Google+, privacy and the human brain

2011-08-01

Luis Corrons

Panda Security, Spain
Editor: Helen Martin

Abstract

‘In the security industry we know the dangers of sharing personal information and we never stop warning about it.' Luis Corrons, Panda Security.


Google+ has become the latest cool new social network that everyone wants to try. More than 10 million users joined the site in the space of just a few days – pretty impressive even for a company like Google. Facebook and Twitter had to wait years to build up such a large number of users. For those who have not yet experienced Google+, I would describe it as a mix between Facebook and Twitter. You can follow whoever you want, you add only the people you want, and you can create different circles of contacts, so that every time you share something you can select the circles with which you wish to share it. You can even go ‘public’, sharing with everybody, as in Twitter.

In the security industry we know the dangers of sharing personal information and we never stop warning about it. The idea of the circles in Google+ is a simple one and a good one, making it very easy to share what you want with the people you want. (While this is technically also possible on Facebook, creating lists on Facebook is a rather more difficult process and users tend to share all of their information with all of their contacts.) Overall, we are enjoying the ease of use of Google+, and hoping that Google has learned from its past mistakes (remember Buzz?).

However, there is still the issue of privacy. The following is an excerpt from the Google+ terms of service:

By submitting, posting or displaying the content you give Google a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit...

The fact that people are worried about this and are discussing it publicly (e.g. http://www.zdnet.com/blog/projectfailures/google-plus-is-privacy-an-issue/13749), and the fact that the site has some close competitors (e.g. Facebook) means that Google will have plenty of motivation to fight to win the trust of its users. But in this battle over privacy the key is the user. Ultimately it is the user who decides how exposed he/she wants to be, and in this case, I’m afraid that the battle is already lost: privacy no longer exists for most users.

It doesn’t matter how loudly we shout our warnings, all users will reach the point where they will have to decide between privacy and popularity – and in that moment the majority of users seem to opt for popularity. Social networks not only enable people to share thoughts, ideas, photographs, videos and more, but they also make all users equal. Anyone can talk, anyone can listen. This was impossible before the Internet came along, and we now have the opportunity for anyone to spread their beliefs and ideas, to become popular and feed their ego. In some cultures people compare the size of their muscles as a show of status; in social networks users compare the number of followers/contacts they have, or in the case of Google+, the size of their circles.

At some point in their lives a lot of people dream of becoming a ‘rock star’ (or the equivalent in their field) – gaining recognition from the masses – yet very few will ever achieve such a status in real life. Social networks give the opportunity to millions of ordinary people to build up networks of followers – people will throw themselves into Google+ hoping to become something they are not. And thus the better privacy settings (or ones that are easier to use) will actually translate into less privacy.

Is there a perfect solution? No. The only way to resolve the issue once and for all would be to take away users’ freedom and clamp down on privacy – which is not a viable option. We can only try to mitigate the problem through education: give users enough information to enable them to make their own decisions based on a better understanding of the implications of being a ‘rock star’. We know that a rock star’s life is not all glamour, and our responsibility is to share that knowledge. No more, no less.

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest articles:

Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects

Aditya Sood & Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited to compromise the C&C panel in order to gather threat intelligence, and present a model of mobile AppInjects.

Cryptojacking on the fly: TeamTNT using NVIDIA drivers to mine cryptocurrency

TeamTNT is known for attacking insecure and vulnerable Kubernetes deployments in order to infiltrate organizations’ dedicated environments and transform them into attack launchpads. In this article Aditya Sood presents a new module introduced by…

Collector-stealer: a Russian origin credential and information extractor

Collector-stealer, a piece of malware of Russian origin, is heavily used on the Internet to exfiltrate sensitive data from end-user systems and store it in its C&C panels. In this article, researchers Aditya K Sood and Rohit Chaturvedi present a 360…

Fighting Fire with Fire

In 1989, Joe Wells encountered his first virus: Jerusalem. He disassembled the virus, and from that moment onward, was intrigued by the properties of these small pieces of self-replicating code. Joe Wells was an expert on computer viruses, was partly…

Run your malicious VBA macros anywhere!

Kurt Natvig wanted to understand whether it’s possible to recompile VBA macros to another language, which could then easily be ‘run’ on any gateway, thus revealing a sample’s true nature in a safe manner. In this article he explains how he recompiled…


Bulletin Archive

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.