Slashdot Mirror
Sites Guilty of Hijacking History
Gunkerty Jeb writes "A recent study launched by the UC San Diego Department of Computer Science to determine the scope of privacy-violating information flows at popular websites shows that popular Web 2.0 applications such as mashups, aggregators, and sophisticated ad targeting are teeming with various kinds of privacy-violating flows. Ultimately the researchers determined that such attacks are not being adequately defended against."
So they inspect the top 50,000 sites and 485 have some level of inferring browser history data? I'm not so sure I see the abundance noted in the summary. Less than one percent is teeming? And only one of those sites is ranked in the top 100 by Alexa?
I'm not saying we shouldn't worry about this or we should ignore it but come on.
Just face it, websites often operate on razor thin margins. They live and die by the clicking of advertisements on their pages. Now they've found a way to sell private information that could be mildly useful to the right bidder. And it turns out it mostly adult websites that stream video doing this. You might have cause for being upset but anyone familiar with business models of seedy websites should not be surprised.
I have always used Google Chrome's incognito browser when I go to seedy sites. It's simply not going to be a priority for the masses but for people who are annoyed or angry, it's the best way to deal with this sort of thing. If some major non-adult site were doing this, I think they would be setting themselves up for embarrassment, I'm glad somebody's doing these checks.
My work here is dung.
I thought that was the whole point of Web 2.0: directly connecting you to people who want to sell you junk you don't need based vaguely on what your interests might be.
Heck, Netflix recommended Rocky and Bullwinkle based on my interest in Yojimbo, and they were spot on... doesn't get much more Web 2.0 than that.
When you're afraid to download music illegally in your own home, then the terrorists have won!
makes me laugh more than frightens me. It's always amusing to go to some popup-riddled website to look up the lyrics to a song, and off in the corner of all of the irrelevant-to-my-tastes "mp3 ringtone justin bieber ringtones here click here to guess your crush" ads is a singular "32-bit RISC based microcontrollers from Atmel" advertisement.
Evidently I'd have to enable Javascript to find out.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
It's not Taco's fault that privacy violations tend to get much worse every 28 days.
For-profit websites using questionable tactics to gather information to better target their advertisements. Film at 11.
Have we finally found out where in the world/time/on earth is Carmen Sandiego?
How do people think that all these "web 2.0" social media sites make money? They do it by selling tracking data about you to research companies and the like.
It is like super market "loyalty" cards. They aren't primarily handing those out to keep customers loyal they are doing it to gather information about buying habits.
TANSTAAFL: If you can't figure out the cost of something you are probably being played.
========
CINC, 4th Penguin Legion
I did not post the link without javascript again did i?
I think the place of the Internet in society is entering a new phase.
Before you piss and moan ...
Trying reading TFA before you whine too loudly, those words are a direct quote, and, apparently not a typo.
Not saying that sometimes the editors shouldn't proof read more, but it's important to actually know the difference.
Lost at C:>. Found at C.
From Facebook, Digg, and the linked site no less.
Man, I love noscript.
Lost at C:>. Found at C.
If a site offers up ads on subjects I'm interested in, I have no problem leaving them unblocked. I learn about products I care about, the site gets ad revenue, and the company gets word-of-mouth. Everyone wins.
So long as sites show me ads relevant to their own subject, I have no problem with them (excluding fly-over ads or ads with sound...those are NEVER ok.)
Living With a Nerd
Ah ... UCSD ... sounds like this might be what you're referencing:
http://cseweb.ucsd.edu/~hovav/papers/jjls10.html
could be interesting if linked up with the stuff Microsoft are developing (Slashdot story from couple of days ago).
As far as history sniffing is concerned, just recently we heard about history sniffing by “mainstream ad networks” and YouPorn (...accompanied by a great disturbance in the Force, as if millions of anon suddenly cried out in terror and were suddenly silenced). Also, [PDF] “documents hundreds of commercial sites exploiting it”.
To learn whether you’re vulnerable (and how exactly this works), http://startpanic.com/.
There are a few ways to immunize Firefox against this sort of attack:
Clearing your history is obviously effective, whether that means clearing it entirely or just deleting particular sites from the history. If a site isn’t in the history, it can’t be detected. You could also use an addon to clean up your history, e.g.
History Deleter – Deletes browsing history by keywords and/or date (on browser close)
HistoryBlock – Blocks specified sites from history, recently closed tabs, and the download manager
Also, disabling the visited link styling will also prevent history sniffing, but you won’t be able to tell if links have been visited by their visual style any more. To disable it, go to about:config, paste layout.css.visited_links_enabled into the search bar, and change its value to false.
Distributed Denial of APK: It takes 15 seconds to reply to him anonymously, but wastes tons of his time if we all do it.
Yep: Seems like 'privacy-violating flows' = 'history sniffing' ... common reference is Youporn.
The article is not particularly good, this one is better: http://www.switched.com/2010/12/02/bug-gathers-your-browsing-history-youporn-perez-hilton/ You can find the original study here: http://cseweb.ucsd.edu/users/lerner/papers/ccs10-jsc.pdf It is quite interesting, especially the list of sites is on page 9...
I'd make a comment about Lynx, but odds are you're not going to be watching much porn in that anyway.
Back in the dark ages (1997 or so), there was a school of thought that advocated cookie poisoning, not just removal. Anybody know of any firefox plugins that actively randomize your history or cookies? Throwing wrenches into databases is the next best thing to naming your kid Little Bobby Tables.
Reminds me of a couple of months back when amazon.de, supposedly based on my previous purchases and pages visited, recommended me 3 new games for very little girls. And I mean really dress-up Barbie stuff. I'm still wondering exactly what has my alter-ego been looking at on Amazon.
A polar bear is a cartesian bear after a coordinate transform.
See, now that's funny. :-P
Yes, we should all send our entire browsing history to yet another company so they can verify if we might have given away private data.
You, sir, need a newsletter. ;-)
Lost at C:>. Found at C.
"Sites Guilty of Hi-Jacking History"
I thought this was going to be a much more interesting listing of sites that have blatantly changed the facts to suit their needs. whitehouse.gov, foxnews.com, cnn.com, msnbc.com, prettymuchanyfinanciallendinginstitution.com, etc
That's the problem with Web 2.0. Everything's a script, from pull down menus to "Reply" buttons on blogs. Which of those is random? Which is malicious? Which shouldn't I run?
It's easy to sort out the third-party scripts, and block all but domain originated scripts from the sites you visit. I don't care if CrazyEgg can't tell where I clicked, or if google-adsense fails to rack up another hit, or alexa doesn't count me in the Top 100. But I kind of need the internal site navigation stuff, and a lot of sites use scripts for sorting, comparison shopping, etc. The scripts in TFA are originating at the domain, and are not being served up as external scripts that are ordinarily blocked by noscript, ghostery, etc.
I suspect these can be blocked with a greasemonkey script that redefines document.defaultView.getComputedStyle() and causes it to throw an exception or something (I can't think of a legitimate use of getComputedStyle that I'd care about.) But what about the invisible attacks I still don't know about yet? I guess I'll block them as they come.
John