Slashdot Mirror
Microsoft Accuses Google of Violating Internet Explorer's Privacy Settings
New submitter Dupple writes with a followup to Friday's news that Google was bypassing Safari's privacy settings. Now, Microsoft's Internet Explorer blog has a post accusing Google of doing the same thing (in a different way) to Internet Explorer. Quoting:
"By default, IE blocks third-party cookies unless the site presents a P3P Compact Policy Statement indicating how the site will use the cookie and that the site’s use does not include tracking the user. Google’s P3P policy causes Internet Explorer to accept Google’s cookies even though the policy does not state Google’s intent. P3P, an official recommendation of the W3C Web standards body, is a Web technology that all browsers and sites can support. Sites use P3P to describe how they intend to use cookies and user information. By supporting P3P, browsers can block or allow cookies to honor user privacy preferences with respect to the site’s stated intentions. ... Technically, Google utilizes a nuance in the P3P specification that has the effect of bypassing user preferences about cookies. The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter. Google sends a P3P policy that fails to inform the browser about Google’s use of cookies and user information. Google’s P3P policy is actually a statement that it is not a P3P policy."
In other words, if your server delivers a garbage or blank P3P header, the browser assumes there are no privacy implications? Sounds like a hole in the standard to me, such headers should be ignored IMO. Though Google really should have tested this properly with all browsers before deploying it in production it sounds to me like an oopsie, not at all like the Safari thing.
Browser requires link to allow cookies, website provides link, browser allows cookies. Film at 11.
telling us that Charles Manson does bad things...
NOT!!!
And it's Google's fault, of course.
if a website (including google) can bend your browser over and sodomize it then they will, so instead of crying about a website violating some rule of conduct just build a secure operating system & browser that can not be taken advantage of (since they are supposed to be integrated and inseparable)
Politics is Treachery, Religion is Brainwashing
Sounds like you are asking the bad guys to cooperate with you. If you want to protect user privacy, do not allow sites to set arbitrary cookies, do not allow iframes to set or read cookies, and so forth. Does anyone really think that Google is going to voluntarily respect privacy, when their entire business is based on tracking people?
We have see proposal after proposal based on the idea that either users should be forced to opt-out of invasions of their privacy, or that the people who want to violate users' privacy will cooperate and not commit such violations. How about giving browsers some teeth, and creating browsers that actually protect user privacy without regard to advertiser profits?
Palm trees and 8
What does Bing do?
don't be a spelling loser
When I was configuring P3P for Mozilla/Firefox, it distinguished between what exactly the P3P policy was stating. If the site didn't say in the P3P policy what it was doing with cookies, Firefox assumed the worst. It seems to me that if the IE devs were dumb enough to stop after seeing a P3P policy presented and didn't bother checking what it said, or if they assumed a lack of a statement indicated respect for privacy, that's a failure in IE. The code needs to start out assuming personal information is collected and used without consent, and then upgrade only if the P3P header specifically says something better. It's not like that's hard to implement.
Then again, we've seen similar problems in Microsoft software time and time again: they assume the best (input's valid, doesn't contain special characters, etc.) until they detect otherwise, even though best practices say to do the opposite (assume input's invalid until analyzed and proven correct, list the known non-special characters and filter out or escape everything not in that list).
According to Google, there is no code in the P3P standard to accurately describe how Google uses cookies. In other words, they can't accurately describe it in standard P3P code.
I'm not trolling, I'm actually curious. If we assume that statement is accurate, how should a website fill use the P3P header?
In IE iframes will block cookies if you don't have the right P3P policy. There where other bugs that would prevent your site's cookies from being read.
I've "faked" a P3P header just so users of certain IE browser versions could use my site.
At the end of the day the standard is a proposal and only MS thinks it's worth a hill of beans.
According to Google, there is no code in the P3P standard to accurately describe how Google uses cookies. [In such a case,] how should a website fill use the P3P header?
The article answers this question by quoting a section from the P3P spec:
Just asking... I do not think we are talking about a tracking/advertising cookie here. I'm very certain google uses first-party cookies for tracking/advertising (meaning it's your site and not google that sets/owns the cookie). And first-party cookies needs no P3P. Or am I wrong?
How is this a Google issue and not an IE issue?
