Forgot your password?
typodupeerror
This discussion has been archived. No new comments can be posted.

Google: IE Privacy Policy Is Impractical

Comments Filter:
  • by scruffy (29773) on Tuesday February 21, 2012 @11:15AM (#39110901)
    I suppose privacy is impractical to those who want to sell our personal information.
    • Re: (Score:2, Insightful)

      by badness (78200)

      When has Google ever stated, or even indicated, that as a goal? They serve personalized ads, but the data they use to do so never leaves their own servers.

      • Re: (Score:3, Insightful)

        by WolfgangPG (827468)
        Why would it need to leave their servers when they are a marketing company? They are selling our demographic information to advertisers.
        • by alphatel (1450715) * on Tuesday February 21, 2012 @11:43AM (#39111399)
          Why would the need to sell our demographic information to advertisers? They are a company that offers free profile pages to plus one enthusiasts.
        • by gorzek (647352) <gorzek@Nospam.gmail.com> on Tuesday February 21, 2012 @01:00PM (#39112675) Homepage Journal

          Selling that demographic information is how they provide all the free services they do. Their ability to target ads effectively is what makes them attractive to advertisers.

          I get that Slashdotters are deeply paranoid about anyone knowing anything about them, but at the same time, you aren't entitled to free services like those that Google provides. If you really don't want anything to do with Google, modify your hosts file so all requests to *.google.com (and related domains) are sent nowhere. That's "voting with your wallet," so to speak.

          But I can't say I have much patience for people who want to use Google's services and then complain about Google using the information they gather about you as part of their advertising system. There's room to argue about what they should or shouldn't be allowed to do with it, but to presume they shouldn't have any information about you at all is a bit silly.

          • by honkycat (249849) on Tuesday February 21, 2012 @01:40PM (#39113263) Homepage Journal

            Are we entitled to something for nothing? No, of course not.

            However, it doesn't follow that Google is therefore entitled to disregard an unambiguous request from a user not to collect personal data. If they feel that a user is granting them too little information in exchange for their service, they are free to deny that user access. Making an end run around security settings is sleazy, no matter how you dice it.

            I'd have a lot more sympathy for Google if the first story to break was this public complaint, together with a statement of how they were working around it and a warning to affected users that their privacy settings were being circumvented. To make a statement like this /after/ being caught with their corporate hand in the proverbial cookie jar doesn't make a very good defense.

            • by gorzek (647352) <gorzek@Nospam.gmail.com> on Tuesday February 21, 2012 @01:50PM (#39113445) Homepage Journal

              If you don't like what Google does with your information, do not use their services and therefore avoid providing any information at all.

              I agree that Google has every right to block access to people who don't allow Google to collect the information they want. That's the price you pay for their services, after all.

              I think that's entirely separate from Google working around IE's security settings, which I agree is pretty fucking shady and not something they have any right to do.

            • I like the way this poster from reddit put it:

              Wow... Experienced web developer here... They tried so hard to make that article accessible for non web developers that it was almost harder for me to understand that way.
              My "OMG nefarious" meter isn't even going off at all.
              This is a misleading headline.
              Google is circumventing
              "is" implies "still is" - which they are not.
              "circumventing" implies intentionally skirting around a bug - which NOTHING in this article says they are or were.

              Cross domain security should be built in to all browsers, and all Google was doing was passing cookies when people hit a button in an iFrame, and google's normal tracking activities if you're logged in to google continued.
              All that happened here was that a bug in Safari meant that google's stuff kept working even when it wasn't supposed to. There's no indication that this code was specially geared toward Safari. It sounds like their tracking was meant to automatically continue on as usual, and Safari failed to prevent 3rd party cookies from being sent.

              This headline is sensationalist bullshit.

              If you want to argue that google does too much tracking in general that's a different story. But there is not one tiny iota of information in this article that suggests google was "exploiting a bug in Safari" -- these iFrame based buttons and the cookies that follow them are standard operating procedure for ad networks.
              EDIT: Also credit to /u/powerje, who points out that it was 2 google engineers who fixed the problem in webkit/Safari

              http://www.reddit.com/r/apple/comments/ptoez/google_is_circumventing_safari_privacy_settings/

          • modify your hosts file

            Oh no!!! You have summoned APK!!!

