Slashdot Mirror
Websites Still Failing Basic Privacy Practices
DigitAl56K writes "Large companies still can't seem to get the basics of privacy and security on the Web pulled together. Today I went to enter a competition from Duracell to win a Nintendo Wii by filling out an online form. It requires entering your full name, address, and date of birth, and then proceeds to submit it via an unencrypted HTTP POST. The ultimate irony is the message at the bottom of the page that reads: 'Trust is a cornerstone of our corporate mission, and the success of our business depends on it. P&G is committed to maintaining your trust by protecting personal information we collect.' Which websites have you found to be lacking in their basic privacy practices?"
That Firefox saves the nasty warnings for Web sites that are encrypted!
HTTP is sent unencrypted, but it's not that easy for a random person who wants to steal your address to be on the correct subnet at exactly the right time to sniff it. Also, address and date of birth aren't usually considered confidential, even if you might not want to publish them.
This isn't a lot different than many of those post-card questionnaires many people fill out and mail in.
I think in this case, it's more important what they do with the information once they receive it.
That said, I think there should be default encryption wherever possible automatically.
"XXXXX is committed to maintaining your trust by protecting personal information we collect."
Means nothing when every website harvesting your info says that.
That level of privacy is not considered important by anybody.
It is by me (obviously) ;)
You don't think a name, address, DOB, and password all going plaintext is troublesome? How many people use the same password for half a dozen websites? How many password recovery systems use address or DOB?
With specific regard to "trust", here you have a website asking for a bunch of personal information without taking the most basic precautions to protect it in transit and without an SSL certificate that identifies the owners to inform you where the data might really be going to.
It was enough to make me cancel out.
Exactly. The junk mail that's in my mailbox every day has more detailed information on the outside of the envelope. This is really a non-issue.
It does not matter when you fill the form. As long as when you clicked submit and it went to a https page you are safe.
That is how all the sites that don't handle CC or SSN's do it. It reduces overhead and load time. Even gmail did until recently.
Dan
If your junk mail shows your date of birth and password I'd be worried. It's also a little harder for an observer to collect millions of records from junk mail than it is to sniff at a router and log all the traffic automatically.
BTW what has happened to /. tonight? If Google switched their login page to http would nobody care?
Your information is already out there in public records. Google your phone number and see what comes up. If the form asked for SSN or driver's license number I would be a bit more cautious. As far as passwords, it is already considered a bad practice to use the same one on a shopping website as your bank or credit card account websites.
Actually, I've heard this discussion come up before-- generally, you want the login form SSL encrypted, as well, to verify the identity and integrity of the form. Otherwise, it leaves the possibility for phishing, poisoned DNS, or a man-in-the-middle attack that rewrites the form to submit to a malicious intermediary. (Granted, a person viewing the code could see that last one, but I know I certainly don't eagle-eye the action param on every form I submit before I hit "go".)
Information wants to be free.
Entertainment wants to be paid.
You just want to be cheap.
You missed the real story, to wit:
..."
"Internet users still can't seem to get the basics of privacy and security on the Web pulled together. Web users still offer up information they consider to be private and sensitive, on the almost zero chance they will win a Wii, to companies about which they know little or nothing. They still believe the company can and should be trusted with their data, based solely on the fact that the companies products have a little brand recognition
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Exactly. This "article" is yet another bad joke (slashdot disappoints a lot lately).
Dear "DigitAl56K": If you're so worried about losing your first and lastname on the interwebs then why the hell do you participate in retarded lotteries?
Here's a little secret: If you don't push that submit button then nobody will ever get your information!
Yeah, the only people that want that level of data are those involved in identity theft. Given the number of people who have had their lives turned upside down through identity theft, we should all be vigilant - including challenging any and all Web sites that don't use proper practices to protect personal information.
How can they maintain something they'll never have?
What?
Easy publicity for Duracell. Have someone complain about a non-issue with your competition, and get free press.
'Thats they exact same thing a banana wrench monkey.'
And I know which ones too.
Three results, all of which, not even related.
Change is certain; progress is not obligatory.
...to mention is that the whole point of a lot of those online forms (such as competitions etc) is to provide an opt-in to any kind of marketing dreck the the site owner (or any of his mates) cares to send you.
The best way to keep your personal information private is to not hand it out. I know that should be obvious, but the fact seems to escape people when they appear to be being offered free ponies (or whatever).
I did google my phone number (although I admit that its a mobile phone). All I got were references to the area code and exchange, and one reference to my wireless provider.
Except that doesn't make any sense. How do they know you're a subscriber when you haven't logged in yet?