Google: IE Privacy Policy Is Impractical

Impractical to who? by scruffy · 2012-02-21 03:15 · Score: 5, Insightful

I suppose privacy is impractical to those who want to sell our personal information.

Re:Impractical to who? by badness · 2012-02-21 03:24 · Score: 2, Insightful

When has Google ever stated, or even indicated, that as a goal? They serve personalized ads, but the data they use to do so never leaves their own servers.
Re:Impractical to who? by WolfgangPG · 2012-02-21 03:28 · Score: 3, Insightful

Why would it need to leave their servers when they are a marketing company? They are selling our demographic information to advertisers.
Re:Impractical to who? by Anonymous Coward · 2012-02-21 03:28 · Score: 4, Informative

actually, they would be quite stupid to sell ... because when I consider how much time I spend with google services compared to anything else, they must know about five times as much about me as the next best competitor ... so selling stuff that helps their competition would be really not a good idea ;)
Re:Impractical to who? by alphatel · 2012-02-21 03:43 · Score: 5, Funny

Why would the need to sell our demographic information to advertisers? They are a company that offers free profile pages to plus one enthusiasts.

--
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
Re:Impractical to who? by egamma · 2012-02-21 03:46 · Score: 5, Interesting

"but the data they use to do so never leaves their own servers."
I guess you believe everything you hear/read....
Why would the data leave their servers? They don't need to sell the information to advertisers--they simply tell advertisers, "We know everything about everyone. We will put your ad in front of the 1 million people most likely to respond. You don't need us to sell their information to you--they will provide it when they buy your product."

--
Battlemaster--Game with friends in medival realms
Re:Impractical to who? by CimmerianX · 2012-02-21 04:18 · Score: 2

The data never needs to leave their servers. They sell access to their servers so companies can run queries against the data. The 'Results of the query' go with the company. Never the data.
Re:Impractical to who? by Anonymous Coward · 2012-02-21 04:22 · Score: 4, Funny

Dude - get your monopolies straight! It's Girl Scouts with the cookies, Boy Scouts with the popcorn, and Congress with the assholes!
It's that last one which doesn't leave many unfilled niches for world dominating companies like Google.
Re:Impractical to who? by darkpixel2k · 2012-02-21 04:46 · Score: 3, Interesting

That's for internet advertising. Google does no print advertising, which loads every mailbox in the nation with tons of shit. Considering the amount of people that use their real names, you don't think they'll sell all that data they collect on you to print advertisers for targeted mailing?
What's a mailbox? I don't have a single bill that shows up in my mailbox. It's all paid online. Anything that shows up in the USPS box just gets chucked into the burn barrel. (Unless it's a package shipped by one of the few companies that charges $1 to ship via USPS from clear across the US--but that's rare.)

To save myself time, I've been thinking about replacing my mailbox with an always-on burn barrel--maybe using a propane barbecue bottle to supply it. Maybe the USPS would finally get the hint. Anything 'important' needs a signature and the mail carrier knocks on the door.

--
There's no place like ::1 (I've completed my transition to IPv6)
Re:Impractical to who? by gorzek · 2012-02-21 05:00 · Score: 4, Insightful

Selling that demographic information is how they provide all the free services they do. Their ability to target ads effectively is what makes them attractive to advertisers.
I get that Slashdotters are deeply paranoid about anyone knowing anything about them, but at the same time, you aren't entitled to free services like those that Google provides. If you really don't want anything to do with Google, modify your hosts file so all requests to *.google.com (and related domains) are sent nowhere. That's "voting with your wallet," so to speak.
But I can't say I have much patience for people who want to use Google's services and then complain about Google using the information they gather about you as part of their advertising system. There's room to argue about what they should or shouldn't be allowed to do with it, but to presume they shouldn't have any information about you at all is a bit silly.

