Subject: [CODE4LIB] proxying Google Book Search and advertising networks to protect patron privacy

From: Eric Hellman <[email-masked]>
Date: Wed, 5 Aug 2009 09:59:17 -0400

Recent attention to privacy concerns about Google Book Search have led  
me to investigate whether any libraries are using tools such as proxy  
servers to enhance patron privacy when using Google Book Search.  
Similarly, advertising networks (web bugs, for example) could be  
proxied for the same reason. I would be very interested to hear from  
any libraries that have done either of these things and of their  
experiences doing so.

Eric Hellman
President, Gluejar, Inc.
41 Watchung Plaza, #132
Montclair, NJ 07042
USA

[email-masked]
http://go-to-hellman.blogspot.com/

---

From: Tim Spalding <[email-masked]>
Date: Wed, 5 Aug 2009 12:13:02 -0400

I suspect that proxying Google will trigger an automatic throttle.
Early on, a number of us hit GB hard, trying to figure out what they
had, and got stopped.

Tim

On Wed, Aug 5, 2009 at 9:59 AM, Eric Hellman<[email-masked]> wrote:
> Recent attention to privacy concerns about Google Book Search have led me to
> investigate whether any libraries are using tools such as proxy servers to
> enhance patron privacy when using Google Book Search. Similarly, advertising
> networks (web bugs, for example) could be proxied for the same reason. I
> would be very interested to hear from any libraries that have done either of
> these things and of their experiences doing so.
>
>
> Eric Hellman
> President, Gluejar, Inc.
> 41 Watchung Plaza, #132
> Montclair, NJ 07042
> USA
>
> [email-masked]

-- 
Check out my library at http://www.librarything.com/profile/timspalding

---

From: Karen Coyle <[email-masked]>
Date: Wed, 5 Aug 2009 09:19:10 -0700

The few public libraries that I have done privacy audits for all use a 
proxy server for ALL traffic going out from their public terminals. This 
mainly has the role of identifying those terminals for access to the 
various online products the libraries have, but it also serves to 
protect privacy. The latter role is only fully effective if proxy logs 
are "anonymized" and/or purged after a short time, which some libraries 
are diligent about, others not so much so.

At the same time, if I go onto UC Berkeley campus and use their 
computers, I have to have a log-on which is intended to identify me. 
Some universities seem to be very intent on identification of users and 
their uses of the system, mainly out of fear of hacking and illegal 
activity.

kc

-- 
-----------------------------------
Karen Coyle / Digital Library Consultant
[email-masked] http://www.kcoyle.net
ph.: 510-540-7596   skype: kcoylenet
fx.: 510-848-3913
mo.: 510-435-8234
------------------------------------

---

From: Glen Newton - NRC/CNRC CISTI/ICIST Research <[email-masked]>
Date: Wed, 5 Aug 2009 12:30:41 -0400

I should hope that Google is smart enough to look at the http Via
header[1] and allowing bigger caps for proxying HTTP requests.

On the other hand:
 1) Google decides to have differential caps for proxying requests
 2) People figure out that they could grab more pretending to be a
    proxy by inserting this header field into their HTTP requests
 3) Google caught on and went back to one cap to bind them all...

BTW, if #1 is true and #2 and #3 are not yet true, then they soon will be!  ;-)

Glen Newton
http://zzzoot.blogspot.com/

[1]http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.45

---

From: Eric Hellman <[email-masked]>
Date: Wed, 5 Aug 2009 14:05:36 -0400

I doubt that very much. It's very common for corporate sites to  
channel all their traffic through gateways. I would assume that google  
was smart enough to recognize that your usage pattern was not that of  
many users coming from a single IP address, but rather that of a  
harvesting robot. The two activities have very different log signatures.

