Slashdot Mirror
Sites Guilty of Hijacking History
Gunkerty Jeb writes "A recent study launched by the UC San Diego Department of Computer Science to determine the scope of privacy-violating information flows at popular websites shows that popular Web 2.0 applications such as mashups, aggregators, and sophisticated ad targeting are teeming with various kinds of privacy-violating flows. Ultimately the researchers determined that such attacks are not being adequately defended against."
So they inspect the top 50,000 sites and 485 have some level of inferring browser history data? I'm not so sure I see the abundance noted in the summary. Less than one percent is teeming? And only one of those sites is ranked in the top 100 by Alexa?
I'm not saying we shouldn't worry about this or we should ignore it but come on.
Just face it, websites often operate on razor thin margins. They live and die by the clicking of advertisements on their pages. Now they've found a way to sell private information that could be mildly useful to the right bidder. And it turns out it mostly adult websites that stream video doing this. You might have cause for being upset but anyone familiar with business models of seedy websites should not be surprised.
I have always used Google Chrome's incognito browser when I go to seedy sites. It's simply not going to be a priority for the masses but for people who are annoyed or angry, it's the best way to deal with this sort of thing. If some major non-adult site were doing this, I think they would be setting themselves up for embarrassment, I'm glad somebody's doing these checks.
My work here is dung.
I thought that was the whole point of Web 2.0: directly connecting you to people who want to sell you junk you don't need based vaguely on what your interests might be.
Heck, Netflix recommended Rocky and Bullwinkle based on my interest in Yojimbo, and they were spot on... doesn't get much more Web 2.0 than that.
When you're afraid to download music illegally in your own home, then the terrorists have won!
... privacy-violating flows.
CmdrTaco: Do you EVER read any submission before publishing?
Did you watch porn?
makes me laugh more than frightens me. It's always amusing to go to some popup-riddled website to look up the lyrics to a song, and off in the corner of all of the irrelevant-to-my-tastes "mp3 ringtone justin bieber ringtones here click here to guess your crush" ads is a singular "32-bit RISC based microcontrollers from Atmel" advertisement.
For-profit websites using questionable tactics to gather information to better target their advertisements. Film at 11.
Have we finally found out where in the world/time/on earth is Carmen Sandiego?
How do people think that all these "web 2.0" social media sites make money? They do it by selling tracking data about you to research companies and the like.
It is like super market "loyalty" cards. They aren't primarily handing those out to keep customers loyal they are doing it to gather information about buying habits.
TANSTAAFL: If you can't figure out the cost of something you are probably being played.
========
CINC, 4th Penguin Legion
they inspect the top 50,000 sites and 485 have some level of inferring browser history data
Is there a list of which ones were violators? They should be pariahs. Does anyone know if there's a website I can visit that will send each of the links I've visited in the past and check it against this list of 485 violators? That would be really easy and helpful to the victims and myself!
I think the place of the Internet in society is entering a new phase.
If a site offers up ads on subjects I'm interested in, I have no problem leaving them unblocked. I learn about products I care about, the site gets ad revenue, and the company gets word-of-mouth. Everyone wins.
So long as sites show me ads relevant to their own subject, I have no problem with them (excluding fly-over ads or ads with sound...those are NEVER ok.)
Living With a Nerd
The article is not particularly good, this one is better: http://www.switched.com/2010/12/02/bug-gathers-your-browsing-history-youporn-perez-hilton/ You can find the original study here: http://cseweb.ucsd.edu/users/lerner/papers/ccs10-jsc.pdf It is quite interesting, especially the list of sites is on page 9...
Back in the dark ages (1997 or so), there was a school of thought that advocated cookie poisoning, not just removal. Anybody know of any firefox plugins that actively randomize your history or cookies? Throwing wrenches into databases is the next best thing to naming your kid Little Bobby Tables.
Since the referenced article was nothing more than a blog with no references to the original material...here is a link to get you started...
http://www.jacobsschool.ucsd.edu/news/news_releases/release.sfe?id=1027
Reminds me of a couple of months back when amazon.de, supposedly based on my previous purchases and pages visited, recommended me 3 new games for very little girls. And I mean really dress-up Barbie stuff. I'm still wondering exactly what has my alter-ego been looking at on Amazon.
A polar bear is a cartesian bear after a coordinate transform.
Given that there is such a story in the news every few days, anyone who hasn't been living under a rock knows the kind of problems that come from running unsolicited scripts. Both direct privacy violating problems, and indirect ones such as breaking out of sandboxes through buffer overruns in PDF readers or whatever.
Why would any sane person run non-trusted scripts, in 2010? You bank site, sure. But that's not what we're talking about here. We're talking about scripts that violate privacy and potentially jack your machine. We hear of problem after problem after problem... yet people keep running them. Are they just insane, or what?
If every time I walk into Joe's Diner I get hit in the face with a bat, pretty soon I learn to go eat at Sue's Diner where I don't get hit in the face. Bitching about getting hit but continuing to go to Joe's every day... I just don't know what to say.
I challenge anyone to define the verb "to hi-jack" in a manner that is consistent with this article's usage, and yet also somewhat consistent with prior usages (we can relax this constraint a bit -- we'll have to, or else you have no chance!), and also not so generic that it essentially only means "to do something that someone doesn't like."
When you try to over-dramaticize things by abusing words, you rob them of their meaning.
"Sites Guilty of Hi-Jacking History"
I thought this was going to be a much more interesting listing of sites that have blatantly changed the facts to suit their needs. whitehouse.gov, foxnews.com, cnn.com, msnbc.com, prettymuchanyfinanciallendinginstitution.com, etc