Slashdot Mirror
Google: IE Privacy Policy Is Impractical
itwbennett writes "In response to Microsoft's claim that Google circumvented Internet Explorer privacy protections (following the discovery that Google also worked around Safari's privacy settings), Google on Monday said that IE's privacy protection, called P3P, is impractical to comply with."
I suppose privacy is impractical to those who want to sell our personal information.
Thank goodness they're not an evil company. It could have been M$ breaking the Web standard...
Google on Monday said that IE's privacy protection, called P3P, is unprofitable to comply with."
SJW: Someone who has run out of real oppression, and has to fake it.
P3P has been Old and Busted since Slashdot first covered it in 2002.
Microsoft would never bring it up, if they weren't already in panic mode. This seems to indicate that MS is in far worse shape than we know.
Free unix account: freeshell.org
Frankly, as an approach to a security engineering problem, P3P is pretty bad. You are basically allowing your adversary to declare what the security policy will be, then leaving it up to your adversary to follow that policy.
If browser makers were serious about protecting their users' privacy, they would make adblocking the default, they would have stricter cookies policies, and they would not let a company like Google decide what sort of privacy people will have.
Palm trees and 8
I think Google is being polite, as do people who quote a "lack of value"
From http://en.wikipedia.org/wiki/P3P
The main content of a privacy policy is the following:
which information the server stores:
which kind of information is collected (identifying or not);
which particular information is collected (IP address, email address, name, etc.);
Kind of information??? As if the AI problems were all solved. IP Address? Of course it is collected. Email address? Yes if there is an input box that says email address then the address is collected.
http://stephan.sugarmotor.org
Future News: For Windows 8, Microsoft has replaced the traditional log on screen with a text field. Users will now have to simply enter a reason why they should be allowed to log onto the system. The system will accept all answers.
The question that should be asked is: Why does IE have some part of their framework in place which can be simply ignored/violated?
Plus, P3P is faulty, it has a loophole which one can take advantage of. Much better to simply follow a properly designed spec for this sort of thing, like RFC 3514.
"National Security is the chief cause of national insecurity." - Celine's First Law
User: "I don't wish to be tracked. I've opted out using this P3P setting."
Google: "Haha there's a loophole that we're gonna use to track you anyway. Blame Microsoft if you don't like it, sucker!"
Yep, Google has done nothing wrong here whatsoever. They're completely right to exploit a known loophole which allows them to disregard the wishes of the users accessing their services, if those wishes would make Google's services less profitable.
If this is "Do no evil," I shudder to think about the damage Google could do if they decided one day to deliberately engage in evil.
Not only does Facebook do it but Microsoft also does it. The standard they are accusing Google of violating is so out of date that W3 doesn't even try to update it anymore, because no one follows it and most browsers don't even implement it fully. This is a non-story in every direction.
Consider the following (from http://www.w3.org/TR/P3P11/#ua_compact;
6.4 Compact Policy Processing
P3P user agents MUST NOT rely on P3P compact policies that do not comply with the P3P 1.0 or P3P 1.1 specifications or are obviously erroneous. Such compact policies SHOULD be deemed invalid and the corresponding cookies should be treated as if they had no compact policies.
As I understand this, IE should actually search the Google P3P header for a valid statement of what Google intends to do with regard to tracking cookies. If it does not find those, it should apply the default behaviour for web sites without any P3P header. As described by Dean Hachamovitch (the author of the blog post):
By default, IE blocks third-party cookies unless the site presents a P3P Compact Policy Statement indicating how the site will use the cookie and that the sites use does not include tracking the user.
Fine. So your browser sees a Google P3P header without any valid policies. At this point, the clause "unless the site presents..." should kick in and cookies should be blocked. To me this looks like a bug in IE, as they failed to implement the default behavior in this case. It would be appropriate for Microsoft to fix this bug, send the fix as update on next patch day and otherwise be very humble about their error.
Instead, Dean Hachamovitch tries to paint this as conspiracy by Google to circumvent IE's security protection. FAIL.
C - the footgun of programming languages