      • by Anonymous Coward on Tuesday February 21, 2012 @11:28AM (#39111185)

        actually, they would be quite stupid to sell ... because when I consider how much time I spend with google services compared to anything else, they must know about five times as much about me as the next best competitor ... so selling stuff that helps their competition would be really not a good idea ;)

      • The data never needs to leave their servers. They sell access to their servers so companies can run queries against the data. The 'Results of the query' go with the company. Never the data.

      • Re: (Score:2, Funny)

        by postbigbang (761081)

        ...never leaves their own servers.

        I have great assurances that Google cannot be hacked, and that their contractors and affiliates use the excellent resources and high standards of Fleishman Hillard to protect data integrity from all possible hacking and cracking attempts.

      • So they merely rent our personal information instead of selling it. That's a pretty small distinction.

    • Re: (Score:2, Redundant)

      by 0123456 (636235)

      Impractical to those who want to spy on everything users do, anyway.

    • by poetmatt (793785) on Tuesday February 21, 2012 @11:36AM (#39111287) Journal

      The question that should be asked is: Why does IE have some part of their framework in place which can be simply ignored/violated?

      • by yotto (590067)

        Where are my mod points, damnit!?

        This is the FIRST thing I thought of.

        • by timeOday (582209) on Tuesday February 21, 2012 @01:06PM (#39112777)
          I disagree. A culture of, "if you are able to do it, it must be fine" is flawed at a very basic level. It's a failure to recognize anything above the law of the jungle. Property law gives us the freedom to have windows in our homes, even though, technically, they're easy to smash. Envelopes are easy to open an copper pairs are easy to tap, yet the laws that preclude this have been very effective - not totally, but far better than nothing. With the level of automated tracking of all kinds available these days, there simply cannot be any privacy unless there is a collective commitment to creating preserving such rights.
          • I disagree. A culture of "sloppy and permissive software" is flawed at a very basic level. It's a failure to recognize the fact that the virtual window of your analogy will be smashed EVERY time. Eventually, actual bars are put over actual windows, to prevent break-ins if they are persistent.

            With the level of automated tracking of all kinds available these days, there simply cannot be any forgiveness for a vendor who feels that the best response to a broken window is to, simply, leave it open.

            • by timeOday (582209)

              It's a failure to recognize the fact that the virtual window of your analogy will be smashed EVERY time.

              I'm not excusing exploits that can be fixed; they should be. But I don't think individual exploits are the main issue. There will always be some available.

              The kind of mass profiling now possible to the police, and google, and facebook, is not open to just anybody. That's why google and facebook are valued at billions of dollars - because they're so pervasive they can create the Total Profile. And

          • by poetmatt (793785)

            Really?

            Why don't you take a look at where this P3P comes form.

            https://plus.google.com/u/0/114753028665775786510/posts/fuLZoEkJZNs [google.com]

            Hint: Microsoft. So they created the issue and raised the flag about it.

            So your focus on "ohhhh, the privacy!" is a false focus in comparison.

      • honey trap?
      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Yeah! Why are they bothering to follow the P3P standard that they didn't invent?

        (rolling eyes)

      • by Desler (1608317) on Tuesday February 21, 2012 @12:33PM (#39112235)

        Yeah how dare they implement the P3P standard as it tells them to! Google is using a loophole in the standard to bypass the privacy protection.

        • by madmark1 (1946846)

          They aren't implementing the P3P standard as it tells them to, because the standard says if the P3P statement can't be parsed, it should assume the worst, not allow it through. Did you even read the standard?

      • by arkhan_jg (618674) on Tuesday February 21, 2012 @01:42PM (#39113305)

        Because P3P was a pile of crap to begin with, is drastically out of date and long since abandoned by everyone except microsoft?

        From wikipedia:

        "The Platform for Privacy Preferences Project (P3P) is a protocol allowing websites to declare their intended use of information they collect about web browser users. Designed to give users more control of their personal information when browsing, P3P was developed by the World Wide Web Consortium (W3C) and officially recommended on April 16, 2002. Development ceased shortly thereafter and there have been very few implementations of P3P. Microsoft Internet Explorer is the only major browser to support P3P. The president of TRUSTe has stated that P3P has not been implemented widely due to the difficulty and lack of value."

