Slashdot Mirror
Microsoft Accuses Google of Violating Internet Explorer's Privacy Settings
New submitter Dupple writes with a followup to Friday's news that Google was bypassing Safari's privacy settings. Now, Microsoft's Internet Explorer blog has a post accusing Google of doing the same thing (in a different way) to Internet Explorer. Quoting:
"By default, IE blocks third-party cookies unless the site presents a P3P Compact Policy Statement indicating how the site will use the cookie and that the site’s use does not include tracking the user. Google’s P3P policy causes Internet Explorer to accept Google’s cookies even though the policy does not state Google’s intent. P3P, an official recommendation of the W3C Web standards body, is a Web technology that all browsers and sites can support. Sites use P3P to describe how they intend to use cookies and user information. By supporting P3P, browsers can block or allow cookies to honor user privacy preferences with respect to the site’s stated intentions. ... Technically, Google utilizes a nuance in the P3P specification that has the effect of bypassing user preferences about cookies. The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter. Google sends a P3P policy that fails to inform the browser about Google’s use of cookies and user information. Google’s P3P policy is actually a statement that it is not a P3P policy."
In other words, if your server delivers a garbage or blank P3P header, the browser assumes there are no privacy implications? Sounds like a hole in the standard to me, such headers should be ignored IMO. Though Google really should have tested this properly with all browsers before deploying it in production it sounds to me like an oopsie, not at all like the Safari thing.
When I was configuring P3P for Mozilla/Firefox, it distinguished between what exactly the P3P policy was stating. If the site didn't say in the P3P policy what it was doing with cookies, Firefox assumed the worst. It seems to me that if the IE devs were dumb enough to stop after seeing a P3P policy presented and didn't bother checking what it said, or if they assumed a lack of a statement indicated respect for privacy, that's a failure in IE. The code needs to start out assuming personal information is collected and used without consent, and then upgrade only if the P3P header specifically says something better. It's not like that's hard to implement.
Then again, we've seen similar problems in Microsoft software time and time again: they assume the best (input's valid, doesn't contain special characters, etc.) until they detect otherwise, even though best practices say to do the opposite (assume input's invalid until analyzed and proven correct, list the known non-special characters and filter out or escape everything not in that list).
In IE iframes will block cookies if you don't have the right P3P policy. There where other bugs that would prevent your site's cookies from being read.
I've "faked" a P3P header just so users of certain IE browser versions could use my site.
At the end of the day the standard is a proposal and only MS thinks it's worth a hill of beans.
According to Google, there is no code in the P3P standard to accurately describe how Google uses cookies. [In such a case,] how should a website fill use the P3P header?
The article answers this question by quoting a section from the P3P spec:
Yeah, just build a secure OS and browser that doesn't allow people to use cookies as tracking cookies. Oh shit, the only way to do that would be to not support cookies at all. And holy crap, IE allows you to turn cookie support off.
You don't really understand the problem here, do you? It's a potential ethics violation by Google, not a technical violation. It's like if a company published inaccurate ingredients on a can of nuts, and you're bitching about shoddy can manufacturing.
If I can just reach out with my words and touch a butthole, just one, it will all be worth it.
Remember DoubleClick? The sleazy advertising company that everyone loved to hate? Remember when they merged with Abacus Direct, creating a merged company that would mine and combine everything from web cookies to physical addresses, names and phone numbers? Remember when this privacy issue was such an obvious risk that the FTC launched investigations into it? Or when they were widely categorized as malware purveyors, or when they were caught serving drive-by malware infections?
Remember when they merged with a search company, changed their name to Google and kept doing all the same things?
No? Thought not.
The problem is that, according to the standard, the browser should ignore any policy it cannot understand. Ignoring a policy means acting as if it wouldn't exist. If no policy exists, IE's behaviour with default settings is to not allow the cookie. Therefore by the standard, it shouldn't accept cookies when it doesn't understand the policy. If IE doesn't do that, it's the browser's fault.
The Tao of math: The numbers you can count are not the real numbers.
This whole P3P thing just sounds like the evil bit all over again.
How exactly is P3P supposed to protect users' privacy?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Google is offering up the tainted cookies, so it's a Google issue. IE is mishandling the cookies, so it's a Google issue, or so says MS. If either of them handled the standard correctly, there would be no issue. Neither follow it, so both have issues.
Learn to love Alaska
The problem with that line of thought is that it allows one person to dominate the discussion by shouting nonsense. If someone keeps saying un- and half-truths repeatedly, and you take the time to independently analyze the validity of what they say, you never have any time to consider the viewpoints of others or to form your own opinions.
It's much easier, and indeed human nature, to eventually decide that source doesn't contribute anything meaningful to the discussion, and ignore it entirely.
Examples:
a) Microsoft and anything about unfair trade practices (to some people)
b) 126.67.234.x and spam (to many spam filters, and I just made up that IP address range)
c) Political talking heads who fill various cable news channels 24/7
d) Boys who previously cried wolf
It doesn't hurt to be nice.