--
Check out my world simulator thingy.
Re:Impractical to who? by honkycat · 2012-02-21 05:40 · Score: 4, Insightful

Are we entitled to something for nothing? No, of course not.
However, it doesn't follow that Google is therefore entitled to disregard an unambiguous request from a user not to collect personal data. If they feel that a user is granting them too little information in exchange for their service, they are free to deny that user access. Making an end run around security settings is sleazy, no matter how you dice it.
I'd have a lot more sympathy for Google if the first story to break was this public complaint, together with a statement of how they were working around it and a warning to affected users that their privacy settings were being circumvented. To make a statement like this /after/ being caught with their corporate hand in the proverbial cookie jar doesn't make a very good defense.
Re:Impractical to who? by gorzek · 2012-02-21 05:50 · Score: 3, Insightful

If you don't like what Google does with your information, do not use their services and therefore avoid providing any information at all.
I agree that Google has every right to block access to people who don't allow Google to collect the information they want. That's the price you pay for their services, after all.
I think that's entirely separate from Google working around IE's security settings, which I agree is pretty fucking shady and not something they have any right to do.

--
Check out my world simulator thingy.
Re:Impractical to who? by StuartHankins · 2012-02-21 06:17 · Score: 2

modify your hosts file
Oh no!!! You have summoned APK!!!
Re:Impractical to who? by madmark1 · 2012-02-21 07:37 · Score: 5, Informative

No, they aren't. In the Safari case, the default setting in Safari is to block third party cookies. No one made that choice, unless it was to go in and unblock them. Seeing as how Safari is the only browser that blocks them by default, most people probably don't even realize they ARE blocked. And in this specific case, the 'work-around' was to provide tracking cookies to people logged in to G+ who specifically opted in to targeted ads. How this can possibly be spun into Google doing evil is really amazing to me. They did exactly what their customers asked for, and got thrashed for it. Lets not forget also that the cookies in question were non-specific, and had no personally identifiable information in them. Did anyone even read the article on that?
In the IE case, Microsoft is relying on an optional, trust based system deprecated 5 years ago as a method of protecting your privacy. Once again, Google used a perfectly legitimate part of that standard to bypass it, for the express purpose of giving users who were logged in to G+ and opted in to targeted ads, those targeted ads. Explain the evil here, if you would?
Re:Impractical to who? by Col.+Klink+(retired) · 2012-02-21 08:55 · Score: 4, Interesting

Wait, you're cheering for the company that told google (and some 11,000 other websites) how to work around their broken P3P implementation?

The 2010 research paper "discovered that Microsoft's support website recommends the use of invalid CPs (codes) as a work-around for a problem in IE." This recommendation was a major reason that many of the 11,176 websites provided different code to the one requested by Microsoft.

--
-- Don't Tase me, bro!
Re:Impractical to who? by madmark1 · 2012-02-21 10:47 · Score: 3, Informative

I like it, anyone who has a valid argument must be a 'fanboi' because you can't figure out the logic.
If you were not signed in to G+, and hadn't opted in to targeted ads, then no, Google did not go around your express privacy choices. See how it works, genius? If you weren't opted in, then you got no cookie, put there against your wishes or not. Why is that so hard to figure out?
Second, the IE thing, it is a trust based system that was deprecated 5 years ago, and only implemented by IE anyway. Why is Google wrong for not paying attention to a lapsed system? And again, it was done to allow people who had opted in to get exactly what they asked for, so where is the privacy problem? If you weren't a G+ member, and didn't opt in to ads, then you didn't get a damn cookie, they didn't 'exploit' anything, and you have no horse in this race at all.
I'm still waiting for someone to explain to me how bypassing ANYTHING to allow users what they opted in to once already, but were blocked by specific browser implementations from getting, is wrong or evil?
Regardless of whether the users were savvy enough to know they opted in to ads or not is a separate question, and really has no bearing whatsoever on whether they opted in or not. If they left it at the default,but signed in to G+, they are getting targeted ads. If they didn't read the agreement, that is hardly Google's fault, no? Nor is it their fault if they provide those ads. They can opt out at any time, and the 'privacy violations' stop. It really is that simple.
No, I don't own Google stock, nor Apple, nor Microsoft. I believe ALL corporations are amoral and not to be trusted. I just believe we should be mad at them for the things they actually do, rather than manufacturing bullshit anger over something that doesn't even exist. They do enough bad on their own, we don't have to go looking for BS reasons to be pissed. I also happen to dislike misinformation, no matter who it's directed toward. If you couldn't bother to read about the issue, why are you even commenting? To show how little you know?
Re:Impractical to who? by noh8rz2 · 2012-02-21 11:04 · Score: 2