        "P3P manages information through privacy policies. When a website uses P3P, they set up a set of policies that allows them to state their intended uses of personal information that may be gathered from their site visitors. When a user decides to use P3P, they set their own set of policies and state what personal information they will allow to be seen by the sites that they visit. Then when a user visits a site, P3P will compare what personal information the user is willing to release, and what information the server wants to get – if the two do not match, P3P will inform the user and ask if he/she is willing to proceed to the site, and risk giving up more personal information."

        P3P can't handle 'legit' cookies not being associated with the domain you're actually viewing. IE requires a P3P policy to exist for 3rd party cookies to be saved when that setting is turned on; google's exists, but just says "this is not a p3p policy", and points you to their privacy policy. IE then goes 'alrighty then, you've got a P3P policy that's utter garbage even though I'm the one that asked for it, but here, go ahead and set that cookie anyway'.

        Frankly, Google not respecting Mozilla's DoNotTrack header is a much worse case of ignoring expressed user privacy than this crappy old IE only 'standard' having a loophole you could ride an elephant through.

    • by Anonymous Coward on Tuesday February 21, 2012 @11:43AM (#39111401)

      I find it interesting that Microsoft also sends an invalid privacy header, just as they are complaining about Google doing.
      I also find it interesting that MS is blaming Google for IE's failed handling on invalid P3P headers rather than fixing their product.

      • by 0racle (667029) on Tuesday February 21, 2012 @12:01PM (#39111689)

        I also find it interesting that MS is blaming Google for IE's failed handling on invalid P3P headers rather than fixing their product.

        As I understand it, Microsoft is following the spec properly. Google is exploiting a loophole in the spec. [slashdot.org]

        • by msauve (701917) on Tuesday February 21, 2012 @12:09PM (#39111789)
          " Google is exploiting a loophole in the spec."

          Which is another way of saying: Google is also following the spec. The problem is, the spec is faulty, and doesn't provide what it's intended to.
          • by Americano (920576) on Tuesday February 21, 2012 @12:26PM (#39112129)

            User: "I don't wish to be tracked. I've opted out using this P3P setting."
            Google: "Haha there's a loophole that we're gonna use to track you anyway. Blame Microsoft if you don't like it, sucker!"

            Yep, Google has done nothing wrong here whatsoever. They're completely right to exploit a known loophole which allows them to disregard the wishes of the users accessing their services, if those wishes would make Google's services less profitable.

            If this is "Do no evil," I shudder to think about the damage Google could do if they decided one day to deliberately engage in evil.

            • by Klync (152475)

              If this is "Do no evil," I shudder to think about the damage Google could do if they decided one day to deliberately engage in evil.

              cf. Hank Scorpio, Globex Corporation.

            • Obligatory!
              Don't make Google angry. You wouldn't like it if it became angry.

            • by madmark1 (1946846)

              So are you telling me you actually opted out using P3P? If so, you must be one of the 10 people on earth who actually knew what this was before the story broke. P3P is a broken system, has been a broken system forever, and has been deprecated as a standard since 2007. This is the privacy protection you are relying on? A system that even Microsoft exploits in EXACTLY THE SAME WAY as Google did?

        • Re: (Score:2, Interesting)

          by shadowmas (697397)

          If it's something that can be exploited then it's a bug. Any security/privacy feature of the browser should be in the control of the user not at the mercy of the http server.

          If it was something like a buffer overflow would microsoft still complain how that bad guys should stop sending invalid data packets to the browser?

