-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Google Search and Gmail Correlation - Full Disclosure February 23, 2005 I. INTRODUCTION Google appears to be correlating searches on Google's site with Gmail accounts, potentially creating privacy concerns for Gmail users. II. DESCRIPTION Perhaps others are aware of this, but it came as a bit of a surprise to me, since I rarely do packet dumps while performing Google searches, but it seems that Google is correlating searches with Gmail accounts - even if the user has logged out of Gmail. In the course of performing some network and software testing, I ended up going to Google and performing some basic searches to ensure my network tweaks were functioning properly. I also happened to be running some packet captures at the same time. While viewing the packet captures, I noticed some odd parameters being passed by my browser to Google - Gmail account information. I thought I may have still been logged into Gmail, so I logged out of Gmail and performed the search again, and again my Gmail account was associated with the search. I then went into Firefox's cookie configuration and deleted the Gmail cookie, performed the search again at Google, and now my Gmail information was no longer associated with the search. Here are the relevant packet dumps: <-- Not logged into Gmail and no cookie present on system --> 02/18-10:10:32.469169 192.168.111.8:33252 -> 216.239.63.104:80 TCP TTL:64 TOS:0x0 ID:21327 IpLen:20 DgmLen:603 DF ***AP*** Seq: 0x3B8327E2 Ack: 0x2DE8A304 Win: 0x16D0 TcpLen: 32 TCP Options (3) => NOP NOP TS: 3699894 6991645 47 45 54 20 2F 73 65 61 72 63 68 3F 68 6C 3D 65 GET /search?hl=e 6E 26 71 3D 68 69 6A 61 63 6B 2B 74 68 69 73 26 n&q=hijack+this& 62 74 6E 47 3D 47 6F 6F 67 6C 65 2B 53 65 61 72 btnG=Google+Sear 63 68 20 48 54 54 50 2F 31 2E 31 0D 0A 48 6F 73 ch HTTP/1.1..Hos 74 3A 20 77 77 77 2E 67 6F 6F 67 6C 65 2E 63 6F t: www.google.co 6D 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D m..User-Agent: M 6F 7A 69 6C 6C 61 2F 35 2E 30 20 28 58 31 31 3B ozilla/5.0 (X11; 20 55 3B 20 4C 69 6E 75 78 20 69 36 38 36 3B 20 U; Linux i686; 65 6E 2D 55 53 3B 20 72 76 3A 31 2E 37 2E 35 29 en-US; rv:1.7.5) 20 47 65 63 6B 6F 2F 32 30 30 34 31 31 30 37 20 Gecko/20041107 46 69 72 65 66 6F 78 2F 31 2E 30 0D 0A 41 63 63 Firefox/1.0..Acc 65 70 74 3A 20 74 65 78 74 2F 78 6D 6C 2C 61 70 ept: text/xml,ap 70 6C 69 63 61 74 69 6F 6E 2F 78 6D 6C 2C 61 70 plication/xml,ap 70 6C 69 63 61 74 69 6F 6E 2F 78 68 74 6D 6C 2B plication/xhtml+ 78 6D 6C 2C 74 65 78 74 2F 68 74 6D 6C 3B 71 3D xml,text/html;q= 30 2E 39 2C 74 65 78 74 2F 70 6C 61 69 6E 3B 71 0.9,text/plain;q 3D 30 2E 38 2C 69 6D 61 67 65 2F 70 6E 67 2C 2A =0.8,image/png,* 2F 2A 3B 71 3D 30 2E 35 0D 0A 41 63 63 65 70 74 /*;q=0.5..Accept 2D 4C 61 6E 67 75 61 67 65 3A 20 65 6E 2D 75 73 -Language: en-us 2C 65 6E 3B 71 3D 30 2E 35 0D 0A 41 63 63 65 70 ,en;q=0.5..Accep 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 t-Encoding: gzip 2C 64 65 66 6C 61 74 65 0D 0A 41 63 63 65 70 74 ,deflate..Accept 2D 43 68 61 72 73 65 74 3A 20 49 53 