Feeds

Google Toolbar caught tracking users when 'disabled'

We'll ignore this window if you close it

Internet Security Threat Report 2014

Google has updated its browser toolbar after the application was caught tracking urls even when specifically "disabled" by the user.

In a Monday blog post, Harvard professor and noted Google critic Ben Edelmen provided video evidence of the Google toolbar transmitting data back to the Mountain View Chocolate Factory after he chose to disable the application in the browser window he was currently using.

The Google toolbar offers two disable options: one is meant to disable the toolbar "permanently," and the other is meant to disable the app "only for this window."

In a statement passed to The Reg, Google has acknowledged the bug. According to the statement, the bug affects Google Toolbar versions 6.3.911.1819 through 6.4.1311.42 for Internet Explorer. An update that fixes the bug is now available here, and the company intends to automatically update users' toolbars sometime today.

The statement also says that the bug does not occur if you open a new tab after disabling the toolbar for a particular window. In the statement, Google goes on to say that the bug disappears if you restart your browser, but this doesn't quite make sense. If you're interested in disabling Google toolbar for a particular window, you aren't going to close that window.

"For that option to work as its name promises, Google Toolbar must cease transmissions immediately," Edelman says. "Fact is, the 'Disable Google Toolbar only for this window' option doesn't work at all: It does not actually disable Google Toolbar for the specified window."

It would appear that in saying the bug is fixed when the browser relaunches, Google is referring to a second bug Edelman uncovered. The Harvard prof also found that the toolbar continued to transmit data when he attempted to disable it through Internet Explorer's "Manage Add-ons" window.

With the Google toolbar, certain "enhanced features" require the transmission of data back to Google servers. These features include the ability to view a website's Google PageRank, essentially a measure of its importance on the web at large, and the new Sidewiki, a means of adding meta-comments to webpages. Using a network monitor, Edelman confirmed that if "enhanced features" are activated, Google collects domain names and associated directories, filenames, URL parameters, and search terms.

The user chooses whether to turn on "enhanced features," but Edelman argues that it's much too easy for a user to do so without completely realizing the consequences. The toolbar's standard installation routine launches a "bubble message" that pushes readers to turn on the features, he says, and it's less than clear about what data is being transmitted.

"The feature is described as 'enhanced' and 'helpful,' and Google chooses to tout it with a prominence that indicates Google views the feature as important," Edelman writes. "Moreover, the accept button features bold type plus a jumbo size (more than twice as large as the button to decline). And the accept button has the focus - so merely pressing Space or Enter (easy to do accidentally) serves to activate Enhanced Features without any further confirmation."

Yes, he continues, the message points out that the toolbar "tells us what site you're visiting by sending Google the url." But he argues this stops short of explaining that it collects everything from directories, filenames, and URL parameters to search keywords.

What's more, Edelman says, turning off "enhanced features" is more difficult than turning them on - especially for the average Joe. It appears that the features can't be turned off unless you uninstall the entire toolbar. Or "disable" it. But that doesn't always work. Or at least it didn't until Edelman noticed it didn't. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.