Detailed Privacy Study Finds Loopholes Galore

BrianWCarver writes "The San Francisco Business Times covers a study by student researchers at UC Berkeley's School of Information pointing up the massive holes in privacy policies and protections of which US companies take advantage. The researchers have released a study and launched a Web site, knowprivacy.org, in which they found that Web bugs from Google and its subsidiaries were placed on 92 of the top 100 Web sites and 88 percent of the approximately 394,000 unique domains examined in the study. This larger data set was provided by the maintainer of the Firefox plugin Ghostery, which shows users which Web bugs are on the sites they visit. The study also found that while the privacy policies of many popular Web sites claim that the sites do not share information with third parties, they do allow third parties to place Web bugs on their sites (which collect this information directly, typically without users' knowledge) and share with corporate 'affiliates.' Bank of America, to take one extreme example, has more than 2,300 affiliates — and users cannot learn their identities. The full report and more findings are available from their Web site."

Comments

Guilty as charged

[alain94040]

Agreed. Trackers such as Google Analytics and more have been around for years. But now it's getting even worse with the flurry of URL shorteners. Not only can't you see what the real URL points to, its main purpose is to track, track, track.

Personally, I don't believe it makes sense to have a web completely free of "web bugs". I'd rather have some pretty strong laws, along the lines of the presumption of innocence, so that anything collected about you can't possibly be used against you if it was obtained "by chance". That would be a start.

--
escape the corporate world, code for fun and profit

Re:Guilty as charged

[orngjce223]

Here's the thing. People don't *want* to be tracked across websites. (Just like they don't *want* to see ads at all... but I digress.) The equivalent is the local store providing a small button-sticker, without your permission, at the door that not only lets their associates direct you to sections you might actually be interested in, but track you via GPS into other stores to see what you buy. And I mean you can take them off later (delete the cookies and all that), but then every other store provides the exact same sticker and some require you to present the sticker at every counter for service. It's something that a paranoid would probably say already happens, but the fact is, that this is turning us *all* paranoid. I don't like being paranoid.

On the other hand, Mr. President Obama has kept quiet on privacy, so we don't even know what his stances are on this issue...

Re:Guilty as charged

[lavacano201014]

Yeah, it's one thing if they stick a cookie on your computer saying "He logs in as lavacano201014, and he gets the password right", or "I've been here before, don't count me as a new visitor". It's like those events where they stamp your hand to show "You've paid, you just went outside for a smoke". It's another thing if they record personal information that you'd rather keep to yourself. It's like forcing them to tattoo your name and Social Security Number to your forehead and both arms. Do you really wanna wander around with "I'm John Johnson, my SSN is 555-55-5555"? That's my stance. Of course, if you really DO want to wander around like that, none of my business.

Re:Guilty as charged

[BitZtream]

You do realize this already happens right? And stupid people play into it. Those retarded 'club' cards for every freaking grocery store, sporting goods store, (insert store type here) store. The price you see on the label is always the 'club' price, which you pay more if you don't use their 'club' card. They send you directed advertisements in the mail and design the store displays and advertisements to direct you to the place in the store where they think they can upsell you the most.

The only people turning paranoid are geeks too stupid to realize they have been able to do this for years and it doesn't just happen on the Internet. 'Web bugs' are nothing new, you've just been too dumb to notice them in the past.

'People' don't CARE if they are tracked. Slashdotters freak out about it. If people gave a damn they wouldn't be so happy to sign up for those cards. They KNOW they are being tracked cause most of them happily send you reports regularly telling you what you've spent your money on.

You guys need to pull your eyes off the monitor for a few minutes and stop thinking that everything on the Internet is new. Most of it isn't, not be a long shot, its just a variation on some scam from else where.

If you actually were worried about being tracked you'd use cash and never buy anything off the Internet.

Re:Guilty as charged

[Aram Fingal]

You're right but storing personal info in the cookie itself isn't the way it's normally done. More often, they store something like visitor#42383645934568125 which is a database key. Your personal info is in their database and not in the cookie. Part of the problem with web beacons is that they effectively allow different sites to share the same database key. This wasn't supposed to happen with cookies which are restricted to being read back only by the same site that set them in the first place. Web beacons get around this limitation by loading a portion of the site which you are visiting, even something as small as a one pixel graphic, from a common advertising agency site. Some of these advertising sites are backed by huge clusters and able to serve a bit of content to a huge percentage of sites on the internet. That's what the graphs about Google's reach are explaining.