Eric Hellman
President, Gluejar, Inc.
41 Watchung Plaza, #132
Montclair, NJ 07042
USA

[email-masked]

---

From: Jon Gorman <[email-masked]>
Date: Wed, 5 Aug 2009 13:34:19 -0500

On Wed, Aug 5, 2009 at 1:05 PM, Eric Hellman<[email-masked]> wrote:
> I doubt that very much. It's very common for corporate sites to channel all
> their traffic through gateways. I would assume that google was smart enough
> to recognize that your usage pattern was not that of many users coming from
> a single IP address, but rather that of a harvesting robot. The two
> activities have very different log signatures.
>

Uh, actually, Google has in the past throttled some services based on
the ip address.  I'm pretty sure it was mentioned before on this list
and I can verify it myself.  Look for some of Jonathan Rochkind's
questions about a year ago.  The original api used with GBS seemed
very prone to this.  I know others hit issues and when our consortium
tried to use a proxy of the original api due to some technical issues
they ran into this.  (First couple of hundred hits would be golden,
the rest just would return http errors).  There's a newer one out
there now that apparently doesn't use this throttling, but I'm not
positive of the details.  An organization may still have to warn
google about it.

There's a reason why the original api strongly encouraged folks to do
things via a ajaxy call on the client.  I'm guessing part of the
reason for the "new api" was to address these issues.

Jon Gorman

---

From: Eric Hellman <[email-masked]>
Date: Wed, 5 Aug 2009 15:28:02 -0400

No doubt throttling is used for API calls, but IP address throttling  
of the full user interface ought to be managed quite differently. If  
anyone has seen that occur, I would be interested to hear of it.

On Aug 5, 2009, at 2:34 PM, Jon Gorman wrote:

>> channel all

Eric Hellman
President, Gluejar, Inc.
41 Watchung Plaza, #132
Montclair, NJ 07042
USA

[email-masked]

---

From: Nate Vack <[email-masked]>
Date: Wed, 5 Aug 2009 14:51:03 -0500

Are you talking about proxying connections from library computers?

For computers in the library, how does a proxy help with privacy? How
is a person linked to a web request? Login records? Video footage? If
either of those, wouldn't purging the records be the simplest way to
provide privacy?

Sorry if I'm being dumb, but I don't understand how proxying helps
privacy in this context.

Cheers,
-Nate

---

From: Glen Newton - NRC/CNRC CISTI/ICIST Research <[email-masked]>
Date: Wed, 5 Aug 2009 15:57:50 -0400

It may/should help protect the user's privacy from the server end (from
Google), not the client end. 

In the original question there is an underlying (perhaps true ;-)  )
assumption that librarians are more trustworthy than Google. 

-glen :-)

>>>>> "Nate" == Nate Vack <[email-masked]> writes:

    Nate> Are you talking about proxying connections from library
    Nate> computers?  For computers in the library, how does a proxy
    Nate> help with privacy? How is a person linked to a web request?
    Nate> Login records? Video footage? If either of those, wouldn't
    Nate> purging the records be the simplest way to provide privacy?

    Nate> Sorry if I'm being dumb, but I don't understand how proxying
    Nate> helps privacy in this context.

    Nate> Cheers, -Nate

    Nate> On Wed, Aug 5, 2009 at 8:59 AM, Eric
    Nate> Hellman<[email-masked]> wrote:
    >> Recent attention to privacy concerns about Google Book Search
    >> have led me to investigate whether any libraries are using
    >> tools such as proxy servers to enhance patron privacy when
    >> using Google Book Search. Similarly, advertising networks (web
    >> bugs, for example) could be proxied for the same reason. I
    >> would be very interested to hear from any libraries that have
    >> done either of these things and of their experiences doing so.
    >> 
    >> 
    >> Eric Hellman President, Gluejar, Inc.  41 Watchung Plaza, #132
    >> Montclair, NJ 07042 USA
    >> 
    >> [email-masked] http://go-to-hellman.blogspot.com/
    >>

---

From: Nate Vack <[email-masked]>
Date: Wed, 5 Aug 2009 15:12:30 -0500

> Google), not the client end.

Yeah. When I use Google Books in a library, how would Google know who I am?

Of course, they would know if I were to log in, but proxying doesn't solve that.

Cheers,
-Nate

---

From: Eric Hellman <[email-masked]>
Date: Wed, 5 Aug 2009 20:46:37 -0400

There are two usage scenarios.
1. use of resources through  a computer in the library or on a campus
2. use of resources from home through a proxy server in the library.