          I don't like googles extensive tracking either, but complaining that it's not using some unpopular protocol is just silly. If you are going to implement privacy control then make it work reg

        • by TheGratefulNet (143330) on Tuesday February 21, 2012 @12:29PM (#39112171)

          what the text SHOULD look like (assme angle brackets here; sorry for having to reformat to get around slash filters)


          [META xmlns="http://www.w3.org/2002/01/P3Pv1"]
            [POLICY-REFERENCES]
                  [POLICY-REF about="/P3P/Policies.xml#first"]
                        [COOKIE-INCLUDE name="*" value="*" domain="*" path="*"/]
                        [COOKIE-EXCLUDE name="obnoxious-cookie" value="*" domain=".example.com" path="/"/]
                  [/POLICY-REF]
                  [POLICY-REF about="/P3P/Policies.xml#second"]
                        [COOKIE-INCLUDE name="obnoxious-cookie" value="*" domain=".example.com" path="/"/]
                  [/POLICY-REF]
            [/POLICY-REFERENCES]
          [/META]

          and what googles looks like:

          P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 [google.com] [google.com] for more info.

          now, without even having a compsci101 level course, anyone here see which is the more correct parseable string and which is weasel bullshit?

          • Suggested update for Internet Explorer:

            IE should try to parse the P3P according to the spec. If that fails, then display the contents to a user, with buttons: "Accept cookie", "Reject cookie", and "never allow visits to this site again".
            • by The Moof (859402)
              Yea, that End-User Allow/Deny thing did wonders for ActiveX security. How about if it's malformed, throw it out entirely and treat the request as if the P3P was not present?
          • by dissy (172727)

            what the text SHOULD look like (assme angle brackets here; sorry for having to reformat to get around slash filters)

            [META xmlns="http://www.w3.org/2002/01/P3Pv1"]
            [POLICY-REFERENCES]
            [POLICY-REF about="/P3P/Policies.xml#first"]
            [COOKIE-INCLUDE name="*" value="*" domain="*" path="*"/]
            [COOKIE-EXCLUDE name="obnoxious-cookie" value="*" domain=".example.com" path="/"/]
            [/POLICY-REF]
            [POLICY-REF about="/P3P/Policies.xml#second"]
            [COOKIE-INCLUDE name="obnoxious-cookie" value="*" domain=".example.com" path="/"/]
            [/POLICY-REF]
            [/POLICY-REFERENCES]
            [/META]

            And what the P3P header at www.microsoft.com looks like:

            P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

            now, without even having a compsci101 level course, anyone here see which is the more correct parseable string and which is weasel bullshit?

            I guess the first is correct, and the second is bullshit?

          • by mcgrew (92797) *

            Angle brackets: for the "less than" bracket, &lt; will produce <

            The greater than bracket just works as is, just hit the key.

        • by Lonewolf666 (259450) on Tuesday February 21, 2012 @01:10PM (#39112827)

          Consider the following (from http://www.w3.org/TR/P3P11/#ua_compact [w3.org];

          6.4 Compact Policy Processing

          P3P user agents MUST NOT rely on P3P compact policies that do not comply with the P3P 1.0 or P3P 1.1 specifications or are obviously erroneous. Such compact policies SHOULD be deemed invalid and the corresponding cookies should be treated as if they had no compact policies.

          As I understand this, IE should actually search the Google P3P header for a valid statement of what Google intends to do with regard to tracking cookies. If it does not find those, it should apply the default behaviour for web sites without any P3P header. As described by Dean Hachamovitch (the author of the blog post):

          By default, IE blocks third-party cookies unless the site presents a P3P Compact Policy Statement indicating how the site will use the cookie and that the sites use does not include tracking the user.

          Fine. So your browser sees a Google P3P header without any valid policies. At this point, the clause "unless the site presents..." should kick in and cookies should be blocked. To me this looks like a bug in IE, as they failed to implement the default behavior in this case. It would be appropriate for Microsoft to fix this bug, send the fix as update on next patch day and otherwise be very humble about their error.

            Instead, Dean Hachamovitch tries to paint this as conspiracy by Google to circumvent IE's security protection. FAIL.

    • by madmark1 (1946846)

      Yes, it probably is. Except Google doesn't sell personal information at all. They sell aggregated information, and more specifically, targeted ads based on aggregate information, and targeted ads based on personal information they hold. At no point is that data sold to others.

      I'm still trying to figure out how a broken implementation of P3P in IE is Google's fault. Of course, I'm also still trying to figure out why basing your 'privacy protection' on a system that was deprecated almost 5 years ago is co

  • No it isn't. (Score:2, Insightful)

    by Anonymous Coward

    Stop including P3P header data if all you're going to put is "this is not a P3P policy" in it. How impractical is that?

