Google: IE Privacy Policy Is Impractical

itwbennett writes "In response to Microsoft's claim that Google circumvented Internet Explorer privacy protections (following the discovery that Google also worked around Safari's privacy settings), Google on Monday said that IE's privacy protection, called P3P, is impractical to comply with."

Comments

Impractical to who?

[scruffy]

I suppose privacy is impractical to those who want to sell our personal information.

Re:Impractical to who?

[badness]

When has Google ever stated, or even indicated, that as a goal? They serve personalized ads, but the data they use to do so never leaves their own servers.

Re:Impractical to who?

[WolfgangPG]

Why would it need to leave their servers when they are a marketing company? They are selling our demographic information to advertisers.

Re:Impractical to who?

[Anonymous Coward]

actually, they would be quite stupid to sell ... because when I consider how much time I spend with google services compared to anything else, they must know about five times as much about me as the next best competitor ... so selling stuff that helps their competition would be really not a good idea ;)

Re:Impractical to who?

[0123456]

Impractical to those who want to spy on everything users do, anyway.

Re:Impractical to who?

[Anonymous Coward]

"but the data they use to do so never leaves their own servers."

I guess you believe everything you hear/read....

Re:Impractical to who?

[alphatel]

Why would the need to sell our demographic information to advertisers? They are a company that offers free profile pages to plus one enthusiasts.

Re:Impractical to who?

[egamma]

"but the data they use to do so never leaves their own servers."

I guess you believe everything you hear/read....

Why would the data leave their servers? They don't need to sell the information to advertisers--they simply tell advertisers, "We know everything about everyone. We will put your ad in front of the 1 million people most likely to respond. You don't need us to sell their information to you--they will provide it when they buy your product."

Re:Impractical to who?

[Anonymous Coward]

How do think the Google assholes make money, by selling Boy Scout cookies?

Re:Impractical to who?

[CimmerianX]

The data never needs to leave their servers. They sell access to their servers so companies can run queries against the data. The 'Results of the query' go with the company. Never the data.

Re:Impractical to who?

[Anonymous Coward]

Dude - get your monopolies straight! It's Girl Scouts with the cookies, Boy Scouts with the popcorn, and Congress with the assholes!

It's that last one which doesn't leave many unfilled niches for world dominating companies like Google.

Re:Impractical to who?

[bhcompy]

That's for internet advertising. Google does no print advertising, which loads every mailbox in the nation with tons of shit. Considering the amount of people that use their real names, you don't think they'll sell all that data they collect on you to print advertisers for targeted mailing?

Re:Impractical to who?

[Inconexo]

That doesn't give them the right to bypass other privacy policies. Cool that they earn money, but wrong if they do it with bad praxis.

Re:Impractical to who?

[postbigbang]

...never leaves their own servers.

I have great assurances that Google cannot be hacked, and that their contractors and affiliates use the excellent resources and high standards of Fleishman Hillard to protect data integrity from all possible hacking and cracking attempts.

Re:Impractical to who?

[darkpixel2k]

That's for internet advertising. Google does no print advertising, which loads every mailbox in the nation with tons of shit. Considering the amount of people that use their real names, you don't think they'll sell all that data they collect on you to print advertisers for targeted mailing?

What's a mailbox? I don't have a single bill that shows up in my mailbox. It's all paid online. Anything that shows up in the USPS box just gets chucked into the burn barrel. (Unless it's a package shipped by one of the few companies that charges $1 to ship via USPS from clear across the US--but that's rare.)

To save myself time, I've been thinking about replacing my mailbox with an always-on burn barrel--maybe using a propane barbecue bottle to supply it. Maybe the USPS would finally get the hint. Anything 'important' needs a signature and the mail carrier knocks on the door.

Re:Impractical to who?

[Anonymous Coward]

You assume their downstream buyers are corporate rather than governmental. I bet there's 200+ nations willing to buy the extremely targetted data mining google has available on citizens around the world, and I'll bet despite their motto they're giving it up like a cheerleader on prom night.

Re:Impractical to who?

[gorzek]

Selling that demographic information is how they provide all the free services they do. Their ability to target ads effectively is what makes them attractive to advertisers.

I get that Slashdotters are deeply paranoid about anyone knowing anything about them, but at the same time, you aren't entitled to free services like those that Google provides. If you really don't want anything to do with Google, modify your hosts file so all requests to *.google.com (and related domains) are sent nowhere. That's "voting with your wallet," so to speak.

But I can't say I have much patience for people who want to use Google's services and then complain about Google using the information they gather about you as part of their advertising system. There's room to argue about what they should or shouldn't be allowed to do with it, but to presume they shouldn't have any information about you at all is a bit silly.

Re:Impractical to who?

[bhcompy]

And how is that any different from a spam folder on Gmail, Yahoo, Hotmail, etc? Or using Adblock? Or any other measure that accomplishes the same thing?

Re:Impractical to who?

[Anonymous Coward]

I thought about that, too, until I got a jury duty notice last year. I almost threw it away since it looked like so much junk mail (seriously, I've been getting free loan offers that are disguised to look like official government documents lately that are from local car dealers mostly).

Re:Impractical to who?

[Anonymous Coward]

I thought about that, too, until I got a jury duty notice last year. I almost threw it away since it looked like so much junk mail (seriously, I've been getting free loan offers that are disguised to look like official government documents lately that are from local car dealers mostly).

I'm sorry--you said someone stole the jury duty notice out of your mailbox? That sucks. How can they 'convict' you of violating your notice when they can't prove you received it in the first place. There is an official process for summoning people to legal proceedings that requires personal contact, verifying identity, and an oath--you know, in case the person who says they handed you the paperwork is lying (because they can be charged with perjury). I have frequent mail theft in my area which I stopped for about a week by putting in a lockable mailbox. It was then promptly bashed open with a baseball bat. If it's something important, it needs to be signed for. (Of course you can get out of Jury duty in most states by ditching your drivers license or voter registration card. That's where 'the list' comes from. If you can't drive--how can you get to jury duty? If you don't vote, how are you a 'peer' citizen in The United States?)

Re:Impractical to who?

[Anonymous Coward]

Keeping your mouth shut regarding aspects of a service which do not value is silly.

"I would value your service more if you respected my privacy," seems like fairly reasonable feedback.

But I can't say I have much patience for people who want to refer to cooperative dissent as silly.

Re:Impractical to who?

[gorzek]

But the person I responded to wasn't even expressing a specific concern about privacy. They were concerned about "selling our demographic information to advertisers." Whether Google sells the information directly or merely sells tools that rely upon it, this is how Google makes their money. Since when did the definition of "privacy" extend to "aggregate data that may or may not represent characteristics of myself within the statistics"?

Re:Impractical to who?

[honkycat]

Are we entitled to something for nothing? No, of course not.

However, it doesn't follow that Google is therefore entitled to disregard an unambiguous request from a user not to collect personal data. If they feel that a user is granting them too little information in exchange for their service, they are free to deny that user access. Making an end run around security settings is sleazy, no matter how you dice it.

I'd have a lot more sympathy for Google if the first story to break was this public complaint, together with a statement of how they were working around it and a warning to affected users that their privacy settings were being circumvented. To make a statement like this /after/ being caught with their corporate hand in the proverbial cookie jar doesn't make a very good defense.

Re:Impractical to who?

[darkpixel2k]

And how is that any different from a spam folder on Gmail, Yahoo, Hotmail, etc? Or using Adblock? Or any other measure that accomplishes the same thing?

I didn't imply it was different. I ignore both equally. You seemed to be implying that loading every mailbox in the nation with 'tons of shit' was a bad thing. Not if you ignore it.

Re:Impractical to who?

[gorzek]

If you don't like what Google does with your information, do not use their services and therefore avoid providing any information at all.

I agree that Google has every right to block access to people who don't allow Google to collect the information they want. That's the price you pay for their services, after all.

I think that's entirely separate from Google working around IE's security settings, which I agree is pretty fucking shady and not something they have any right to do.

Re:Impractical to who?

[bhcompy]

You seem to be implying that ignoring it means that my original statement doesn't/can't/won't happen. I never said it was bad, just substituted spam with shit. See no evil, eh?

Re:Impractical to who?

[darkpixel2k]

You seem to be implying that ignoring it means that my original statement doesn't/can't/won't happen. I never said it was bad, just substituted spam with shit. See no evil, eh?

I prefer 'hear no evil', that's why I read Slashdot. ;)

Re:Impractical to who?

[StuartHankins]

modify your hosts file

Oh no!!! You have summoned APK!!!

Re:Impractical to who?

[noh8rz2]

Yes, this is the best approach. An explicit opt in - to gain access to this service, you need to give us access to you rbrowsing habits by logging into an account / accepting cookies or whatever. I both this case and safari, google is making an end run around privacy choices that users have made, ie the choice to block third party cookies, and stealing user info anyways. Yes, when the door is locked and you crawl down a chimney, then take something that the owner didn't want you to have, it's stealing.

Re:Impractical to who?

[Anonymous Coward]

It's a pity they've been pwn3d by the Chinese government, twice. They also hire irresponsible assholes from time to time.

Re:Impractical to who?

[madmark1]

Yes, it probably is. Except Google doesn't sell personal information at all. They sell aggregated information, and more specifically, targeted ads based on aggregate information, and targeted ads based on personal information they hold. At no point is that data sold to others.

I'm still trying to figure out how a broken implementation of P3P in IE is Google's fault. Of course, I'm also still trying to figure out why basing your 'privacy protection' on a system that was deprecated almost 5 years ago is considered privacy protection at all, no matter who tries to get around it. I'm also a little confused about how using that mechanism to provide their own customers with targeted ads they specifically opted in to is invading anyone's privacy at all, no matter what they did to get the information there.

Re:Impractical to who?

[TheGoodNamesWereGone]

I never thought I'd be cheering Microsoft until now. That said, they aren't any better. What happened to "Don't be evil"?

Re:Impractical to who?

[mcgrew]

Your grandma never sends you a birthday card with a check in it? Personally I'd rather pay for the fifty cent stamp than the buck fifty fee to pay my gas bill online.

But I agree, snail junk mail is worthless. But you (and I, even if I do still use the USPO) aren't normal people. We're nerds. Most people actually do still use the mail, or the Springfield Advertiser would have gone out of business long ago.

Re:Impractical to who?

[madmark1]

No, they aren't. In the Safari case, the default setting in Safari is to block third party cookies. No one made that choice, unless it was to go in and unblock them. Seeing as how Safari is the only browser that blocks them by default, most people probably don't even realize they ARE blocked. And in this specific case, the 'work-around' was to provide tracking cookies to people logged in to G+ who specifically opted in to targeted ads. How this can possibly be spun into Google doing evil is really amazing to me. They did exactly what their customers asked for, and got thrashed for it. Lets not forget also that the cookies in question were non-specific, and had no personally identifiable information in them. Did anyone even read the article on that?

In the IE case, Microsoft is relying on an optional, trust based system deprecated 5 years ago as a method of protecting your privacy. Once again, Google used a perfectly legitimate part of that standard to bypass it, for the express purpose of giving users who were logged in to G+ and opted in to targeted ads, those targeted ads. Explain the evil here, if you would?

Re:Impractical to who?

[darkpixel2k]

Your grandma never sends you a birthday card with a check in it?

Not since I was 12ish and she was alive you insensitive clod! ;)

If she were alive and sending me checks, it'd be a small price to pay for not having to sort through the 5 metric tons of junk mail that comes in every year. Or I could just start paying attention on my birthday.

