So to hide your traffic from CoffeeShopSSIDThatMightBeLoggingEverything, route it through a Google-VPN-that's-guaranteed-to-log-everything? Nice try, Google!
The pitch is presumably "to hide your traffic from CoffeeShopSSIDThatMightBeMITMingYou, route it through a Google-VPN-that's-logging-everything-but-at-least-not-injecting-malware".
Technical users like you and I can already set up our own VPN-server-that-logs-nothing. This would serve the needs of others, who currently have the options of (a) be MITM'ed or (b) get scammed by some shady offshore company because it was the first search result for "vpn service".
That pitch is too obscure to work legitimately with most users. Hence, they will cajole users that don't understand the privacy tradeoffs through the VPNs in some other way (very much in line with their current behavior).
Isn't the whole point of validated HTTPS that it protects you from MITM attacks? (barring shenanigans like Lenovo) And if somebody MITMs my regular-HTTP connection...well then, oh no I might see ads instead of the blog I wanted to read.
Everything is blocked for me at airports... Unless I pay a stupid amount of money per hour. Of course they would dare blocking Google (and anyone else) servers.
There are thousands of VPN providers, some better some worse, but if you pick well your data can be safe from US government. By picking Google VPN, you are essentially giving away all your privacy to inspect to NSA. Kind of funny when you think about it :)
From the screenshots, this seems more like something built into a future version of Android that might automatically engage when joining unsecured networks.
It's hard not to see an offer of at least some form of security to be a net positive in that case.
Think of it this way: this is worse than any other option, but still better than nothing. As such, it's great as an opt-out default: it steps in exactly where the users would otherwise be using "nothing", thus actually eliminating the "nothing" level as an option.
What if using google's service for your vpn would actually make it easier for them to get the data _you are trying to hide_ than compared to not involving GOOGLE as your _vpn service_ at all.
Honestly, how are everyone's alarms not going off right now? Google fiber, alright, at least I get fucking 1 gbps. Google VPN?? A VPN?? Keep Google/<substitute-3-letter-agency-of-the-day> in charge of what you use to hide your illegal torrents?? Genius.
I think it's because you're coming from a position of insufficient cynicism.
Are you torrenting, or planning terrorist acts, or whatever else, on your mobile connection? You're crazy. I would never do anything I'd want to hide from the government on my phone; it's already got that mysterious baseband coprocessor running god-knows-what with direct DMA access to main memory. Adding a VPN pipe directly to the manufacturer doesn't make me any more potentially-spied-on than I already was, since the ISP already, effectively, had arbitrary code execution and their own backchannel.
Security professionals don't avoid smartphones altogether, of course; they just use them only as conveniences for "unclassified" day-to-day operations.
>doesn't make me any more potentially-spied-on than I already was
That's the logic that brought us ads plastered all across the web, with nothing sanctified, including the _content_ of the web page. 'I mean, we _already_ see them anyway, what's the difference if they're blinking/videos/popups? I mean, we don't have to look.'
And yes, I pretty much use my mobile as less as I can, just for these reasons. I'd never use it willingly as long as there's even a trace of google in android. However, can you elaborate more on the coprocessor? Maybe some additional reading? I'm very interested in what possible surveillance do they have in the hardware itself.
P.S - At this point, I'd rather use apple than google. At least apple can't tie my activities to my search results, which is an insanity that the world will come to terms with several years down the road, and then repent.
Okay, let me be more clear: I don't expect the NSA to care much about me. I'm a Canadian citizen. I would rather my phone automatically suggest to me a VPN that ends up piping all my data to a country that doesn't have specific reason to be interested in me, than that I route my data in-the-clear over networks that are operated by governments who do have reason to care about me (because I'm one of their citizens and their laws apply to me, and they might want to figure out if I'm breaking them, etc.)
Android phones are sold globally, remember. There are much worse places to "moor your ship", data-wise, than the US. If this VPN circumvents Chinese Internet censorship, for example, then it's a win by sheer numbers, whatever it does to US domestic citizens.
Citation needed. I get that it's trivial to actually do, but do you have any studies that show that a lot/any WiFi is being sniffed and/or MiTM'd? The most I've seen is airports and so on tracking people via MAC addresses or the WiFi AP names they request.