Re:Guilty as charged

[Aram Fingal]

Personally, I don't believe it makes sense to have a web completely free of "web bugs"...

Why? Why can't advertising work on the web without tracking? Advertising in newspapers, television and radio doesn't track people and that has worked just fine for many many years.

Defective by design

[Torodung]

The law: this is the thing that really deserves this tag.

Defective by design, my friends. You have no privacy from the powerful.

--
Toro

It's the INTERNET for crying out lud

[Anonymous Coward]

What the fuck did you expect? If you want "privacy", stay home. Oh, wait.

We need to take care of our privacy.

[Krneki]

NoScript can stop most of the scripts running in the background when you visit a web page.
https://addons.mozilla.org/en-US/firefox/addon/722

Re:We need to take care of our privacy.

[AnalPerfume]

A decent cookie policy helps too. CSS Lite along with a "deny all cookies" default works wonders in that regard. Then just like NoScript you van allow them temporarily or permanently on an individual basis when a site you need demands them.

Re:We need to take care of our privacy.

[spottedkangaroo]

There are three main strikes against noscript though... 1) it's irritating and doesn't necessarily protect against 1x1 pixel or iframe attacks anyway; 2) it sucks and breaks things like OpenID, which are necessarily cross site scripting; 3) the guy's a total fuck head (see adblock).

Re:We need to take care of our privacy.

[drinkypoo]

1) Use adblock pro and it will whack most of those 2) You can enable sites one by one if you need OpenID, ReCAPTCHA, etc 3) This part is true :(

...and so what?

[raehl]

I have Google Analytics on my websites. It gives me lots of useful information about my users in a format that is easy to understand. But, about the only thing it tells me that I couldn't discern from the server logs is where people link in from.

Now, this does mean that Google gets a record of when an IP address visited my server and what page they looked at. Is this an invasion of privacy? I don't think so. What's the worst that is going to happen? Google sells my browsing habits so that companies I already have a business relationship with send me targeted advertising? OH NO!

What we need is legal limits on what can be done with collected information. We already have some - companies can't email me out of the blue unless we have an established relationship. We could perhaps use some additional protection in terms of public release of possibly not-entirely-flattering personal information.

But beyond that, who cares? Privacy isn't, by itself, important. What we care about is negative consequences of our privacy being invaded. I don't want my friends to know about my Enzyte purchases, for example, but if I cancel my Enztye order and place a Capatrex order, what's the big deal if Enzyte sends me an email with a special offer to double my order for the same price?**

(Note: I would never actually use either Enzyte or Capatrex... when I could use both!)

Anyway, if it really bothers you, it's not like anoyne is actually sharing your information with 3rd parties anyway. Those web bugs don't get their information from the websites you visit, they get that information from you - it's YOUR browser on YOUR computer that sends the request to Google Analytics et al. If you don't want your browser to do that, block the sites.

Re:...and so what?

[jimmyswimmy]

In my mind it's enough that Google is able to understand how my thought processes develop by tracking search queries - which is an overt and expectable result when I tell them what I'm looking for. And since they present the results to me, they also get to see which ones are appealing, both by me clicking on the result link (and thereby telling them which one I have clicked) as well as by whether I return for a similar search, or a search which takes me down a related tangent.

But I don't care for the idea that Google or any other company can know which other sites I visit, either as a result of (omg) Yahoo searches or whatever MS calls their search engine these days. Or even sites whose names I know, like facebook or various company sites whose names are typically companyname.com or similar. In other words, if I didn't ask them for it, it's not their business to know. In fact, I see it as my business alone. The fact that there is value to tracking that information, or appending that data (where I surf) to some customer record that contains my real name and address - I should have some level of control over that information. My (sadly unrealistic) opinion is that Choicepoint should be paying me a percentage of their revenue when they sell information about me. I don't care that it's aggregated - there is value to that data, it should not be theirs to sell with no restrictions.

Re:...and so what?

[X0563511]

... that I couldn't discern from the server logs is where people link in from.

