Slashdot Mirror
Google: IE Privacy Policy Is Impractical
itwbennett writes "In response to Microsoft's claim that Google circumvented Internet Explorer privacy protections (following the discovery that Google also worked around Safari's privacy settings), Google on Monday said that IE's privacy protection, called P3P, is impractical to comply with."
I suppose privacy is impractical to those who want to sell our personal information.
Do No... errr, nevermind.
Thank goodness they're not an evil company. It could have been M$ breaking the Web standard...
IE privacy protections were "circumvented" by Google sending a string stating, "This is not a P3P policy." Typical Microsoft quality product, that's like getting conned by a guy wearing a shirt that says "I don't guarantee I won't run off with your money" and then sueing them.
Google on Monday said that IE's privacy protection, called P3P, is unprofitable to comply with."
SJW: Someone who has run out of real oppression, and has to fake it.
P3P has been Old and Busted since Slashdot first covered it in 2002.
Microsoft would never bring it up, if they weren't already in panic mode. This seems to indicate that MS is in far worse shape than we know.
Free unix account: freeshell.org
I think Google is being polite, as do people who quote a "lack of value"
From http://en.wikipedia.org/wiki/P3P
The main content of a privacy policy is the following:
which information the server stores:
which kind of information is collected (identifying or not);
which particular information is collected (IP address, email address, name, etc.);
Kind of information??? As if the AI problems were all solved. IP Address? Of course it is collected. Email address? Yes if there is an input box that says email address then the address is collected.
http://stephan.sugarmotor.org
The question that should be asked is: Why does IE have some part of their framework in place which can be simply ignored/violated?
I find it interesting that Microsoft also sends an invalid privacy header, just as they are complaining about Google doing.
I also find it interesting that MS is blaming Google for IE's failed handling on invalid P3P headers rather than fixing their product.
As I understand it, Microsoft is following the spec properly. Google is exploiting a loophole in the spec.
"I use a Mac because I'm just better than you are."
" Google is exploiting a loophole in the spec."
Which is another way of saying: Google is also following the spec. The problem is, the spec is faulty, and doesn't provide what it's intended to.
"National Security is the chief cause of national insecurity." - Celine's First Law
I find it amusing that you are twisting and squirming to rationalize how Google explicitly disregarding the wishes of the user and exploiting a well-known loophole in the P3P spec in order to do something against that user's wishes is "not evil."
Even in the best "Microsoft should have prevented this" light, it makes them no better than the used car dealer who tries to convince you that the rust on that El Camino is a special limited-edition two-tone finish that the manufacturer tested out, and the noise from that busted exhaust system is just evidence that the car has a special glasspack muffler. It's bottom-feeding behavior of the worst sort, and blatant hypocrisy from a company that carries on about its "do no evil" policy.
User: "I don't wish to be tracked. I've opted out using this P3P setting."
Google: "Haha there's a loophole that we're gonna use to track you anyway. Blame Microsoft if you don't like it, sucker!"
Yep, Google has done nothing wrong here whatsoever. They're completely right to exploit a known loophole which allows them to disregard the wishes of the users accessing their services, if those wishes would make Google's services less profitable.
If this is "Do no evil," I shudder to think about the damage Google could do if they decided one day to deliberately engage in evil.
Not only does Facebook do it but Microsoft also does it. The standard they are accusing Google of violating is so out of date that W3 doesn't even try to update it anymore, because no one follows it and most browsers don't even implement it fully. This is a non-story in every direction.
Consider the following (from http://www.w3.org/TR/P3P11/#ua_compact;
6.4 Compact Policy Processing
P3P user agents MUST NOT rely on P3P compact policies that do not comply with the P3P 1.0 or P3P 1.1 specifications or are obviously erroneous. Such compact policies SHOULD be deemed invalid and the corresponding cookies should be treated as if they had no compact policies.
As I understand this, IE should actually search the Google P3P header for a valid statement of what Google intends to do with regard to tracking cookies. If it does not find those, it should apply the default behaviour for web sites without any P3P header. As described by Dean Hachamovitch (the author of the blog post):
By default, IE blocks third-party cookies unless the site presents a P3P Compact Policy Statement indicating how the site will use the cookie and that the sites use does not include tracking the user.
Fine. So your browser sees a Google P3P header without any valid policies. At this point, the clause "unless the site presents..." should kick in and cookies should be blocked. To me this looks like a bug in IE, as they failed to implement the default behavior in this case. It would be appropriate for Microsoft to fix this bug, send the fix as update on next patch day and otherwise be very humble about their error.
Instead, Dean Hachamovitch tries to paint this as conspiracy by Google to circumvent IE's security protection. FAIL.
C - the footgun of programming languages
Check the ARS story with 2 updates:
http://arstechnica.com/tech-policy/news/2012/02/google-tricks-internet-explorer-into-accepting-tracking-cookies-microsoft-claims.ars
Yes Facebook is doing it as well as msn.com and live.com