Personally I'd rather pay for the fifty cent stamp than the buck fifty fee to pay my gas bill online.

But I agree, snail junk mail is worthless. But you (and I, even if I do still use the USPO) aren't normal people. We're nerds. Most people actually do still use the mail, or the Springfield Advertiser would have gone out of business long ago.

$1.50? Time to find a small credit union.

Re:Impractical to who?

[fotbr]

The fee is probably not from his bank. My gas company charges a $2 "convenience fee" for paying online, and closer to $5 for the paying by phone. The electric company adds an additional > $5 for paying online.

Re:Impractical to who?

[bickerdyke]

Opposed to selling personal data (what would be the exact opposite) I'm fine with that.

The advertiser doesn't need to know that I saw the ad. He only needs to know that so many people of my demographics saw it.

Re:Impractical to who?

[bickerdyke]

They make money by having and mining that data. they'd be stupid if they gave it away!

Re:Impractical to who?

[noh8rz2]

First off, I chose to set/keep my Safari settings to block third party cookies, so Google went around my express privacy choices. I'm still waiting for my apology.

Second off, what does non-PII even mean in this context, or on the internet at all anymore? They add a cookie that links your computer behavior to your google account. Advertisers track your behavior against the body of data already collected on you. Isn't that how all tracking works? How is this different than any other tracking?

Third, you say Safari users weren't savvy enough to know that they had blocked cookies in the preferences, but were savvy enough to know that by signing into google they "opted in to targeted ads." Nope, you have to choose one or the other. Most people are likely clueless about their browser settings AND their google tracking settings. How is Google clearly right on this, and Safari clearly wrong?

Lastly, I laugh at your justification for the IE thing. If Google chose to abuse the trust based system, it's not their fault?

I hope you own google stock, because if you're just a fanboi with no monetary benefit, then it's especially sad.

Re:Impractical to who?

[Anonymous Coward]

The evil part: Ignoring the perfectly legitimate part of the standard that says you must not lie.

Also, it's old, but saying it's "deprecated" is poisoning the well.

Re:Impractical to who?

[Col. Klink (retired)]

Wait, you're cheering for the company that told google (and some 11,000 other websites) how to work around their broken P3P implementation?

The 2010 research paper "discovered that Microsoft's support website recommends the use of invalid CPs (codes) as a work-around for a problem in IE." This recommendation was a major reason that many of the 11,176 websites provided different code to the one requested by Microsoft.

Re:Impractical to who?

[madmark1]

I like it, anyone who has a valid argument must be a 'fanboi' because you can't figure out the logic.

If you were not signed in to G+, and hadn't opted in to targeted ads, then no, Google did not go around your express privacy choices. See how it works, genius? If you weren't opted in, then you got no cookie, put there against your wishes or not. Why is that so hard to figure out?

Second, the IE thing, it is a trust based system that was deprecated 5 years ago, and only implemented by IE anyway. Why is Google wrong for not paying attention to a lapsed system? And again, it was done to allow people who had opted in to get exactly what they asked for, so where is the privacy problem? If you weren't a G+ member, and didn't opt in to ads, then you didn't get a damn cookie, they didn't 'exploit' anything, and you have no horse in this race at all.

I'm still waiting for someone to explain to me how bypassing ANYTHING to allow users what they opted in to once already, but were blocked by specific browser implementations from getting, is wrong or evil?

Regardless of whether the users were savvy enough to know they opted in to ads or not is a separate question, and really has no bearing whatsoever on whether they opted in or not. If they left it at the default,but signed in to G+, they are getting targeted ads. If they didn't read the agreement, that is hardly Google's fault, no? Nor is it their fault if they provide those ads. They can opt out at any time, and the 'privacy violations' stop. It really is that simple.

No, I don't own Google stock, nor Apple, nor Microsoft. I believe ALL corporations are amoral and not to be trusted. I just believe we should be mad at them for the things they actually do, rather than manufacturing bullshit anger over something that doesn't even exist. They do enough bad on their own, we don't have to go looking for BS reasons to be pissed. I also happen to dislike misinformation, no matter who it's directed toward. If you couldn't bother to read about the issue, why are you even commenting? To show how little you know?

Re:Impractical to who?

[noh8rz2]

Let me make a car analogy to simplify it for you. My car is configured to automatically lock when parked (like safari, default cookie setting, see?). At the same time, I signed up for google's informational flyer service, where they put a map in my car with stores I might be interested in, and also throws I an few ad flyers. But there,s a conflict, right? I asked google to put shit in my car, but my car locks by default. Obviously, the correct resolution is for google to respect my locked car, but yu're telling me that it is correct for google to break in to leave me the flyers even though I don't want anybody to go in my car. Do you understand how wack that is? Now that I,ve laid it out for you using small words, please admit that you were wrong.

Re:Impractical to who?

[cheater512]

When the starting value is $0, Google doesn't really care if you'd prefer things differently.

Now if you paid $1 per search they most certainly would listen to your feedback and try and 'increase the value to you'.

Re:Impractical to who?

[Vokkyt]

If you were not signed in to G+, and hadn't opted in to targeted ads, then no, Google did not go around your express privacy choices. See how it works, genius? If you weren't opted in, then you got no cookie, put there against your wishes or not. Why is that so hard to figure out?

I kind of get what you're saying here, but that's really weak justification for functions that are difficult to claim that a user consciously opted in or out of. Analogies aside (since there will be no little black dress of an analogy for this), what it comes down to is should Google respect the browser security settings? Whether or not it is part of theToS ( and Privacy), Google is still using a work around to circumvent the security settings determined by the user's browser. As was noted by one of the above posters, I don't think you can have the unread Google policies apply while the unchecked security policies do not, and even if were so, no part of the agreement as listed on their ToS suggests that you offer permission to circumvent your security policy to do so.

IANAL (as all posts should be prefaced), but per Google's own Terms of Service, they should not do anything or discontinue service until you meet the necessary requirements. On top of that, the "you opt in when you use Google's Services" idea, that the cookie is of benefit to the user not detriment, is also not justification for making this a universal process. Perhaps someone really does want the ad services, but another may not. The work around seems to affect both users in that instance, regardless of their stance.

Re:Impractical to who?

[madmark1]

Now let's try an analogy that actually fits the situation. You signed up for Google's flier service, expecting to get your fliers. You didn't realize that your car locked itself by default, when no other car does that, and want to know why you aren't getting your fliers. Google decides to avoid the locked car, and puts the flier under your windshield wiper instead. They then get blasted for not accepting that your car was locked.

Re:Impractical to who?

[madmark1]

And I understand what you are saying, but since I have to actively accept Google's terms of service, and yet don't know without searching that IE attempts to block cookies via P3P headers, the active choice is by the consumer, whether they read the agreement or not. Having to accept terms is NOT the same as accepting a default you didn't even know existed. Every single user had to click yes to accept those terms, and I would bet 99% of them have no idea IE was using something called P3P.

Re:Impractical to who?

[Anonymous Coward]

The flyer analogy doesn't work at all: they're easy to detect and remove. They're adding Mission Impossible tracking devices to your car. Your car has a sticker on it saying "no Mission Impossible tracking devices, please, only tracking devices from the surplus store". The garage security comes over to challenge Google about whether it's a Mission Impossible tracking device, but Google changes the subject.

Re:Impractical to who?

[honkycat]

As I hinted at above, "not evil" would be at least making it clear that you are taking steps to circumvent a privacy control prior to being called out for doing so.

Is there a technical need to take the steps they took other than to make their tracking work when the browser settings interfere? If so, they should have (and I'm sure would have) apologized for the oversight and corrected it. If not, then sorry, the "not evil" thing to do is to ask the user to change the setting. If it's deprecated, there's no reason they shouldn't turn it off.

Re:Impractical to who?

[madmark1]

And what if there isn't a good way around it? What if Microsoft and Facebook both do the same thing in order to get Microsoft's own browser to accept cookies from some of their own sites? Oh, that would be wrong too then, yes?

Re:Impractical to who?

[noh8rz2]

NOPE, in this analogy google would break the window to put the flyers into the car. This is the illegal part. There's not internet analogue to putting flyers in the windshields. Perhaps this is a pop-under?

Re:Impractical to who?

[noh8rz2]

um, who is the garage security in this case? this is overly complex.

Re:Impractical to who?

[madmark1]

I see, you came up with a BS analogy that didn't fit, then decided mine didn't fit? There is an internet analogy to putting flyers on windshields, I just used it. Google didn't break any windows, open any locks, or do anything else but stick the flyer on the windshield. They used an alternate method to attach the flyer. What you still haven't explained to me is how it is wrong to give a user what they expressly opted in for? Explain it to me, if you would? And don't tell me about how they violated a user's express choice in not getting cookies, since in both the recent incidents, the browsers were acting by default, and not by user choice. Tell me how a user opting in to Google services gets trumped by some chump at Apple deciding to make it harder for anyone else to gather the same data they do by blocking third party cookies? Shouldn't a user's express choice trump default behavior? I guarantee if a user opted not to get charged a fee per web page, and the browser defaulted to charging one anyway, you would sure as hell say user choice should prevail, but any other time the company choice wins?

Re:Impractical to who?

[terjeber]

Here is a simple question you should ask when you get services. Am I paying for it? If the answer to that question is "No", then you are the product being sold. For Google, you are not a customer, you are a product. The advertising industry is the customer.

Re:Impractical to who?

[Anonymous Coward]

I suppose privacy is impractical to those who want to sell our personal information.

And I suppose making a poorly veiled ad hominem attack is easier than addressing the real question. Which is, simply put "Should the story be that Google is violating the IE privacy policy, or that the IE privacy policy is such a piece of shit that it's completely worthless to start with? Or both?"

But this is slashdot, so of course you are standing at +5 Insightful.

Re:Impractical to who?

[noh8rz2]

dude, I can see you don't like to read. Let me recap prior posts.

both the recent incidents, the browsers were acting by default, and not by user choice

I'll grant you that in many instances the user unknowingly relied on browser defaults, but in many others such as for me the user made an informed decision on his browser settings. You're saying that because many users used defaults, it's ok that Google hacked my safari to get around my express preferences. I feel violated by an entity that I was silly enough to trust.

how it is wrong to give a user what they expressly opted in for?

this is disingenuous at best. You can't claim that users were ignorant of their browser defaults, then claim that they read and understood all the invisible cookie implications of signing into a google account.

Here's what google should have done. On safari when cookies are blocked, pop up a dialog box. "Your browser is currently blocking cookies from Google affiliates. In order to get the best Google experience including the +1 buttons, please change your browser settings. Instructions for doing this are here (insert link)."

Re:Impractical to who?

[Anonymous Coward]

Dude...are you new?

Google IS the advertiser! data they collect never has a need to ever leave their data centers....PERIOD. They also run Search and other enterprise services. Let's not forget Music and Film streaming as well.

Re:Impractical to who?

[Branciforte]

Google does not, and has never, sold personal information. All they do it match ads to users. No personal data ever leaves the datacenter.

Re:Impractical to who?

[madmark1]

I like to read just fine, I think the issue is I actually understand what I read.

If you made a specific choice on your browser settings, great. I am also willing to bet you never signed up for G+, don't log in to it, and never accepted the opt-in for tracking cookies. Do you understand what this means? It means this issue doesn't even apply to you, and nothing was done to you. If you accepted a G+ account, and opt-in to targeted ads, then left the browser settings to block it, you are violating the terms of service. It's that easy.