4F 2D 38 38 -Charset: ISO-88 35 39 2D 31 2C 75 74 66 2D 38 3B 71 3D 30 2E 37 59-1,utf-8;q=0.7 2C 2A 3B 71 3D 30 2E 37 0D 0A 4B 65 65 70 2D 41 ,*;q=0.7..Keep-A 6C 69 76 65 3A 20 33 30 30 0D 0A 43 6F 6E 6E 65 live: 300..Conne 63 74 69 6F 6E 3A 20 6B 65 65 70 2D 61 6C 69 76 ction: keep-aliv 65 0D 0A 52 65 66 65 72 65 72 3A 20 68 74 74 70 e..Referer: http 3A 2F 2F 77 77 77 2E 67 6F 6F 67 6C 65 2E 63 6F ://www.google.co 6D 2F 0D 0A 43 6F 6F 6B 69 65 3A 20 50 52 45 46 m/..Cookie: PREF 3D 49 44 3D 37 34 30 39 64 63 64 66 65 36 61 38 =ID=7409dcdfe6a8 38 32 38 62 3A 54 4D 3D 31 31 30 38 37 34 36 36 828b:TM=11087466 31 38 3A 4C 4D 3D 31 31 30 38 37 34 36 36 31 38 18:LM=1108746618 3A 53 3D 71 36 47 4A 41 4D 47 66 50 4A 66 4B 6A :S=q6GJAMGfPJfKj 54 55 50 0D 0A 0D 0A TUP.... =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+=+=+ <-- Not logged into Gmail but Gmail cookie still on my system --> 02/18-10:13:27.109702 192.168.111.8:33262 -> 216.239.63.104:80 TCP TTL:64 TOS:0x0 ID:20271 IpLen:20 DgmLen:838 DF ***AP*** Seq: 0x459C51DB Ack: 0x72CB0C4B Win: 0x16D0 TcpLen: 32 TCP Options (3) => NOP NOP TS: 3874561 6991994 47 45 54 20 2F 73 65 61 72 63 68 3F 68 6C 3D 65 GET /search?hl=e 6E 26 6C 72 3D 26 71 3D 67 6F 6F 67 6C 65 2B 67 n&lr=&q=google+g 6D 61 69 6C 26 62 74 6E 47 3D 53 65 61 72 63 68 mail&btnG=Search 20 48 54 54 50 2F 31 2E 31 0D 0A 48 6F 73 74 3A HTTP/1.1..Host: 20 77 77 77 2E 67 6F 6F 67 6C 65 2E 63 6F 6D 0D www.google.com. 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A .User-Agent: Moz 69 6C 6C 61 2F 35 2E 30 20 28 58 31 31 3B 20 55 illa/5.0 (X11; U 3B 20 4C 69 6E 75 78 20 69 36 38 36 3B 20 65 6E ; Linux i686; en 2D 55 53 3B 20 72 76 3A 31 2E 37 2E 35 29 20 47 -US; rv:1.7.5) G 65 63 6B 6F 2F 32 30 30 34 31 31 30 37 20 46 69 ecko/20041107 Fi 72 65 66 6F 78 2F 31 2E 30 0D 0A 41 63 63 65 70 refox/1.0..Accep 74 3A 20 74 65 78 74 2F 78 6D 6C 2C 61 70 70 6C t: text/xml,appl 69 63 61 74 69 6F 6E 2F 78 6D 6C 2C 61 70 70 6C ication/xml,appl 69 63 61 74 69 6F 6E 2F 78 68 74 6D 6C 2B 78 6D ication/xhtml+xm 6C 2C 74 65 78 74 2F 68 74 6D 6C 3B 71 3D 30 2E l,text/html;q=0. 39 2C 74 65 78 74 2F 70 6C 61 69 6E 3B 71 3D 30 9,text/plain;q=0 2E 38 2C 69 6D 61 67 65 2F 70 6E 67 2C 2A 2F 2A .8,image/png,*/* 3B 71 3D 30 2E 35 0D 0A 41 63 63 65 70 74 2D 4C ;q=0.5..Accept-L 61 6E 67 75 61 67 65 3A 20 65 6E 2D 75 73 2C 65 anguage: en-us,e 6E 3B 71 3D 30 2E 35 0D 0A 41 63 63 65 70 74 2D n;q=0.5..Accept- 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 2C 64 Encoding: gzip,d 65 66 6C 61 74 65 0D 0A 41 63 63 65 70 74 2D 43 eflate..Accept-C 68 61 72 73 65 74 3A 20 49 53 4F 2D 38 38 35 39 harset: ISO-8859 2D 31 2C 75 74 66 2D 38 3B 71 3D 30 2E 37 2C 2A -1,utf-8;q=0.7,* 3B 71 3D 30 2E 37 0D 0A 4B 65 65 70 2D 41 6C 69 ;q=0.7..Keep-Ali 76 65 3A 20 33 30 30 0D 0A 43 6F 6E 6E 65 63 74 ve: 300..Connect 69 6F 6E 3A 20 6B 65 65 70 2D 61 6C 69 76 65 0D ion: keep-alive. 