Let me make a car analogy to simplify it for you. My car is configured to automatically lock when parked (like safari, default cookie setting, see?). At the same time, I signed up for google's informational flyer service, where they put a map in my car with stores I might be interested in, and also throws I an few ad flyers. But there,s a conflict, right? I asked google to put shit in my car, but my car locks by default. Obviously, the correct resolution is for google to respect my locked car, but yu're telling me that it is correct for google to break in to leave me the flyers even though I don't want anybody to go in my car. Do you understand how wack that is? Now that I,ve laid it out for you using small words, please admit that you were wrong.
Re:Impractical to who? by cheater512 · 2012-02-21 12:22 · Score: 2

When the starting value is $0, Google doesn't really care if you'd prefer things differently.
Now if you paid $1 per search they most certainly would listen to your feedback and try and 'increase the value to you'.

No it isn't. by Anonymous Coward · 2012-02-21 03:22 · Score: 2, Insightful

Stop including P3P header data if all you're going to put is "this is not a P3P policy" in it. How impractical is that?

Google by Dexter+Herbivore · 2012-02-21 03:23 · Score: 4, Funny

Do No... errr, nevermind.

Wer're safe! by accessbob · 2012-02-21 03:23 · Score: 5, Funny

Thank goodness they're not an evil company. It could have been M$ breaking the Web standard...

Re:Wer're safe! by poetmatt · 2012-02-21 04:04 · Score: 2

Well it's not like they have a contract with facebook as Microsoft does, to do what google does to IE anyway, right? Right?
Too soon?
Re:Wer're safe! by thetoadwarrior · 2012-02-21 07:45 · Score: 2

I'd hardly consider it a standard when it development died shortly after it became a standard and IE is the only one to implement it.

The flaw has been known since at least 2010 and in fact when it was pointed out that even Microsoft was passing invalid codes on their own support site. Some people get such a hard-on for ripping on Google that they're willing to defend MS as the good guy despite implementing something that was completely broken and never offered any protection.

http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enough-for-a-cookie-to-fit-through/

Google certainly is not perfect but MS is the one that is at fault here and they just look desperate by pointing out that Google (like many people including themselves) have by passed their failed privacy protection.

Microsoft Quality by darkfeline · 2012-02-21 03:24 · Score: 4, Funny

IE privacy protections were "circumvented" by Google sending a string stating, "This is not a P3P policy." Typical Microsoft quality product, that's like getting conned by a guy wearing a shirt that says "I don't guarantee I won't run off with your money" and then sueing them.

Re:Microsoft Quality by betterunixthanunix · 2012-02-21 03:30 · Score: 5, Insightful

Frankly, as an approach to a security engineering problem, P3P is pretty bad. You are basically allowing your adversary to declare what the security policy will be, then leaving it up to your adversary to follow that policy.

If browser makers were serious about protecting their users' privacy, they would make adblocking the default, they would have stricter cookies policies, and they would not let a company like Google decide what sort of privacy people will have.

--
Palm trees and 8
Re:Microsoft Quality by SaroDarksbane · 2012-02-21 03:33 · Score: 5, Funny

Future News: For Windows 8, Microsoft has replaced the traditional log on screen with a text field. Users will now have to simply enter a reason why they should be allowed to log onto the system. The system will accept all answers.
Re:Microsoft Quality by SJHillman · 2012-02-21 03:40 · Score: 4, Funny

Or if you have a webcam, it will accept sincere looking smiles.
Re:Microsoft Quality by msauve · 2012-02-21 04:14 · Score: 5, Funny

Plus, P3P is faulty, it has a loophole which one can take advantage of. Much better to simply follow a properly designed spec for this sort of thing, like RFC 3514.

--
"National Security is the chief cause of national insecurity." - Celine's First Law
Re:Microsoft Quality by Xest · 2012-02-21 04:32 · Score: 4, Insightful

I remember thinking the same when I was forced to study it academically some time ago, and thought at the time what the fuck is the point in it exactly?
Well at least now I have my answer, it makes for good headlines when you want to troll your competitors with it if nothing else.

FTFY by elrous0 · 2012-02-21 03:24 · Score: 5, Funny

Google on Monday said that IE's privacy protection, called P3P, is unprofitable to comply with."