I most certainly can claim users were ignorant of their browser defaults, yet claim they could opt-in to tracking, in the same way Google can claim it, because they had to actively accept the terms. If they didn't read it, that isn't Google's fault, or their responsibility. That belongs to the user. If they sign up for things without understanding the consequences, that is on them, but they made an active choice to participate. They did not choose to participate in their browser settings, it was set for them, and set in a manner not the norm for any other browser.

Google might could pop up a window like that, to tell people how to fix their browser settings, except it also blocks pop-ups by default.

Someone actively choosing to participate in something, even if they didn't understand it, is always more powerful an argument than something set by default. Understand now, genius?

Now, answer this simple question. Did you sign up for G+, log in, and accept the opt-in for targeted ads? Because if not, your privacy was never violated, and you have no horse in this race. You are looking for a reason to be pissed (I assume your screen name is meant as irony?), and someone gave it to you. Congratulations on allowing PR to guide your actions, instead of reading about the situation and coming up with an informed opinion.

Re:Impractical to who?

[noh8rz2]

If you accepted a G+ account, and opt-in to targeted ads, then left the browser settings to block it, you are violating the terms of service. It's that easy.

bahahahahaha. So now if I block Google's cookies, I'm violating their TOS? Slap the cuffs on me! This flame war is boring me, because you're being purposefully obtuse. or maybe you're trolling me, but it's a slow-burn troll.

Re:Impractical to who?

[madmark1]

Yeah, that's it, I'm the one trolling. The guy who is actually presenting evidence, and asking questions that you ignore. I'm not the one who doesn't answer the question asked, ignores the facts, keeps claiming that their privacy was violated when it most likely wasn't, and keeps presenting BS analogies that don't remotely fit the situation.

Yeah, It's boring me too, I hate having a battle of wits with an unarmed man.

Re:Impractical to who?

[honkycat]

Is that the case or are you just asking a rhetorical question?

As I understand it, this is a setting that the user can change. It's pretty standard practice for web sites to fail when a browser setting or missing piece of software blocks them. Frequently this triggers a request to install the software or to change the setting. Regardless of who is doing it, that is the right thing to do.

Re:Impractical to who?

[noh8rz2]

and keeps presenting BS analogies that don't remotely fit the situation.

that's what ur mom said.

I think

[koan]

We should get over the privacy aspect, if you truly want privacy there are ways to deal with it, and second I find it amusing that as often as IE gets raped on the Internet Microsoft chose this to get public about.

No it isn't.

[Anonymous Coward]

Stop including P3P header data if all you're going to put is "this is not a P3P policy" in it. How impractical is that?

Re:No it isn't.

[Anonymous Coward]

How about DON'T TRUST RANDOM SERVERS ON THE INTERNET?

The whole P3P thing is royally fucked up bullshit.

Re:No it isn't.

[stephanruby]

Or they could just say the truth:

We track everything (allowable by law). We track as much as possible and for as long as possible. This P3P policy couldn't possibly summarize everything we track, we just track too much.

Google

[Dexter Herbivore]

Do No... errr, nevermind.

Re:Google

[Anonymous Coward]

Good thing they never made that one official, eh?

Re:Google

[It doesn't come easy]

New corporate motto: Do Some Evil

Wer're safe!

[accessbob]

Thank goodness they're not an evil company. It could have been M$ breaking the Web standard...

Re:Wer're safe!

[poetmatt]

Well it's not like they have a contract with facebook as Microsoft does, to do what google does to IE anyway, right? Right?

Too soon?

Re:Wer're safe!

[thetoadwarrior]

I'd hardly consider it a standard when it development died shortly after it became a standard and IE is the only one to implement it.

The flaw has been known since at least 2010 and in fact when it was pointed out that even Microsoft was passing invalid codes on their own support site. Some people get such a hard-on for ripping on Google that they're willing to defend MS as the good guy despite implementing something that was completely broken and never offered any protection.

http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enough-for-a-cookie-to-fit-through/

Google certainly is not perfect but MS is the one that is at fault here and they just look desperate by pointing out that Google (like many people including themselves) have by passed their failed privacy protection.

Microsoft Quality

[darkfeline]

IE privacy protections were "circumvented" by Google sending a string stating, "This is not a P3P policy." Typical Microsoft quality product, that's like getting conned by a guy wearing a shirt that says "I don't guarantee I won't run off with your money" and then sueing them.

Re:Microsoft Quality

[betterunixthanunix]

Frankly, as an approach to a security engineering problem, P3P is pretty bad. You are basically allowing your adversary to declare what the security policy will be, then leaving it up to your adversary to follow that policy.

If browser makers were serious about protecting their users' privacy, they would make adblocking the default, they would have stricter cookies policies, and they would not let a company like Google decide what sort of privacy people will have.

Re:Microsoft Quality

[SaroDarksbane]

Future News: For Windows 8, Microsoft has replaced the traditional log on screen with a text field. Users will now have to simply enter a reason why they should be allowed to log onto the system. The system will accept all answers.

Re:Microsoft Quality

[Anonymous Coward]

What? So if a guy with a shirt that says "I'm going to rob you" goes ahead and robs you, you wouldn't press charges?

Re:Microsoft Quality

[SJHillman]

Or if you have a webcam, it will accept sincere looking smiles.

Re:Microsoft Quality

[msauve]

Plus, P3P is faulty, it has a loophole which one can take advantage of. Much better to simply follow a properly designed spec for this sort of thing, like RFC 3514.

Re:Microsoft Quality

[betterunixthanunix]

Unfortunately, it is unlikely that you will get modded funny. Nobody will RTFA here, not even the moderators!

Re:Microsoft Quality

[Xest]

I remember thinking the same when I was forced to study it academically some time ago, and thought at the time what the fuck is the point in it exactly?

Well at least now I have my answer, it makes for good headlines when you want to troll your competitors with it if nothing else.

Re:Microsoft Quality

[Anonymous Coward]

Nope, he would preventively walk to the other side of street, tase him, release the hounds and shoot him when he attempts to escape.

Re:Microsoft Quality

[Nimey]

A good second-order use is when someone wants to stoke the flames of anti-Google hysteria, as seen with this article and many of the posters.

Re:Microsoft Quality

[Anonymous Coward]

Or if you have a webcam, it will accept sincere looking smiles.

... or boobs. Just make sure that your computer is connected to the Internet while logging in.

Re:Microsoft Quality

[Todd Knarr]

Thing is, P3P isn't a security solution. It's a legal/social solution: make the site declare what it promises to do, and then the user has a solid basis for complaints through the usual channels for breach of that promise. The courts may not understand the technicalities of P3P and the Internet and such, but "He made a written promise to not do X (which promise I have a copy of), I relied on that promise, he went ahead and did X anyway and I've suffered these damages because of it." is something the courts deal with every day.

As for whether that's effective or not, I simply point back to Google's response. They're playing this game precisely because of the risk they run if they openly make a false statement in their P3P header (and the only non-false options they have are things they don't want to admit to). Once the grifter has to start being openly evasive about what he's promising, it's not long before the marks start getting nervous and dropping out of the game.

Re:Microsoft Quality

[betterunixthanunix]

I do not think anyone would be surprised by the fact that a legal solution to a computer security problem is a complete failure.

Re:Microsoft Quality

[sexconker]

I do not think anyone would be surprised by the fact that a legal solution to a computer security problem is a complete failure.

You're a moron. P3P has nothing to do with security. It has to do with privacy policy.

P3P is a standard way of stating what your site's privacy policy is. Browsers can use this standard to enforce a user's privacy preferences.
It has absolutely nothing to do with security.

Re:Microsoft Quality

[betterunixthanunix]

Yeah, it is not as if privacy is a matter of security or something crazy like that. Enforcing a user's privacy preferences is not a matter of computer security at all!

The ironic thing is that you are calling people "moron" while pushing the claim that protecting privacy has nothing to do with security.

Re:Microsoft Quality

[OhSoLaMeow]

That only works if the Beads application is installed.

Re:Microsoft Quality

[terjeber]

Yeah, it is terrible that Microsoft follows an open W3C standard, an honor-standard, the way the standard specifies, while it is perfectly OK that Google circumvents the same standard. I will never get the zealotry of some /.ers.

Re:Microsoft Quality

[terjeber]

Frankly, as an approach to a security engineering problem, P3P is pretty bad

That's like saying - as an approach to an airplane, a 1969 VW Bug is pretty bad. P3P is not designed to solve a security problem.

FTFY

[elrous0]

Google on Monday said that IE's privacy protection, called P3P, is unprofitable to comply with."

Re:FTFY

[Larryish]

MS is a private company, not a legislative body.

As the situation is presented, Google is under no legal requirement to comply with any 3rd party browser "privacy requirements" outside of any existing legal agreements with manufacturers of said browsers. Was any such agreement in place?

tl;dr - MS can go get stuffed.

Re:FTFY

[betterunixthanunix]

More importantly, why are browser makers worried about Google's interests? Google is the adversary as far as user privacy is concerned, and browsers should ship with security against that adversary. Adblocking should be the default. Cookie policies should be strict and should forbid iframes from third party sites from setting or reading cookies. If browser makers actually cared about user privacy, we would not be in this situation.

Re:FTFY

[Americano]

Google is under no legal requirement, but remember, they're the "Do No Evil!" crowd. Deliberately circumventing a system which allows browser USERS to say "I don't want to allow cookies from sites which will do X, Y, or Z with my data," would seem to fly in the face of that policy, wouldn't it?

What you're saying is, "Since Microsoft didn't create a hermetically sealed box that's unable to be bypassed, it's okay for Google to simply disrespect the wishes of the user - as expressed by the web browser settings - and do whatever they want."

Is this REALLY a road you think any company should be going down, where "whatever's not bolted down" is fair game for anybody smart enough to take it?

Re:FTFY

[xeno314]

Well, there are a few problems with those suggestions (outside of the "they're just following the P3P standard" issue). A browser that shipped with an ad blocker enabled is unprofitable for the publisher and competitors. If it allows the publisher's ads and not everyone else's, they're going to end up in court. Actually, if it has the equivalent of ABP or other extensions included and on by default, they're probably going to end up in court. Targeting particular adversaries with privacy controls -- same problem. Even if they win all of the lawsuits, it's a major diplomatic failure for them with adversaries who may also be business partners.

That said, I'd like to see it happen, but unless some rich benefactor independently funds a browser, it's not likely.

Re:FTFY

[Anonymous Coward]

Deliberately circumventing a system .... ? Its IN THE SPEC for P3P to do what it does in response to Google's P3P notpolicy. It is not circumvention when both sides are adhering to the specification. It is, as they say, a feature.

It is more like saying "Since Microsoft didn't create anything at all that does anything for privacy, regardless of what users say or want, its okay for Google to not try very hard to implement it"

Re:FTFY

[thsths]

> Google is under no legal requirement to comply with any 3rd party browser "privacy requirements"

Maybe in the US, but not in the rest of the world, where privacy laws exist. Time and time again Google has argued that the consent of the user can be presumed, because cookies are enabled. Only with this presumed consent are they allowed to track users.

However, cookies are enabled by default, so this argument is pretty weak. And it collapses as soon as the user takes any action to discourage tracking, whether it is effective or not. Google is certainly not allowed to work around any imperfect measures to stop tracking.

It is not all clear here, because again MS has turned this on by default. But if P3P is actively being used to prevent tracking, then Google has to respect that.

