Wednesday, February 20, 2008

Is Google Reader a keylogger?

A recent post on the Google Reader blog got my attention:
The "j" key (which takes you to the next item) is perhaps the most well-known keyboard shortcut. However, there are many more keys to press, and I was curious to see just how much they were tapped in Google Reader. A quick analysis later, I came up with a simple top-10 list, and I thought it would be fun to share. The units here are "milli-Js", where 1,000 milli-Js are equivalent to all the presses "j" received.
The chart that follows is presumably generated by sniffing the keystrokes of Reader users. Google goes on to say:
Partly based on the data we gathered, and in our quest to make Reader as keyboard-accessible as possible, we've actually added a few more with the latest release.
A few questions:
  • Can Google log keystrokes in other open tabs (Firefox?)
  • *DOES* Google log keystrokes in other tabs? URL's?
  • What other properties does Google track keystrokes? Gmail? Blogger? Does Google know what I'm posting to my blog before I click "Publish?"
  • Can Google's data be used as evidence, exculpatory or otherwise ("My client is innocent, your honor, as Google shows him at home pressing 'J' in Google Reader at the time of the murder.")
  • Is my own keylogged activity open to me?
Google's response, of course, is that they're only using this data to analyze the usage of their Reader product. And for most Google employees, this may actually be true. History has shown, however, that every tracking feature that can be (ab)used, will be (ab)used.


Jeremy said...

No, google doesn't "log" your keystrokes. Whenever you visit a particular website and press keys, presumably you are intentionally transmitting that data to the website. It's nothing malicious.
They cannot detect what keys you press on other websites.
Detecting when a certain key is pressed is a very simple thing to do with JavaScript. Passing that data on to a database or XML document wouldn't be a very far stretch...