microsoft both throw barriers (phone confirmation required) in the way. I ended up with an inbox.com account, like that.

Re:“We are only collecting the list of applications you have... by zxyzzxxx on Saturday May 30, 2015 @12:26AM (#9628972)
DDG is the fastest of all the privacy-respecting engines, but it consistently gives me the least accurate results. It works if you search for mainstream keywords, otherwise it mostly doesn't.
Re:“We are only collecting the list of applications you have... by ajays on Saturday May 30, 2015 @01:04AM (#9629071)
Google's strength lies in (and always has been in) the tail and ambiguous queries. Everyone can get the query "facebook" right; try the query "how to disassemble tile" on Google[1] and Yahoo[2] or Bing[3]. Google knows the difference between "tile" (the gadget) and "tiles".

[1] https://www.google.com/#safe=off&q=how+to+disassemble+tile

[2] https://search.yahoo.com/search?p=how+to+disassemble+tile&fr...

[3] http://www.bing.com/search?q=how+to+disassemble+tile

Re:“We are only collecting the list of applications you have... by e12e on Saturday May 30, 2015 @11:22AM (#9630432)
Interesting example. The results for ddg improve dramatically if you add "tracker" ("tile tracker"). I'm not sure I'd consider Google's default results better -- but then I don't own a "Tile". I do get that inferring that the connection "disasemble tile" implies something other than ceramic tiles (as opposed to "repair tile" -- here ddg and google are very similar for "repair tile" and "repair tile tracker" -- although none seem to give a result for software/a device to track progress of repairing ceramic tiles...).
Re:“We are only collecting the list of applications you have... by dredmorbius on Sunday May 31, 2015 @09:59PM (#9636435)
I use it for all manner of searches. Knowing how to tune a search appropriately helps. Tossing in an additional keyword, or a set of associations can help:

    (phrase one| phrase two|phrase three) 
Using bang syntax is also quite useful.

In my experience, where a DDG search doesn't turn up good results, an SP or Google search (both bang-searchable) are generally not much better. I'll revise my terms at that point.

Again, date-range is the notable exception, and it's not a minor issue.

Re:“We are only collecting the list of applications you have... by johnny22 on Saturday May 30, 2015 @12:11AM (#9628925)
The main feature I'm missing from DDG is the ability to filter results by date. I end up going to google often without it.
Re:“We are only collecting the list of applications you have... by FractalNerve on Saturday May 30, 2015 @12:06AM (#9628904)
I really like using https://swisscows.ch their search results are quite good and they respect my privacy.

EDIT: https://swisscows.ch/agreement

Re:“We are only collecting the list of applications you have... by saurik on Friday May 29, 2015 @11:39PM (#9628833)
Replacing email should be easy, but a surprising number of people, even tech people (which makes no sense at all as they should know better), not only use Gmail for their email storage but also for their email address, and so can never entirely extricate themselves from Gmail.
Re:“We are only collecting the list of applications you have... by mirimir on Friday May 29, 2015 @11:38PM (#9628827)
Use https://search.disconnect.me/ .

You can use Bing, DuckDuckgo, Google or Yahoo as the search engine. "We don’t collect any of your personal info, including your IP address, other than information you voluntarily provide." See https://disconnect.me/privacy .

Re:“We are only collecting the list of applications you have... by ajays on Saturday May 30, 2015 @12:51AM (#9629039)
If too many people use this site, Google (and probably others too) will ban the IP.
Re:“We are only collecting the list of applications you have... by FlaceBook on Saturday May 30, 2015 @02:32AM (#9629286)
I doubt it. Even if Google can't use the data they're getting from searches done via that service to target ads to specific people, they're still getting valuable data on what people search for generally.
Re:“We are only collecting the list of applications you have... by bato on Saturday May 30, 2015 @12:09AM (#9628918)
I've been using qwant with pretty good results lately.

Still a bit hit and miss but getting better every day.