Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Google Accused of Bypassing Safari's Privacy Controls

Soulskill posted more than 2 years ago | from the daily-dose-of-tech-giant-soap-opera dept.

Safari 202

DJRumpy points out an article (based on a possibly paywalled WSJ report) describing how Google and other ad networks wrote code that would bypass the privacy settings of Apple's Safari web browser. 'The default settings of Safari block cookies "from third parties and advertisers," a setting that is supposed to only allow sites that the user is directly interacting with to save a cookie (client side data that remote web servers can later access in subsequent visits). ... The report notes that "Google added coding to some of its ads that made Safari think that a person was submitting an invisible form to Google. Safari would then let Google install a cookie on the phone or computer.' Google says this mischaracterizes what the code does, claiming it simply enables 'features for signed-in Google users on Safari who had opted to see personalized ads and other content — such as the ability to “+1” things that interest them.' Google adds that the data transferred between Safari and Google's servers was anonymized. John Battelle writes that the WSJ's story is sensationalist, but that it raises good questions about the practices of ad networks as well as Apple's efforts to stymie industry-standard practices.

cancel ×

202 comments

Sorry! There are no comments related to the filter you selected.

And people ask me why I don't use Chrome (5, Insightful)

elrous0 (869638) | more than 2 years ago | (#39074407)

I trust Google with way too much as it is. And practices like this only make me even more determined to avoid them as much as reasonably possible. It's bad enough that pretty much every website out there now is feeding them tracking data (seriously, use Firefox with NoScript and just look at all the sites using Google-analytics [wikipedia.org] , it's *everywhere*). I certainly am *not* about to let them takeover my entire browser too.

They'll have to content themselves with just reading my gmail.

Re:And people ask me why I don't use Chrome (5, Informative)

Anonymous Coward | more than 2 years ago | (#39074515)

If you're running DNSmasq just add this line:

address=/google-analytics.com/127.0.0.1

and it won't bother you again.

Re:And people ask me why I don't use Chrome (4, Informative)

phrostie (121428) | more than 2 years ago | (#39074805)

another cool trick is to set up a host file.

http://winhelp2002.mvps.org/hosts.htm [mvps.org]

Re:And people ask me why I don't use Chrome (5, Funny)

Anonymous Coward | more than 2 years ago | (#39074991)

Goddamn you. It is not acceptable to mention hosts files on slashdot. If you summon APK, I will find you, and there will be consequences, you bastard.

Re:And people ask me why I don't use Chrome (2)

phrostie (121428) | more than 2 years ago | (#39075079)

ROTFL

+1 funny

Re:And people ask me why I don't use Chrome (0)

dougisfunny (1200171) | more than 2 years ago | (#39075091)

I think he's case sensitive.

Re:And people ask me why I don't use Chrome (4, Insightful)

NeutronCowboy (896098) | more than 2 years ago | (#39074519)

And that's why noscript is so important. Yes, with time, everyone is going to consolidate their scripts under the main domain. But there will be ways to control that as well. And ultimately, that's why Firefox, despite all its problems, is a super-important part of the open web.

Re:And people ask me why I don't use Chrome (3, Interesting)

Pieroxy (222434) | more than 2 years ago | (#39074637)

Yes, with time, everyone is going to consolidate their scripts under the main domain.

And the situation will be fine. Because when people will consolidate their stuff on their own domain, they will be able to track you on their website (big deal, there's access_log anyways) but they won't be able to track you anywhere else.

Which is fine with me.

Re:And people ask me why I don't use Chrome (4, Insightful)

sakdoctor (1087155) | more than 2 years ago | (#39074687)

with time, everyone is going to consolidate their scripts under the main domain

No they won't. There simply isn't enough selection pressure to make that happen. noscript users are this tiny insignificant blip concealed in the statistical noise of web traffic.

Secondly, you're right. All the superficial problems (which I can almost never reproduce anyway) with firefox are nothing compared to having a browser I can trust, from an organization that I'm ideologically aligned with.
Google building a web browser is a conflict of interests; though I'm still glad they did for browser war / political reasons.

Re:And people ask me why I don't use Chrome (1)

TheGratefulNet (143330) | more than 2 years ago | (#39074921)

Google building a web browser is a conflict of interests

its like playing a game of baseball and having the opposing team provide the mitts, bats and balls.

Re:And people ask me why I don't use Chrome (0)

Anonymous Coward | more than 2 years ago | (#39075701)

Google building a web browser is a conflict of interests

its like playing a game of baseball and having the opposing team provide the mitts, bats and balls.

Bzzt!

It *is* like going to arbitration and letting the arbitrator be selected by the one party who is a regular arbitration customer.

Re:And people ask me why I don't use Chrome (0)

Anonymous Coward | more than 2 years ago | (#39075411)

Whether or not anyone uses Chrome, Google still wins. The purpose of chrome was not to necessarily get users -- it was to inject competition into a somewhat stagnant market. If the other browsers had stayed slow, Google wins because everyone uses Chrome. Since they caught up, Google wins because everyone can look at ads faster now.