--
SJW: Someone who has run out of real oppression, and has to fake it.

Re:FTFY by Larryish · 2012-02-21 03:52 · Score: 3, Informative

MS is a private company, not a legislative body.
As the situation is presented, Google is under no legal requirement to comply with any 3rd party browser "privacy requirements" outside of any existing legal agreements with manufacturers of said browsers. Was any such agreement in place?
tl;dr - MS can go get stuffed.
Re:FTFY by Americano · 2012-02-21 04:06 · Score: 2, Interesting

Google is under no legal requirement, but remember, they're the "Do No Evil!" crowd. Deliberately circumventing a system which allows browser USERS to say "I don't want to allow cookies from sites which will do X, Y, or Z with my data," would seem to fly in the face of that policy, wouldn't it?
What you're saying is, "Since Microsoft didn't create a hermetically sealed box that's unable to be bypassed, it's okay for Google to simply disrespect the wishes of the user - as expressed by the web browser settings - and do whatever they want."
Is this REALLY a road you think any company should be going down, where "whatever's not bolted down" is fair game for anybody smart enough to take it?
Re:FTFY by Americano · 2012-02-21 04:36 · Score: 2, Interesting

If Google sent nothing, and simply said "We refuse to support P3P," then the P3P system would have stopped them setting the tracking cookie. So Google had to expend the effort to:
1) Find a loophole that would allow them to track users even if this P3P system was in place;
2) Implement & test their workaround;
So yes, they had to deliberately develop and implement a workaround to allow them to plant the tracking cookie on IE users. Because not planting that cookie would be ever-so-inconvenient and unprofitable for them otherwise.
What blows my mind is that people are trying to frame this as a "Google vs. Microsoft" issue, when it is very clearly a "Google vs. User" issue. Google should respect the wishes of the users, as expressed by the P3P settings, or work to convince users that it is trustworthy & that they should change their settings (or use a different browser) that would allow google to track them. Hard claiming you're trustworthy when you're caught making an end-run around user preferences because they happen to be at odds with your business model.
Re:FTFY by madmark1 · 2012-02-21 07:54 · Score: 3, Insightful

No, everyone is framing it correctly as a Google vs. Microsoft issue, since Microsoft intended it that way, using the 'user' as a convenient damsel in distress. The fact is, Google is following the standard as written. IE is not handling the invalid P3P statement as it should, as laid out in their own specification. Any malformed statement should be treated as having no statement, and the cookies blocked. Instead, IE happily accepts the malformed response and allows the cookies anyway. They brought this up now because of the Safari thing, they are playing piggyback-the-bad-press here.
You know who else 'circumvents' P3P policies? Microsoft. Oh, and some outfit they have a contract with, called uhm... Facebook, or something.

Dear Google by JamesP · 2012-02-21 03:26 · Score: 3, Interesting

So you're telling me it's impractical to send nothing or to NOT SEND BS in the field?

Congratulations for being as evil as MS

--
how long until /. fixes commenting on Chrome?

Re:Dear Google by xeno314 · 2012-02-21 04:13 · Score: 2

They could also have just not sent P3P headers if they didn't intend to actually provide a valid one and comply with it...
Re:Dear Google by Americano · 2012-02-21 04:22 · Score: 4, Insightful

I find it amusing that you are twisting and squirming to rationalize how Google explicitly disregarding the wishes of the user and exploiting a well-known loophole in the P3P spec in order to do something against that user's wishes is "not evil."
Even in the best "Microsoft should have prevented this" light, it makes them no better than the used car dealer who tries to convince you that the rust on that El Camino is a special limited-edition two-tone finish that the manufacturer tested out, and the noise from that busted exhaust system is just evidence that the car has a special glasspack muffler. It's bottom-feeding behavior of the worst sort, and blatant hypocrisy from a company that carries on about its "do no evil" policy.
Re:Dear Google by BitZtream · 2012-02-21 04:27 · Score: 2

They send a valid P3P header that says 'we're not complying with your privacy request'
IE says 'Thanks for complying! with our policy!'
How exactly is that googles fault?