Hrm, strange. You would think your server would both be able to read and log the Referer request header.

Re:...and so what?

[Anonymous Coward]

Those are excellent points.

BTW, from your recent purchasing history on one of our affiliate sites we've noticed that you are interested in laxatives. May we suggest "Stool-Max" (tm), the new and improved laxative to provide 24 hours of continuous relief? Many customers who are fans of Bon Jovi like yourself, have benefited from this breakthrough product.

Re:...and so what?

[martin-boundary]

Is this an invasion of privacy? I don't think so.

See, the problem is that my privacy is none of your business. I don't care what you think is acceptable to me. Speak for yourself.

If a surfer visits your site, they have a certain expectation of viewing your content. Now you've decided to share that two-way communication with a hidden third party, who offers you a service (so far so good) in exchange for access to the visitors (that's the problem). Your visitors have not entered into any relationship with the third party, and are not getting any service from them. So why are you letting them get milked?

Think of it this way: Do you carry a hidden tape recorder in your pocket so that you can record all your conversations with your friends and colleagues, just because the weird guy down the street is paying you 10 bucks a week to let him listen in on anything he likes? Would you consider that acceptable behaviour from any of your friends and colleagues?

Re:...and so what?

[nitroyogi]

Google doesn't sell that info.

Thus far they haven't done anything nefarious with the info they collect. They even refused to turn tons of it over to the government.

Can you prove what you say? As authoritatively as you say it?

Google has brainwashed many people with its strangely inscrutable "Don't be evil" campaign. So much so that those folks start dreaming divine fantasies about Google's impeccable loyalty to its dear beta customers' rights online. And start making statements that make remote business sense but none too practical. Keep an open eye on both sides of Google. Its not a saintly or charitable venture. Its just lesser of the evils.

How Ironic...

[lag10]

How ironic that a school without sufficient knowledge to protect its students from identity theft lectures the world on personal privacy.

A number of student Social Security numbers were leaked not too long ago.

Here's the article

Lie, cheat and steal. Why keep acting surprised?

[swb]

Why do we keep having studies like this? It's like having more studies to prove that gravity will cause a rock to drop on the ground; it's pretty well understood without having to have yet another study remind us that given even the slightest chance to lie, cheat or steal, corporations will willingly and vigorously lie, cheat and steal.

While I'm not "old" I am, at 42, at the point where I just tune out anything a corporation tells me. It's all bullshit. All of it. And I often ask myself why I don't make every attempt to rip them off as often and as completely as I can -- just fuck off being honest, all you get is ripped off anyway. There is no "fair" or "middle ground", it's just "how badly do you want to get lied to/cheated/ripped off?"

In spite of this and in spite of my equally strong cynicism that government can "fix" this, why don't we treat these corporate fucks properly?

For so many of these frauds, jail just isn't good enough, or it doesn't provide the right life lesson. These people need to know just exactly what the shit end of the stick feels like. Here's a suitable punishment for corporate malfeasance:

1) Corporate thief *and* immediate family, including wives divorced after the initiation of fraud, stripped of ALL personal possessions, property, real estate and financial assets. YOU MAY NOT EVER PROFIT FROM YOUR CRIME NOR ENRICH YOUR FAMILY. YOU HAVE LOST EVERYTHING. FOREVER.

2) Forced to live a residence in a neighborhood with at least 50% of the population at or below the poverty line. POVERTY SUCKS.

3) All family members required to work at a job which pays no more than 2x the poverty wage for whatever size family they consist. Any money earned over this amount is forfeited. YOU WILL NEVER GET AHEAD OR EVEN CATCH UP.

4) No financial or material support of any kind from the outside, including support in-kind (free rent, forgiven debt, etc). AND NOBODY WILL HELP.

Even whitehouse.gov has a web bug

[karl.auerbach]

Even the Whitehouse.gov website has a 1x1 pixel web bug that is in violation of their own privacy policy, not to mention 5 USC 552a.

This is new?!

[erroneus]

ADVERTISERS are Anti-Privacy People!!! They would create massive databases tracking every single man woman and child on the planet if they could and many are still working on that very thing.

Google is an advertiser. When you break it down, Google's motivation is making money by selling advertisements in various forms and means.

