I don't agree with everything they listed, but I'm glad someone is pushing Google to think hard about this.

Why even bothering mentionning them and giving them Googlejuice ?
If you wand privacy, set up your mail server with encryption. You potentially can do it. You even have extension than encrypt your gmail messages

Previously discussed here: http://blogoscoped.com/forum/144180.html

The lone problem in the list is Google Chrome's missing address bar. That is, at least for me, a security issue (as well as hidden statusbar).
All other critics are crap.

<< Google Chrome's missing address bar >>

One way to get the URL of the active page is by clicking on the favicon and selecting "copy url".

> That is, at least for me, a security issue

Agreed. And isn't it odd that Google would release a feature that makes phishing easier, when they'd be a big beneficiary of people trusting the web *more*?

Gmail Auto Save:
Normaly if I start writing an email I am either going to send it, or store it, so I don't really see the problem with this.

Google Targeted Ads:
Admitedly I can see the point about privacy, but his point about the messages being stored on Google's servers? Where do you think the sent box is stored? Or your inbox for that matter?

Google "Reading" Emails:
Surely your in the same situation with any Webmail service or ISP, to be able to send your message they have to know what it says, and then could use keywords to advertise to you.

IMHO, every problem here are either false or misleading:
* The auto-saved feature never pretended to save drafts as temporary data on your computer. The advantage of this feature is to keep the draft on a server so that you can send them from any computer. In the future, Gears will probably allow us to keep temporarily those data on your computer, as does Google Docs, but it will still sync them often so that we can access those information from anywhere. Web-based applications have a goal: to save information on servers in the cloud. Why would anyone be surprised that Gmail excels in doing that?
* Desktop shortcuts in Chrome should be used for truster application. Once you've verified the URL – which is your own responsibility, you can create a shortcut. Then, if an action (pop-up, click on a link/button) opens a URL with an other domain address, Chrome opens it as a tab in a classic Chrome window. No surprise here.
* On advertising issues, nothing new since April 2004.

Finally, it looks like a good lobbying campaign to frighten customers who are likely to shift to the cloud.

But the real question is: will jessica.privacygmail.com account be deleted? :D

> * Desktop shortcuts in Chrome should be used for truster
> application. Once you've verified the URL – which is your
> own responsibility, you can create a shortcut. Then, if an action
> (pop-up, click on a link/button) opens a URL with an other
> domain address, Chrome opens it as a tab in a classic Chrome
> window. No surprise here.

Jérôme, the problem of increased phishing remains. Even *if* you only create application shortcuts for trusted, good domains, you will not see the URL change when you click a link within such a trusted domain which may lead to a non-trusted, evil domain. Imagine for instance that you create a desktop shortcut for GoodWebMailProgram.com. Now, GoodWebMailProgram.com in one exotic instance forgot to open links from within emails in a new window. Thus, BadPhishingSite.com can now send you a link that looks semi-official (official enough to fool some), and then when you click it, they will use the same layout as GoodWebMailProgram.com... say, to tell you "your session has timed out, please login to GoodWebMailProgram again". Classic phishing... enter your password now, and they've got you. Displaying the URL is *still* not enough to prevent all people from falling for this, but at least it's one way that could help.

Philipp Lenssen
You're right.
I would like to see a *notification* of domain change from "shortcuted application" rather than a new address bar. The bar would kill the benefit of the feature (space saving).

Jérôme
As well as the point Philipp made, a virus could easily change the address and you would have no idea that it had changed. So the desktop icon says Gmail, but instead of going to mail.google.com it could go to any address, it wouldn't even have to be a convincing looking as you can't see it.

>IMHO, every problem here are either false or misleading

I saw this and thought the exact same thing!

This video is a load of crap. Are they serious? The only people who are going to buy into this shit are computer noobs. Preying on fear, that is what it is. Sensationalism.

Hey, look from the window – Are this car is always been there? Or this is FBI is spying on you ...

Paranoid delirium ...

Everybody repeat after me : S – S – L

And now, you are going to your gmail preferences tab to activate SSL :)

There are alway birds crying out that they have just made a great discorvery.

not understood moment with sniffer. gmail is going through ssl, or not ?

LMZ, no not by default, SSL is a possible setting.

Sensationalized attempt at grabbing a bit of publicity.

I also think the examples given in the video were not very convincing: If you write an email to apply for a new job from your computer at work, that's not very smart in the first place. And if you would do it from a desktop applicattion it would probably be even easier for you boss to find out because the draft of the email would be saved on your work computer.

"Google opens every messages and decides what ads to show to Bob."

Mr. Google has to be very busy opening all those messages. Apparently, these (watch)dogs forgot that webmail services process email to see if it's spam, index all the messages so you can find them later, check the filtering rules to see if they forward a message or mark it as read, check the email to see if it contains locations, tracking numbers, information about events etc. Google would "read" the message even if it wouldn't display contextual ads.

Here's a similar technology from Yahoo Mail: http://help.yahoo.com/l/us/yahoo/mail/original/tools/tools-83.html (contextual shortcuts).