Re:FTFY

[Americano]

If Google sent nothing, and simply said "We refuse to support P3P," then the P3P system would have stopped them setting the tracking cookie. So Google had to expend the effort to:

1) Find a loophole that would allow them to track users even if this P3P system was in place;
2) Implement & test their workaround;

So yes, they had to deliberately develop and implement a workaround to allow them to plant the tracking cookie on IE users. Because not planting that cookie would be ever-so-inconvenient and unprofitable for them otherwise.

What blows my mind is that people are trying to frame this as a "Google vs. Microsoft" issue, when it is very clearly a "Google vs. User" issue. Google should respect the wishes of the users, as expressed by the P3P settings, or work to convince users that it is trustworthy & that they should change their settings (or use a different browser) that would allow google to track them. Hard claiming you're trustworthy when you're caught making an end-run around user preferences because they happen to be at odds with your business model.

Re:FTFY

[madmark1]

No, everyone is framing it correctly as a Google vs. Microsoft issue, since Microsoft intended it that way, using the 'user' as a convenient damsel in distress. The fact is, Google is following the standard as written. IE is not handling the invalid P3P statement as it should, as laid out in their own specification. Any malformed statement should be treated as having no statement, and the cookies blocked. Instead, IE happily accepts the malformed response and allows the cookies anyway. They brought this up now because of the Safari thing, they are playing piggyback-the-bad-press here.

You know who else 'circumvents' P3P policies? Microsoft. Oh, and some outfit they have a contract with, called uhm... Facebook, or something.

Re:FTFY

[madmark1]

No, they actually don't, because the P3P spec was deprecated almost 5 years ago. It isn't legally binding (never was) and means nothing at all to anyone but Microsoft.

Re:FTFY

[Larryish]

> Google is certainly not allowed to work around any imperfect measures to stop tracking.

According to what legislation, by which legislating body?

In the jurisdiction of...?

Re:FTFY

[LordArgon]

Adblocking should be the default.

So you may be among the very few here, but MOST people lose a lot of credibility with me when they say something like this. Exactly how do you think private websites should be funded? Are you currently paying for all the sites you use (that let you pay)? Do you really want to do that? I don't. Anecdotally, the vast majority of people seem totally OK with reasonable advertising in exchange for free access; suggesting it shouldn't be the default implies you either know something I don't (e.g. people want to pay) or simply want your own preferences applied to everybody.

Re:FTFY

[Anonymous Coward]

Why is nobody asking why the fuck this piece of shit fails open instead of closed?

Why is it that if you send it unparsable crap, is assumes to track and not to block? You say P3P is FOR the users. Explain the bullshit then.

Re:FTFY

[Americano]

No, everyone is framing it correctly as a Google vs. Microsoft issue

Incorrect. This is NOT a "Google vs. Microsoft" issue no matter how much the google-can-do-no-wrong crew shouts that it is.

What you are suggesting is that corporations begin behaving according to this standard: "If it's not impossible for us to do, then it's okay."

I'll ask you again: is this the standard you want corporations to behave to? Is this a standard you will *defend* corporations for behaving to?

Re:FTFY

[madmark1]

No, but since that has nothing to do with the current situation, it really doesn't matter. Google was providing a service that it's users opted in to. Yeah, they chose it. A browser using a deprecated trust system that only they ever implemented, and that they implemented incorrectly, allowed them to provide that service. That doesn't make them evil.

Are you upset at a real problem here, or that Microsoft tricked you into being mad at Google?

don't follow that link --- it's worse than gotse

[Anonymous Coward]

it's itworld!

Dear Google

[JamesP]

So you're telling me it's impractical to send nothing or to NOT SEND BS in the field?

Congratulations for being as evil as MS

Re:Dear Google

[yotto]

Google could have lied. They could have sent a page of lawyerese that looked OK on the surface but actually said that they weren't complying. But they didn't. They provided you with a service (whatever wouldn't have worked) and openly stated while doing so that complying with the policy was idiotic.

They had at least 2 chances to be evil and failed to be both times.

Re:Dear Google

[marcroelofs]

+1

Re:Dear Google

[xeno314]

They could also have just not sent P3P headers if they didn't intend to actually provide a valid one and comply with it...

Re:Dear Google

[Americano]

I find it amusing that you are twisting and squirming to rationalize how Google explicitly disregarding the wishes of the user and exploiting a well-known loophole in the P3P spec in order to do something against that user's wishes is "not evil."

Even in the best "Microsoft should have prevented this" light, it makes them no better than the used car dealer who tries to convince you that the rust on that El Camino is a special limited-edition two-tone finish that the manufacturer tested out, and the noise from that busted exhaust system is just evidence that the car has a special glasspack muffler. It's bottom-feeding behavior of the worst sort, and blatant hypocrisy from a company that carries on about its "do no evil" policy.

Re:Dear Google

[BitZtream]

They send a valid P3P header that says 'we're not complying with your privacy request'

IE says 'Thanks for complying! with our policy!'

How exactly is that googles fault?

Re:Dear Google

[mr_gorkajuice]

It's Googles fault exactly because it's done to achieve the end result of ignoring user preferences.

Is it really that hard to understand? Are you really that blinded by your love for Google?

Re:Dear Google

[ceoyoyo]

Right. They exploited a bug in Internet Explorer so they could track users against their wishes. On is own maybe more naughty than evil, but following on their very purposeful and sneaky bypassing of anti-tracking measures in Safari, it's just a continuation of a pattern of sneaky disregard for users' wishes.

Don't be evil had to go out the window the second Google became an advertising company. If you didn't realize before, it should have become obvious when they bought doubleclick, the evilest company on the web.

Re:Dear Google

[Anonymous Coward]

Laywer thinking. Jamming arbitrary garbage into machine-interpreted fields must not change the contract. See that Linuxant junk where they declared the module license string to be GPL\0only for files in the GPL subdirectory.

Re:Dear Google

[Anonymous Coward]

Mostly because it's not polite to take advantage of the mentally retarded.

Re:Dear Google

[JamesP]

No, it is an invalid content for a machine readable field

Legalese is not a valid P3P header content

Re:Dear Google

[madmark1]

And IE, following the standard written by Microsoft, is supposed to deny any cookies when the P3P field can't be parsed.

Re:Dear Google

[madmark1]

You are wrong on both counts. In both cases, the tracking cookies were placed for users logged in to G+, who had opted in to targeted ads. How again is that exploiting a bug so they could track users against their wishes? How is it again that having something on by default represents a users wishes anyway?

Re:Dear Google

[makomk]

I find it amusing that you are twisting and squirming to rationalize how Google explicitly disregarding the wishes of the user and exploiting a well-known loophole in the P3P spec in order to do something against that user's wishes is "not evil."

Google aren't tracking users "against their wishes" because pretty much no-one even knows that the P3P settings exist and almost precisely no-one uses it to express their wishes about privacy (people tend to use plugins like Ghostery for that). It's basically a dead standard that went nowhere. It's just that for whatever reason, Internet Explorer defaults to blocking third party cookies unless they have a P3P policy - including, apparently, cookies that are required to log into Google services like GMail. In fact in some cases they even block first-party cookies due to bugs.

Re:Dear Google

[Kalriath]

If by Microsoft you mean W3C, then yes. Otherwise, bullshit.

Re:Dear Google

[walterbyrd]

But P3P allows that. You can jump right past P3P is you care to do so. So when you decide to "protect yourself" with that joke of a standard, you implicitly accept the limitations of that standard.

If anybody is being evil, it's MS for making you think their silly standard meant something.

Re:Dear Google

[madmark1]

Genius, Microsoft created the spec, and submitted it to the W3C. The spec clearly states that any compact statement that cannot be parsed should be treated as no statement, and the cookie blocked. Microsoft failed to do that with IE. So, I call your bullshit and raise you actual facts.

Re:Dear Google

[ceoyoyo]

IE blocks certain cookies if a site doesn't publish a privacy policy in a certain format. Google discovers that if they make a fake privacy policy, IE is too stupid to check if it's real or not. That's not cool, regardless of what the user told G+. If Facebook pulled that they'd be raked over the coals.

The thing with safari was even worse. Google had a whole invisible iframe, just for safari users, to bypass their browser cookie preferences.

If it's a browser default and google wants someone to opt in then they need to walk the user through changing the setting, not simply assume they want to be tracked however google likes and hack around the block.

Re:Dear Google

[madmark1]

Yes, IE blocks certain cookies if the site doesn't publish a privacy policy in a certain format, one they came up with, and only they use. Oh wait, except the problem is they didn't block the cookies, they let them right through, in violation of their own published spec. And here's the good bit: Both of these 'hacks' as everyone likes to call them, were done to give users exactly what they asked for, so I will ask again, since no one seems to be able to answer me, how is giving me what I expressly opted for evil? Because they used a workaround to get past browser defaults that are outside the norm? No other browser at all uses P3P any more, and haven't in some time. Only Safari blocks third party cookies by default. Now why do they have an obligation to guide the user through the setup of their browser, when they already opted in to a service, but the browser default was done for them, without their knowledge or consent? Why is it ok for Facebook and Microsoft to violate their own P3P standard to do exactly the same thing,but Google doing it is evil?

As I have noted before, a user had to opt in to Google's targeted ads, they did not opt in to having third party cookies blocked. Why is delivering that cookie wrong? Why should the user have to opt in once for Google, then opt in again for a default they didn't set, and likely didn't even know was chosen for them, since Safari was the only browser defaulting that way?

The short answer is, the user chose to opt in to Google services, they got their targeted ads. The consumer got exactly what they asked for, no privacy was broken, no data secretly obtained. It should not be Google's job to teach people to change settings in someone else's browser.

Now that we are on the topic, why WAS Safari set to automatically block those third party cookies? We already know Apple collects most of that information just as much as Google does, so why block them? Do you think it was intended not to provide any privacy for the end user, but to deny Google that data?

Re:Dear Google

[ceoyoyo]

Try this one. Facebook ads an opt-outable setting that says you want them to find people you might know who are also on Facebook. You don't opt out, or even explicitly opt in. Facebook then uses a zero day exploit to install a key logger on your computer to grab your email password and look through addresses you correspond with. No big deal right? You opted in.

Clicking a button on G+ is not permission for Google to hack around privacy settings in my browser, or any other security measures they find inconvenient. Maybe I don't want to be tracked in that way, or tracked in that browser, or on that computer. If my browser settings are incompatible with the needs of their program I opted into, they need to ask me to change those browser settings.

And no, your conspiracy theories about Apple aren't relevant.

Re:Dear Google

[madmark1]

Aren't relevant to you, perhaps, but then your conspiracy theories about Google aren't relevant either, nor the ones about Facebook. Interestingly enough, Facebook and Microsoft themselves both use the same P3P process to serve cookies when necessary, yet called Google out on it.

If there was an opt-out program that overrode your browser preferences, it would be a problem. Since this was an explicit opt-in, my wishes should be respected, not the default setting on a browser. User choice should always come first, especially in a case where one browser handles things outside the norm.

No matter how many times I ask, there still hasn't been a single answer to my question: How does setting tracking cookies I explicitly opted in for constitute a breach of privacy? I keep hearing people say "Google violated my privacy!" Then tell me they don't even use G+, and didn't opt in to targeted ads. How then was their privacy violated, since they never received one of the tracking cookies anyway? This issue is a whole bunch of folks who want so very badly to be indignant about something crying about what never happened to them anyway.

