Slashdot Mirror
Microsoft Accuses Google of Violating Internet Explorer's Privacy Settings
New submitter Dupple writes with a followup to Friday's news that Google was bypassing Safari's privacy settings. Now, Microsoft's Internet Explorer blog has a post accusing Google of doing the same thing (in a different way) to Internet Explorer. Quoting:
"By default, IE blocks third-party cookies unless the site presents a P3P Compact Policy Statement indicating how the site will use the cookie and that the site’s use does not include tracking the user. Google’s P3P policy causes Internet Explorer to accept Google’s cookies even though the policy does not state Google’s intent. P3P, an official recommendation of the W3C Web standards body, is a Web technology that all browsers and sites can support. Sites use P3P to describe how they intend to use cookies and user information. By supporting P3P, browsers can block or allow cookies to honor user privacy preferences with respect to the site’s stated intentions. ... Technically, Google utilizes a nuance in the P3P specification that has the effect of bypassing user preferences about cookies. The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter. Google sends a P3P policy that fails to inform the browser about Google’s use of cookies and user information. Google’s P3P policy is actually a statement that it is not a P3P policy."
In other words, if your server delivers a garbage or blank P3P header, the browser assumes there are no privacy implications? Sounds like a hole in the standard to me, such headers should be ignored IMO. Though Google really should have tested this properly with all browsers before deploying it in production it sounds to me like an oopsie, not at all like the Safari thing.
Browser requires link to allow cookies, website provides link, browser allows cookies. Film at 11.
telling us that Charles Manson does bad things...
NOT!!!
And it's Google's fault, of course.
Sounds like you are asking the bad guys to cooperate with you. If you want to protect user privacy, do not allow sites to set arbitrary cookies, do not allow iframes to set or read cookies, and so forth. Does anyone really think that Google is going to voluntarily respect privacy, when their entire business is based on tracking people?
We have see proposal after proposal based on the idea that either users should be forced to opt-out of invasions of their privacy, or that the people who want to violate users' privacy will cooperate and not commit such violations. How about giving browsers some teeth, and creating browsers that actually protect user privacy without regard to advertiser profits?
Palm trees and 8
What does Bing do?
don't be a spelling loser
When I was configuring P3P for Mozilla/Firefox, it distinguished between what exactly the P3P policy was stating. If the site didn't say in the P3P policy what it was doing with cookies, Firefox assumed the worst. It seems to me that if the IE devs were dumb enough to stop after seeing a P3P policy presented and didn't bother checking what it said, or if they assumed a lack of a statement indicated respect for privacy, that's a failure in IE. The code needs to start out assuming personal information is collected and used without consent, and then upgrade only if the P3P header specifically says something better. It's not like that's hard to implement.
Then again, we've seen similar problems in Microsoft software time and time again: they assume the best (input's valid, doesn't contain special characters, etc.) until they detect otherwise, even though best practices say to do the opposite (assume input's invalid until analyzed and proven correct, list the known non-special characters and filter out or escape everything not in that list).
According to Google, there is no code in the P3P standard to accurately describe how Google uses cookies. In other words, they can't accurately describe it in standard P3P code.
I'm not trolling, I'm actually curious. If we assume that statement is accurate, how should a website fill use the P3P header?
In IE iframes will block cookies if you don't have the right P3P policy. There where other bugs that would prevent your site's cookies from being read.
I've "faked" a P3P header just so users of certain IE browser versions could use my site.
At the end of the day the standard is a proposal and only MS thinks it's worth a hill of beans.
According to Google, there is no code in the P3P standard to accurately describe how Google uses cookies. [In such a case,] how should a website fill use the P3P header?
The article answers this question by quoting a section from the P3P spec:
Just asking... I do not think we are talking about a tracking/advertising cookie here. I'm very certain google uses first-party cookies for tracking/advertising (meaning it's your site and not google that sets/owns the cookie). And first-party cookies needs no P3P. Or am I wrong?
