Google is nearly everyone's best friend. But have you ever stopped to think about just how much Google knows about you?
Do you realize that Google may have recorded and stored every single search term you have ever punched into its search box? Chances are some of those searches could be soberingly damaging to your reputation. What about Gmail? Have you ever sent any sensitive e-mails? How about business information stored in Google Docs?
Unless you sat out the last decade offline, you've likely been building a pretty thorough profile of yourself on Google Inc.'s servers. Depending on which of the dozens of Google services you use, data about your habits, interests, activities, schedule, professional pursuits, stock portfolio and medical history could be sitting somewhere on Google's servers -- along with records of the trip routes you've mapped, the Web sites you've visited and much more.
The good news is that Google anonymizes its server logs by removing the last three digits from the IP addresses associated with searches after nine months and by deleting the associated cookies after 18 months, which makes it very difficult to link you to searches that are more than 18 months old.
That's still a pretty big window into your life, though. What if any or all of that data ever became public? An attacker could conceivably get access to your information on Google by hacking directly into its servers, or by hacking into your individual account.
"There is a huge amount of stuff on Google," says Gartner Research VP Jay Heiser, "and it would be naive to believe that all that information wasn't of huge interest to a wide variety of people."
What's more, the large number of services Google offers means there are multiple ways of accessing data. "Each service brings its own unique risks," says Heiser. "There's potential for a minor vulnerability in one to add up to a more significant vulnerability when combined with something else."
And criminals aren't the only ones who could potentially access your Google records. Should the government (or attorneys from a legal suit you're involved with) come calling, all it takes is a simple subpoena and Google is forced to turn over your information, as outlined in Google's Privacy Policy.
Bottom line? Big Brother knows a whole lot more than you probably thought. But you don't have to avoid Google to keep yourself reasonably safe. You just need to take steps to prevent potentially dangerous information from being stored on Google's servers in the first place, and to protect the integrity of your account.
By taking some basic -- and not-so-basic -- precautions, you can minimize your exposure to bad guys, wherever and whoever they are. Read on to learn about things you can do to minimize the security risks involved in using Google, whether for search or for one of its myriad other online services.
For good measure, we've included two levels of advice on how you can protect yourself:
* "Defcon 2" (good security) tips are things you can do with the tools already at your disposal to keep yourself safe against typical attacks -- but not against a determined attacker.
* "Defcon 1" (best security) tips -- a.k.a. "the celebrity solution" (steps to take if you have, or intend to have, a highly visible public profile) -- offer far more security but are far less practical and often require using third-party tools.
In the end, only you can determine what trade-offs between security and convenience make sense for you.
Risk 1: Search data and metadata
If you visit Google's Web History page, you can see every single Google search you've run, while signed into your Google account, for years. And it's not limited to text searches -- you can also see your history of Google image searches, Google video searches, Google Maps searches and so on. This data is stored by default; users must activate Web History to access it.
Google uses this information for a number of benign purposes, such as fine-tuning its search algorithms and determining wider patterns in Web searches for its Google Trends page. But however useful it is to the company, it's probably a safe bet that you don't want anyone to see every search you've ever done.
Defcon 2
The simplest thing you can do to prevent the accumulation of search data is to make sure you're logged out of your Google account before searching. If you're logged in, your e-mail address will show up in the upper right-hand corner of Google's home page, search results pages or any Google Web page you're on.
Also, turn off Google's Web History. From the upper-right corner of Google's home page, choose Settings --> Google Account settings, click "Edit" next to "My Products" in the left-middle of the page, and click "Remove Web History permanently." (If you don't see this option, it means you never initially activated Web History.)
This will unsubscribe you from Google's Web History service and erase all the specific data linking your account to your searches from Google's servers. Google will still keep data associating your searches with your IP address for nine months and with other nonpersonal information for 18 months, but this data is not specifically linked to your identity.
However, the Web History service can be of value to individual users, not just to Google. A searchable history of every Web search you've ever run could be a powerful tool for your own use. If you're comfortable with your search data being available in Web History but want to prune a few "incriminating" searches from the list, choose Web History under My Products from your Accounts page and click "Remove Items" in the left-hand menu. This will place a checkbox next to each query in your history; select the ones you want to chuck into the Memory Hole and click "Remove," and they'll be deleted.
You can also click the "Clear entire Web history" link at the bottom of the page to delete your past searches all at once, or "pause" Web History for a while, if you know some of your upcoming searches might be difficult to explain or reveal too much personal information. To put Web History on hold, just click the "Pause" link in the left menu, then click "Resume" to have Web History begin saving your searches again.
Defcon 1
Logging out of Google prevents the direct association of searches with you, but not the searches' association with your IP address and other information such as the operating system and browser used, time and date of the search, and the ID of the cookie saved to your computer for that search. (Google's Privacy FAQ shows a sample log entry.) A determined attacker could conceivably work backward from Google's server logs to discover your identity.
To prevent this, anonymize your Web use by using tools like Tor, Anonymizer or the PhZilla Firefox extension. These tools funnel your Web use through one or more proxies, bouncing from city to city around the world, so your searches cannot be traced directly back to your computer. Be warned, though: Internet surfing is significantly slower when it takes place behind a proxy server.
