Slashdot Mirror
Amazon To Block Phorm Scans
clickclickdrone writes "The BBC are reporting that Amazon has said it will not allow online advertising system Phorm to scan its web pages to produce targeted ads. For most people this is a welcome step, especially after the European Commission said it was starting legal action against the UK earlier this week over its data protection laws in relation to Phorm's technology. Anyone who values their privacy should applaud this move by Amazon."
It doesn't say anywhere how you opt your own website out of this.
I suggest everyone does this, no-matter how small or insignificant your site it.
Anyone who values their privacy should applaud this move by Amazon.
Thank you for telling me how to think. I believe we are approaching this from the wrong end (why start with websites?).
The article hints at two other points I would encourage Brits who care to be vocal about:
Jim Killock, executive director of the Open Rights Group, said: We expect more sites to block Webwise in the near future and also ISPs to drop plans to snoop on web users.
Write your ISPs. Threaten to change ISPs even if you're not able to. Let them know how this makes you feel.
The European Commission has described the technology as an "interception" of user data and wants UK law to reflect more explicitly the need for consent from users in order for the service to be implemented.
As always, contact your parliamentary representative and also EU representative and let them know how you feel about this.
These would be much more effective options than asking each website that exists to request Phorm not scan their site.
My work here is dung.
Well this is a good PR move on the part of Amazon as far as I'm concerned. Cancels out their "censorship" glitch from the other day and puts them back in a healthy credit again. Obviously keeping an eye out as always for loopholes such as allowing a different company to do the same as Phorm on their site, but currently Amazon is getting points from me for this. I despise Phorm. But apparently Phrom haven't been doing that well anyway. There was a bit of an exodus from their board a while back and I heard their shareprice took a bit of a whack after the original scandal. The EU investigating what the UK government refused to has just added to their woes, I'm guessing.
Aide-toi, le Ciel t'aidera - Jeanne D'Arc.
... but they obviously didn't do it for privacy reasons. As a business, I can bet they weren't happy with the idea of something scanning their pages and then targeting adverts from possible competitors based on what users were looking at on Amazon.
'If Christ had tweeted the sermon on the mount, it might have lasted until nightfall.' - John Perry Barlow
you DO hate google
Who want to bet that Amazon is actually blocking them because they are not paying to do it?
Incidentally, why would a business let another business makes money out of it for free?
Simple economic strikes: THAT service isn't free.
Yes exactly but Google 'does no evil' so they must be doing it for the betterment of mankind.
figuring that any publicity to take the collective internet's minds off of the gay book fiasco (as I have decided to term it) is good publicity. They've probably been sitting on this one for 6 months and just not telling anybody. I still will think more than twice before ordering something from them again.
--- He advocated thrift and hard work and disapproved of loose women who turned him down. ---
There's a big difference. Google doesn't hoover up ALL of your http traffic, Phorm, on the other hand, does!
It's actually been a while since I last heard about phorm. I believe that the general issue had more to do with phorm intercepting pages on the ISP's side and re-writing them to insert material before re-serving them to you. Google ads, on the other hand (since you brought them up) is a widget added by the site owner's permission.
Except with Google ads, the people who actually own the website choose whether or not to serve them. Phorm ads are injected at the ISP level, completely ignoring whether the server wants the ads or not. Yes, they're still interest based, but they're evil for other reasons in my opinion.
Reviewing just the first hour of video games.
Google doesn't do anything unless you use Google. Phorm gets the information from your ISP.
AdBlockPlus Phorm Edition, anyone? :P
This thing is hard-wired and scoops everything, and the vast majority of people who are targeted won't even realise it's happening. I think it's considerably worse than what google gets up to.
More sites should provide an option for https, like gmail does. Some still don't even provide it for authentication.
Once upon a time there were wimpy CPUs, and https was a more significant computational burden. Now, not so much. Especially when compared to the resource requirements of most dynamic page generation systems.
You opt into Google's ad service by visiting a site using it, and can opt out by simply stopping them from creating the tracking cookies. You automatically opt into Phorm when you use the internet and can only opt out by setting a special "don't track me bro" cookie on each profile of each browser used by each device in your home. I think that's quite a distinction. Phorm assumes that any of your web activity is theirs to track unless you specifically tell them otherwise.
No kidding!!! What do you say at this point?
Can someone provide an unbiased explanation of what Phorm is? Why is it an opt-out system? When did I or Slashdot give implied consent to anyone to inspect the packets for reasons other than routing? What data do they collect and what do they do with it?