Yeah, just build a secure OS and browser that doesn't allow people to use cookies as tracking cookies. Oh shit, the only way to do that would be to not support cookies at all. And holy crap, IE allows you to turn cookie support off.
You don't really understand the problem here, do you? It's a potential ethics violation by Google, not a technical violation. It's like if a company published inaccurate ingredients on a can of nuts, and you're bitching about shoddy can manufacturing.
If I can just reach out with my words and touch a butthole, just one, it will all be worth it.
Did we say evil? We mean Don't Get Caught.
Remember DoubleClick? The sleazy advertising company that everyone loved to hate? Remember when they merged with Abacus Direct, creating a merged company that would mine and combine everything from web cookies to physical addresses, names and phone numbers? Remember when this privacy issue was such an obvious risk that the FTC launched investigations into it? Or when they were widely categorized as malware purveyors, or when they were caught serving drive-by malware infections?
Remember when they merged with a search company, changed their name to Google and kept doing all the same things?
No? Thought not.
So, does running a truck through loopholes, bad specs, known bugs, etc.---when the intent is clear---constitute being evil?
The problem is that, according to the standard, the browser should ignore any policy it cannot understand. Ignoring a policy means acting as if it wouldn't exist. If no policy exists, IE's behaviour with default settings is to not allow the cookie. Therefore by the standard, it shouldn't accept cookies when it doesn't understand the policy. If IE doesn't do that, it's the browser's fault.
The Tao of math: The numbers you can count are not the real numbers.
This whole P3P thing just sounds like the evil bit all over again.
How exactly is P3P supposed to protect users' privacy?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
For some reason, they neglected to mention that Microsoft's own sites have also been found doing EXACTLY THE SAME THING. Weird.
Google is offering up the tainted cookies, so it's a Google issue. IE is mishandling the cookies, so it's a Google issue, or so says MS. If either of them handled the standard correctly, there would be no issue. Neither follow it, so both have issues.
Learn to love Alaska
I'm with you on this one - well, partially at least. The problem is that the spec doesn't really plan for a site saying "We don't want to tell you that we do lots of stuff that may or may not be parseable in this header, so here's some text plus a URL for the browser to not show". Microsoft should definitely have assumed the worst case scenario for PII use, not the best case.
Now I'll agree that the URL is valid - but it's completely useless because no browser on earth actually shows that info. The engineer who decided the compact policy reference should be JUST the URL because the other parts of the spec aren't perfect deliberately chose to obfuscate Google's information use, just as much as Microsoft chose not to show the P3P URL to users (except when it's buried in the UI - I haven't seen it ever work).
Let's also not forget that Google chose not to make the XML version available to the browser for evaluation - so there's a second deliberate avoidance of any machine-readable information. And the fact that it's twice avoided is the red flag to me.
>Google’s P3P policy is actually a statement that it is not a P3P policy.
As Rene Magritte would say: "Ceci n'est pas une politique P3P."
If what you say is right, why would Google release a do not track extension for Chrome?
Two possible answers:
1) Google knows only a handful of people will download and install such things anyway, leaving the general population easily tracked.
2) You know they Google does not track you even with the extension installed how again? Preventing anyone BUT Google from tracking you is quite the competitive advantage.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
That's very surreal, Google.
René Magritte would approve.
Welcome to the Panopticon. Used to be a prison, now it's your home.
Never mind the protocol failure. If I'm reading this right, and it is right, then it seems the real problem is the W3C is attempting to create a standard designed to make web browsers accept third party cookies even though the user sets the browser to not accept any third party cookies. Now we'll need a setting to not accept third party cookies and another setting to really not accept third party cookies.
Comment removed based on user account deletion
Once or twice is a mistake, but google have been doing "evil" things repeatedly for a while now. I'm moving my stuff to iCloud (don't laugh). As a paid service (with mac purchase, subscription for additional data, etc) the payment is not my privacy.
