Google Accused of Bypassing Safari's Privacy Controls

DJRumpy points out an article (based on a possibly paywalled WSJ report) describing how Google and other ad networks wrote code that would bypass the privacy settings of Apple's Safari web browser. 'The default settings of Safari block cookies "from third parties and advertisers," a setting that is supposed to only allow sites that the user is directly interacting with to save a cookie (client side data that remote web servers can later access in subsequent visits). ... The report notes that "Google added coding to some of its ads that made Safari think that a person was submitting an invisible form to Google. Safari would then let Google install a cookie on the phone or computer.' Google says this mischaracterizes what the code does, claiming it simply enables 'features for signed-in Google users on Safari who had opted to see personalized ads and other content — such as the ability to “+1” things that interest them.' Google adds that the data transferred between Safari and Google's servers was anonymized. John Battelle writes that the WSJ's story is sensationalist, but that it raises good questions about the practices of ad networks as well as Apple's efforts to stymie industry-standard practices.

Comments

And people ask me why I don't use Chrome

[elrous0]

I trust Google with way too much as it is. And practices like this only make me even more determined to avoid them as much as reasonably possible. It's bad enough that pretty much every website out there now is feeding them tracking data (seriously, use Firefox with NoScript and just look at all the sites using Google-analytics, it's *everywhere*). I certainly am *not* about to let them takeover my entire browser too.

They'll have to content themselves with just reading my gmail.

Re:And people ask me why I don't use Chrome

[Anonymous Coward]

If you're running DNSmasq just add this line:

address=/google-analytics.com/127.0.0.1

and it won't bother you again.

Re:And people ask me why I don't use Chrome

[MrKevvy]

I support a locked-down corporate image. I'm surprised at the number of people I support that I've found using Chrome.

Yesterday I talked to someone and asked how she got it and she said that a site prompted her to install it so she did. I just tried this and was able to install it on the locked-down image, including setting it as default, etc. It may have put its settings in the user-writable area of the registry but it's very sneaky to do so whereas other browsers will refuse to install without admin. privileges. Hey, whatever leads to higher market share, right?

Re:And people ask me why I don't use Chrome

[Xest]

I don't think Google have done anything wrong there, saving settings to a user section of the registry makes more sense than a browser needing me to give it admin priviliges to write wherever the fuck it wants. It's precisely that sort of behaviour that leads people to click okay each time windows notifies them a program wants admin rights without even stopping to consider why.

It sounds more like your problem is that your lockdown policy isn't configured as you'd like it to be, yet you blame the software for not obeying how you wanted things setup, rather than how things actually are setup, other than that it sounds like Chrome is following correct and best practice behaviour in this respect whereas how you'd have liked it to respond is bad practice and not preferable.

Re:And people ask me why I don't use Chrome

[Anonymous Coward]

You *can* do a system-wide installation, it's just not obvious.

Re:And people ask me why I don't use Chrome

[Anonymous Coward]

Goddamn you. It is not acceptable to mention hosts files on slashdot. If you summon APK, I will find you, and there will be consequences, you bastard.

Re:And people ask me why I don't use Chrome

[Xest]

"But on a locked down machine, nothing should be able to be installed without the admins knowing about it. Period. Google found a way around that."

No they didn't, that's precisely the point, the issue isn't that Google found some way around the lock down, it's that the system wasn't locked down properly to facilitate that goal.

Chrome is not some magical psychic piece of software that can tell what the system admin intended, it can only do what the OS allows it to do and is configured to allow it to do.

If Chrome is able to do things you did not intend on your systems then you have much more serious problems and your systems are incompetently configured and managed. You can guarantee if Chrome is obtaining admin privileges as a legitimate peice of software then a peice of malware would have a hell of a time enjoying your poorly configured systems. The first step to solving your problem is get rid of the geek squad level of staff, and start hiring some proper admins.

Re:And people ask me why I don't use Chrome

[Xest]

"That is a gigantic security hole just waiting to be exploited."

Right, so a browser that isolates itself to userspace is a gigantic security hole waiting to be exploited, yet a browser that requires admin privileges to install is not?

"Further, there's a reason corporate machines are locked down. We don't want people, especially IT people, installing every random piece of software that asks the user to install it."

So why are you letting people run arbitrary executables in the first place if you need that level of control of your systems?

"Rule #3 of IT that should never be broken: Never, ever, ever, EVER give a regular user administrative rights on their machine. Ever. Chrome breaks this rule with a wrecking ball."

Er no, that's exactly what it DOESN'T do.

"It's bad enough that as an admin I am constantly harassed by Windows 7, "Do you want to allow...?" Yes, I'm a fucking admin, just install the damn thing! Now we have to put up with companies making it so every user can install whatever they want and expect us to figure out what they did."

Well at least now we know you're really not qualified for your own profession. Really, you have a degree of IT security responsibility yet you complain when an OS alerts you to a request by an application for (or if you're a user, blocks you from providing) admin access, and say you just blindly accept, but then you complain when an application doesn't try and obtain admin access that you previously suggested should never be given to a user?

You haven't configured your network to limit what people can run and install, you've configured your network to only allow executables to work within the permissions defined for the currently active user account, Chrome is doing exactly that, thus the only problem is that how you've configured your network, isn't how you seem to beleive your network should be configured.

Safari has a long history of cookie problems

[MrLint]

IIRC the first 3 major versions of Safari on OS X totally ignored the setting for 'don't allow 3rd party cookies'. I had to file a bug that apple.com was setting these cookies w/ safari.

These assertions are really empty for me personally, since apple's site has partners that set these cookies, and apple's devs couldn't bother to implement this feature right.

And yes, my bitterness permeates everything:)

Re:haha

[crmarvin42]

How so?

My cookie settings were as described "only accept from sites I visit". Google tricks my browser into thinking I've visited a site I did not, in fact, visit. They do this by submitting a form and intentionally making in invisible to me. At what point did I "Opt in" to this behavior??

I'm not excusing Apple's complete security failure here, but how exactly is Google not also culpable for this violation of my trust?