Comment removed based on user account deletion
WTF?! Even ignoring all the privacy issues everyone else is talking about, isn't that still blatantly illegal? It's copyright infringement! By modifying the web page, Phorm is creating a derivative work, and that requires permission of the copyright holder.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Phorm are liars when it comes to robots.txt.
They say they respect robots.txt but their scraper will only respect it if it also blocks google and yahoo. If it allows Google and Yahoo, they say it's fair game for Phorm. That's not respecting it at all.
But what do you expect from the sort of people who would conduct illegal surveillance on people to test their spyware system and claim that letting opt opt out would have been impossible because it would have been too difficult for them to understand the complicated computery stuff they were doing.
Phraudsters.
Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
Well no, because when Google does it you have to visit a site that uses Google's technology, you can easily choose not to, you can also just opt-out.
When Phorm does it they are searching through every single action you take on the internet, whether it's a site that has anything to do with Phorm or not. Phorm works at ISP level by watching all the data that goes in and out on your connection. There's no avoiding it, you just have to go through it no matter what.
You see the fundamental difference is this, with Google I have to effectively send the data to them, it is only what I allow to pass out of my connection to them that is effected and only if I haven't opted out.
With Phorm I have no choice, every single bit of data whether I want it to or not goes through their systems.
I don't like what Google is doing either, but at least they make it possible for me to avoid their systems. With Phorm, they get to look at every single bit of data I send or receive, they say I can opt out but that doesn't mean my data isn't still passing through their systems and that's assuming I can opt-out unlike the people who they tested it on covertly with no notice or chance to opt-out.
Is that if you opt-out of Phorm, you are automatically entered, for free, in a program called Phorm2. But don't worry, you can opt out. For your convenience, in that case, you will automatically be entered in our new business web marketing program, Phorm++. If you're not interested in Phorm++, no worries, you can very easily opt-out. In fact, it's so easy, we'll do you a favour and give you free, automatic access to PhormDeluxe. PhormDeluxe is completely optional. Just send us a certified letter to opt out.
This is stunningly devious. The bastards.
For real,
To: website-exclusion@webwise.com
Subject: Exclusion requested from your spyware system
I hereby request that you remove the following domains that I own or may own in the near future from your WebWise / Phorm system:
phorm-is-a-fraud.com
webwise-is-big-brother.com
bt-is-completely-retarded-for.allowing-this-phorm-nonsense-on-their-network.com
webmasters-shouldnt-have-to-opt-out.com
you-dont-respect-robots.txt-you-lying-scumbags.com
Fuck you very much!
they're still interest based
Advertiser interest based. That has little to do with user interest. I haven't seen an ad I was interested in in years.
or similar should do it. For extra bonus points, inject your own links and/or images into the ads. How long before advertisers pull out of Phorm if the goatse guy or something equally horrific keeps appearing in their ads? It is, after all, your content and you should be able to do with it what you please.
TODO: Insert witty sig
And don't forget the method by which they do their thing -- deep packet inspection. It's not the behavioural targeted ads that are the real problem with Phorm -- the real problem is that their DPI kit "gifted" to the ISP intercepts communication between two parties (the web surfer and the web page) without informed consent of both parties. In short, they spy on your web browsing in order to profile you.
Thought thinks itself.
I believe phorm acts like other advertisers in that you place areas on your site for ads and link to them, the scary bit is they do a deal with ISPs to DPI your web traffic to help profile you for these adverts, so the user has to opt-out of their profiling. This is the scary/illegal bit they are getting bashed for, and the EU is looking into.
Come as you are, do what you must, be who you will.
Cut new squares out of them.
Right. I'm not seeing the difference, except that Google -- says -- they use the contextual system of adsense ads on a page to categorize it as to "interests," so they are only tracking your route between pages that carry Google ads, not the whole web. They wouldn't take note of your visit to a government agency page, for instance, supposedly.
A distinction without a difference in practical terms at best.
Sent from the iPad I found in your car.
As explained on the Customer Choice Process page, when a user opts into the BT Webwise service, a Webwise UID cookie, containing a unique random number is placed on the userâ(TM)s computer. This master cookie is held is the Webwise.net domain. When the user then visits other websites, the Webwise system stores a copy of the Webwise UID cookie within the browser in each the website domains visited by the user. The cookies are clearly labelled as belonging to Webwise as noted above and as a result can be easily identified as different to those cookies which may be placed by the website itself.