  • Google (Score:5, Funny)

    by Dexter Herbivore (1322345) on Tuesday February 21, 2012 @11:23AM (#39111041) Journal
    Do No... errr, nevermind.
  • by accessbob (962147) on Tuesday February 21, 2012 @11:23AM (#39111045)
    Thank goodness they're not an evil company. It could have been M$ breaking the Web standard...
    • by poetmatt (793785)

      Well it's not like they have a contract with facebook as Microsoft does, to do what google does to IE anyway, right? Right?

      Too soon?

    • I'd hardly consider it a standard when it development died shortly after it became a standard and IE is the only one to implement it.

      The flaw has been known since at least 2010 and in fact when it was pointed out that even Microsoft was passing invalid codes on their own support site. Some people get such a hard-on for ripping on Google that they're willing to defend MS as the good guy despite implementing something that was completely broken and never offered any protection.

      http://bits.blogs.nytimes. [nytimes.com]
  • by darkfeline (1890882) on Tuesday February 21, 2012 @11:24AM (#39111075)
    IE privacy protections were "circumvented" by Google sending a string stating, "This is not a P3P policy." Typical Microsoft quality product, that's like getting conned by a guy wearing a shirt that says "I don't guarantee I won't run off with your money" and then sueing them.
    • by betterunixthanunix (980855) on Tuesday February 21, 2012 @11:30AM (#39111201)
      Frankly, as an approach to a security engineering problem, P3P is pretty bad. You are basically allowing your adversary to declare what the security policy will be, then leaving it up to your adversary to follow that policy.

      If browser makers were serious about protecting their users' privacy, they would make adblocking the default, they would have stricter cookies policies, and they would not let a company like Google decide what sort of privacy people will have.
      • by msauve (701917) on Tuesday February 21, 2012 @12:14PM (#39111907)
        Plus, P3P is faulty, it has a loophole which one can take advantage of. Much better to simply follow a properly designed spec for this sort of thing, like RFC 3514 [ietf.org].
      • by Xest (935314) on Tuesday February 21, 2012 @12:32PM (#39112215)

        I remember thinking the same when I was forced to study it academically some time ago, and thought at the time what the fuck is the point in it exactly?

        Well at least now I have my answer, it makes for good headlines when you want to troll your competitors with it if nothing else.

        • by Nimey (114278)

          A good second-order use is when someone wants to stoke the flames of anti-Google hysteria, as seen with this article and many of the posters.

      • by Todd Knarr (15451)

        Thing is, P3P isn't a security solution. It's a legal/social solution: make the site declare what it promises to do, and then the user has a solid basis for complaints through the usual channels for breach of that promise. The courts may not understand the technicalities of P3P and the Internet and such, but "He made a written promise to not do X (which promise I have a copy of), I relied on that promise, he went ahead and did X anyway and I've suffered these damages because of it." is something the courts

        • I do not think anyone would be surprised by the fact that a legal solution to a computer security problem is a complete failure.
    • by SaroDarksbane (1784314) on Tuesday February 21, 2012 @11:33AM (#39111255)
      Future News: For Windows 8, Microsoft has replaced the traditional log on screen with a text field. Users will now have to simply enter a reason why they should be allowed to log onto the system. The system will accept all answers.
  • FTFY (Score:5, Funny)

    by elrous0 (869638) * on Tuesday February 21, 2012 @11:24AM (#39111079)

    Google on Monday said that IE's privacy protection, called P3P, is unprofitable to comply with."

    • Re:FTFY (Score:4, Informative)

      by Larryish (1215510) <larryishNO@SPAMgmail.com> on Tuesday February 21, 2012 @11:52AM (#39111547)

      MS is a private company, not a legislative body.

      As the situation is presented, Google is under no legal requirement to comply with any 3rd party browser "privacy requirements" outside of any existing legal agreements with manufacturers of said browsers. Was any such agreement in place?

      tl;dr - MS can go get stuffed.