Re:And people ask me why I don't use Chrome (4, Funny)

forkfail (228161) | more than 2 years ago | (#39075589)

Try Lynx.

Re:And people ask me why I don't use Chrome (0)

Anonymous Coward | more than 2 years ago | (#39074627)

Ghostery is important. Turn it on, block *. You can still view ads, support sites, whatever, but at least its blocking the tracking pixels...

Re:And people ask me why I don't use Chrome (2)

GameboyRMH (1153867) | more than 2 years ago | (#39075081)

Yep I use Ghostery and block all the known tracking services. Using a whitelist system like RequestPolicy would be technically better but it would be a massive PITA to browse that way.

Re:And people ask me why I don't use Chrome (1)

korean.ian (1264578) | more than 2 years ago | (#39075625)

Thanks, was unaware of ghostery until now.

Re:And people ask me why I don't use Chrome (5, Interesting)

MrKevvy (85565) | more than 2 years ago | (#39074665)

I support a locked-down corporate image. I'm surprised at the number of people I support that I've found using Chrome.

Yesterday I talked to someone and asked how she got it and she said that a site prompted her to install it so she did. I just tried this and was able to install it on the locked-down image, including setting it as default, etc. It may have put its settings in the user-writable area of the registry but it's very sneaky to do so whereas other browsers will refuse to install without admin. privileges. Hey, whatever leads to higher market share, right?

Re:And people ask me why I don't use Chrome (1)

Oswald McWeany (2428506) | more than 2 years ago | (#39074769)

I use Komodo Dragon which is a free Chromium variant with a higher focus on security and privacy.

I don't know if it really IS more secure and private- but Komodo claims it is; whether Google knows tricks to bypass Komodo's features I don't know.

Re:And people ask me why I don't use Chrome (5, Insightful)

Xest (935314) | more than 2 years ago | (#39074801)

I don't think Google have done anything wrong there, saving settings to a user section of the registry makes more sense than a browser needing me to give it admin priviliges to write wherever the fuck it wants. It's precisely that sort of behaviour that leads people to click okay each time windows notifies them a program wants admin rights without even stopping to consider why.

It sounds more like your problem is that your lockdown policy isn't configured as you'd like it to be, yet you blame the software for not obeying how you wanted things setup, rather than how things actually are setup, other than that it sounds like Chrome is following correct and best practice behaviour in this respect whereas how you'd have liked it to respond is bad practice and not preferable.

Re:And people ask me why I don't use Chrome (1, Flamebait)

BlackSnake112 (912158) | more than 2 years ago | (#39075017)

But on a locked down machine, nothing should be able to be installed without the admins knowing about it. Period. Google found a way around that. Also chrome has add ins that allow people around more things on a locked down machine. We had a professor that wanted google chrome for a classroom pc. This professor also hated not being an admin on the classroom machines, he complained every chance he got. After chrome was installed he stopped complaining. That machine started to have different settings. The background was changed, screen saver was changed. The registry was totally screwed up. The professor got added to the admin group. We re-imaged the machine. Everything was fine until that same professor went in that room. Then he was admin again. Again we imaged the machine. No chrome. No issues, well, besides his complaining. We now have a no chrome policy on the domain machines. Granted this professor has connections with google, so he may have more insight then other people. He cannot crack the machine without chrome. He tries. We watch him trying to boot the machines off of a USB or CD all the time. That is locked down to. He has said he is going to cut the lock keeping the machine case shut. He is determined, I'll give him that.

Re:And people ask me why I don't use Chrome (5, Insightful)

Xest (935314) | more than 2 years ago | (#39075123)

"But on a locked down machine, nothing should be able to be installed without the admins knowing about it. Period. Google found a way around that."

No they didn't, that's precisely the point, the issue isn't that Google found some way around the lock down, it's that the system wasn't locked down properly to facilitate that goal.

Chrome is not some magical psychic piece of software that can tell what the system admin intended, it can only do what the OS allows it to do and is configured to allow it to do.

If Chrome is able to do things you did not intend on your systems then you have much more serious problems and your systems are incompetently configured and managed. You can guarantee if Chrome is obtaining admin privileges as a legitimate peice of software then a peice of malware would have a hell of a time enjoying your poorly configured systems. The first step to solving your problem is get rid of the geek squad level of staff, and start hiring some proper admins.

Re:And people ask me why I don't use Chrome (3, Insightful)

EasyTarget (43516) | more than 2 years ago | (#39075303)

Well said; just what I was thinking but more coherent :-)

A security policy that still allows users to install software in the userland is not 'locked down'.

