Google Desktop 3 criticized
EFF, Kapersky Lab say new feature that stores data on Google servers creates target for malicious hackers, feds.
Google released the latest version of its desktop search application on Wednesday. It includes an option that allows people who regularly use several computers to search for items stored on multiple computers simultaneously.
Once the Search Across Computers function is enabled, text copies of documents and Web history are automatically transferred to the other computer that has Google Desktop installed. When the user searches on one computer for information, the second computer is automatically searched.
The Electronic Frontier Foundation warned consumers that the government or litigious rivals could subpoena the search engine for the information stored on the Google servers before it is deleted, which Google said is within 30 days.
The threat is underscored by the recent Justice Department request to Google, Microsoft, Yahoo and America Online for random Web search records. Google was the only one of the companies to deny the request and challenge it in court.
"EFF urges consumers not to use this feature, because it will make their personal data more vulnerable to subpoenas from the government and possibly private litigants, while providing a convenient one-stop-shop for hackers who've obtained a user's Google password," the EFF said in a statement on its Web site on Thursday.
"Coming on the heels of serious consumer concern about government snooping into Google's search logs, it's shocking that Google expects its users to now trust it with the contents of their personal computers," EFF Staff Attorney Kevin Bankston wrote.
"For this feature to operate you need to use your Google account, the same one that you use for Gmail, Orkut and the other Google services. This means that if an attacker can obtain your Google login details, he will be able to access your confidential files," security firm Kaspersky Lab wrote in a blog on its Web site. "The good side is that this feature is an option and is not turned on by default. We advise you to keep it that way."
A Google spokeswoman said the data is encrypted while in transit and on the server, where it resides only temporarily. Google also automatically excludes from being transferred any password-protected files and secure Web pages, like those containing bank account information, and enables users to exclude any folders or files and to easily clear them from Google's servers by hitting a button, she said.
Privacy "was an important consideration in the development of the feature, and we have taken a number of steps to protect the privacy of users," she said.
As far as subpoenas, "for the files stored on Google servers we would of course comply with valid legal process, but we provide notice to users when a request for their data is made, unless we are prohibited from doing that," she said.