Slashdot Mirror
Spyware or Researchware?
prostoalex writes "When the story of Firefox Web site visitors being predominantly male was published, many questioned the methodology used to acquire such research data. This MSNBC article talks about another research company, ComScore Networks, using a free antivirus utility to lure the Web users into downloading a small utility to their hard drives. The catch? The software watches not only sites visited, but even locations of the mouse clicks. ComScore swears the final data does not contain any personal information, but, as the article states, anti-spyware utility manufacturers are still thinking whether to include it on their list."
To find out the gender of a visitor, just create a site which requires visitors to hold one key while moving the mouse.
Rock that crushes, Paper & Scissors that don't matter.
The difference between Spyware and Usage Statistics pretty simple: is it clearly stated to the End User and is optionable. Essentially, its not spyware if you know about it up front and have the ability to (actually,) turn it off.
The beef I have with spyware is that it's never given me a choice; it installs without me knowing and lurks like a drooling Rutterkin in the corner -- waiting for me to spill my drink or drop The One Ring. But this research program is optional, right?
I have no problem with optional programs that record data to be used in a study. My wife also participates in allgery studies. So?
The dangers of knowledge trigger emotional distress in human beings.
Isn't that sort of app supposed to be CHECKING for trojans? Sheesh.
Paleotechnologist and connoisseur of pretty shiny things.
The software watches not only sites visited, but even locations of the mouse clicks.
add the use of the word "lure" and it makes me think that this is, indeed, spyware.
Mongrel News all the news that fits and froths
why? forty-two.
Unfortunately, if they give the users a choice to turn it off, you can't qualify the statistics obtained from users who allow information to be logged as good - e.g. who's to say whether guys may be more inclined to turn it off than girls - or conversely, women feel more threatened about privacy... in either case your stats will be skewed.
In any case most users (myself, certainly) would turn it off - I am supremely uncomfortable with some random company knowing anything about what I do on my computer.
I don't want to read
Marketscore is part of an online market research community with over 2 million members worldwide. Marketscore relies on its members to gain valuable insight into Internet trends and behavior. In exchange for having their Internet browsing and purchasing activity observed, members have access to free email virus scanning and other benefits.
You have to draw the line of reasonableness somewhere. If that site isn't clear enough for you to understand what they do, you probably shouldn't be on the Internet (or at least not from a computer configuration you could hurt yourself with).
This tool then is cutting out the Mac and Linux users from their tracked demographic; together those users represent about 5-10% of the market. And they represent many early adopters of tech, too.
I would think that the use of a tool of this kind would be enough to skew their information, causing any results to be not credible. I certainly wouldn't use them to research products that I would sell, as I would want to be able to target Mac and Linux users as well.
--
$tar -xvf
It takes information without my knowing or permission and steals my bandwidth to send it somewhere.
I know it's not hip to RTFA, but it doesn't install without your knowing or permission. It clearly states that you will allow the program to monitor your internet usage in exchange for the free antivirus software. It's easy to uninstall and doesn't leave its hooks all over the OS.
Stealing your bandwidth? If you consent to installing it, that hardly constitutes theft.
https://www.eff.org/https-everywhere
Why not just download AVG Anti-virus?
Its free, and has no spyware attached.
Symantec, for example, designates the program as spyware on its Web site.
A major antivirus company saying a free anitvirus program is spyware, that should raise a few red flags right there.
It started out being marketed as a way to "speed up" web browing, much like AOL is advertising with "Top Speed" now. According to the article, they even have access to encrypted connections. It also says that your passwords and stuff are visible to them. This isn't good, and they don't really state up front that they do this. I believe marketscore has been considered spyware for a while by some people. Also, the program they give you in exchange only scans emails, or so it appears. Definentaly not worth it.
Ah, but lots of software that clearly state in their EULA's that they collect and submit information are also considered spyware. Yes they said it on their web page, but in a PR friendly way, most people will read it and not think about the privacy implications. Remember most people will give away their identity for the chance to win a chocolate bar.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Some banks also block online banking sessions coming in via Marketscore's proxies.
This is the same spyware previously known as "netsetter". There's no question about this being spyware.
Here's Stanford's Information Security Office's statement on Marketscore.
11 Jan 2005
MarketScore (also called NetSetter) is a spyware-like application that compromises the security of all data sent or received by your web browser, even on "secure" encrypted web sites. All external browser communications are re-routed through MarketScore's proxy servers, so they have access to any "secure" traffic/passwords/accounts that otherwise would be encrypted.
If you have MarketScore installed on your computer and have used your browser for any services that require WebLogin, your password should be considered compromised. After you have removed MarketScore from your computer, we strongly recommend that you change your SUNet password. This advice also applies to any other secure web sites you may have visited with your browser.
The Information Security Office is directly contacting owners of machines that appear to behave as if MarketScore is present.
Technical Detail
MarketScore reconfigures the browser to use a "proxy server" for all non-local connections, including HTTPS connections. A proxy server is a machine that acts as a middle-man, brokering web page requests intended for other sites. So if the browser on machine A wants to visit web sites C, D, and E it makes all those requests through the proxy server B. B then contacts C, D, and E and passes the results back to A. This is usually transparent to the user on machine A after the browser has been configured to use the proxy.
Web proxies are typically used in a corporate environment where all web traffic must be controlled or inspected centrally, although in the case of secure HTTPS traffic there is ordinarily nothing the proxy can do except forward the connection or refuse it. In this case, the proxy servers belong to a company called ComScore where they collect and analyze the intercepted data.
While ordinarily an HTTPS connection would simply pass through a proxy securely, in this case MarketScore also installs a new root certificate in your browser so that it can decrypt all intercepted SSL connections (a "man-in-the-middle" attack) without triggering a security warning from the browser. In normal operation, browsers would complain if a site certificate doesn't match the domain of the URL, but the new root certificate tells the browser to trust ComScore's site certificate for any URL.
This goes well beyond what Marketscore claims their program does.
That seems to settle the issue.
If it monitors what I'm doing on my computer it should be classified as spyware. I don't care if it's for research rather than commercial uses, it's still spying.
The fact that the spying program is included with a free anti-virus program to entice people to download it says it all.