I was thinking more about the second scenario.

Eric Hellman
President, Gluejar, Inc.
41 Watchung Plaza, #132
Montclair, NJ 07042
USA

[email-masked]

---

From: Karen Coyle <[email-masked]>
Date: Thu, 6 Aug 2009 06:48:19 -0700

> I was thinking more about the second scenario.

What do you see as different between 1 and 2? (I see them as being 
pretty much the same.)
kc

---

From: Eric Hellman <[email-masked]>
Date: Thu, 6 Aug 2009 10:53:58 -0400

I guess a better way to distinguish is between public terminals (which  
have a different set of usage issues) and private terminals.

Eric Hellman
President, Gluejar, Inc.
41 Watchung Plaza, #132
Montclair, NJ 07042
USA

[email-masked]

---

From: Eric Hellman <[email-masked]>
Date: Mon, 10 Aug 2009 09:44:21 -0400

Thanks to everyone who commented on my question regarding proxying  
Google Book Search.

On looking into this further, it appears to me that current techniques  
for proxying would not be able to enhance privacy for Google Book  
Search once the provisions of the settlement agreement are  
implemented. http://go-to-hellman.blogspot.com/2009/08/what-google-books-settlement-agreement.html

I am in the process of looking at other technologies to see if there  
are alternatives. Hence another question: Does anyone know of  
libraries that have done anything with "attribute release" in the  
context of SAML/Shibboleth?

Thanks!

Eric Hellman
President, Gluejar, Inc.
41 Watchung Plaza, #132
Montclair, NJ 07042
USA

[email-masked]

---

From: Till Kinstler <[email-masked]>
Date: Mon, 10 Aug 2009 16:04:07 +0200

Eric Hellman schrieb:

> I am in the process of looking at other technologies to see if there are 
> alternatives. Hence another question: Does anyone know of libraries that 
> have done anything with "attribute release" in the context of 
> SAML/Shibboleth?

What do you mean by "have done anything..."? Something like 
http://www.federation.org.au/twiki/bin/view/Federation/AutographView to 
give users control over their attributes?

Till

-- 
Till Kinstler
Verbundzentrale des Gemeinsamen Bibliotheksverbundes (VZG)
Platz der Göttinger Sieben 1, D 37073 Göttingen
[email-masked], +49 (0) 551 39-13431, http://www.gbv.de

---

From: Eric Hellman <[email-masked]>
Date: Mon, 10 Aug 2009 14:07:15 -0400

Exactly what I was looking for, but what I want to know, are these  
things actually used and implemented for real resource providers?

On Aug 10, 2009, at 10:04 AM, Till Kinstler wrote:

> Eric Hellman schrieb:
>
>> I am in the process of looking at other technologies to see if  
>> there are alternatives. Hence another question: Does anyone know of  
> What do you mean by "have done anything..."? Something like http://www.federation.org.au/twiki/bin/view/Federation/AutographView 
>  to give users control over their attributes?
>
> Till
>
> -- 
> Till Kinstler

Eric Hellman
President, Gluejar, Inc.
41 Watchung Plaza, #132
Montclair, NJ 07042
USA

[email-masked]

---

From: Till Kinstler <[email-masked]>
Date: Mon, 10 Aug 2009 21:51:48 +0200

> things actually used and implemented for real resource providers?

We are running one Shibboleth Identity Provider, but don't have 
implemented something for users that would allow them to set their 
personal attribute release policy. Currently we don't disseminate any 
personal attributes at all, to no Service Provider, just one general 
attribute with fixed value member@[shibboleth-provoderID] (read as: 
"that (not further specified) user is a member of our service").
If there will be services requesting personal attributes (email, name or 
even just targetedID) we are planning to implement a self service 
application that allows users to control their attribute release policy. 
As far as I know the Autograph and ShARPE services developed in 
Australia only work with Shibboleth 1.3, so we will need something else, 
because we are running Shibboleth 2. Anyone aware of something like 
Autograph for Shib2?

Till