--
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Re:Dear Google by ceoyoyo · 2012-02-21 05:11 · Score: 3, Interesting

Right. They exploited a bug in Internet Explorer so they could track users against their wishes. On is own maybe more naughty than evil, but following on their very purposeful and sneaky bypassing of anti-tracking measures in Safari, it's just a continuation of a pattern of sneaky disregard for users' wishes.
Don't be evil had to go out the window the second Google became an advertising company. If you didn't realize before, it should have become obvious when they bought doubleclick, the evilest company on the web.
Re:Dear Google by madmark1 · 2012-02-21 08:00 · Score: 2

You are wrong on both counts. In both cases, the tracking cookies were placed for users logged in to G+, who had opted in to targeted ads. How again is that exploiting a bug so they could track users against their wishes? How is it again that having something on by default represents a users wishes anyway?

Old and Busted by uigrad_2000 · 2012-02-21 03:27 · Score: 5, Interesting

P3P has been Old and Busted since Slashdot first covered it in 2002.

Microsoft would never bring it up, if they weren't already in panic mode. This seems to indicate that MS is in far worse shape than we know.

--
Free unix account: freeshell.org

Not impractical, ridiculous! by sugarmotor · 2012-02-21 03:32 · Score: 5, Interesting

I think Google is being polite, as do people who quote a "lack of value"

From http://en.wikipedia.org/wiki/P3P

The main content of a privacy policy is the following:

which information the server stores:
which kind of information is collected (identifying or not);
which particular information is collected (IP address, email address, name, etc.);

Kind of information??? As if the AI problems were all solved. IP Address? Of course it is collected. Email address? Yes if there is an input box that says email address then the address is collected.

--
http://stephan.sugarmotor.org

misleading/wrong question by poetmatt · 2012-02-21 03:36 · Score: 5, Insightful

The question that should be asked is: Why does IE have some part of their framework in place which can be simply ignored/violated?

Re:misleading/wrong question by Barsteward · 2012-02-21 03:54 · Score: 2

honey trap?

--
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
Re:misleading/wrong question by Anonymous Coward · 2012-02-21 03:58 · Score: 2, Insightful

Yeah! Why are they bothering to follow the P3P standard that they didn't invent?
(rolling eyes)
Re:misleading/wrong question by Desler · 2012-02-21 04:33 · Score: 5, Insightful

Yeah how dare they implement the P3P standard as it tells them to! Google is using a loophole in the standard to bypass the privacy protection.
Re:misleading/wrong question by timeOday · 2012-02-21 05:06 · Score: 4, Insightful

I disagree. A culture of, "if you are able to do it, it must be fine" is flawed at a very basic level. It's a failure to recognize anything above the law of the jungle. Property law gives us the freedom to have windows in our homes, even though, technically, they're easy to smash. Envelopes are easy to open an copper pairs are easy to tap, yet the laws that preclude this have been very effective - not totally, but far better than nothing. With the level of automated tracking of all kinds available these days, there simply cannot be any privacy unless there is a collective commitment to creating preserving such rights.
Re:misleading/wrong question by arkhan_jg · 2012-02-21 05:42 · Score: 4, Insightful

Because P3P was a pile of crap to begin with, is drastically out of date and long since abandoned by everyone except microsoft?
From wikipedia:
"The Platform for Privacy Preferences Project (P3P) is a protocol allowing websites to declare their intended use of information they collect about web browser users. Designed to give users more control of their personal information when browsing, P3P was developed by the World Wide Web Consortium (W3C) and officially recommended on April 16, 2002. Development ceased shortly thereafter and there have been very few implementations of P3P. Microsoft Internet Explorer is the only major browser to support P3P. The president of TRUSTe has stated that P3P has not been implemented widely due to the difficulty and lack of value."
"P3P manages information through privacy policies. When a website uses P3P, they set up a set of policies that allows them to state their intended uses of personal information that may be gathered from their site visitors. When a user decides to use P3P, they set their own set of policies and state what personal information they will allow to be seen by the sites that they visit. Then when a user visits a site, P3P will compare what personal information the user is willing to release, and what information the server wants to get – if the two do not match, P3P will inform the user and ask if he/she is willing to proceed to the site, and risk giving up more personal information."
P3P can't handle 'legit' cookies not being associated with the domain you're actually viewing. IE requires a P3P policy to exist for 3rd party cookies to be saved when that setting is turned on; google's exists, but just says "this is not a p3p policy", and points you to their privacy policy. IE then goes 'alrighty then, you've got a P3P policy that's utter garbage even though I'm the one that asked for it, but here, go ahead and set that cookie anyway'.
Frankly, Google not respecting Mozilla's DoNotTrack header is a much worse case of ignoring expressed user privacy than this crappy old IE only 'standard' having a loophole you could ride an elephant through.

