Google Toolbar caught tracking users when 'disabled'
We'll ignore this window if you close it
Google has updated its browser toolbar after the application was caught tracking urls even when specifically "disabled" by the user.
In a Monday blog post, Harvard professor and noted Google critic Ben Edelmen provided video evidence of the Google toolbar transmitting data back to the Mountain View Chocolate Factory after he chose to disable the application in the browser window he was currently using.
The Google toolbar offers two disable options: one is meant to disable the toolbar "permanently," and the other is meant to disable the app "only for this window."
In a statement passed to The Reg, Google has acknowledged the bug. According to the statement, the bug affects Google Toolbar versions 6.3.911.1819 through 6.4.1311.42 for Internet Explorer. An update that fixes the bug is now available here, and the company intends to automatically update users' toolbars sometime today.
The statement also says that the bug does not occur if you open a new tab after disabling the toolbar for a particular window. In the statement, Google goes on to say that the bug disappears if you restart your browser, but this doesn't quite make sense. If you're interested in disabling Google toolbar for a particular window, you aren't going to close that window.
"For that option to work as its name promises, Google Toolbar must cease transmissions immediately," Edelman says. "Fact is, the 'Disable Google Toolbar only for this window' option doesn't work at all: It does not actually disable Google Toolbar for the specified window."
It would appear that in saying the bug is fixed when the browser relaunches, Google is referring to a second bug Edelman uncovered. The Harvard prof also found that the toolbar continued to transmit data when he attempted to disable it through Internet Explorer's "Manage Add-ons" window.
With the Google toolbar, certain "enhanced features" require the transmission of data back to Google servers. These features include the ability to view a website's Google PageRank, essentially a measure of its importance on the web at large, and the new Sidewiki, a means of adding meta-comments to webpages. Using a network monitor, Edelman confirmed that if "enhanced features" are activated, Google collects domain names and associated directories, filenames, URL parameters, and search terms.
The user chooses whether to turn on "enhanced features," but Edelman argues that it's much too easy for a user to do so without completely realizing the consequences. The toolbar's standard installation routine launches a "bubble message" that pushes readers to turn on the features, he says, and it's less than clear about what data is being transmitted.
"The feature is described as 'enhanced' and 'helpful,' and Google chooses to tout it with a prominence that indicates Google views the feature as important," Edelman writes. "Moreover, the accept button features bold type plus a jumbo size (more than twice as large as the button to decline). And the accept button has the focus - so merely pressing Space or Enter (easy to do accidentally) serves to activate Enhanced Features without any further confirmation."
Yes, he continues, the message points out that the toolbar "tells us what site you're visiting by sending Google the url." But he argues this stops short of explaining that it collects everything from directories, filenames, and URL parameters to search keywords.
What's more, Edelman says, turning off "enhanced features" is more difficult than turning them on - especially for the average Joe. It appears that the features can't be turned off unless you uninstall the entire toolbar. Or "disable" it. But that doesn't always work. Or at least it didn't until Edelman noticed it didn't. ®
You don't just disable Google Toolbar
You uninstall it, along with every other toolbar that might come near your Internet browser.
I deeply hate those toolbar pests and I feel sorry for each and every one of the people I know who end up having 4 or 5 of them at the same time in their browser, without even knowing how they got them and what is their purpose.
Just say no to google. It's an accident waiting to happen.
I don't know much about Google toolbar, but if it's sending the entire URL to Google that's almost certainly an offense under RIPA.
Anything in a URL after the first single slash (technically, anything beyond that which is necessary to identify the machine the webpage is on, but it's usually considered to be anything after the first slash) is regarded as content, and making content available to others, ie Google, is interception.
And you can't "opt-in", for the same reasons a Phorm opt-in wouldn't be legal. For interception by consent the express permission of both parties, ie the user and the website, is needed.
Google ain't getting my permission to look at URL's for my website.
It's past time for an "evil Google" smilie option on el Reg methinks. Gates and Jobs have them, why not Google?