If a site offers a tainted cookie, isn't it the responsibility of the browser to reject it? How exactly is a browser "tricked" into accepting it?
Did we say evil? We mean Don't Get Caught.
Remember DoubleClick? The sleazy advertising company that everyone loved to hate? Remember when they merged with Abacus Direct, creating a merged company that would mine and combine everything from web cookies to physical addresses, names and phone numbers? Remember when this privacy issue was such an obvious risk that the FTC launched investigations into it? Or when they were widely categorized as malware purveyors, or when they were caught serving drive-by malware infections?
Remember when they merged with a search company, changed their name to Google and kept doing all the same things?
No? Thought not.
So, does running a truck through loopholes, bad specs, known bugs, etc.---when the intent is clear---constitute being evil?
Google bad....Bing good. And so goes the bullshit from Redmond, read this bullshit however you wish it is just continuation of the already advanced "screw Google" campaign... http://www.dailyfinance.com/2009/08/28/microsofts-secret-screw-google-meetings-in-d-c/ which unfortunately has now become a daily post item essential on Slashdot. Until the Microsoft shills are stopped from posting shit like this on Slashdot the only reason I come here is to see how much damage they have done to a once very relevant tech forum.
This whole P3P thing just sounds like the evil bit all over again.
How exactly is P3P supposed to protect users' privacy?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Google honor the DNT header? I've got javascript and meta redirects disabled and it's really irritating when google start redirecting their search results to track clicks.
It's really time that tracking, cookies, online advertising became opt-in instead of opt-out. I block EVERYTHING by default now and have for some months. I started off with just Adblock Plus, but that wasn't good enough. Then I added a very aggressive hosts file with over 300k entries. Still not good enough. It seems there are new tracking mechanism being put in place almost daily. Basically I have to whitelist content and sites I want to see because of the absolute cesspool of Internet monetization out there. Ghostery doesn't cover nearly enough bad stuff. Basicaly I want websites down to the bare metal and I've pretty much got it down to a science now, but it took awhile and the right combination of tools and command line tricks to get this far.
I refuse to see any online ads, get tracked, and allow websites to use me for profit when I am not allowed to realize any of that profit myself. No thanks. I block all social media "like" buttons and scripts because they track you even when you do not have a profile with the respective service. It's getting ridiculous and I know I'm not the only one angry over this stuff. I already pay to use the Internet so my bandwidth and eyeballs are mine. It's surprising just how quick sites load without all the useless, evil dreck.
What muppets still use IE anyway? :s
For some reason, they neglected to mention that Microsoft's own sites have also been found doing EXACTLY THE SAME THING. Weird.
Any word from, or about, Mozilla and Opera yet?
>Google’s P3P policy is actually a statement that it is not a P3P policy.
As Rene Magritte would say: "Ceci n'est pas une politique P3P."
If what you say is right, why would Google release a do not track extension for Chrome?
Two possible answers:
1) Google knows only a handful of people will download and install such things anyway, leaving the general population easily tracked.
2) You know they Google does not track you even with the extension installed how again? Preventing anyone BUT Google from tracking you is quite the competitive advantage.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
That's very surreal, Google.
René Magritte would approve.
Welcome to the Panopticon. Used to be a prison, now it's your home.
Never mind the protocol failure. If I'm reading this right, and it is right, then it seems the real problem is the W3C is attempting to create a standard designed to make web browsers accept third party cookies even though the user sets the browser to not accept any third party cookies. Now we'll need a setting to not accept third party cookies and another setting to really not accept third party cookies.
Flash Player plugins fail in privacy, also. They do NOT retain my user settings (Either in IE of Firefox)-- no storage of anything on my PC! So every Flash video page think it can set a flash cookie. Adobe's Fault?
You know things have gotten bad when Microsoft are the good guys.
Hitler hates pedophiles.
Facebook does exactly the same thing:
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
If IE is doing anything based on these bogus headers, that's Microsoft's own fault.
Comment removed based on user account deletion
Once or twice is a mistake, but google have been doing "evil" things repeatedly for a while now. I'm moving my stuff to iCloud (don't laugh). As a paid service (with mac purchase, subscription for additional data, etc) the payment is not my privacy.