--
Remember kids, it's all fun and games until someone commits wholesale galactic genocide.
Re:misleading/wrong question by whereissue · 2012-02-21 05:43 · Score: 2

I disagree. A culture of "sloppy and permissive software" is flawed at a very basic level. It's a failure to recognize the fact that the virtual window of your analogy will be smashed EVERY time. Eventually, actual bars are put over actual windows, to prevent break-ins if they are persistent.
With the level of automated tracking of all kinds available these days, there simply cannot be any forgiveness for a vendor who feels that the best response to a broken window is to, simply, leave it open.

--
where is sue? sue is idle.
Re:misleading/wrong question by amicusNYCL · 2012-02-21 05:48 · Score: 2

If P3P is being violated, then they should be making sure P3P is enforced, not calling into question google
Isn't that what they're doing? Google is essentially violating the standard by claiming their cookies have no privacy implications, and Microsoft is trying to call them out on it.

--
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Re:misleading/wrong question by poetmatt · 2012-02-21 06:49 · Score: 2, Informative

Please.
Microsoft created the standard *AND* implemented it. It's their own fault if they allow loopholes.
see: https://plus.google.com/u/0/114753028665775786510/posts/fuLZoEkJZNs
and NYT criticism of basically creating security loopholes: http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enough-for-a-cookie-to-fit-through/
google's fault? none, really.
title: "If you rely on Microsoft’s Internet Explorer’s privacy settings to control cookies on your computer, you may want to rethink that strategy."
Re:misleading/wrong question by madmark1 · 2012-02-21 07:42 · Score: 2

They aren't implementing the P3P standard as it tells them to, because the standard says if the P3P statement can't be parsed, it should assume the worst, not allow it through. Did you even read the standard?
Re:misleading/wrong question by Kalriath · 2012-02-21 14:41 · Score: 2

Bullshit. You know where P3P actually comes from? The World Wide Web Consortium [w3.org] (W3C). The people who brought us HTML, and CSS. Where does it not come from? Microsoft. In fact, Microsoft isn't even one of the contributors (AT&T, IBM, ETH, MIT and the University of Venice are though). Funnily enough, the author didn't even imply in that G+ post you link to that Microsoft invented P3P.

--
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".

Impractical to Microsoft, MS also send invalid P3P by Anonymous Coward · 2012-02-21 03:43 · Score: 4, Interesting

I find it interesting that Microsoft also sends an invalid privacy header, just as they are complaining about Google doing.
I also find it interesting that MS is blaming Google for IE's failed handling on invalid P3P headers rather than fixing their product.

Re:Android by andydread · 2012-02-21 03:59 · Score: 2

You do realise that Microsoft does the same thing right? They send an invalid privacy header the same way they are complaining that Google is doing. So you trust Microsoft to tell you the truth?

Re:Impractical to Microsoft, MS also send invalid by 0racle · 2012-02-21 04:01 · Score: 4, Informative

I also find it interesting that MS is blaming Google for IE's failed handling on invalid P3P headers rather than fixing their product.

As I understand it, Microsoft is following the spec properly. Google is exploiting a loophole in the spec.

--
"I use a Mac because I'm just better than you are."

Re:Impractical to Microsoft, MS also send invalid by msauve · 2012-02-21 04:09 · Score: 4, Insightful

" Google is exploiting a loophole in the spec."

Which is another way of saying: Google is also following the spec. The problem is, the spec is faulty, and doesn't provide what it's intended to.

--
"National Security is the chief cause of national insecurity." - Celine's First Law

One question never answered by microbee · 2012-02-21 04:21 · Score: 3, Interesting

How does Facebook do it (the Like button)? Does Facebook also circumvent it this way? Either Facebook found a way to do it better, or they are both doing the same thing.