Re:Dear Google

[Kalriath]

Actually, no the working group does appear to have Microsoft as a member, but the lead contributor is not Microsoft. That they can't even adhere to the spec themselves would definitely indicate that they didn't write it since Microsoft's modus operandi is to make specs so confusing that only they can adhere to them. So I counter your bullshit masquerading as facts.

Re:Dear Google

[madmark1]

The lead contributor to the working group is not Microsoft, genius. Does that mean they didn't write or propose the spec in the first place?

I'll even help you out. Try this page and then tell me who appears on the list of signatories?

I counter your bullshit with actual cited facts. While you are poking around there, look at all the rest of the historical documents, and see how many times the 'minor contributors' at Microsoft show up.

Re:Dear Google

[noh8rz2]

dude, you're a super douche bag. why can't you accept that goog is teh evilz?

Re:Dear Google

[madmark1]

I'm sorry, if you construed any part of my arguments to mean that I thought Google wasn't evil, you got the wrong idea. Or that is to say, I think they are every bit as amoral and greedy as any other company. What I'm saying is that we have enough reasons to be angry at all corporations, we don't need to manufacture outrage at something that isn't really an issue. The more we wail and moan and wave our hands at meaningless stuff, the less often we are taken seriously when there is an actual reason to be upset.

Re:Dear Google

[noh8rz2]

100% of your comment posts are goog fanboi bs. don't talk to me anymore.

Re:Dear Google

[madmark1]

Actually they aren't. I've even been known to post about doctor's salaries and things like that. Oh, and I'm not talking to you, I'm posting on a board, and I can do that whenever I like, whether you like it or not. Have a nice day.

Re:Dear Google

[noh8rz2]

wrong. when you address me directly, you are speaking to me and thus you must respect my wishes for the terms of our engagement. doesn't matter if we're out in public or not. to do otherwise is a violation of my personal space and can be considered verbal assault.

Re:Dear Google

[madmark1]

To use one of your own responses, slap the handcuffs on me then. I can pretty much say whatever I like, regardless of your feelings, and no, it does not constitute 'verbal assault', or a violation of your personal space. If I stood hovering over you, that would be a violation of your personal space, but since no one is within several hundred feet of me at the moment, I can guarantee I am in no one's personal space. As to verbal assault, if I threatened you in some way, you might have some case, but I haven't. See, here's the thing. I have every right to freedom of speech, within the bounds of the rules set up for this private space, and unless I violate them, there isn't anything you can do. The proper thing to do, if you don't like what I'm saying, is to not listen, because while I have freedom of speech, I have no guaranteed right of an audience.

Re:Dear Google

[noh8rz2]

since no one is within several hundred feet of me at the moment

:( lonely?

I have every right to freedom of speech, within the bounds of the rules set up for this private space

then maybe you should read the /. TOS about harassment, then decide if your "rights" are exceeding the bounds for this private space.

Also, maybe you have these "rights" in the America, but those rights stop at the border, and you're violating my own rights in my home country.

Re:Dear Google

[madmark1]

So let me see if I understand this... By posting comments to a public board, I am violating your rights? Maybe you can explain that to me, or cite the relevant laws in your country that make speaking in your general direction illegal? I'm genuinely curious.

Oh, and no, I'm not lonely, I just didn't happen to be near anyone at the time. Thanks for the concern though.

Re:Dear Google

[noh8rz2]

what about the right against defamation and ad hominems? you're very focused on your other rights, what about the rights of others?

Re:Dear Google

[madmark1]

Ok, let me just say... huh? What ad hominems or defamation did I get into? Maybe you can point that out, since you still haven't pointed out any of the laws I've allegedly broken, or ToS provisions I've broken.

Re:Dear Google

[noh8rz2]

wow, can't drop it, can you? so far you have proven:

1) you are a jackass

2) you have poor grasp of simple logic

3) You trample on my rights

4) you are a jackass.

so please just let it go, mmkay?

Re:Dear Google

[madmark1]

One more try: Please provide an example of how I am harassing you, violating your rights, violating any laws, or violating the ToS here? Please tell me why YOU keep replying, if I am such a jackass, and so repugnant? Please point to where you added anything to this conversation resembling evidence, or even informed opinion? No?

Didn't think so.

Re:Dear Google

[noh8rz2]

Please stop! I will report you to Slashdot and the relevant Internet authorities. Where do you live please? And your IP address?

Re:Dear Google

[madmark1]

Go for it. I eagerly await the arrival of the relevant authorities, to arrest me for replying on a public forum.

Re:Dear Google

[noh8rz2]

Based on your comment I recorded your ip as 164.34.181.45. Please note that this identifying information is now "out there" and consider being more considerate in future comments.

Re:Dear Google

[madmark1]

Please note that posting personally identifying information is not only a ToS violation, but a violation of several privacy laws. Now, I don't know if you are dense, or you think I am, but that isn't my IP, either internal or external. Nice try though.

Old and Busted

[uigrad_2000]

P3P has been Old and Busted since Slashdot first covered it in 2002.

Microsoft would never bring it up, if they weren't already in panic mode. This seems to indicate that MS is in far worse shape than we know.

Re:Old and Busted

[inode_buddha]

Somebody give this guy another +1, Informative please. Shit outta mod points myself.

Not impractical, ridiculous!

[sugarmotor]

I think Google is being polite, as do people who quote a "lack of value"

From http://en.wikipedia.org/wiki/P3P

The main content of a privacy policy is the following:

        which information the server stores:
                which kind of information is collected (identifying or not);
                which particular information is collected (IP address, email address, name, etc.);

Kind of information??? As if the AI problems were all solved. IP Address? Of course it is collected. Email address? Yes if there is an input box that says email address then the address is collected.

misleading/wrong question

[poetmatt]

The question that should be asked is: Why does IE have some part of their framework in place which can be simply ignored/violated?

Re:misleading/wrong question

[yotto]

Where are my mod points, damnit!?

This is the FIRST thing I thought of.

Re:misleading/wrong question

[Barsteward]

honey trap?

Re:misleading/wrong question

[Anonymous Coward]

Yeah! Why are they bothering to follow the P3P standard that they didn't invent?

(rolling eyes)

Re:misleading/wrong question

[Anonymous Coward]

One word ... marketing

Re:misleading/wrong question

[Desler]

Yeah how dare they implement the P3P standard as it tells them to! Google is using a loophole in the standard to bypass the privacy protection.

Re:misleading/wrong question

[timeOday]

I disagree. A culture of, "if you are able to do it, it must be fine" is flawed at a very basic level. It's a failure to recognize anything above the law of the jungle. Property law gives us the freedom to have windows in our homes, even though, technically, they're easy to smash. Envelopes are easy to open an copper pairs are easy to tap, yet the laws that preclude this have been very effective - not totally, but far better than nothing. With the level of automated tracking of all kinds available these days, there simply cannot be any privacy unless there is a collective commitment to creating preserving such rights.

Re:misleading/wrong question

[Anonymous Coward]

I'm as shocked as you are that Microsoft adhered in some way to a public standard.

Re:misleading/wrong question

[poetmatt]

This is equivalent to allowing a buffer overflow, the question is not about whether they made it or not.

If P3P is being violated, then they should be making sure P3P is enforced, not calling into question google who they see as a competitor simply for purposes of fud.

Re:misleading/wrong question

[arkhan_jg]

Because P3P was a pile of crap to begin with, is drastically out of date and long since abandoned by everyone except microsoft?

From wikipedia:

"The Platform for Privacy Preferences Project (P3P) is a protocol allowing websites to declare their intended use of information they collect about web browser users. Designed to give users more control of their personal information when browsing, P3P was developed by the World Wide Web Consortium (W3C) and officially recommended on April 16, 2002. Development ceased shortly thereafter and there have been very few implementations of P3P. Microsoft Internet Explorer is the only major browser to support P3P. The president of TRUSTe has stated that P3P has not been implemented widely due to the difficulty and lack of value."

"P3P manages information through privacy policies. When a website uses P3P, they set up a set of policies that allows them to state their intended uses of personal information that may be gathered from their site visitors. When a user decides to use P3P, they set their own set of policies and state what personal information they will allow to be seen by the sites that they visit. Then when a user visits a site, P3P will compare what personal information the user is willing to release, and what information the server wants to get – if the two do not match, P3P will inform the user and ask if he/she is willing to proceed to the site, and risk giving up more personal information."

P3P can't handle 'legit' cookies not being associated with the domain you're actually viewing. IE requires a P3P policy to exist for 3rd party cookies to be saved when that setting is turned on; google's exists, but just says "this is not a p3p policy", and points you to their privacy policy. IE then goes 'alrighty then, you've got a P3P policy that's utter garbage even though I'm the one that asked for it, but here, go ahead and set that cookie anyway'.

Frankly, Google not respecting Mozilla's DoNotTrack header is a much worse case of ignoring expressed user privacy than this crappy old IE only 'standard' having a loophole you could ride an elephant through.

Re:misleading/wrong question

[whereissue]

I disagree. A culture of "sloppy and permissive software" is flawed at a very basic level. It's a failure to recognize the fact that the virtual window of your analogy will be smashed EVERY time. Eventually, actual bars are put over actual windows, to prevent break-ins if they are persistent.

With the level of automated tracking of all kinds available these days, there simply cannot be any forgiveness for a vendor who feels that the best response to a broken window is to, simply, leave it open.

Re:misleading/wrong question

[amicusNYCL]

If P3P is being violated, then they should be making sure P3P is enforced, not calling into question google

Isn't that what they're doing? Google is essentially violating the standard by claiming their cookies have no privacy implications, and Microsoft is trying to call them out on it.

Re:misleading/wrong question

[timeOday]

It's a failure to recognize the fact that the virtual window of your analogy will be smashed EVERY time.

I'm not excusing exploits that can be fixed; they should be. But I don't think individual exploits are the main issue. There will always be some available.

The kind of mass profiling now possible to the police, and google, and facebook, is not open to just anybody. That's why google and facebook are valued at billions of dollars - because they're so pervasive they can create the Total Profile. And when they exploit a loophole or bug, it affects a huge percentage of the entire Internet. There are only a few such "information utilities," so they can be held to standards. At the very least, they can be tried in the court of public opinion against their pledge to "do no evil." They're advertising companies. Public relations matter greatly to them.

Re:misleading/wrong question

[poetmatt]

Really?

Why don't you take a look at where this P3P comes form.

https://plus.google.com/u/0/114753028665775786510/posts/fuLZoEkJZNs

Hint: Microsoft. So they created the issue and raised the flag about it.

So your focus on "ohhhh, the privacy!" is a false focus in comparison.

Re:misleading/wrong question

[poetmatt]

Please.

Microsoft created the standard *AND* implemented it. It's their own fault if they allow loopholes.

see: https://plus.google.com/u/0/114753028665775786510/posts/fuLZoEkJZNs

and NYT criticism of basically creating security loopholes: http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enough-for-a-cookie-to-fit-through/

google's fault? none, really.

title: "If you rely on Microsoft’s Internet Explorer’s privacy settings to control cookies on your computer, you may want to rethink that strategy."

Re:misleading/wrong question

[madmark1]

They aren't implementing the P3P standard as it tells them to, because the standard says if the P3P statement can't be parsed, it should assume the worst, not allow it through. Did you even read the standard?

Re:misleading/wrong question

[Anonymous Coward]

The Internet has been, is and will be a place where anarchy rules. You cover your own butt or you get owned. What the fuck do you think some Chinese guy cares about your stupid laws?