Google isn't holding a gun to anyone's head and making them use their services.
If you feel that Google potentially having access to your data is worse than some other potential threat that can exist then by all means use that open wifi.
Hey look, it's an informationless comment in response to what may be an interesting find!
If you're worried about a Google VPN provided by the Google Operating System you run, I think you may have your knee-jerk circuits prioritizing incorrectly.
Arguably, that operating system is open source, and at the least, decently vetted. If you disable spyware like Google Play Services, it's likely to be reasonably safe. On the other hand, routing data through Google's servers is a distinctly different proposition.
And arguably logging everything that goes over a VPN doesn't increase the value of ads for someone that's already using you for search and email. What gain would there be there?
> Arguably, that operating system is open source, and at the least, decently vetted
The one provided pre-installed by Samsung and Verizon. Right.
> If you disable spyware like Google Play Services, it's likely to be reasonably safe.
Ah, so we're going with the "well it feels safer" school of computer security.
Do you work for Google? I don't know how you can actually argue that sending all of your traffic through Google's servers won't give them more chances to look at the traffic you are sending them.
"The one provided pre-installed by Samsung and Verizon. Right."
For the average user, yes. Developers can go deeper and install a version that's not just binary blob installed on your phone.
If you really care, just buy a VPN connection of your own. I did, for around $50 a year - and I can connect to it on port 80, so no firewalls even get in the way. Easy.
Seems like a good place to plug one of my favorite osx apps, https://www.getcloak.com. Blocks your Wi-Fi connection on open networks until it's able to secure a vpn connection to one of the many services they use (aws, rackspace, etc)
Not quite the same concept, but I setup Little Snitch to work differently on my home/work networks versus tethered phone or untrusted wireless. I originally did this because I didn't want updates running while tethered at a coffee shop. This article got me started: http://www.practicallyefficient.com/home/2014/7/8/little-sni...
How does Google benefit from being a VPN server? Obviously they get to track web usage patterns for analytics and reinforcing their search algorithm. But what the other thing a VPN does is hide that same information from the tunneled through networks. And who else is pushing for the use of public wifi? AT&T and Comcast. But neither of them are in the advertising business so don't have a reason to be collecting the same information that Google makes their money off of. But what Comcast and AT&T do make their money off of is providing telecommunication service. How would AT&T feel about their public wifi being used for, say, handling VOIP calls to T-Mobile telephone customers? Or Google telephone customers.
Net neutrality promises that AT&T won't be able to discriminate VOIP but Google doesn't trust them. This VPN is a hedge so they won't have their traffic interfered with when they compete directly with the traditional telecom providers.
Some ISPs are in the advertising business to some degree, with DNS redirection and even sometimes direct ad injection. One of the other things the VPN will do, semi-ironically, is prevent this.
I suppose Google's philosophy on advertising is similar to how they feel about operating systems: if they can't make money on something, they want to ensure that no one else can, either.
If they're going to discontinue their service after a couple of years (like they did on countless occasion, last one being Google Code), then no thank you.
That's probably their next attack target. VPNs. Put out this awesome new 'secure' service for free, suddenly make everyone aware of VPNs and what they are, and how they are suddenly the most important thing for security, through subtle ads and 'techcrunch-y' articles. BAM, people start switching in droves, other reliable and cheap VPN service providers start losing business, google reader (but the service actually stays up this time, just logging like hell, and eventually becomes _necessary_ to use google services, because SECURITY!) yada yada
How is google allowed to repeat this again and again is beyond me
That's probably their next attack target. VPNs. Put out this awesome new 'secure' service for free, suddenly make everyone aware of VPNs and what they are, and how they are suddenly the most important thing for security, through subtle ads and 'techcrunch-y' articles. BAM, people start switching in droves, other reliable and cheap VPN service providers start losing business, google reader (but the service actually stays up this time, just logging like hell, and eventually becomes _necessary_ to use google services, because SECURITY!) yada yada
How is google allowed to repeat this again and again is beyond me
I usually have a hard time connecting to VPN over public wifi, even when I use servers that are designed to be connectable even if there's a firewall in the way. This is true of servers I've set up myself and it's true of servers from commercial VPN providers like HideMyAss. Even if there isn't active manipulation or blocking from the firewall, it just seems that the connection is rarely strong or consistent enough to keep the tunnel from breaking all the time.