      • More importantly, why are browser makers worried about Google's interests? Google is the adversary as far as user privacy is concerned, and browsers should ship with security against that adversary. Adblocking should be the default. Cookie policies should be strict and should forbid iframes from third party sites from setting or reading cookies. If browser makers actually cared about user privacy, we would not be in this situation.
      • Re: (Score:3, Interesting)

        by Americano (920576)

        Google is under no legal requirement, but remember, they're the "Do No Evil!" crowd. Deliberately circumventing a system which allows browser USERS to say "I don't want to allow cookies from sites which will do X, Y, or Z with my data," would seem to fly in the face of that policy, wouldn't it?

        What you're saying is, "Since Microsoft didn't create a hermetically sealed box that's unable to be bypassed, it's okay for Google to simply disrespect the wishes of the user - as expressed by the web browser setting

      • by thsths (31372)

        > Google is under no legal requirement to comply with any 3rd party browser "privacy requirements"

        Maybe in the US, but not in the rest of the world, where privacy laws exist. Time and time again Google has argued that the consent of the user can be presumed, because cookies are enabled. Only with this presumed consent are they allowed to track users.

        However, cookies are enabled by default, so this argument is pretty weak. And it collapses as soon as the user takes any action to discourage tracking, wheth

  • Dear Google (Score:4, Interesting)

    by JamesP (688957) on Tuesday February 21, 2012 @11:26AM (#39111151)

    So you're telling me it's impractical to send nothing or to NOT SEND BS in the field?

    Congratulations for being as evil as MS

  • Old and Busted (Score:5, Interesting)

    by uigrad_2000 (398500) on Tuesday February 21, 2012 @11:27AM (#39111167) Homepage Journal

    P3P has been Old and Busted [epic.org] since Slashdot first covered it [slashdot.org] in 2002.

    Microsoft would never bring it up, if they weren't already in panic mode. This seems to indicate that MS is in far worse shape than we know.

  • by sugarmotor (621907) on Tuesday February 21, 2012 @11:32AM (#39111231) Homepage

    I think Google is being polite, as do people who quote a "lack of value"

    From http://en.wikipedia.org/wiki/P3P [wikipedia.org]

    The main content of a privacy policy is the following:

            which information the server stores:
                    which kind of information is collected (identifying or not);
                    which particular information is collected (IP address, email address, name, etc.);

    Kind of information??? As if the AI problems were all solved. IP Address? Of course it is collected. Email address? Yes if there is an input box that says email address then the address is collected.

  • by microbee (682094) on Tuesday February 21, 2012 @12:21PM (#39112015)

    How does Facebook do it (the Like button)? Does Facebook also circumvent it this way? Either Facebook found a way to do it better, or they are both doing the same thing.

    Can we stop the Google/Microsoft bashing and focus on the techniques please?

    • by MozeeToby (1163751) on Tuesday February 21, 2012 @12:37PM (#39112291)

      Not only does Facebook do it but Microsoft also does it. The standard they are accusing Google of violating is so out of date that W3 doesn't even try to update it anymore, because no one follows it and most browsers don't even implement it fully. This is a non-story in every direction.

    • by Anonymous Coward on Tuesday February 21, 2012 @01:23PM (#39113019)

      Check the ARS story with 2 updates:

      http://arstechnica.com/tech-policy/news/2012/02/google-tricks-internet-explorer-into-accepting-tracking-cookies-microsoft-claims.ars

      Yes Facebook is doing it as well as msn.com and live.com

    • How does Facebook do it (the Like button)? Does Facebook also circumvent it this way? Either Facebook found a way to do it better, or they are both doing the same thing.

      Can we stop the Google/Microsoft bashing and focus on the techniques please?

      Firefox with Ghostery is your friend. Forget "do not track" and P3P. They rely on fair play of web sites - which is unreasonable to expect.

  • Thy name is Corporate.

  • by flimflammer (956759) on Tuesday February 21, 2012 @04:29PM (#39115513)

    As much as I hate the facebook +1 button, logging in with facebook, the google variants, and other such functionality that is appearing on pretty much every website, I just can't fault Google that hard for this. The P3P spec is old. Ancient. No one follows it. The standards body who created it doesn't even want anything to do with it. The only reason Microsoft is even bringing this up as to take a shot at Google while Apple is taking a shot at Google for their Safari stuff.

NOWPRINT. NOWPRINT. Clemclone, back to the shadows again. - The Firesign Theater

Working...