Risk 2: Tracking cookies
Google uses cookies to store your log-in status for its various services, so, for instance, you don't have to log into Google Calendar when you're already logged into Gmail. But that means that you're leaving a trail of log-ins that can be accessed both from Google's servers and from your hard disk.
Also, the Google-owned ad service Doubleclick uses cookies to track visitors as they move among sites, and that information, combined with your Google login, can identify exactly what sites you visited.
Defcon 2
Use your browser's security or privacy settings to reject third-party cookies -- that is, cookies that originate from sources other than the site you're on.
Blocking all cookies can be problematic if you want specific sites to remember your log-in info or preferences. Blocking third-party cookies, on the other hand, won't inconvenience you on most sites but will take your privacy up a notch.
Note that blocking new third-party cookies won't actually get rid of the ones that are already on your system. So to be thorough, you can use your browser's security/privacy settings to either delete all of your current cookies at once -- which means you'll have to re-enter log-in information or preferences at certain sites (but only once) -- or look through your cookies file and manually delete those that aren't from sites whose cookies you want to keep.
However, some services -- notably Doubleclick -- have been able to install cookies even with third-party cookies blocked. You can opt out of Doubleclick's cookies by, ironically, installing an opt-out cookie. But if you clear your cookies file at any time, you might also delete the opt-out cookie. Google provides tools and instructions for making your opt-out preferences permanent in Firefox, Internet Explorer, Chrome and Safari.
Another option is to take advantage of your browser's "private browsing" feature. The most recent versions of Firefox, Safari, IE, Opera and Chrome all offer private browsing sessions -- sometimes called "InPrivate" or "incognito" browsing -- that purge cookies and passwords when you close the browser, and also erase your Web history and browser cache.
The only challenge is remembering to select private browsing before you begin a sensitive search.
Defcon 1
Block scripts and ads entirely. Use an ad blocker such as AdSweep for Firefox, Opera and Chrome or AdblockIE for IE8 to prevent sites from serving ads, including Doubleclick's.
Many ads (including Google AdWords) use JavaScript to load. Blocking scripting in addition to ads is the belt-and-suspenders way of keeping ads from loading and third-party tracking cookies from finding their way onto your system. You can turn off JavaScript and other scripting using your browser's security settings, or use the NoScript extension if you use Firefox.
This will make a huge number of sites unusable, but it will make it much more difficult to track your online behavior. Note that you can add exceptions for sites you trust using the "Trusted Sites" list in IE8 (on the Security tab under Internet Options) or by clicking the NoScript toolbar icon and selecting "Allow" for sites you wish to accept scripting from to restore functionality.
Risk 3: Hackers attacking Google
Even if you trust Google as much as you trust your mother, the sheer amount of data the company amasses about your life is daunting -- even more so when you consider what could happen if someone outside of Google managed to get access to Google's servers.
Sound far-fetched? Google's internal networks were breached in December 2009 in a widespread attack known as "Operation Aurora" that resulted in the theft of some Google source code and some (but not all) personal details of at least one Chinese human-rights activist, including his account creation data and e-mail subject lines.
Google may have some of the best minds in the world working to secure its systems, but it's also a big target -- and a potentially big prize -- for hackers. "Companies like Google are under attack because they have so much data about you," says Bill Morrow, CEO of CSIdentity, an Austin-based provider of identity theft protection services. "Instead of getting a little snippet of your life's digital footprint, [attackers] could get your entire profile."
Defcon 2
Use common sense. "If it's absolutely critical intellectual property, don't use [online] services," says Mark Kadrich, CEO of The Security Consortium, a San Jose-based security services provider and research firm.
The same goes for personal information. No system is 100% perfect. If you simply could not recover from a piece of information getting out into the world, then no online service can offer you the level of security you need.
While Google's mechanisms are strong enough to protect against common threats, a determined attacker such as a corporate competitor or a government agent who gains access to your account on Google could conceivably access everything you've entrusted to the company -- including data you didn't even know you were leaving behind.
"You have both very sensitive and less sensitive data under the same log-in credential," says Vatsal Sonecha, vice president of business development and product management at security vendor TriCipher Inc. "An attacker who gets into your account has the keys to the kingdom."
It's up to you to make the distinction between what information can be trusted to Google and what can't.
Defcon 1
Encrypt your e-mail. If you use an e-mail client like Outlook or Thunderbird to access your Gmail account, you can use a product like PGP Corp.'s PGP Desktop Home or its open-source cousin GnuPG to encrypt all of your outgoing e-mail. Or you can use the FireGPG Firefox extension to add encryption to Gmail's Web interface.
Businesses can use tools such as PGP Desktop Corporate on the desktop or one of PGP's server-based products to encrypt all outgoing e-mail at the network level.
You'll have to insist that others send you only encrypted e-mail, though, or all your incoming e-mail will still be in plain text. Unfortunately, there are no equivalent encryption tools for other Google services -- some, like Google Health, encrypt your data, but not all do.
Risk 4: Hackers guessing your log-in