Sites Wary of Adopting P3P

technogamy writes: "CNN is reporting on the industry's take on P3P, the W3C's Platform for Privacy Preferences.According to the article, the W3C is expected by April to formally adopt P3P -- of course, as many of you are aware, Microsoft's IE6 already includes an implementation of the client side of P3P. 'Because Microsoft's browser checks for P3P, sites risk getting flagged if they don't adopt it.' P3Pizing (or 'pethripizing') a complex site can evolve into a Herculean task...! (See also EPIC's critique of P3P.)"

Comments

I worked on this..

[Sc00ter]

At my old job (before getting laid off) at an internet advertising company this was top priority. P3P is actually really cool, and it wasn't all THAT hard to get it implemented. It probably would have been faster for us if we didn't have a sucky developer.

I wonder if doing it with a module for Apache would be a good idea.. mod_p3p, then it reads your privacy stuff from a config file. That sure would save a lot of time for a lot of people.

Re:I worked on this..

[nzkoz]

Maybe not an apache module, but libraries for perl, python, PHP, JSP etc. The less work it is for the actual web developers the more likely our privacy concerns are going to be respected.

I can't be the only one...

[oGMo]

Am I the only one who saw the headline and wondered whether P3P was some new file distribution fad? ;-) I can see it now. P3P: Share music with two friends at once!

OK, sue me, it's been a long day...

Privacy Protection...? Probably...

[KeatonMill]

The thing that I wonder about is HOW people ensure that these privacy claims are followed through with. I trust that, for most sites, the want to protect privacy and the drive to do so is there, but despite eTrust and despite (eventually) P3P, I'm still getting lots and lots of junk mail even though I recently changed e-mail addresses. These standardized privacy ratings are great, since they provide a common scale from which to view the results, don't get me wrong here. But I just think that there should be a better way of, if not ENFORCING privacy, at least downgrading site's ratings if they don't keep true to their word. (It's also possible it's the ads on the site collecting the data, not the site itself)

I guess what the whole internet needs is a /. type moderation system.

Why bother for private sites?

[Bonker]

I have to say that this is a way of trying to shut out non-commercial sites from the web. For example, my site is a privately run anime fansite with nothing for sale and no adds. Despite this, it gets flagged for not having a compliant privacy policy.

Now, I suppose that I could make a privacy policy for my site, but why should I have to bother when I'm obviously not in any kind of business, let alone selling personal information?

The web should be for *everyone*, not just businesses with large advertising budgets. Shutting out sites who don't have privacy policies posted is FUD tactics against little guys, plain and simple.

Re:Why bother for private sites?

[Sc00ter]

I don't get any kind of warning in IE6.

Re:Why bother for private sites?

[los furtive]

But are you collecting any information such as email addresses? Even if your current intent is innocuous (email updates), what happens two years down the road when money is getting tight and someone offers to buy that list? Of course P3P isn't going to stop that, but it helps promote privacy as being important in the public's conscience...This is definitely a step up, and not a step down, and shouldn't be poopooed as a tactic against the little guy. It's a tactic for the little guy.

Re:Why bother for private sites?

[Fweeky]

> I don't get any kind of warning in IE6.

You'll get a little icon in the status bar you can click on if it blocks something based on your settings; look at View -> Privacy Report otherwise.

Yahoo is a good example to try it out on, since it seems to specify just about everything.

What about Slashdot?

[los furtive]

I'm sure it's members would like to know what they have to say about it. How far up the priority list is this one CmdrTaco? And what does Katz have to say about it?

Hope this dies

[Pussy Is Money]

Conceptually, the biggest problem with P3P is that it presupposes that the browser is already in control of sensitive and confidential information. This jibes perfectly with the vision behind schemes like Passport and product activation.

Practically, the system is a nightmare to configure. If this thing ever gets widespread adoption I am sure we will see a surge of privacy consultants and third party privacy management tools.

Re:Damn

[Stone Rhino]

But you DID pay for windows. Unless you're a 1337 w4r3z d00d. Where do you think Micro$hit gets the money for their world domi^H^H^H^H^H^H^H^H^H^Hbrowser?