You fucking "social network" sissies can go fuck yourself. It's the fucking lawyers and marketers and crybabies that kill themselves at the first dumbass comment some anonymous fuckwad throws at them that made the Internet the fuckup it is today--regulated, censored, commercialized. There are countries where making penetration testing tools is illegal, fucking illegal! You can't even test your own network properly. That's akin to keeping your kid 99% sterile and then cry when someone sneezes at him and he dies from a fucking cold.

And it's because of moron like YOU crying for regulation.

Seriously, FUCK YOU.

The fact that your whiney dumbass post is at 5, Insightful now makes me sad and without hope for a better future.

Re:misleading/wrong question

[Anonymous Coward]

They are not exploiting anything.

The very concept of a "will you please do as I tell you?" flag sent to what is basically enemy rogue servers, is beyond retarded. It's not that Google needs to be restricted by laws. It's idiots like you who need to be put off the Internet. Idiots that don't grasp the fact that you can't invent some concept which has no standing on its own and needs laws to even be effective.

Why the fuck do you think such a braindead idea was even conceived? Because the other scum of the Internet, fucking marketers and advertising crackwhores, noticed that people exercised their free right to block their junk. So now they try to sneak in their stuff by pretending to play nice. Soon you'll have no browser that can outright block cookies but instead plays along this P3P bullshit and advertisers are free to rape you again.

THAT is why you cover your own butt and develop some critical thinking skills that detect bullshit as the bullshit that it is. But if that were common, noone would use Facebook et al. Alas, the future is dark.

Re:misleading/wrong question

[Anonymous Coward]

They aren't implementing the P3P standard as it tells them to, because the standard says if the P3P statement can't be parsed, it should assume the worst, not allow it through. Did you even read the standard?

Yes, and this is a misunderstanding of the standard. It states that the statements within the policy (meant to be machine readable) will tell you what they use cookies for, but if they can't be parsed they are to be ignored, the default then being the sitedon't use the cookies for anything. Google have fed a human readable statement into this, and IE is interpreting it as standard defines. You can disagree with how smart the standard is defined, but it is an honor system standard, you tell what you do with the cookies in machine readable format. No input = we don't use the cookies for anything! Google clearly willfully subverts this standard and its honor system by feeding a human readable cop-out into what is supposed to be a machine readable format. The standard doesn not have a system to catch cheaters like Google (again, the whole standard is an honor system anyway), but IE do interpret it as defined in the standard.

Re:misleading/wrong question

[Anonymous Coward]

I cannot see that link as my firewall blocks every Google owned IP address but I'm going to err on the safe side and assume that it was the fault of the arrogant Google assholes.

--
Glass

Re:misleading/wrong question

[Anonymous Coward]

So it's more important to call Google out on this, which basically shows you how insecure the entire scheme is, rather than stopping and thinking to yourself "Wow... if google can get past this, what's to stop someone with more vicious intent and goals from doing the same? PERHAPS THIS STANDARD ISN'T VERY PRACTICAL."

Re:misleading/wrong question

[Anonymous Coward]

It says unknown P3P statements should be ignored, this allows future ones to be added seemlessly, in essence google is sending an empty P3P statement which is a valid satement to send according to the spec. MS has followed the spec, Google is just abusing it to get past deafult cookie restrictions.

Re:misleading/wrong question

[Kalriath]

Bullshit. You know where P3P actually comes from? The World Wide Web Consortium (W3C). The people who brought us HTML, and CSS. Where does it not come from? Microsoft. In fact, Microsoft isn't even one of the contributors (AT&T, IBM, ETH, MIT and the University of Venice are though). Funnily enough, the author didn't even imply in that G+ post you link to that Microsoft invented P3P.

So, your focus on "ohhh, Microsoft!" is a false focus in comparison.

Re:misleading/wrong question

[Kalriath]

Bullshit. You know where P3P actually comes from? The World Wide Web Consortium [w3.org] (W3C). The people who brought us HTML, and CSS. Where does it not come from? Microsoft. In fact, Microsoft isn't even one of the contributors (AT&T, IBM, ETH, MIT and the University of Venice are though). Funnily enough, the author didn't even imply in that G+ post you link to that Microsoft invented P3P.

Re:misleading/wrong question

[mariasama16]

Don't forget though, its not just Google doing this (though everyone's jumping on them for it). Facebook (hello known people to care less about privacy) does the exact same thing. So, why is no one jumping on FB for this (when every other potential for privacy stirs up the masses)? There are other sites as well, though I can't recall a list off-hand.

Re:misleading/wrong question

[Anonymous Coward]

No, Google is claiming their cookie usage is more complicated than the P3P standard is able to convey, supplying a link to display to the user. But IE doesn't know how to display the link, ignores the fact that it got some information it didn't understand, and acted like there weren't any privacy implications.

Anyway, this whole P3P thing is about as useful as the evil bit, or a bank letting anyone into the vault who is wearing a badge saying "not a bank robber".

Re:misleading/wrong question

[terjeber]

If Microsoft follows the W3C standards then that is wrong too?

Re:misleading/wrong question

[terjeber]

You obviously didn't.

Re:misleading/wrong question

[thisisntme]

From TFA:

A 2010 study by researchers from Carnegie Mellon collected CPs from 33,139 websites and detected errors in 11,176 of them, including websites of Facebook and Microsoft.

Re:misleading/wrong question

[madmark1]

Actually I did, several times. Just to save time, here are some relevant sections:

If an unrecognized token appears in a compact policy, the compact policy has the same semantics as if that token was not present.

Compact policies are summarized P3P policies that provide hints to user agents to enable the user agent to make quick, synchronous decisions about applying policy. Compact policies are a performance optimization that is OPTIONAL for either user agents or servers. User agents that are unable to obtain enough information from a compact policy to make a decision according to a user's preferences SHOULD fetch the full policy.

So, from this, we find that 1) If a token cannot be parsed, it should be considered to not exist, and the cookie blocked, and 2) If the full P3P compact policy cannot be read, or does not contain enough information, the full P3P policy should be fetched and followed instead.

What actually happened is, Google sent a policy that could not be parsed by this dead, unused by pretty much anyone but IE system, and IE helpfully ignored TWO separate sections of the spec and accepted it. This is now Google's fault, I guess.

By default, IE blocks anything without a P3P policy in place. In order for many sites to do what they need to do, they also present P3P headers that are not necessarily accurate. Microsoft does it themselves. Facebook does it too. What IE fails to do is block anything it cannot parse, as it should be doing.

In any event, all this is still a moot point. I still haven't heard anyone explain to me how attaching tracking cookies for users that specifically opted in to those targeted ads is a privacy violation. I can't hand you my social security card, then claim breach of privacy because you have my name and social security number.

Re:misleading/wrong question

[poetmatt]

W3C released the spec, it didn't mean they implemented it.

Microsoft harped on everyone about oh you must implement this! And everyone said "hey, guess what, we don't give a fuck because this doesn't fix anything". Now microsoft goes "how dare they use our broken implementation" and focuses on google?

fucking please. I'm not excusing google's behavior or any other party, but you don't hear microsoft talking about preventing facebook from abusing their P3P implementation either. Trying to call attention to one or the other and not the issue at hand (via Microsoft's standard FUD campaign) is what is the problem - turning this into a political issue and not focusing on any form of technical solution.

Why is there a lack of outrage?

[Anonymous Coward]

If it was the other way around, there would be a pile of MS hating nitwits here already.

Re:Why is there a lack of outrage?

[Anonymous Coward]

If it was the other way around, there would be a pile of MS hating nitwits here already.

From this thread:

I suppose privacy is impractical to those who want to sell our personal information.

Do No... errr, nevermind.

Google on Monday said that IE's privacy protection, called P3P, is unprofitable to comply with."

Re:don't follow that link --- it's worse than gots

[Anonymous Coward]

Indeed. I can't fap to itworld.

Android

[geoffrobinson]

So tell me again why I would want to use Android? No way I want Google to have built my phone. They know enough about me, thank you.

Re:Android

[andydread]

You do realise that Microsoft does the same thing right? They send an invalid privacy header the same way they are complaining that Google is doing. So you trust Microsoft to tell you the truth?

Re:Android

[Anonymous Coward]

You do not have to have a Google account to use Android. You could level the same criticisms against iOS or windows phone but don't let that get in the way of your paranoid google hate.

Re:Android

[Anonymous Coward]

[Citation Needed]

Re:Android

[Anonymous Coward]

Facebook: The organization that established P3P, the World Wide Web Consortium, suspended its work on this standard several years ago because most modern web browsers do not fully support P3P. As a result, the P3P standard is now out of date and does not reflect technologies that are currently in use on the web, so most websites currently do not have P3P policies.

Amazon: http://es.scribd.com/doc/50083197/Del-Vecchio-v-Amazon-Complaint

Microsoft: http://social.msdn.microsoft.com/forums/en-us/iewebdevelopment/thread/15D38FB3-AF79-46E0-B85F-E976F4EF522D

Impractical to Microsoft, MS also send invalid P3P

[Anonymous Coward]

I find it interesting that Microsoft also sends an invalid privacy header, just as they are complaining about Google doing.
I also find it interesting that MS is blaming Google for IE's failed handling on invalid P3P headers rather than fixing their product.

Re:Slashdot censorship

[Anonymous Coward]

I've just reported your post as "anti-censorship."

so long,

Re:Impractical to Microsoft, MS also send invalid

[0racle]

I also find it interesting that MS is blaming Google for IE's failed handling on invalid P3P headers rather than fixing their product.

As I understand it, Microsoft is following the spec properly. Google is exploiting a loophole in the spec.

Re:Impractical to Microsoft, MS also send invalid

[msauve]

" Google is exploiting a loophole in the spec."

Which is another way of saying: Google is also following the spec. The problem is, the spec is faulty, and doesn't provide what it's intended to.

Tomorrow Never Dies

[pan0k]

All these bugs bring back my favorite quote from that movie. " Elliot Carver: Mr. Jones, are we ready to release our new software? Jones: Yes, sir. As requested, it's full of bugs, which means people will be forced to upgrade for years. Elliot Carver: Outstanding. " If Microsoft and Apple knew about the bug, why left them open? Hoping that somebody would find the bug for them?

Re:Not impractical, ridiculous!

[Anonymous Coward]

IP Address? Of course it is collected.

Why is this an "of course" item? There is no immediate reason to collect and store IP addresses for long term, past the end of the current TCP connection.

Re:Not impractical, ridiculous!

[TheGratefulNet]

read this again, mate:

P3P is a machine-readable language that helps to express a websiteâ(TM)s data management practices

MACHINE READABLE.

is english machine readable? english sentences?

NO.

google fucked up. such a simple thing and they fucked it up.

ON PURPOSE.

this was not incompetance. what is difficult about making something either blank or token scannable via a simple grammar?

english grammar? sorry google, but you lose in the worst possible way if you think THIS is the correct answer.

One question never answered

[microbee]

How does Facebook do it (the Like button)? Does Facebook also circumvent it this way? Either Facebook found a way to do it better, or they are both doing the same thing.

Can we stop the Google/Microsoft bashing and focus on the techniques please?

Re:One question never answered

[MozeeToby]

Not only does Facebook do it but Microsoft also does it. The standard they are accusing Google of violating is so out of date that W3 doesn't even try to update it anymore, because no one follows it and most browsers don't even implement it fully. This is a non-story in every direction.