Auto-save:
The auto-save feature is a good one for people in some countries. Like in Pakistan, India and many other places, sudden electricity cuts are a norm. And it's happened a few times that I wrote a long long email, forgot to save it myself, and lost it all when one of those electricity cuts came my way. So if we have the option to delete the autosaved drafts, and this deletion also removes them from Google's records (as far as I think), then it's a very good option for me.

Contextual Ads in Gmail:
About the contextual ads, I would again say that this is a lot more useful to me than those annoying flash banner ads by other free email services. In fact, I have sometimes found very useful websites through this. And again, having contextual ads rather than big flash banner ads makes pageloading faster for many who are still on 56K.

If some human being occasionally comes there skimming through those emails, that's a big issue. Or if Google saves everything and gives access to third parties like the CIA, that's again a biggie (like Phillip wrote in the Google 20 years post).

Or if you are Obama, Palin, Medvedev, Ahmedinijad or the like, these issues are still understandable. But for a Joe somebody like me, what's the big deal in all these.

On a sidenote, I am happy that there are organizations like CWD who are keeping an eye on Google and other big boys. At least to ensure they keep up with 'do no evil'.

I'm quite surprised to see this sort of stuff, especially tonality and inferences, coming from the US Watchdog who are supposed to be impartial.

It makes me question who's interests are really being responded to?

Even though the video feels more like as a big load of rubbish, the only privacy concern I see is if for some reason Google would be "forced" to share all its data with some government and once again I hope google will make it possible to store all data on a server anybody could set up and where google only parses the data. (They would still earn the money and they would need nearly no servers, perfect right?)

This reminds me of the Prodigy days (remember them you old timers).

For those who were not around, before the Internet there were OSPs like AOL called Compuserve and Prodigy. Prodigy used a GUI before windows was around. In installing on to your hard drive it made space for storing information. Unfortunately, they did not wipe the hard drive space before hand and just claimed it as their own. What ever information was there stayed there and we all know that no information on a drive is erased until data is written over it. Someone got curious one day and looked at the file and screamed that Prodigy was uploading personal information to their computers and spying on him.

Now stop and think about things for a second. Let us say Prodigy had 5,000 users (just a number not a fact). How many people would it take to look at all the files that would be uploaded for just those 5,000 people? Multiply that by how many users were really on and you get the idea.

Anyone who really thinks that Google is reading my private email to give me ads is smoking some strong stuff. Text is scanned for keywords and ads are fed accordingly, and I have had some funny ads. Just think people, who many people would they have to hire to read your emails?

Maybe I should invest in a tin foil hat company!

Phillip,

While I understand what you are saying about Chroming the gmail to make it application takes away the ability to see if it sends you to a bad site, that would only work if it opens it up in the same window. Both my Reader and Gmail icons open up any links in them in a separate Chrome window so unless I am reading you wrong, I do not see the security problems. You can see the address bar at that point.

Bob, please see http://blogoscoped.com/forum/144978.html#id144991 for the answer to that... i.e. an application may not in all circumstances open a link in a new window.

Added to that, Chrome's "chromeless" windows do their own part in educating users in the exact wrong direction: "URLs don't matter." This is wrong – URLs do matter, and knowing which domain you're on at all times is a huge part of security. Why don't certain companies start educating users that URLs do matter? Google has promoted all kinds of products from their frontpage, but did they ever link to a brief security guide in that promo spot? The Google Account after all is one of the most far-reaching single sign ons across all web pages, granting an abuser who compromises the credentials potential rights to read email, docs, spreadsheets, photo albums etc.

I am not saying google reads peoples email, but the argument that people at google could not read thousands or millions of email is erroneous, I believe. Google is powerful at search. Someone at google could search for specific words or phrases and see which emails pop up.

Wonder
That could apply to any mail account whether it's webmail or ISP provided. The only way to stop people from having the possibility to do this is to run your own mail server, which would be impractical for most people.

Sorry Philipp,

I read the post wrong as I was still thinking about the video. I felt that people were saying Google was bad for opening mail in the same window.

Yes, that situation is different, but that is different than what I feel the video was saying. To me that comes down to the ignorance of the user though. To say Google is bad because a user is not intelligent is a stretch IMHO.

If a URL is not visible and you need to do exotic things like clicking an icon to retrieve it, then IMO that's not ignorance of the user, it's a tool specifically making the web more insecure for everyone. Well, at least everyone who uses the feature of Chrome application shortcuts, which security-aware users might not use for that reason in the first place – but then why even offer it? (Except to make an app look more like your traditional OS/ Windows-app, which Google might think helps them in the battle against Microsoft, but the web is not a traditional Windows/ desktop OS app, it has different security parameters that need to be thought of.)

When you build a browser there would be ways to make URLs even easier recognizable for security purposes, like embolding the first and second level domain so that users would not need to know quite as much about the dfference between wwwgoogle.com and www.google.com and google.search.com etc. Completely *hiding* the URL however is going the exact wrong direction.

Under Settings > General you can force gmail to only operate in https mode...