[kall]

From www.gmail-is-too-creepy.com :

Google has added many new services and features in recent years. On April 1 they announced their Gmail service. It's no April Fools joke, but someone at Google may still be laughing. A form on their site lets you enter your email address so that Google can send you updated information about Gmail within the next few weeks.

Many Google fans, as well as those who are attracted to the generous storage offered by Google's free Gmail, are rushing to enter their email address in this box. Although it is not stated anywhere on Google's site, the presumption among many is that those who do this immediately will have a better chance of getting a unique username that suits them.

This is an urgent appeal to anyone entering their email address on any page at google.com, to first delete their Google cookie. The urgency has to do with the fact that hundreds of thousands have already done this, and millions more can be expected to do this over the next month or two. Other pages at Google have the same problem (News Alerts is an example), but the numbers involved are much smaller.

Google uses a single cookie for everything, and it expires in 2038. Your browser offers this cookie, which contains a unique ID number, every time you enter any page on Google's site. If you don't have a cookie, Google will give you one with a new unique ID number.

All of your search terms are saved by Google, along with a time stamp, your IP address, and your unique cookie ID. So far this information is not considered "personally identifiable" by Google because your IP addresses might be dynamic. (Broadband addresses are often fixed for weeks or months, but dialup addresses are very dynamic.) The unique ID in the cookie is the one thing that identifies all of your various IP addresses as coming from the same browser.



Google execs spin three answers to the same
question, but we know what they want to say


1. April 2, Los Angeles Times, by Chris Gaither:

Larry Page wouldn't say whether Google planned to link Gmail users to their Web search queries. "It might be really useful for us to know that information" to make search results better, he said. "I'd hate to rule anything like that out."

2. April 6, Associated Press, by Michael Liedtke:

Wayne Rosing said there will be an information firewall separating Google's search engine from Gmail. "We don't use the data collected on one service," he said, "to enhance another."

3. April 8, New York Times, by Katie Hafner:

Mr. Rosing said Google did not create links between users' search activity and their Gmail accounts. "We have no immediate plans to do so in the future," he said.

What Google really wants to say:

"As soon as those privacy nuts with the tin-foil hats grow tired and leave us alone, we can get on with our Master Plan."


Your Internet service provider maintains logs that can trace your IP address to you as an individual at a particular point in time. This is especially true if you use broadband. But as time passes, many providers rotate their logs and the old data is deleted. Normally, the only way that your unique cookie ID at Google can be traced to you as an individual is through this IP address.

However, as soon as you enter an email address on a Google form, it becomes easy for Google to assign your cookie ID to you as an individual. That's because your browser, at the precise point in time that you click your email address to Google on one of their forms, sends your Google cookie ID along with the email address you entered. Google is no fool. They will record this information so that it can be retrieved from their databases. Now they've tied your searching history to your email address. How hard is it to tie your email address to you as an individual? It's not hard at all.

If you delete your Google cookie before you hand over your email address, then by the time you get to the form and submit your email, Google will have issued a new cookie that has an unused ID in it. This cookie ID will not match anything in Google's databases. After submitting your email, you should delete your new cookie too. That way your email address is tied to a cookie ID number that remains useless to Google.