Comments on: What have you been watching on YouTube lately?

By: Ben

Ben — Mon, 07 Jul 2008 13:37:47 +0000

I don’t understand why Google haven’t contested this (seemingly erroneous) ruling. In an age where the internet is increasingly inter-connected, and where lobbying groups pop up all over the place, a privacy break-down on this scale must be extremely damaging to their integrity. I, for one, am far more loath to use YouTube now than before.

Unless, as some have suggested, they plan to cripple Viacom by supplying the data in the form of individual paper cards, causing an admin nightmare – a Pyrrhic victory of sorts.

By: roac

roac — Sun, 06 Jul 2008 14:59:49 +0000

Amplification of my previous post: Ordinarily, in the federal courts, disputes about discovery are delegated to a magistrate—a sort of assistant judge. The magistrate’s ruling can be appealed to the district judge pursuant to Rule 72 of the civil procedure rules (though they don’t call it an appeal).

This order, however, is signed by the district judge. I don’t know whether the practice is different in the Southern District, or whether this case is receiving special treatment.

By: roac

roac — Sun, 06 Jul 2008 01:20:38 +0000

Since the ruling ignores the VPPA, one would assume Google’s well-payed lawyers would file an appeal?

Discovery rulings cannot ordinarily be appealed.

It seems to me that practically anyone who has ever downloaded a video could ask the Court of Appeals—anonymously—for a writ of prohibition. With what chance of success, I can’t say, but I wouldn’t be surprised to see it happen.

By: Martin Bento

Martin Bento — Sun, 06 Jul 2008 01:08:16 +0000

Jake, yes and no. What the court ordered does not seem like it would include any unique identifiers for gmail users. But the gmail cookie, which is the unique identifier for user and session, is accessible from youtube, even embedded youtube, because, as idlemind points out, youtube videos make connections to the google domain, and gmail aliases to mail.google. Your cookie is actually in the google, not a specific gmail, domain. If by “gmail ID” you mean the gmail username, I doubt google stores that in the clear in cookies, but the cookie can identify you to the google servers, including when you watch youtube. In short, no the judgement doesn’t turn this info over, but yes, google can and (I would bet money) is tracking it.

By: Jake

Jake — Sat, 05 Jul 2008 22:36:24 +0000

I do have some familiarity with the concept of logs correlation.

My point was that the data Viacom just got the court to order YouTube/Google to produce does not in fact contain your GMail ID, and that “if you have GMail open in another tab, it’s easy enough to send your GMail ID to YouTube” is not in fact correct. Viacom would have a hard time claiming that surfing habits for other Google properties were in any way relevant to their case.

By: cm

cm — Sat, 05 Jul 2008 19:22:41 +0000

jake: In case other commenters have not made it clear – all traffic going through your DSL/cable has the same IP number (unless you have a multi-IP “business tier” service which most people don’t). When you are “logged in” to Google, Yahoo, or anything else, that ties your Google/Yahoo/XYZ ID to your IP number, at that time or period. When you access anything else “anonymously”, that exposes your IP number, and Google/Yahoo can correlate e.g. any Doubleclick or other “tracker” hits from that IP number to you.

There is still the possibility that they cannot distinguish between you and your family member/roommate who is on the same “line”. But how much of a difference does that make? If e.g. your spouse/kid/parent is “logged in” to Google, you can surf “anonymously” as much as you like, it can be correlated to their ID.

By: Martin Bento

Martin Bento — Sat, 05 Jul 2008 11:09:05 +0000

“Did they log that cookie when they received it? I have no idea. But they could have.”

Ha ha, I’d love to bet if there were a way to settle it. Anyone think there’s a chance in hell that google is going to just not bother logging this?

By: abb1

abb1 — Sat, 05 Jul 2008 08:30:17 +0000

Idlemind, how do you know that google.com domain wasn’t used? It could’ve been used from some invisible frame or via javascript/applet or some other way.

Have you noticed how sometimes you visit a site where you’ve never been before, there is an amazon ad on the page and this amazon ad knows who you are and addresses you by name?

By: jholbo

jholbo — Sat, 05 Jul 2008 08:15:18 +0000

It’s terrifying to think that the Man knows how many times you’ve been Rickrolled, when how and by whom.

By: idlemind

idlemind — Sat, 05 Jul 2008 08:08:54 +0000

Just as a test, I went over to talkingpointsmemo.com and clicked on an in-page YouTube video. Several new connections were made when I clicked on that video, including some to “video-stats.video.google.com”—which would have sent all my “google.com” cookies including my Gmail ID. Did they log that cookie when they received it? I have no idea. But they could have.

Similarly, Google recorded through Google Analytics that I visited this site. Now in this case the “google.com” domain wasn’t used and so my Gmail ID wasn’t sent. Of course, my visit here could then be connected to my visit to other sites (like TPM) via the anonymous identifier given me the first time I encountered the “google-analytics.com” domain (assuming i didn’t purge that cookie). And perhaps at some point that identifier could be linked to a less-anonymous one through a visit to a site that has access to it.

We’re putting a lot of trust in Google, whether we know it or not, not to make a near-comprehensive dossier of our Internet activities.

By: Martin Bento

Martin Bento — Sat, 05 Jul 2008 05:34:57 +0000

If I’m logged into gmail in one tab or window and go to google in another, it knows I’m logged in – says so right atop the screen. That must be the cookie, which should be visible to any site that uses or aliases to “google.com” – google sees google cookies, that’s in the cookie spec. Google ads also come from google domains wherever they appear, so all those sites are one from the cookie perspective. People kind of gave up on being paranoid about cookies, which was foolish.

By: Jake

Jake — Sat, 05 Jul 2008 03:11:42 +0000

No, it’s quite common. In fact, every single site you visit that shows Google’s ads (and they seem to be nearly everywhere) will log your visits in Google’s databases.

What does this have to do with passing your Gmail id to YouTube’s databases?

By: Righteous Bubba

Righteous Bubba — Sat, 05 Jul 2008 00:58:37 +0000

This seems like the time to mention NoScript for Firefox. For java stuff you can set it to only allow your trusted sites access to run java on your browser. It's initially a pain in the ass to keep allowing certain domains you like, but eventually you develop a nice set of domains you like and a bunch of ad crap you don't.

By: idlemind

idlemind — Fri, 04 Jul 2008 23:19:48 +0000

I’m quite sure that browsers make this nearly impossible.

No, it’s quite common. In fact, every single site you visit that shows Google’s ads (and they seem to be nearly everywhere) will log your visits in Google’s databases.

By: Jake

Jake — Fri, 04 Jul 2008 23:11:43 +0000

Also, if you logged into your gmail account in one browser tab while accessing youtube in another tab – it wouldn’t surprise me if your gmail account id gets passed to youtube and saved in some database there. Seems like a natural thing to do.

I’m quite sure that browsers make this nearly impossible.