Mixed thoughts..

[steppin_razor_LA]

I haven't read the full specifications -- so take anything I write with a grain of salt. I've spent years building web applications, authored a popular anti-spam package, and have done some work building an advertising filtering & privacy enhancement proxy server-based package.

It seems to me that a better approach would be something like this (call it Personal Information Widget):

User puts all of their personal information into some form of a "wallet" (yes - I know there are technologies similar to this) -- the information resides on their computer not in a passport on a third party server.

When a user goes to a site and wishes to sign up for registration, to purchase something, etc -- there should be a mechanism where that site is able to formulate a list of the fields that it wants + requires for registration. The site will send this (i.e. XML) to the Personal Information Widget.

The PIW will pop a window on the user's screen showing them what information the site wants + requires. The other can then choose to "deny" "allow all" "allow required" or "custom".

If they deny -- end of transaction.
Allow all -- give the site everything it wants
Allow required - give the site only required fields
Custom - chose to give the site information different than in your profile.

This sort of approach would solve one of the major problems of building registration-based sites -- the pain in the ass factor of getting people to type in their information for the Xth time -- without doing anything sneaky about privacy.

In an ideal world, I would be able to choose to allow cookies that are required for a web application to funciton, but deny cookies used to track my viewing habits (especially across multiple sites). I don't think that a "protocol" can really solve this problem though.

Once a site uses cookies, they inherently have the ability to track you -- whether or not that is there intent -- this protocol doesn't really protect your privacy.

I'm not really opposed to cookies -- as a web developer, it is painful for me to imagine coding without them! That said, I don't like the idea of someone tracking my usage habits across multiple sites and then potentially correlating that back w/ registration information to me.

I tend to disallow third party cookies. I know that this breaks a number of 1x1 pixel tracking tools -- but this same sort of technology could be ran off the web servers of the clients or if it was really necessary to outsource it -- you could use DNS (i.e. tracking.yourcompany.com points to webtrendslive.com ) to limit the tracking cookies to a single domain.

You can disallow third party cookies and protect your privacy that way w/o this extra layer of technology added.

I am a priori (guess I'm being closed minded) opposed to anything that facilitates that automatic transfer of information. I just can't wait to see someone find an exploit....

The problem with P3P is...

[Dr Kool, PhD]

P3P has absolutely no Application-Server/Scripting support. It's just a
simple XML-File that tells the User what (personal) data the Website
collects, and is Requested with "hard-coded" relative URL's.
Assume a PHP Website with URL-based Session's. A User Request the Homepage
(/index.phtml) - he's anonymous, collected data is anonymous. The (static)
P3P File tells the User that the collected data is anon. Well, now the User
logs-in via a Form-Submit and reloads the Page (/index.phtml). The
information is set in the PHP-Session, the User is shown other
(personalized) Content, but the P3P-File is still the same, telling the
user, that the collected data is still anonymous - this is (or may be) wrong
now.

P3P has no mechanism to handle this case, in P3P you can only set a
different policy for (sub-)folders (differrent URI's). The problem is, that
the GET Request is absolutely the same, it doesn't matter if the user is
logged-in or anonymous (well, it would be a security hole, if someone is
able to find out, if a user is logged-in when (s)he takes a look at the URL,
hm?).

Sure, it's possible to copy all "templates" to another subfolder and link
logged-in users to this one, but why should I do so? The advantage of using
templates (a I define them) is that they just show any content. They don't
care if this content is personalized or not. The content is "prepared" by
the "business logic" - programmed in PHP - and stored in a database. This
way, I'm able to use the same "templates" for logged-in and anonymous
users - well, half the work to do...

Re:The problem with P3P is...

[Fweeky]

"in P3P you can only set a different policy for (sub-)folders (differrent URI's)"

Uhm, no, you can specify policies for URI's, methods (GET/POST/PUT/DELETE etc) and cookies (including name, value, domain and even content).