Can we stop the Google/Microsoft bashing and focus on the techniques please?

Re:One question never answered by MozeeToby · 2012-02-21 04:37 · Score: 5, Informative

Not only does Facebook do it but Microsoft also does it. The standard they are accusing Google of violating is so out of date that W3 doesn't even try to update it anymore, because no one follows it and most browsers don't even implement it fully. This is a non-story in every direction.
Re:One question never answered by Anonymous Coward · 2012-02-21 05:23 · Score: 4, Informative

Check the ARS story with 2 updates:
http://arstechnica.com/tech-policy/news/2012/02/google-tricks-internet-explorer-into-accepting-tracking-cookies-microsoft-claims.ars
Yes Facebook is doing it as well as msn.com and live.com

Re:Android by Anonymous Coward · 2012-02-21 04:23 · Score: 2

[Citation Needed]

Re:Impractical to Microsoft, MS also send invalid by Americano · 2012-02-21 04:26 · Score: 5, Insightful

User: "I don't wish to be tracked. I've opted out using this P3P setting."
Google: "Haha there's a loophole that we're gonna use to track you anyway. Blame Microsoft if you don't like it, sucker!"

Yep, Google has done nothing wrong here whatsoever. They're completely right to exploit a known loophole which allows them to disregard the wishes of the users accessing their services, if those wishes would make Google's services less profitable.

If this is "Do no evil," I shudder to think about the damage Google could do if they decided one day to deliberately engage in evil.

Re:Impractical to Microsoft, MS also send invalid by TheGratefulNet · 2012-02-21 04:29 · Score: 3, Informative

what the text SHOULD look like (assme angle brackets here; sorry for having to reformat to get around slash filters)

[META xmlns="http://www.w3.org/2002/01/P3Pv1"]
[POLICY-REFERENCES]
[POLICY-REF about="/P3P/Policies.xml#first"]
[COOKIE-INCLUDE name="*" value="*" domain="*" path="*"/]
[COOKIE-EXCLUDE name="obnoxious-cookie" value="*" domain=".example.com" path="/"/]
[/POLICY-REF]
[POLICY-REF about="/P3P/Policies.xml#second"]
[COOKIE-INCLUDE name="obnoxious-cookie" value="*" domain=".example.com" path="/"/]
[/POLICY-REF]
[/POLICY-REFERENCES]
[/META]

and what googles looks like:

P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 [google.com] for more info.

now, without even having a compsci101 level course, anyone here see which is the more correct parseable string and which is weasel bullshit?

--

--
"It is now safe to switch off your computer."

Re: I shudder to think about the damage by TaoPhoenix · 2012-02-21 04:57 · Score: 2

Obligatory!
Don't make Google angry. You wouldn't like it if it became angry.

--
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine

Re:Impractical to Microsoft, MS also send invalid by gnasher719 · 2012-02-21 05:02 · Score: 2

Suggested update for Internet Explorer:

IE should try to parse the P3P according to the spec. If that fails, then display the contents to a user, with buttons: "Accept cookie", "Reject cookie", and "never allow visits to this site again".

Re:Impractical to Microsoft, MS also send invalid by Lonewolf666 · 2012-02-21 05:10 · Score: 5, Informative

Consider the following (from http://www.w3.org/TR/P3P11/#ua_compact;

6.4 Compact Policy Processing

P3P user agents MUST NOT rely on P3P compact policies that do not comply with the P3P 1.0 or P3P 1.1 specifications or are obviously erroneous. Such compact policies SHOULD be deemed invalid and the corresponding cookies should be treated as if they had no compact policies.

As I understand this, IE should actually search the Google P3P header for a valid statement of what Google intends to do with regard to tracking cookies. If it does not find those, it should apply the default behaviour for web sites without any P3P header. As described by Dean Hachamovitch (the author of the blog post):

By default, IE blocks third-party cookies unless the site presents a P3P Compact Policy Statement indicating how the site will use the cookie and that the sites use does not include tracking the user.

Fine. So your browser sees a Google P3P header without any valid policies. At this point, the clause "unless the site presents..." should kick in and cookies should be blocked. To me this looks like a bug in IE, as they failed to implement the default behavior in this case. It would be appropriate for Microsoft to fix this bug, send the fix as update on next patch day and otherwise be very humble about their error.

