Greg Conti - Googling Security: How Much Does Google Know About You?

Greg Conti

Upper Saddle River, NJ Boston Indianapolis San Francisco
New York Toronto Montreal London Munich Paris Madrid
Cape Town Sydney Tokyo Singapore Mexico City

Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and the publisher was aware of a trademark claim, the designations have been printed with initial capital letters or in all capitals.

The author and publisher have taken care in the preparation of this book, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for incidental or consequential damages in connection with or arising out of the use of the information or programs contained herein.

The views expressed in this article are those of the author and do not reflect the official policy or position of the U.S. Military Academy, the Department of the Army, the Department of Defense, or the U.S. government.

The publisher offers excellent discounts on this book when ordered in quantity for bulk purchases or special sales, which may include electronic versions and/or custom covers and content particular to your business, training goals, marketing focus, and branding interests. For more information, please contact:

U.S. Corporate and Government Sales
(800) 382-3419

For sales outside the United States, please contact:

International Sales

Visit us on the web: www.informit.com/aw

Library of Congress Cataloging-in-Publication Data available on request.

Copyright 2009 Pearson Education, Inc.

All rights reserved. Printed in the United States of America. This publication is protected by copyright, and permission must be obtained from the publisher prior to any prohibited reproduction, storage in a retrieval system, or transmission in any form or by any means, electronic, mechanical, photocopying, recording, or likewise. For information regarding permissions, write to:

Pearson Education, Inc.
Rights and Contracts Department
501 Boylston Street, Suite 900
Boston, MA 02116
Fax (617) 671 3447

Google, Gmail, AdSense, AdWords, Google Maps, Google Analytics, Google Groups, and Google Mobile are all registered trademarks of Google Inc.

ISBN-13: 978-0-321-51866-8
ISBN-10: 0-321-51866-7

Text printed in the United States on recycled paper at RR Donnelley in Crawfordsville, Indiana.

First printing October 2008

Editor in Chief
Karen Gettman
Acquisitions Editor
Jessica Goldstein
Development Editor
Sheri Cain
Managing Editor
Kristy Hart
Project Editor
Jovana San Nicolas-Shirley
Copy Editor
Krista Hansing Editorial Services, Inc.
Indexer
Erika Millen
Proofreader
Kathy Ruiz
Publishing Coordinator
Romny French
Cover Designer
Gary Adair
Compositor
Bronkella Publishing

For Nicholas

The rise of the information economy dramatically shifted how we conduct business and live our lives. In the competitive world of business, the organization that has the best access to information can make more timely and effective decisions than its rivals, creating a distinct advantage. In our day-to-day lives, easier access to information and improved methods of communication enrich virtually every facet of our existence. At the heart of this revolution is the Internet, particularly the World Wide Web.

Shortly after the formation of the web in the early 1990s, its commercialization began in earnest. Online companies struggled to find business models that worked in this brave new world, where many of the traditional rules of business no longer applied. The combination of free, easy-to-use tools, along with targeted advertising, emerged as one of the most viable approaches. Customized advertising, by definition, requires insight into the needs of the individual user, which, in turn, requires logging and data mining to be most effective. As a result, online companies have logged virtually every conceivable type of data associated with our use of web-based tools. The existence of this data enables online companies to constantly improve our user experience and support their goal of selling customized advertising.

The value of this data is unprecedented in the history of mankind. If you consider the sum of your online searching, mapping, communicating, blogging, news reading, shopping, and browsing, you should realize that you've revealed a very complete picture of yourself and placed it on the servers of a select few online companies. The thin veneer of anonymity on the web is insufficient to protect you from revealing your identity. If you aren't even a little concerned, you should be. The value of this information is staggering and ripe for misuse. The threat is even worse when you consider the sum of the disclosures of your company. Everything from the dark little secrets of the corporate executives to the strategic plans of the company exists on someone else's servers. Like water rising behind a dam, this is an issue we need to address sooner or later. Today there are only one billion Internet users; however, this value represents just 18% of the world population. Web-based information disclosure will certainly grow as billions more users join us online. Although there is no miracle cure on the horizon, this book is a first step toward a solution. This book clearly illustrates and analyzes the problem of web-based information disclosure and provides you with countermeasures that you can employ now to minimize the threat.

Stated simply, if you use the web, you should read this bookunless, of course, you have nothing to hide. Not everyone is a pedophile or a terrorist, right? However, I argue that you wouldn't want everything from your health to your politics to your social network stored on someone's server, even if that someone is Google or one of its competitors. Perhaps today this won't be a problem, but history has shown that information leaks, privacy policies change, companies merge, data spills, and attacks occur. The mere existence of this information, and the power it proffers, ensures that it will be coveted by many, including business competitors, insurance companies, law enforcement officials, and governments.

As with any book, there are limits on what can fit between two covers. I've chosen to address a broad range of topics, to make the contents as accessible as possible (and increase the positive impact of the book), but at the same time give enough technical detail to provide insight into the technical challenges that exist behind the scenes. My intent is to raise awareness of the privacy implications of using the tools of Google and other online tools. The threat of web-based information disclosure is an open problem; I've attempted to outline the problem in detail, but complete solutions do not exist. For many, this book will be eye opening. However, I believe some IT and security professionals will have considered some of the points the book brings up. That being said, there will be insights and ah-ha moments for even the most security-savvy readers.