Sites Wary of Adopting P3P

technogamy writes: "CNN is reporting on the industry's take on P3P, the W3C's Platform for Privacy Preferences.According to the article, the W3C is expected by April to formally adopt P3P -- of course, as many of you are aware, Microsoft's IE6 already includes an implementation of the client side of P3P. 'Because Microsoft's browser checks for P3P, sites risk getting flagged if they don't adopt it.' P3Pizing (or 'pethripizing') a complex site can evolve into a Herculean task...! (See also EPIC's critique of P3P.)"

Comments

Re:The problem with P3P is...

[Fweeky]

"in P3P you can only set a different policy for (sub-)folders (differrent URI's)"

Uhm, no, you can specify policies for URI's, methods (GET/POST/PUT/DELETE etc) and cookies (including name, value, domain and even content).

For example:

<POLICY-REF about="/P3P/UserPolicy.xml">
<COOKIE-INCLUDE name="loggedin" value="*" domain="*" path="*"/>
</POLICY-REF>

If you really can't describe your case:

1. Generate the headers dynamically based on whether they're logged in or not.
2. Generate the P3P dynamically based on whether they're logged in or not.
3. Just describe the case for logged in users, since your anonymous logging is likely just a subset of that anyway

And, of course, talk to the peeps on the P3P ml and see if you can get it fixed in version 2.

I've implemented this, and use it day-to-day.

[SuperBug]

To actually implement P3P, you only need mod_headers when using apache. There is no magic here, it's only a damn header + two XML files, at it's most basic.
At it's most basic P3P just a header being looked at by a http user agent which has a P3P agent built in. I believe to date it's only I.E. 6.0. Though Mozilla, Opera, Galeon, and Konquerer are sure to follow.
Many aspects of P3P are positive, but there are parts of the specification which have yet to be properly determined and implemented, in a real-world environment.
The main parts affected would be any "Third-party" though any "First-party" running a site and issuing cookies of any unacceptable fashion, mainly things which are PII related and cannot be opted out of, will be flagged.
. In short, be sure you have an opt-out mechanism for your shoppers if you're an e-commerce site.

Also, any "Third-party" acting as an "Agent" on behalf of any "First-party" which is issuing cookies or collecting data, regardless if PII is involved. The spec for being a "Third-party Agent" has yet to actually be implemented by anyone, though I know some people who will try this soon. Up to this point, the view of "Third-party Agent" is quite desireable to anyone on the 'net who operates in such a manner. It nearly absolves them of "having" to deal with any consumer related issues regarding their data collection because you can point people back to the "First-party's" P3P policy, rather than having to maintain your own.

The obvious problem here though, is scalability and maintainability. It's tantamount to remote key-managment. You must then manage your "First-party" client's P3P Policies and keep in contact/communication with them to ensure that any changes are propagated to you, should it change, yet you continue to serve an *out of date* P3P Compact Policy in the web server's headers for that client, you very well could be blamed for screwing the data they hired you to collect for them in a very bad way.
Aside from that, P3P is a very positive thing for consumers and business persons in such a way that it opens a channel of communication which did not exist so much in the foreground, as P3P enables, before. Hope this is useful to anyone trying to understand some of what P3P really is.