For example:

<POLICY-REF about="/P3P/UserPolicy.xml">
<COOKIE-INCLUDE name="loggedin" value="*" domain="*" path="*"/>
</POLICY-REF>

If you really can't describe your case:

1. Generate the headers dynamically based on whether they're logged in or not.
2. Generate the P3P dynamically based on whether they're logged in or not.
3. Just describe the case for logged in users, since your anonymous logging is likely just a subset of that anyway

And, of course, talk to the peeps on the P3P ml and see if you can get it fixed in version 2.

Re:Standard Microsoft

[Sc00ter]

Nice troll.. Microsoft didn't invent this p3p thing.. perhaps you missed "W3C's Platform for Privacy Preferences" in the article.. It's a standard, Microsoft was just the first to implement the client side of it.

l337 sp34k

[metalhed77]

can we be l337 and call this new P3P technology 'Pep'

Simple solutions

[david.johns]

One of the criticisms of this is that it doesn't have any enforcement behind it.

There's nothing to stop the industry, or me, or all of us who run websites, from just saying, "Sure, we respect virtually everything about your privacy!" and then selling the hell out of your information.

So, for those of us for whom it would be a pain - we have two easy choices. We can a) ignore people who bother to use it 'cuz it sucks or b) adopt the most private P3P policies possible, and then don't worry about them.

The real problem this will have on the developer end is having the P3P options mean something. If there's no reason (legislation, for instance) for big business to respect their own P3P policies, why should I pretend that mine have anything to do with reality?

Re:Simple solutions

[steve_l]

there is already someone with a new token called 'everything else here is untrue' or words to that effect, so you can have all the statements about how well you adhere to privacy rules, which the browser believes, followed by this disclaimer, which IE ignores.

result, it thinks you respect privacy, you get to do what you want *and* your P3P privacy statement is actually honest.

what the US needs is the EU data protection act.

Re:Definition of "Privacy"

[Sc00ter]

Well.. at the internet advertising company we already had a privacy policy set in place.. How they got to it, I have no idea. As for the sites that ran our ads, they didn't have to do anything, since our p3p code was in our http headers. As far as running it on your own site, I wouldn't know

Am I the only one who has a problem with this?

[wowbagger]

OK, let me see if I correctly understand P3P.

1. I give my browser all sorts of information about me, some of which I don't want distributed widely
2. I then trust the remote web site to correctly identify what they are asking for, and that they will use the data in the way the P3P data says it will be used.

So, if I trust the web site to correctly implement their privacy policy, why don't I trust them with my data?

If I don't trust them with my data, why do I trust them to correctly implement a privacy policy?

In fact, this is one of the few real uses for a Cue-Cat I can think of- have your credit card numbers et. al. printed out on a barcode chart next to your computer. You see the pretty shiny thing you want on the web site, they want your credit card number, you scan the paper. I DEFY any 1337 haxor to get that by ownxoring my machine - I have to scan it.

Re:Am I the only one who has a problem with this?

[Monkeyman334]

You still have to trust the site to be honest in its privacy policy, but with P3P you can't obscure it, make it in legaleese, or have it be misinterpreted. P3P makes it so all *trusted* companies, C|Net, CNN, MSNBC, give you a standardized, automated, and consistent way of getting someone a privacy policy. Just because it is a trusted company does not mean they aren't selling your information. It might say in the privacy policy "Yes, we sell your personal information." But when was the last time you read the privacy policy for a site? P3P makes it automated so anyone and everyone can check the policy for every site they visit. (My site has the XML piece in there already, btw, still don't have the cookie part, probably never will)

Re:Am I the only one who has a problem with this?

[wowbagger]

You missed the point. The point is, that with the method I described, you are no more able to get my card number than you would be were I to type it in from the keyboard.

What you CANNOT do is get a worm on my machine, and read (the registry|my home directory) to get my credit card number - you would have to comprimise my machine, and keep it comprimised until such time as I made an online purchase. You couldn't do a quick "smash and grab" - crack my machine, get the data, and who cares if I find the worm fifteen minutes later.