Blaming it on the browser is a cop out. if you're NOT evil, you wouldn't exploit it. I'm sure if the shoe was on the other foot (and someone was exploiting say, a hole in google's network to steal trade secrets) google would be mighty pissed.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
No. According to the standard, the browser should ignore any policy _statement_ it doesn't understand. That's very different from what you said, because a _policy_ is a list of statements indicating what the cookies are used for. A policy containing no statements is the way for a site to use P3P to say "we don't use the cookies for anything".
So the the standard requires that a policy with only invalid statements be treated like a policy with no statements at all, which is the "these cookies are not used for anything" policy.
You can argue that that's a dumb standard (and I would agree), but IE is in fact implementing it correctly as far as I can tell. And Google is purposefully abusing the standard, again as far as I can tell.
Everyone seems to be getting all het-up about Google abusing trust, being deceptive, yada yada... But it's a fact: Google get headlines worldwide.
In a world of clouds, +1s, and Likes, people want to circumvent the 2001 P3P objectives because that's how they want the web to work in 2012. So if IE is quietly ignoring P3P for Google, what other unknown, untrusted, and non-headline-grabbing sites might have been doing the same thing for the last 10 years? It seems other browsers ignore P3P as pointless, but not IE.
It may be that by Google risking a minor PR hit, they might encourage Microsoft to drop the charade of P3P protection, and just maybe get enough people interested in pursuing a real solution.
With each breath in, a flower somewhere opens; with each breath out, a flower withers away. In between lies beauty.
People don't mind the advertising so much - it's the tracking that bugs us the most. The all-prevasive, obsessive-cumpulsive, privacy-invading stalking behavioural tracking ...
Just like we don't mind ads on TV - we either watch them, channel surf, or go do a couple minutes worth of housework, but if TV ads watched us back, we'd find that unacceptable as well.
Cookies to preserve state in client-server web apps == good. Cookies to track peoples behaviour == bad. Cross-site cookies == bad by definition.
Let's call it what it is, Anti-Social Media.
So can not Microsoft patch P3P in IE to identify these work arounds or simply reject Google cookies?
This sig has been distributed under the Creative Commons license.
Let me guess. This is how IE code looks like
[...] /* NEVER GOING TO HAPPEN!!111one */ }
SecuritySettings s= new SecuritySettings();
try {
s.allowCookied= true;
parseP3P(header, s);
} catch (Exception e) {
[...]
Freetards - alive and well, and now with twice the stupidity.
Re: TV - over-modulated ads haven't been much of a problem since BEFORE the regulations requiring normalization of sound - unless you bought a cheap set that didn't have auto volume control. As for the length of time of TV ads, I prefer a 3-minute block of ads - it lets me put away the dishes or fold some laundry or make the bed or any one of a number of things that need to be done.
Re: Radio - if you don't like the ads on it, again, the technical solution is to carry your own music, audiobooks, etc.
Re: Streaming video: so pay to stream stuff ad-free (oh wait, you want it for nothing)
Re: Websites: So go elsewhere. Start your own. Go into the big blue room and take a break. Relax.
Re: Electronic billboards: Get a better-shielded radio, duh! Or some duct tape and tin foil ...
Re: Email: so what's the problem again, since you don't use webmail or html mail? Oh right, there isn't one, you just want to complain.
Re: Search engines: So instead of using them, just bookmark the damn site once and be done with it. Is it *that* hard? Or create your own. It's not that hard to write a crawler. It's even easier to pay someone else to, if you can't. Just put your money where your mouth is.
Let's call it what it is, Anti-Social Media.
The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter.
Just as you shouldn't configure a firewall to allow incoming traffic to private computers on unknown (unassigned port numbers); default accept, the P3P specification's choice of "default accept" for unknown policy tokens is a very poor one.
It's not Google's fault that the spec is defunct and permissive.