Here's other news: Advertising WORKS!!! They wouldn't do all this if it didn't yield results. And that will never change. Our consumer culture is so developed that people can't imagine any other way of seeing the world they live in.

And here's an interesting aside -- according to my younger brother who recently went through law enforcement training informed the family of an interesting bit of trivia. He told us that the code word for "mentally retarded person" is "CONSUMER." He was not joking. Let that settle in... There are so many different areas where "consumer" is used to describe people and it makes you think doesn't it? We're all the brainless pawns in their business strategies and plans.

Privacy is Possible

[CodeBuster]

If people are concerned about their privacy then why don't they use Firefox, AdBlock, Flashblock, and NoScript? The truly paranoid can download and use Tor as well. Do people have a right to complain if they aren't willing to lift a finger to protect themselves?

Re:Privacy is Possible

[twostix]

"Do people have a right to complain if they aren't willing to lift a finger to protect themselves?"

Why yes, yes they do.

Re:Lie, cheat and steal. Why keep acting surprised

[phantomfive]

While I'm not "old" I am, at 42, at the point where I just tune out anything a corporation tells me. It's all bullshit.

Not trying to out-cynical you or anything, but who really tells you anything that isn't bullshit? Politicians and government? Right. Your friends? Doubt it. Scientists? Sometimes, but only because they know if they lie someone else will repeat their experiment and catch their mistake. It happens.

Seriously. You're 42. It's time to grow up, be a man and take responsibility for yourself, not depend on dishonest corporations or dishonest other people to take care of you. In this case, figure out how to block cross-site cookies, or block cookies all together. Learn how to use an anonymizer. Whatever it takes. This is something YOU can do. Stop relying on other people, and other people will stop taking advantage of you.

Re:Lie, cheat and steal. Why keep acting surprised

[Jimmy_B]

Sorry, but the US Constitution expressly prohibits extending punishment for crimes onto family members. The most you could get is forfeiture of assets which a prosecutor could prove constituted stolen goods, and that wouldn't be nearly everything.

Stupidity...

[Velska1]

'People' don't CARE if they are tracked.

You may be right that most people don't. Most non-geeks I know have a hard time figuring how much their groceries are going to cost when our VAT rate goes down (now why is there VAT on groceries in the first place? Don't get me started...) or how much their paycheck is going to grow when the employer withholding tax goes down. They care what reality shows are most popular or who wins Idols or whatever.

But that doesn't change the fact that they should. It's one thing to be a member of a consumer co-op and buy stuff at member prices -- and another thing entirely to be looking for daily news, info about your or your friends' minor or major ailments, and have it all recorded forever in a way they are able to associate with your identity.

So Google has not been caught selling the info yet. They have, however, been forced by the DOJ to submit info about search terms and stuff. If Google's revenue takes a big hit for any reason, what's going to stop them from selling the info about the people who seem to spend a lot of time on Chinese dissident sites to the Chinese government? Or just to the highest bidder for whatever info they can offer?

Furthermore, imagine if a perfectly legal hobby were to be criminalized -- retroactively -- say, by a new government elected in a wave of frenzy about national security (totally hypothetical, I know but bear with me). Now if that had been my hobby, I would be a sitting duck for the newly created national security cop unit. I may be a perfectly law-abiding citizen perfectly willing to forgo a hobby if my government tells me it endangers the national security, but I would already be a criminal.

This is just an oversimplified example of what could happen. Much more complex, and at the same time impossible-to-win situations have happened many times over in different parts of the world since mid-1960s when I started following the news. To mention just one example from U.S. history (well researched, doesn't affect us today other than a warning example of just the kind of circs I describe), check out the Senator Joseph McCarthy crusade (and learn that he was just a front man for a lot of mean bullies, who wanted to do their bullying legally).

P.S. I have RefControl with Firefox, I use redirection for most of my systems that directs requests like web bugs to a dummy address etc. I don't do it for all of my systems all of the time, though.

Re:Exactly!

[xouumalperxe]

Now you've decided to share that two-way communication with a hidden third party,

I did no such thing. I placed a link in my page to the third party. Your web browser, running on your computer, executed the link to the 3rd party and provided the data.

Next time someone complains about legalese, think of this sort of shmuck.

Doubleclick

[MrKaos]

Ghostery found 1 web bug on Slashdot