And my point re: P3P stands - the site's XML says "We won't sell your information, we won't trade it, we'll keep it to ourselves. Honest!". Until they decide to change their minds, and sell out to the highest bidder.

Face it: once you give information to somebody, you no longer control to whom they give that information, therefor if you want to control who has your information, don't give it out.

Join P3PSI

[yerricde]

When will Slashdot become P3P complaint?

You might want to start a P3P Slashdot Initiative. Tell those in charge that you won't subscribe until Slashdot implements P3P, a W3C Proposed Recommendation. You can even call it P3PSI (pronounced PEP-see).

The only cookie solution

[jmd!]

The only reliable cookie solution is already here. No changes are required server-side, and you just need a competent browser like Mozilla client side.

First, disable third-party cookies. Then, weekly, or whenever you're bored, go in to cookie manager, check 'do not reaccept deleted cookies', and delete all the cookies for the sites where you do not need them (login info, valuable preferences, etc). Eventually, you'll end up with a block list that rejects all the bogus cookies of the sites you visit, and you never had to bother with dialogs per cookie, or sites not working because of cookie prefs.

God is an Iron

[poena.dare]

I find it ironic that W3C's website isn't fully compliant:

http://validator.w3.org/p3p/20020128/p3p.pl?uri= ht tp%3A%2F%2Fwww.w3.org

But, at least they're trying. ;)

Stop bombarding me with cookies

[alanjstr]

I'm so sick of being bombarded with third-party persistent cookies. Damn right I want to maintain my privacy. Ok, so if their privacy statement fully notifies me they're going to put a thousand cookies on my machine its alright? Uh, no.

You don't need my home address

[Skapare]

You don't need my home address, unless I am asking you to send something to my home address. You have no valid need or purpose for that information.

The real problem here is not the complexity of protocols to match privacy policies with privacy preferences, but instead is the fact that so many businesses are just too fucking nosy!. Now I know that those people in suits in the fancy shmancy corporate offices do tend to be idiots most of the time, but this spying on people has got to be stopped. What is wrong with those people that makes them so fucking sick that they need to be spying on everyone so much?

I find it interesting to note that quite a number of the dot-coms that went into business to spy on people were the ones that failed. But that's only a marginal level of significance. Many others, like doubleclick (which I block at my proxy server), still exist, and need to be taken out by any legal means (I'm doing my part by cutting out their level of hits, even when that means slashdot won't get the ad revenues).

Re:You don't need my home address

[radja]

> We "spy" because we make money out of it, not by reselling your info but by using it to personalise site - we are an etailer. IF you stop it, we would lose money, and lots of it, and probably go out of business, then you can go and buy stuff of your local monopolistic shop who rips you off.

Translation: We want to bombard you with specific ads rather than generic ones. If you don't give us your address, we feel that you are a freeloading, pirating hacker. You make us get less money, so you must be at least borderline criminal. We have the right to rip you off, force you to view non-content, and generally be a pain in the ass. You, sir, are a threat to capitalists everywhere, which is the only true economic system.

//rdj

I've implemented this, and use it day-to-day.

[SuperBug]

To actually implement P3P, you only need mod_headers when using apache. There is no magic here, it's only a damn header + two XML files, at it's most basic.
At it's most basic P3P just a header being looked at by a http user agent which has a P3P agent built in. I believe to date it's only I.E. 6.0. Though Mozilla, Opera, Galeon, and Konquerer are sure to follow.
Many aspects of P3P are positive, but there are parts of the specification which have yet to be properly determined and implemented, in a real-world environment.
The main parts affected would be any "Third-party" though any "First-party" running a site and issuing cookies of any unacceptable fashion, mainly things which are PII related and cannot be opted out of, will be flagged.
. In short, be sure you have an opt-out mechanism for your shoppers if you're an e-commerce site.

Also, any "Third-party" acting as an "Agent" on behalf of any "First-party" which is issuing cookies or collecting data, regardless if PII is involved. The spec for being a "Third-party Agent" has yet to actually be implemented by anyone, though I know some people who will try this soon. Up to this point, the view of "Third-party Agent" is quite desireable to anyone on the 'net who operates in such a manner. It nearly absolves them of "having" to deal with any consumer related issues regarding their data collection because you can point people back to the "First-party's" P3P policy, rather than having to maintain your own.

