Feeds

Google Toolbar caught tracking users when 'disabled'

We'll ignore this window if you close it

Intelligent flash storage arrays

Google has updated its browser toolbar after the application was caught tracking urls even when specifically "disabled" by the user.

In a Monday blog post, Harvard professor and noted Google critic Ben Edelmen provided video evidence of the Google toolbar transmitting data back to the Mountain View Chocolate Factory after he chose to disable the application in the browser window he was currently using.

The Google toolbar offers two disable options: one is meant to disable the toolbar "permanently," and the other is meant to disable the app "only for this window."

In a statement passed to The Reg, Google has acknowledged the bug. According to the statement, the bug affects Google Toolbar versions 6.3.911.1819 through 6.4.1311.42 for Internet Explorer. An update that fixes the bug is now available here, and the company intends to automatically update users' toolbars sometime today.

The statement also says that the bug does not occur if you open a new tab after disabling the toolbar for a particular window. In the statement, Google goes on to say that the bug disappears if you restart your browser, but this doesn't quite make sense. If you're interested in disabling Google toolbar for a particular window, you aren't going to close that window.

"For that option to work as its name promises, Google Toolbar must cease transmissions immediately," Edelman says. "Fact is, the 'Disable Google Toolbar only for this window' option doesn't work at all: It does not actually disable Google Toolbar for the specified window."

It would appear that in saying the bug is fixed when the browser relaunches, Google is referring to a second bug Edelman uncovered. The Harvard prof also found that the toolbar continued to transmit data when he attempted to disable it through Internet Explorer's "Manage Add-ons" window.

With the Google toolbar, certain "enhanced features" require the transmission of data back to Google servers. These features include the ability to view a website's Google PageRank, essentially a measure of its importance on the web at large, and the new Sidewiki, a means of adding meta-comments to webpages. Using a network monitor, Edelman confirmed that if "enhanced features" are activated, Google collects domain names and associated directories, filenames, URL parameters, and search terms.

The user chooses whether to turn on "enhanced features," but Edelman argues that it's much too easy for a user to do so without completely realizing the consequences. The toolbar's standard installation routine launches a "bubble message" that pushes readers to turn on the features, he says, and it's less than clear about what data is being transmitted.

"The feature is described as 'enhanced' and 'helpful,' and Google chooses to tout it with a prominence that indicates Google views the feature as important," Edelman writes. "Moreover, the accept button features bold type plus a jumbo size (more than twice as large as the button to decline). And the accept button has the focus - so merely pressing Space or Enter (easy to do accidentally) serves to activate Enhanced Features without any further confirmation."

Yes, he continues, the message points out that the toolbar "tells us what site you're visiting by sending Google the url." But he argues this stops short of explaining that it collects everything from directories, filenames, and URL parameters to search keywords.

What's more, Edelman says, turning off "enhanced features" is more difficult than turning them on - especially for the average Joe. It appears that the features can't be turned off unless you uninstall the entire toolbar. Or "disable" it. But that doesn't always work. Or at least it didn't until Edelman noticed it didn't. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.