Blaming it on the browser is a cop out. if you're NOT evil, you wouldn't exploit it. I'm sure if the shoe was on the other foot (and someone was exploiting say, a hole in google's network to steal trade secrets) google would be mighty pissed.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
oo is a spying man in the middle attacking deception of a front corporation sucking all the big toes yumm yumm why is any one surprised over this seemingly docile misuse of aMerican citizens basic right to the pursuit of happiness and this fucknut spy bunch is shredding it right before the world's eyes
what rules do we put into squid to block p3p policies everywhere?
can the files be named anything and in any directory?
or do p3p come in iframes?
toss a brutha a bone here.
Everyone seems to be getting all het-up about Google abusing trust, being deceptive, yada yada... But it's a fact: Google get headlines worldwide.
In a world of clouds, +1s, and Likes, people want to circumvent the 2001 P3P objectives because that's how they want the web to work in 2012. So if IE is quietly ignoring P3P for Google, what other unknown, untrusted, and non-headline-grabbing sites might have been doing the same thing for the last 10 years? It seems other browsers ignore P3P as pointless, but not IE.
It may be that by Google risking a minor PR hit, they might encourage Microsoft to drop the charade of P3P protection, and just maybe get enough people interested in pursuing a real solution.
With each breath in, a flower somewhere opens; with each breath out, a flower withers away. In between lies beauty.
So can not Microsoft patch P3P in IE to identify these work arounds or simply reject Google cookies?
This sig has been distributed under the Creative Commons license.
Let me guess. This is how IE code looks like
[...] /* NEVER GOING TO HAPPEN!!111one */ }
SecuritySettings s= new SecuritySettings();
try {
s.allowCookied= true;
parseP3P(header, s);
} catch (Exception e) {
[...]
As I just posted on their blog
This is just a case of Microsoft being incompetent and blaming the competition for their mistakes. I find this post to be nothing but a defamatory post in shameless self-promotion of Microsoft's anti-tracking cookie technology - put in place to address the security shortcomings of their own browser product.
Did any of the IE team actually read the P3P specifications?. Googles Compact Policy, while it does not adhere to the required machine readable vocabulary, does not make any false or misleading statements whatsoever. There is no valid CP vocabulary in this string at all and therefore should be treated as such, invalid or non-existant.
I would like to also quote from the document under the same section:
"3.2.2 The POLICY element
The POLICY element contains a complete P3P policy. Each P3P policy MUST contain exactly one POLICY element. The policy element MUST contain an ENTITY element that identifies the legal entity making the representation of the privacy practices contained in the policy. In addition, the policy element MUST contain an ACCESS element and one or more STATEMENT elements.It SHOULD contain a DISPUTES-GROUP element. It may contain a P3P data schema and one or more extensions."
As there are no valid ACCESS or STATEMENT (That would be COMPACT-ACCESS, and COMPACT STATEMENT) elements in valid Compact Policy vocabulary as required above, I back up my argument that it is Internet Explorer itself that does not correctly conform to the aforementioned standards.
It seems that w3's own validator tool would also agree with me:
http://validator.w3.org/p3p/20020128/p3p.pl?uri=http%3A%2F%2Fwww.google.com
my question, how does a webpage override a program that's actually on your computer? it doesn't seem like rocket science to me. i only know a tad about mirc scripting, and and-if-else pops into my head. the way it sounds, safari and internet exploder want to make the internet comply to them. whereas they should actually do what they advertize. the worlds worst browser doesn't have much of a leg to stand on, i'm not sure where safari falls into this. but if the browsers were truly secure, there shouldn't be a prob. i am not a fan of google. i do not agree with that blasted google anylitics (sp) everywhere. if you click secure, it should be somewhat secure, not spark a lawsuit because they don't want to do actual programming. it really seems like they want the image of being secure, but do not actually want it to be. like most things. laptop encryption is in court atm, what about smart phone encryption? also, wanting to be secure is on the list of the fbis 'you could be a terrorist if...' statement. they only want it to look like its secure, not actually be secure.
The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter.
Just as you shouldn't configure a firewall to allow incoming traffic to private computers on unknown (unassigned port numbers); default accept, the P3P specification's choice of "default accept" for unknown policy tokens is a very poor one.
It's not Google's fault that the spec is defunct and permissive.