The obvious problem here though, is scalability and maintainability. It's tantamount to remote key-managment. You must then manage your "First-party" client's P3P Policies and keep in contact/communication with them to ensure that any changes are propagated to you, should it change, yet you continue to serve an *out of date* P3P Compact Policy in the web server's headers for that client, you very well could be blamed for screwing the data they hired you to collect for them in a very bad way.
Aside from that, P3P is a very positive thing for consumers and business persons in such a way that it opens a channel of communication which did not exist so much in the foreground, as P3P enables, before. Hope this is useful to anyone trying to understand some of what P3P really is.

Re:Standard Microsoft

[Tony Hoyle]

Whether it is a w3c standard has nothing to do with whether MS invented it (They didn't if the working documents are to be believed).

For example, I know that XPath was invented by MS (the guy who invented it mentioned it at an MSDN roadshow I went to)... it's also a w3c standard.

AFAIK Any w3c member can propose a standard, and if they have enough clout/money it will be adopted.

Why should privately run sites be unprofessional?

[TheMCP]

Look, in 1996 a friend of mine and I sat down and produced a multi-thousand-page hand-coded web site that won basically every web award there was at the time.

We are both self-taught at both web programming and visual design.

At present we're doing a different site. It gets half a million hits a day. We're doing a redesign now, intended to increase traffic by making the site more attractive. It hasn't had a facelift in 6 or 7 years. The site sells nothing and has no paid ads.

There's no reason why a "personal" web site can't be done just as professionally and using just as good technology as any commercial site out there. If a site author can't be bothered to learn how to code a site correctly or design it well, I have no problem with avoiding the site.

Now that it looks like P3P may actually catch on, I'll learn how it works and implement it.

Ebay is already making the P3P usability zero

[aepervius]

http://www.cnn.com/2002/TECH/internet/03/16/privac y.labels.ap/index.html IF you read at the middle of the article Ebay is putting into its privacy policy that : quote "Online auctioneer eBay, which has yet to commit, is revising its privacy policy to say its written form takes precedent even if P3P or other statements say otherwise. " Whatever P3P says, privacy policy has still the last word. So in summary : p3p is *USELESS*.

OECD Privacy Policy Generator

[rtos]

What is the OECD Privacy Policy Generator? It's a freely available tool to help you put together a working privacy policy for your website. Here is the site description:

"It provides guidance on conducting an internal review of existing personal data practices and on developing a privacy policy statement. It gives links to private sector organisations with expertise in developing a privacy policy. It offers links to governmental agencies, non-governmental organisations and private bodies that give information on applicable regulations.

The Generator makes use of a questionnaire to learn about your personal data practices. A Help Section provides explanatory notes and practical guidance. Warning flags appear where appropriate. Your answers are then fed into a pre-formatted draft policy statement. You must assess this statement: is it an accurate reflection of your personal data practices and policy?"

I'm not sure if it fits with the P3P standard, but I thought some site admins might find it to be useful.

PS. OECD = Organization for Economic Co-Operation and Development. According to their site they are "an international organisation helping governments tackle the economic, social and governance challenges of a globalised economy."

90% use IE6??

[Mike Greaves]

> Microsoft had no problem jumping on it and getting it out and in use
> (in 90% of the browsers out there, no less).

Really? IE6 supports it; are 90% of internet users using IE6? I think not.

Something like (very roughly), 65% use IE (all versions), 20% use AOL (w. embedded IE, various versions), 10% use Netscape/Mozilla (all versions), 5% others.

So 85% use an IE-based browser. What fraction of those are *IE6*-based? Half? My guess would be that less than 30% of current users (total, all browsers) run IE6.

People should remember that the majority of users *don't upgrade* their web browser regularly. Lots of IE's market share is still version 4; and I would guess that 6 is still not as popular as 5.x.