Re:One question never answered

[Anonymous Coward]

Check the ARS story with 2 updates:

http://arstechnica.com/tech-policy/news/2012/02/google-tricks-internet-explorer-into-accepting-tracking-cookies-microsoft-claims.ars

Yes Facebook is doing it as well as msn.com and live.com

Re:One question never answered

[AtomicJake]

How does Facebook do it (the Like button)? Does Facebook also circumvent it this way? Either Facebook found a way to do it better, or they are both doing the same thing.

Can we stop the Google/Microsoft bashing and focus on the techniques please?

Firefox with Ghostery is your friend. Forget "do not track" and P3P. They rely on fair play of web sites - which is unreasonable to expect.

MS Rocks

[Anonymous Coward]

Wow! My respect for Microsoft just went up a notch. Release IE for Mac again and I'll use it as long as you have strict privacy standards like this. LOVE IT!!!

Re:MS Rocks

[Anonymous Coward]

You are a complete fucking tool.

Irony.

[forkfail]

Thy name is Corporate.

Be less evil and confused for a day, Google.

[sander]

Microsoft's privacy protection feature in Internet Explorer, known as P3P

This is simply utterly preposterous. P3P is not a Internet Explorer thing. Even google search knows its a w3c thing - but apparently those coming up with such excuses do not use Google search. Google can do with a doze of being at least a bit less evil.

Re:Be less evil and confused for a day, Google.

[Anonymous Coward]

AC because of I modded on this page.

P3P is a w3c spec but Microsoft is pretty much the only one using it, so it's reasonable to associate them.

Re:Be less evil and confused for a day, Google.

[The Moof]

It's even more preposterous that Google claims the standard is impractical. If you don't have a P3P policy, the correct course of action the standard states is to, literally, do nothing. If doing nothing is too impractical, I'm curious what Google feels is a practical solution.

Re:Impractical to Microsoft, MS also send invalid

[Americano]

User: "I don't wish to be tracked. I've opted out using this P3P setting."
Google: "Haha there's a loophole that we're gonna use to track you anyway. Blame Microsoft if you don't like it, sucker!"

Yep, Google has done nothing wrong here whatsoever. They're completely right to exploit a known loophole which allows them to disregard the wishes of the users accessing their services, if those wishes would make Google's services less profitable.

If this is "Do no evil," I shudder to think about the damage Google could do if they decided one day to deliberately engage in evil.

Re:Impractical to Microsoft, MS also send invalid

[shadowmas]

If it's something that can be exploited then it's a bug. Any security/privacy feature of the browser should be in the control of the user not at the mercy of the http server.

If it was something like a buffer overflow would microsoft still complain how that bad guys should stop sending invalid data packets to the browser?

I don't like googles extensive tracking either, but complaining that it's not using some unpopular protocol is just silly. If you are going to implement privacy control then make it work regardless of the information that the site may send or just don't bother.

Re:Impractical to Microsoft, MS also send invalid

[TheGratefulNet]

what the text SHOULD look like (assme angle brackets here; sorry for having to reformat to get around slash filters)

[META xmlns="http://www.w3.org/2002/01/P3Pv1"]
  [POLICY-REFERENCES]
        [POLICY-REF about="/P3P/Policies.xml#first"]
              [COOKIE-INCLUDE name="*" value="*" domain="*" path="*"/]
              [COOKIE-EXCLUDE name="obnoxious-cookie" value="*" domain=".example.com" path="/"/]
        [/POLICY-REF]
        [POLICY-REF about="/P3P/Policies.xml#second"]
              [COOKIE-INCLUDE name="obnoxious-cookie" value="*" domain=".example.com" path="/"/]
        [/POLICY-REF]
  [/POLICY-REFERENCES]
[/META]

and what googles looks like:

P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 [google.com] for more info.

now, without even having a compsci101 level course, anyone here see which is the more correct parseable string and which is weasel bullshit?

Re:Not impractical, ridiculous!

[Anonymous Coward]

I gather you've never ran any ecommerce sites have you? Or any other kind of site that needs to keep track of customers to prevent fraud. You are a clueless idiot.

Re:Not impractical, ridiculous!

[sugarmotor]

Let's put it the other way around. If you were to tell your browser you only want to visit websites that do not store your IP address, how far would you get?

Or, how tired would you get of pop-up's saying " This site stores your IP address. Continue viewing?"

Re:Impractical to Microsoft, MS also send invalid

[Klync]

If this is "Do no evil," I shudder to think about the damage Google could do if they decided one day to deliberately engage in evil.

cf. Hank Scorpio, Globex Corporation.

Re:Not impractical, ridiculous!

[sugarmotor]

The file may be machine readable, but someone has to configure the other side, the client's preferences.

Here you will run into an overwhelming list of options that an average user is simply not going to bother with ---> Ridiculous waste of time.

You know those locks on people's doors?

[Anonymous Coward]

They are also impractical. We should just get rid of them.

I am sorry, but Google has outlived it's mantra. They should change it to:

Don't get caught.

Because honestly, they are now evil-er than almost any other company. At least with facebook, they admit they are stealing your personal data.

Re: I shudder to think about the damage

[TaoPhoenix]

Obligatory!
Don't make Google angry. You wouldn't like it if it became angry.

Re:Impractical to Microsoft, MS also send invalid

[gnasher719]

Suggested update for Internet Explorer:

IE should try to parse the P3P according to the spec. If that fails, then display the contents to a user, with buttons: "Accept cookie", "Reject cookie", and "never allow visits to this site again".

Re:Impractical to Microsoft, MS also send invalid

[Lonewolf666]

Consider the following (from http://www.w3.org/TR/P3P11/#ua_compact;

6.4 Compact Policy Processing

P3P user agents MUST NOT rely on P3P compact policies that do not comply with the P3P 1.0 or P3P 1.1 specifications or are obviously erroneous. Such compact policies SHOULD be deemed invalid and the corresponding cookies should be treated as if they had no compact policies.

As I understand this, IE should actually search the Google P3P header for a valid statement of what Google intends to do with regard to tracking cookies. If it does not find those, it should apply the default behaviour for web sites without any P3P header. As described by Dean Hachamovitch (the author of the blog post):

By default, IE blocks third-party cookies unless the site presents a P3P Compact Policy Statement indicating how the site will use the cookie and that the sites use does not include tracking the user.

Fine. So your browser sees a Google P3P header without any valid policies. At this point, the clause "unless the site presents..." should kick in and cookies should be blocked. To me this looks like a bug in IE, as they failed to implement the default behavior in this case. It would be appropriate for Microsoft to fix this bug, send the fix as update on next patch day and otherwise be very humble about their error.

  Instead, Dean Hachamovitch tries to paint this as conspiracy by Google to circumvent IE's security protection. FAIL.

not sold, but perhaps rented

[OrangeTide]

So they merely rent our personal information instead of selling it. That's a pretty small distinction.

Re:not sold, but perhaps rented

[bickerdyke]

Would you rent something that you'd never get in your hands?

Re:Impractical to Microsoft, MS also send invalid

[Anonymous Coward]

You got that wrong - it's 'Do know evil' not 'Do no evil'

Re:Not impractical, ridiculous!

[Anonymous Coward]

If you don't want websites to store your IP address, I recommend browsing with TOR. ;-)

Single point of failure

[ThatsNotPudding]

What's a mailbox? I don't have a single bill that shows up in my mailbox. It's all paid online.

You better pray like hell nothing ever goes wrong, Mr Buttle http://en.wikipedia.org/wiki/Brazil_(film)

Re:Single point of failure

[Anonymous Coward]

What's a mailbox? I don't have a single bill that shows up in my mailbox. It's all paid online.

You better pray like hell nothing ever goes wrong, Mr Buttle http://en.wikipedia.org/wiki/Brazil_(film)

Unfortunately for my children, I think they will be facing a dystopian future, but not necessarily my generation. But it will happen. So I counter with this movie and the following chunk of video from 6:43 through 8:45 here.

Re:Impractical to Microsoft, MS also send invalid

[The Moof]

Yea, that End-User Allow/Deny thing did wonders for ActiveX security. How about if it's malformed, throw it out entirely and treat the request as if the P3P was not present?

Google Not Needed

[Anonymous Coward]

I've gotten to the point in my Internet life where I rarely use Google anymore. There are better options out there. People will disagree with them and let them. Google has mind share and they are a verb. So what? I want to use services that respect my freedom and my dignity and don't try and monetize everything. I really miss some aspects of the early WWW. I miss the personal websites that seemed to have a greater number than corporate ones. I miss the search engine wars. I miss alot of it.

Several months ago, I became very concerned with tracking online. I already used to block some stuff as a precaution, but the recent tomfoolery by online companies was the last straw. I know block Flash cookies while still using Flash, I block ALL advertising, I block all elements, beacons, trackers, web bugs, pixel bugs, and social media (I don't use any of it). I turn of geolocation, HTTP/S referrer, CSS visited links (avoid sites seeing your history), and I employ an aggressive hosts file with more entries than grains of sand. Ghostery is nice to use as it picks up some newer blocked sites I can add to my hosts file. As a result, I have a super clean, super fast Internet experience free of the evil tracking that occurs as a result of advertising. When advertising doesn't track me, I will allow it once again. Until then, no. I have a RIGHT to not be tracked, to not be monetized without my consent. Disagree all you want. I don't care. This tracking is becoming an issue. The bypassing of set privacy setttings is abhorrent and borderline illegal. Can't bypass a hosts file. What is great about a hosts file is that you can add entries and it never slows anything down.

The rabid desire to monetize everything about the Internet is a shame. People are too greedy, too ready to make a buck at someone else's expense. Tracking should be made illegal as a soon as possible. Advertising should be anonymous and never tied to anyone. Until a saner Internet is forced upon the corporate asshats, I will continue to block everything that is not pure content.

Re:Not impractical, ridiculous!

[Anonymous Coward]

If the machine can't read it, it should default to the most security, not the least.

That's like a password field which isn't supposed to contain any " characters, and if a password with a " is typed, instead of rejecting the login attempt, it logs you in successfully.

Re:Impractical to Microsoft, MS also send invalid

[Anonymous Coward]

Yep, there's a bug in IE with regard to their fallback, but that doesn't excuse Google's actions. If Google didn't *want* to provide a P3P header, they shouldn't have provided one. Instead, they discovered the IE bug and intentionally took advantage of it. (Similarly to how they discovered a Webkit cookie-handling bug and took advantage of it to work around some cookie restriction settings in Safari.)

Re:Impractical to Microsoft, MS also send invalid

[madmark1]

So are you telling me you actually opted out using P3P? If so, you must be one of the 10 people on earth who actually knew what this was before the story broke. P3P is a broken system, has been a broken system forever, and has been deprecated as a standard since 2007. This is the privacy protection you are relying on? A system that even Microsoft exploits in EXACTLY THE SAME WAY as Google did?

Re:Impractical to Microsoft, MS also send invalid

[dissy]

what the text SHOULD look like (assme angle brackets here; sorry for having to reformat to get around slash filters)

[META xmlns="http://www.w3.org/2002/01/P3Pv1"]
    [POLICY-REFERENCES]
                [POLICY-REF about="/P3P/Policies.xml#first"]
                            [COOKIE-INCLUDE name="*" value="*" domain="*" path="*"/]
                            [COOKIE-EXCLUDE name="obnoxious-cookie" value="*" domain=".example.com" path="/"/]
                [/POLICY-REF]
                [POLICY-REF about="/P3P/Policies.xml#second"]
                            [COOKIE-INCLUDE name="obnoxious-cookie" value="*" domain=".example.com" path="/"/]
                [/POLICY-REF]
    [/POLICY-REFERENCES]
[/META]

And what the P3P header at www.microsoft.com looks like:

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

now, without even having a compsci101 level course, anyone here see which is the more correct parseable string and which is weasel bullshit?