Since it claims to need no client software, I must assume they do this by injecting extra cookie headers into all the HTTP responses sent to my browser....
Come as you are, do what you must, be who you will.
I'm no fan of AdSense, but Phorm's scheme is technically quite different. Google does not, nor can it, do the kind of packet inspection that Phorm is doing.
The world's burning. Moped Jesus spotted on I50. Details at 11.
... who read "Amazon to block porn scams"?
"Anyone who values their privacy should applaud this move by Amazon" /golfclap
Supplication before our Robotic Overlord. Check.
Suspend free-thought. Check.
Check-out cart. Check.
In fact, even if you do set the Phorm 'opt out' cookie on all browsers/devices/profiles that you use in your house, all of you HTTP requests still go through multiple redirects before getting to the intended destination.
If your ISP implements Phorm, then there is no way of opting out of having your HTTP requests being directed through Phorm's servers before finally redirecting back to the server you wanted in the first place.
All that the 'opt out' cookie does is to stop them serving up customised advertisments. You still have all your HTTP requests going through their servers. There is no way to avoid this, other than to change ISP.
I do hope the above is incorrect. Sadly I'm pretty sure it is accurate.
I think you've misunderstood. Apart from some questions about early trials by BT, the Phorm system inserts customised advertisments only where the site owner has requested them. It won't insert advertisments into pages served up by owners who don't want Phorm advertisments. There won't be any Phorm advertisments (or any other for that matter) appearing on my personal website, or any other websites that I maintain.
No, the real objections most people have to Phorm are:
1. It spies on information that is private to the client and the server.
2. It degrades the web by causing every HTTP request to go through a series of redirects before getting to its final destination.
3. It spoofs cookies on the client's machine.
But in all fairness to Phorm, their corporate motto is:
Do only Evil.
So how does Phorm actually display its ads? Will it replace ads on my site with ads of their own (if so, how will they identify which images are ads?) If so, what happens to my ads - and to the people who have paid to advertise on my site? If not, will it modify my site's layout to place its ads (say, a banner on top of the page)? If so, what happens to my layout - will it be fubar?
I'm seriously asking, I haven't really come across a good explanation of the "delivering ads" bit of their business, only the "snooping and spoofing" parts.
Thanks for clarifying, I was under the impression that the ads would be injected into sites on the fly. In this case, if we could figure out the user-agent and/or IP addresses for their spiders, we could still do some interesting and mischievous things like keyword injection or replacing the normal content with random strings of garbage text. This would have the effect out poisoning their keyword scraping process, at least for your site. I know Google frowns on this practice and can knock you down in the SERPS or even de-list you, but who cares about these Phorm bastards.
TODO: Insert witty sig
The first problem has already been solved in SSL's successor, TLS. The "Server Name Indication"[1] extension of TLS allows the client to transmit the desired virtual host before the encryption begins. The current versions of most major browsers support this, including: Firefox 2.0 and later, Opera 8 and later, IE7 and later, Chrome, Safari 3.2.1 and later.
Apache, Cherokee, Lighttpd and nginx support SNI on the server side.
Your second problem is not as easy to solve. You could consider CACert[2], a certificate authority based on a web of trust. When I applied for CACert, the assurers were quite serious and checked my identity (ID card, photo and signature) more thoroughly than some ISPs who are reselling commercial certificates. No major browser ships with the CACert root cert but fortunately it's very easy to install!
[1] http://en.wikipedia.org/wiki/Server_Name_Indication
[2] http://www.cacert.org/
I saw this Phorm and instantly thought it would lead to phone porn!!!
Double Doh!!
Why not have a key pair (or something of that ilk) that you exchange with the crawlers? If you authenticate, then you can crawl my site. At the moment it's a free for all. Why not use the weight of Google to change the rules. Just my starter for ten after a few beers.
Marc
I was wondering if this use is in violation of the Attribution-Non-Commercial-No Derivative Works 2.0 UK: England & Wales license? http://creativecommons.org/licenses/by-nc-nd/2.0/uk/
I posted a correction to this above, (boy am i going to get flamed today, yes, phorm is evil, but not because of this bit...), If a banner ad rotator serves up a non Phorm ad you'll see it as normal, if it serves up a Phorm placeholder ad and you're on a Phorm ISP that ad may be switched out on the fly for a different Phorm ad. If you're not on a phorm isp you'll see the placeholder ad just like it was a normal banner. They used a charity's banner ads in the trial to try and portray themselves as "nice".
If you don't risk failure you don't risk success.
Comment removed based on user account deletion