I have had better luck with a SOCKS proxy hosted at my home, but it's still not as good as VPN.
Google already did this back in 2005. Google Secure Access was a similar VPN service to protect your traffic on open Wi-Fi networks. I wonder what other shuttered Google projects from ten years ago might be interesting again.
54 comments
[ 2.5 ms ] story [ 112 ms ] threadTechnical users like you and I can already set up our own VPN-server-that-logs-nothing. This would serve the needs of others, who currently have the options of (a) be MITM'ed or (b) get scammed by some shady offshore company because it was the first search result for "vpn service".
My vpn is often blocked at airports and the like. I doubt the would dare block a google server.
If you want a Google Server, use Google Compute Engine :)
It's hard not to see an offer of at least some form of security to be a net positive in that case.
If they don't provide an easy and apparent way to turn that off, this is the word that always sets off alarm bells in my head.
Honestly, how are everyone's alarms not going off right now? Google fiber, alright, at least I get fucking 1 gbps. Google VPN?? A VPN?? Keep Google/<substitute-3-letter-agency-of-the-day> in charge of what you use to hide your illegal torrents?? Genius.
Are you torrenting, or planning terrorist acts, or whatever else, on your mobile connection? You're crazy. I would never do anything I'd want to hide from the government on my phone; it's already got that mysterious baseband coprocessor running god-knows-what with direct DMA access to main memory. Adding a VPN pipe directly to the manufacturer doesn't make me any more potentially-spied-on than I already was, since the ISP already, effectively, had arbitrary code execution and their own backchannel.
Security professionals don't avoid smartphones altogether, of course; they just use them only as conveniences for "unclassified" day-to-day operations.
That's the logic that brought us ads plastered all across the web, with nothing sanctified, including the _content_ of the web page. 'I mean, we _already_ see them anyway, what's the difference if they're blinking/videos/popups? I mean, we don't have to look.'
And yes, I pretty much use my mobile as less as I can, just for these reasons. I'd never use it willingly as long as there's even a trace of google in android. However, can you elaborate more on the coprocessor? Maybe some additional reading? I'm very interested in what possible surveillance do they have in the hardware itself.
P.S - At this point, I'd rather use apple than google. At least apple can't tie my activities to my search results, which is an insanity that the world will come to terms with several years down the road, and then repent.
Likelihood Bob the Tomato's Coffee Shop is collecting your info: Low.
Android phones are sold globally, remember. There are much worse places to "moor your ship", data-wise, than the US. If this VPN circumvents Chinese Internet censorship, for example, then it's a win by sheer numbers, whatever it does to US domestic citizens.
Airport itself? Low Other people in the airport? High
It's not necessarily the place itself, but anywhere there's open (or easy to get) WiFi, the chance of nefarious users increases dramatically.
Citation needed. I get that it's trivial to actually do, but do you have any studies that show that a lot/any WiFi is being sniffed and/or MiTM'd? The most I've seen is airports and so on tracking people via MAC addresses or the WiFi AP names they request.
That is, if you believe the company that is operating behind it.
If you're worried about a Google VPN provided by the Google Operating System you run, I think you may have your knee-jerk circuits prioritizing incorrectly.
> Arguably, that operating system is open source, and at the least, decently vetted
The one provided pre-installed by Samsung and Verizon. Right.
> If you disable spyware like Google Play Services, it's likely to be reasonably safe.
Ah, so we're going with the "well it feels safer" school of computer security.
"The one provided pre-installed by Samsung and Verizon. Right."
For the average user, yes. Developers can go deeper and install a version that's not just binary blob installed on your phone.
Net neutrality promises that AT&T won't be able to discriminate VOIP but Google doesn't trust them. This VPN is a hedge so they won't have their traffic interfered with when they compete directly with the traditional telecom providers.
I suppose Google's philosophy on advertising is similar to how they feel about operating systems: if they can't make money on something, they want to ensure that no one else can, either.
How is google allowed to repeat this again and again is beyond me
How is google allowed to repeat this again and again is beyond me
I have had better luck with a SOCKS proxy hosted at my home, but it's still not as good as VPN.
http://lifehacker.com/126454/google-secure-access---encrypt-...