I guess the first is correct, and the second is bullshit?

My Toolset So Far

[Anonymous Coward]

Some of the things in my toolset.

I use Linux, so for some of you, some of these tips will not work. I use aggressive settings. YMMV.

Firefox: Settings work in both Linux and Windows

Type about:config in address bar. Accept warning.

geo.enabled (set to false) # Prevents sites seeing your whereabouts, but if they have IP, they can guess.
layout.css.visited_links_enabled (set to false) # Prevents sites from seeing your history. I have history set to no remember anyway.
network.http.sendRefererHeader (set to 0) # Prevents sites from seeing where you came from.
network.http.sendSecureXSiteReferer (set to false) # Same as above for HTTPS.
network.prefetch-next (set to false) # Prevents prefetch of cookies for first page of search engine results for those engines that use prefetch.

Flash: Linux only

To get the "benefits" of Flash without the evil tracking aspects...

Open up a terminal window:

ls -la to ensure both .adobe and .macromedia are present.

rm -rf .adobe .macromedia
ln -s /dev/null .adobe
ln -s /dev/null .macromedia

Ta-da... Flash cookies are written to /dev/null but you can still use it without being tracked as the

I use Ghostery, Adblock Plus with Easylist, Easy Privacy, Fanboy's Adblock List, Fanboy's Tracking, and Fanboy's Annoyances List. I use FlagFox to see what country a given website is in. I use Ghostery to see the companies that are tracking me. I use this information to add those same trackers into a hosts file that is slowly but surely getting better and better.

I also have Firefox set to Private Browsing Mode with no cookies accepted. I allow on an as-needed basis, which so far is only my bank as my webmail doesn't require cookies.

The above gets me down to pretty much bare content. When sites stop the evil tracking, I may not block near as much.

I don't get the outrage.

[flimflammer]

As much as I hate the facebook +1 button, logging in with facebook, the google variants, and other such functionality that is appearing on pretty much every website, I just can't fault Google that hard for this. The P3P spec is old. Ancient. No one follows it. The standards body who created it doesn't even want anything to do with it. The only reason Microsoft is even bringing this up as to take a shot at Google while Apple is taking a shot at Google for their Safari stuff.

Re:Impractical to Microsoft, MS also send invalid

[mcgrew]

Angle brackets: for the "less than" bracket, &lt; will produce <

The greater than bracket just works as is, just hit the key.

Re:Impractical to Microsoft, MS also send invalid

[makomk]

More like this, I think:

User: "Why can't I log into GMail or use Facebook comments? Your sites suck!"
Google and Facebook: "Well, you see there's this thing called P3P that controls..."
User: "P3what now? This sounds too complicated and technical."
Google and Facebook: "Fine, we'll fix it (by sending something that resembles a P3P policy enough that IE won't break stuff)."

Re:Impractical to Microsoft, MS also send invalid

[makomk]

The first one is a P3P policy in XML format. The second resembles a P3P policy in compact format. As far as I can tell, IE only supports the compact format and not the XML format that you claim Google's policy should look like. If you don't have a P3P policy that's in the compact format it'll reject all third party cookies and even first party cookies under some circumstances.

Interestingly, any kind of complex privacy policy can only really be represented through adding non-standard extensions to the full XML format, and if you do that you're not you're not supposed to use the compact format. This means that it's effectively useless to try and implement P3P properly; IE is the only browser that actually takes any notice of it at all and it's restricted to the non-descriptive compact version which is useless for most sites.

Re:Impractical to Microsoft, MS also send invalid

[Americano]

"Google's just doing the same thing everybody else does."

"The system's broken; Google can't be blamed for exploiting a known bug to make their lives easier while circumventing something users though would protect their privacy."

"If it's not explicitly prevented by Microsoft's software, then there's no problem with Google doing it, even if it goes against the expressed of the users!"

Again: this is the road you want corporations to go down? Seriously? This is the standard you wish them to behave to?

Circumvented?

[lennier]

"Circumvented Internet Explorer's privacy protections".

Um. If a third party can circumvent it, it's not actually a protection.

Re:Impractical to Microsoft, MS also send invalid

[madmark1]

No, this isn't the road I want them to go down, but since they aren't, and your claims have no bearing on what happened here, it really doesn't matter. Google used a broken implementation to provide targeted ads to users who had specifically opted in to the service. This does not make them evil. Had they been using this to track everyone, then yeah, that would be bad. That is what you don't seem to be understanding, despite the multiple times people have explained it. Using tracking cookies on users who specifically opted in to get them is not wrong or evil.

What is evil is Microsoft using a broken implementation of a non-used standard to try and score points over something that shouldn't even be an issue.

Re:Impractical to Microsoft, MS also send invalid

[Americano]

Keep spinning it, people might start to believe that Google did nothing wrong!

Maybe Google did not circumvent Safari privacy

[walterbyrd]

I like the way this poster from reddit put it:

Wow... Experienced web developer here... They tried so hard to make that article accessible for non web developers that it was almost harder for me to understand that way.
My "OMG nefarious" meter isn't even going off at all.
This is a misleading headline.
Google is circumventing
"is" implies "still is" - which they are not.
"circumventing" implies intentionally skirting around a bug - which NOTHING in this article says they are or were.

Cross domain security should be built in to all browsers, and all Google was doing was passing cookies when people hit a button in an iFrame, and google's normal tracking activities if you're logged in to google continued.
All that happened here was that a bug in Safari meant that google's stuff kept working even when it wasn't supposed to. There's no indication that this code was specially geared toward Safari. It sounds like their tracking was meant to automatically continue on as usual, and Safari failed to prevent 3rd party cookies from being sent.

This headline is sensationalist bullshit.

If you want to argue that google does too much tracking in general that's a different story. But there is not one tiny iota of information in this article that suggests google was "exploiting a bug in Safari" -- these iFrame based buttons and the cookies that follow them are standard operating procedure for ad networks.
EDIT: Also credit to /u/powerje, who points out that it was 2 google engineers who fixed the problem in webkit/Safari

http://www.reddit.com/r/apple/comments/ptoez/google_is_circumventing_safari_privacy_settings/

First Apple, Then Microsoft

[bky1701]

What a shocker. Google must be doing something right to have those enemies.

No Google end run - Safari was just broken

[walterbyrd]

Google did not target Safari. Safari's security was just not working until Google fixed it.

All that happened here was that a bug in Safari meant that google's stuff kept working even when it wasn't supposed to

Google did not bypass

[walterbyrd]

Other browsers just have broken security.

Re:Google did not bypass

[Inconexo]

Having my door broken doesn't justify anyone who enters without my permission.

Re:Impractical to Microsoft, MS also send invalid

[walterbyrd]

User: "I don't wish to be tracked. I've opted out using this P3P setting."
Microsoft: "Haha our browser is insecure, out of date, and broken. Be sure to blame Google for our crappy browser. Maybe Google will fix our browser too, just like Google had to do for Apple's insecure browser."

Re:Impractical to Microsoft, MS also send invalid

[walterbyrd]

What is evil is Microsoft using a broken implementation of a non-used standard to try and score points over something that shouldn't even be an issue.

If anything it should be an issue against Microsoft, not Google.

Microsoft smear campaign seems to be working very well, thanks to ignorant people.

MS lets Google choose, so Google chose

[walterbyrd]

What's the big deal? P3P openly let's you decide to bypass it if you care to do so. So Google decided to do so.

What is so much better than Google?

[walterbyrd]

I've gotten to the point in my Internet life where I rarely use Google anymore. There are better options out there

Like what? Please remember that MS, and Facebook, do the same things that the are so desperately trying to smear Google about.

Just more of the anti-Google smear campaign

[walterbyrd]

Apple and MS are scared to death of Google. And neither company has ever liked fair competition.

Re:Impractical to Microsoft, MS also send invalid

[madmark1]

Exactly my point. I wish I could mod and comment, I'd give you a +1. Just not a Google +1.

Sure, but

[OrangeTide]

How far do you want to take this analogy?

Tyranny

[Anonymous Coward]

Tyrants always find rights and freedom impractical and they assert pressing matters to relieve us of both; do not let them.

Re:Impractical to Microsoft, MS also send invalid

[wer32r]

Exploiting browser bugs is what hackers have been doing for more than a decade to perform drive-by installations. The mere fact that they managed to exploit a *bug* doesn't justify their actions. Nor does it for Google.

Re:Impractical to Microsoft, MS also send invalid

[Anonymous Coward]

Will it still complain if I navigate to 127.0.0.1 instead of localhost?

Heaven forbid I take DNS out of the equation and watch my perfectly valid certs throw warnings because the IP doesn't match the DNS name. You'd think the damn browser could reverse lookup before throwing up that alert.

Terribly annoying.

Re:Impractical to Microsoft, MS also send invalid

[Americano]

If I have a crowbar, do I have the right to just walk into your house and use the restroom and help myself to a snack from the fridge because your lock couldn't stop me? How about me presenting falsified credentials from the electric or cable company and lying my way inside, only to leave a floater and eat some of your tasty snacks?

*Respecting* users and their wishes would seem to be part of "doing no evil," and yet you're defending Google's deliberate circumvention of user preferences. It's certainly possible for Google to display a "Hey, we can't set this cookie that's required, unless you open up your browser settings for us. Here's how to do it, and why we think you should" type of page. Instead, they opted to say, "since you signed up to use my service, I'll assume for you that you want it everywhere you go, despite your default browser settings."

Respecting other people's stuff is kind of a big part of what's known as 'polite society.' I've asked this repeatedly of the Google defenders here: Do you really want the standard of behavior for corporations set so low that "whatever they can get away with" is the only limit on their behavior? So far, all I've seen is a willful refusal to accept the facts of the matter: that if any other corporation did this, you would be going apeshit and calling it "hacking" and demanding blood.

Re:Impractical to Microsoft, MS also send invalid

[Anonymous Coward]

How is Google or others supposed to have their services accessed by legitimate customers if they block access to user cookies. We will be sending ourselves back to the old days of IE6 when we would need to manually mod all of the itty bitty settings just to make the internet work the way we wanted it to. If a user is signed into G+ then a cookie should be granted based on a modded version of the P3P standard. This way Google and others would have no need to use the standards current failings to allow their products to work with a draconian improperly implemented web standard.

Re:Impractical to Microsoft, MS also send invalid

[Americano]

"How am I supposed to provide televisions to legitimate customers if tv shops lock up their inventory and don't allow me to take what I need?"

"How am I supposed to provide organs to legitimate organ recipients if people don't allow me to knock them out and steal their kidneys?"

Final time: Do you really want the standard of behavior for corporations set so low that "whatever they can get away with" is the only limit on their behavior?

Google could build a better browser that isn't limited like IE, and convince people to use it; they could educate their users and score points against MSFT for being backwards and out of date, and convince those users to change the settings willingly, but honor them if they haven't been changed; Instead, they opted to simply disregard users' preferences, and do whatever they damn well pleased. And that's a problem, no matter how blindly devoted you are to Google.