INTERNET
Can you trust Google gadgets? Probably not
By Dan Tynan.
Google's gadgets may want your location information and a lot more. Telling a legit gadget from a bogus one is harder than it looks.
July 25, 2010, 10:34 PM —
A couple of weeks ago I posted a blog entry about a troubling request I received for my location information from an obscure URL. Turns out the request was coming from one of my iGoogle gadgets, though there was no way to tell that from the message itself, which read:
"http://lfkq9vbe9u4sg98ip8rfvfOOl7atcn3d.ig.ig.gmodules.com/ wants to track your physical location"
The only explanation I could find: It was coming from Google Latitude. Why didn’t Google just say that? Because the names of Gadgets can be spoofed, though their Web addresses cannot, so the best Google could do was display that insane URL.
[ See also: Why location privacy is important ]
At the time I thought the explanation sounded too funky. This was Google, after all – surely they had a more elegant solution? So I requested some clarification from Google. It took a while, but I finally did get it. It turns out I was right on all counts. In fact, it’s worse than I originally thought.
Here’s the official statement, which I’ve been asked to attribute to a “Google spokesperson”:
"We render iGoogle gadgets in separate iframes and tie them to a specific web address. These web addresses are unique in order to help prevent gadgets from improperly accessing data from other gadgets or web pages that they should not be able to access.iGoogle can blacklist bad gadgets, and users can report them for us to investigate. We also always advise users never to install gadgets that they don't trust.Separately, these same unique web addresses appear in a notification bar in browsers like Chrome and Firefox when a gadget or web page requests access to a user's location. The requesting web address should be recognizable for most web pages, such as maps.google.com, but we are looking into how to better present unique web addresses for gadgets to users to help them discern which gadget is requesting their location."
Like any content on the Internet, Google Gadgets are only as trustworthy as the people who built ‘em. And since the Gadget marketplace, like the Android Market, is open to anyone willing to crank out and upload some code, that will vary greatly.
No comments:
Post a Comment