0A 52 65 66 65 72 65 72 3A 20 68 74 74 70 3A 2F .Referer: http:/ 2F 77 77 77 2E 67 6F 6F 67 6C 65 2E 63 6F 6D 2F /www.google.com/ 73 65 61 72 63 68 3F 68 6C 3D 65 6E 26 71 3D 68 search?hl=en&q=h 69 6A 61 63 6B 2B 74 68 69 73 26 62 74 6E 47 3D ijack+this&btnG= 47 6F 6F 67 6C 65 2B 53 65 61 72 63 68 0D 0A 43 Google+Search..C 6F 6F 6B 69 65 3A 20 50 52 45 46 3D 49 44 3D 37 ookie: PREF=ID=7 34 30 39 64 63 64 66 65 36 61 38 38 32 38 62 3A 409dcdfe6a8828b: 54 4D 3D 31 31 30 38 37 34 36 36 31 38 3A 4C 4D TM=1108746618:LM 3D 31 31 30 38 37 34 36 37 37 32 3A 47 4D 3D 31 =1108746772:GM=1 3A 53 3D 62 30 41 5F 6F 4D 7A 38 38 43 45 4E 61 :S=b0A_oMz88CENa 36 4F 72 3B 20 54 5A 3D 34 32 30 3B 20 47 4D 41 6Or; TZ=420; GMA 49 4C 5F 4C 4F 47 49 4E 3D 31 31 30 38 37 34 36 IL_LOGIN=1108746 37 35 37 33 32 34 2F 31 31 30 38 37 34 36 37 35 757324/110874675 37 33 32 34 2F 31 31 30 38 37 34 36 37 37 36 34 7324/11087467764 30 36 2F 31 31 30 38 37 34 36 37 37 38 30 36 31 06/1108746778061 2F 31 31 30 38 37 34 36 37 37 38 35 35 39 2F 31 /1108746778559/1 31 30 38 37 34 36 37 38 30 31 34 32 2F 31 31 30 108746780142/110 38 37 34 36 37 38 30 34 37 34 2F 66 61 6C 73 65 8746780474/false 2F 66 61 6C 73 65 3B 20 53 3D 67 6D 61 69 6C 3D /false; S=gmail= 32 49 31 55 50 63 47 49 67 33 51 3A 67 6D 70 72 2I1UPcGIg3Q:gmpr 6F 78 79 3D 4B 6D 6F 30 4D 6C 44 37 34 36 51 3B oxy=Kmo0MlD746Q; 20 47 4D 41 49 4C 5F 52 54 54 3D 32 33 38 0D 0A GMAIL_RTT=238.. 0D 0A .. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+=+=+ As you can see, Gmail information is being passed to the Google server as part of my search request as long as I have a Gmail cookie on my system. None of the Gmail parameters in the search request seemed to obviously match with the parameters of the Gmail cookie, but when the cookie isn't on the system, no Gmail info is passed to the Google search servers. III. IMPACT It seems to me that Google is correlating search terms and potentially clicked-through links with my Gmail account. When I signed up for a Gmail account, I understood that Google would crawl my e-mails - which I was okay with. I was not under the impression that my searches through Google would be correlated with my Gmail account, and was surprised to see that logging out of Gmail did not completely remove any Gmail cookies from my system. I'm not sure why Google would do such a thing, but when I have my tinfoil hat on I can come up with some theories, many of which would masquerade as search "enhancements". I'm curious to know what the rest of you think. IV. WORKAROUND Delete your Gmail cookies immediately following a log out of Gmail and do not perform Google searches while logged into Gmail. V. VENDOR RESPONSE I didn't contact Google because this isn't a bug. Thanks, Cody Hatch -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkIdVU8ACgkQKUIrW/hBVexjxACgmr+JORGNw4ECc2sPmrl2+EOlvvEA nA5r89rPbjrPnuDR4P2Dfa8BCXiz =ZPQd -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get secure FREE email: http://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger http://www.hushmail.com/services-messenger?l=434 Promote security and make money with the Hushmail Affiliate Program: http://www.hushmail.com/about-affiliate?l=427 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html