Instead, Dean Hachamovitch tries to paint this as conspiracy by Google to circumvent IE's security protection. FAIL.

--
C - the footgun of programming languages

Re:Impractical to Microsoft, MS also send invalid by The+Moof · 2012-02-21 07:10 · Score: 2

Yea, that End-User Allow/Deny thing did wonders for ActiveX security. How about if it's malformed, throw it out entirely and treat the request as if the P3P was not present?

Re:Impractical to Microsoft, MS also send invalid by madmark1 · 2012-02-21 07:46 · Score: 2

So are you telling me you actually opted out using P3P? If so, you must be one of the 10 people on earth who actually knew what this was before the story broke. P3P is a broken system, has been a broken system forever, and has been deprecated as a standard since 2007. This is the privacy protection you are relying on? A system that even Microsoft exploits in EXACTLY THE SAME WAY as Google did?

Re:Impractical to Microsoft, MS also send invalid by dissy · 2012-02-21 08:03 · Score: 2

what the text SHOULD look like (assme angle brackets here; sorry for having to reformat to get around slash filters)

[META xmlns="http://www.w3.org/2002/01/P3Pv1"]
[POLICY-REFERENCES]
[POLICY-REF about="/P3P/Policies.xml#first"]
[COOKIE-INCLUDE name="*" value="*" domain="*" path="*"/]
[COOKIE-EXCLUDE name="obnoxious-cookie" value="*" domain=".example.com" path="/"/]
[/POLICY-REF]
[POLICY-REF about="/P3P/Policies.xml#second"]
[COOKIE-INCLUDE name="obnoxious-cookie" value="*" domain=".example.com" path="/"/]
[/POLICY-REF]
[/POLICY-REFERENCES]
[/META]

And what the P3P header at www.microsoft.com looks like:

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

now, without even having a compsci101 level course, anyone here see which is the more correct parseable string and which is weasel bullshit?

I guess the first is correct, and the second is bullshit?

I don't get the outrage. by flimflammer · 2012-02-21 08:29 · Score: 2

As much as I hate the facebook +1 button, logging in with facebook, the google variants, and other such functionality that is appearing on pretty much every website, I just can't fault Google that hard for this. The P3P spec is old. Ancient. No one follows it. The standards body who created it doesn't even want anything to do with it. The only reason Microsoft is even bringing this up as to take a shot at Google while Apple is taking a shot at Google for their Safari stuff.

Re:Impractical to Microsoft, MS also send invalid by mcgrew · 2012-02-21 08:38 · Score: 2

Angle brackets: for the "less than" bracket, < will produce <

The greater than bracket just works as is, just hit the key.

--
Free Martian Whores!

Maybe Google did not circumvent Safari privacy by walterbyrd · 2012-02-21 15:47 · Score: 2

I like the way this poster from reddit put it:

Wow... Experienced web developer here... They tried so hard to make that article accessible for non web developers that it was almost harder for me to understand that way.
My "OMG nefarious" meter isn't even going off at all.
This is a misleading headline.
Google is circumventing
"is" implies "still is" - which they are not.
"circumventing" implies intentionally skirting around a bug - which NOTHING in this article says they are or were.

Cross domain security should be built in to all browsers, and all Google was doing was passing cookies when people hit a button in an iFrame, and google's normal tracking activities if you're logged in to google continued.
All that happened here was that a bug in Safari meant that google's stuff kept working even when it wasn't supposed to. There's no indication that this code was specially geared toward Safari. It sounds like their tracking was meant to automatically continue on as usual, and Safari failed to prevent 3rd party cookies from being sent.

This headline is sensationalist bullshit.

If you want to argue that google does too much tracking in general that's a different story. But there is not one tiny iota of information in this article that suggests google was "exploiting a bug in Safari" -- these iFrame based buttons and the cookies that follow them are standard operating procedure for ad networks.
EDIT: Also credit to /u/powerje, who points out that it was 2 google engineers who fixed the problem in webkit/Safari

http://www.reddit.com/r/apple/comments/ptoez/google_is_circumventing_safari_privacy_settings/

Slashdot Mirror

Google: IE Privacy Policy Is Impractical

72 of 258 comments (clear)