I've read a few posts here indicating those running this WA are seeing
cached pages from other users, esp. in various forums on the net.
If Google's proxy is showing the same cached page when the request has
changed, this is serious indeed. At the very least, a request's
uniqueness should be determined by looking at the URL and any
querystring or POST data, and the cookies. If any of these things are
different, the request can result in a different page customized for a
specific user. Obviously it should not be cached by a proxy.
Google states this WA will not cache sites protected by HTTPS, but many
private members-only sites only use HTTPS to protect their login forms.
Once you are logged in, you are using an HTTP connection to reduce the
load on their CPUs. The site knows you are still logged in and allowed
to view the content based on your cookies (in many cases). These sites
are now at risk to being cached by Google's WA, and apparantly, served
to other users. And worse?
It would also be nice if Google clarified what exactly it is caching on
its servers, versus what it is caching in the local cache on the user's
computer. The privacy FAQs are not clear. From my reading, they are not
caching page content on their servers, but they are caching cookies.
Why do they need to cache cookies on their servers to speed things up?
It doesn't make sense to me. And if they are caching page content on
their servers, they need to explicitly specify how they
are deciding when to serve it up to multiple users, and that they are
not using that content for any other purpose.
I think people are worried mostly because a huge search engine is now
getting access to a ton of private websites that it normally could not
reach.
It would also be nice if their proxy would pass a header indicating
what IP address the user's request is coming from. After all, this is
not meant to be an anomymizing proxy, but just one to speed up
browsing. IP address statistics are very useful to website admins. Now
anyone using this WA is using Google's set of IPs. Admins already have
to deal with this issue with AOL's sizeable user base, and now Google
is opening this problem up to potentially a much larger set of web
users.
Unless this service quickly improves, I will continue to discourage my
family, friends, and co-workers from using this product.
Thomas Samoht