Re:And people ask me why I don't use Chrome (4, Insightful)

Xest (935314) | more than 2 years ago | (#39075723)

It makes me despair as it's been some years since I left IT support behind, and I noticed at the time the profession was becoming more and more filled with people who simply have no idea what the fuck they're doing but coast by nonetheless, calling in consultants for a fortune when they don't know how to do something that any half competent IT support person should be able to do, or blaming the software, going off sick, hiding at a different office or whatever else when inevitably things go wrong and they'd otherwise have to face up to their responsibilities.

It seems now that these numpties have found their way to Slashdot, extolling their blame on software to the world at large, rather than facing up to the fact that they just don't know what in the flying fuck they are actually doing.

Of course, the worst part is, they then moan when their job gets outsourced to India - is it any fucking wonder why when they show such ineptitude? It's no wonder Chinese hackers are supposedly pillaging Western firms dry of IP when IT security means "blame the software when your incorrectly configured security policy lets the user do something they weren't meant to be able to do".

This is why IT support has rapidly started to gain the same sort of disrespect as a profession that many manual trades like bricklaying long have, and why support has seen a deterioration in wages to boot - because there's so many IT staff out there who really can't be trusted to show a bit of intelligence and do a good job nowadays, and they drag it down for those who know what they're doing.

I'm just glad I got the hell out of there seeing as it's only continued to deteriorate as a profession!

Re:And people ask me why I don't use Chrome (-1, Troll)

93 Escort Wagon (326346) | more than 2 years ago | (#39075327)

If Chrome is able to do things you did not intend on your systems then you have much more serious problems and your systems are incompetently configured and managed.

Just keep drinking the Koolaid...

It's amazing to me that - even despite the story we're responding to - it doesn't even enter your mind that maybe, just maybe, Google knows about a nice little unpublicized exploit that lets them work around the standard Windows corporate lockdown setup.

Re:And people ask me why I don't use Chrome (0)

Anonymous Coward | more than 2 years ago | (#39075375)

And maybe, just maybe, Sergei and Larry eat babies for breakfast that Eric procures for them.

Or may be, just may be, GGP is incompetent as a sysadmin.

Re:And people ask me why I don't use Chrome (4, Informative)

icebraining (1313345) | more than 2 years ago | (#39075397)

If it was properly locked down, the Chrome installer wouldn't be able to run at all. And if it able to run, then it doesn't need an exploit.

Re:And people ask me why I don't use Chrome (0)

Anonymous Coward | more than 2 years ago | (#39075509)

Maybe they do -- if so, all your "standard Windows corporate lockdown setup" PCs are WIDE FUCKING OPEN to anyone who downloads chrome, reverse-engineers it, and implements the same exploit in their malware. Which means YOU have a problem, and would have a problem (but not realize it) even if Chrome didn't exist.

(Silly question, but I'm no Windows admin -- isn't there an equivalent of the "noexec" mount option, to prevent any binaries within certain subtree of the filesystem from being executed?)

Re:And people ask me why I don't use Chrome (3, Insightful)

Xest (935314) | more than 2 years ago | (#39075543)

What Google is doing in TFA is not an exploit, just because Apple didn't want people to write Javascript in that way, doesn't mean there's anything wrong with it per-se. This isn't to defend it as it's obviously not a particularly respectful thing to do, but it's not illegal, nor does it breach any standards, in contrast, abusing an operating system level exploit potentially falls foul of both these things and opens Google up to a lawsuit. Perhaps you or the GP could consider taking it to court and challenge it there if you genuinely believe it's the case? You'd be able to get a pretty hefty payout or settlement if true.

Don't come crying when you actually get laughed out of court though because it turns out you just didn't know how to configure a network properly.

Re:And people ask me why I don't use Chrome (0)

Anonymous Coward | more than 2 years ago | (#39075551)

Pretend it was a trojan or a virus instead of Chrome. Are you going to pretend to blame the virus writer? No: the image was insufficiently locked down. This is indicated by the image's ability to run arbitrary code outside of a sandbox.

Re:And people ask me why I don't use Chrome (1)

Baloroth (2370816) | more than 2 years ago | (#39075631)

If Chrome is able to do things you did not intend on your systems then you have much more serious problems and your systems are incompetently configured and managed.

Just keep drinking the Koolaid...

It's amazing to me that - even despite the story we're responding to - it doesn't even enter your mind that maybe, just maybe, Google knows about a nice little unpublicized exploit that lets them work around the standard Windows corporate lockdown setup.

You know, I was about to point out that the idea of a major company using an exploit to install software was ridiculous. Then I remembered Sony-BMG. I still think the idea of Google using an exploit to install Chrome (knowing it is an exploit and not reporting it) is ridiculous, but I can't really make fun of you for thinking it is possible.

Re:And people ask me why I don't use Chrome (0)

Anonymous Coward | more than 2 years ago | (#39075423)

Frankly I'd do the same things if you pulled that on me. And if you did manage to prevent me from making my computer actually useful to me, I'd probably try to set you up so you got fired.

Re:And people ask me why I don't use Chrome (1)

icebraining (1313345) | more than 2 years ago | (#39075451)

But on a locked down machine, nothing should be able to be installed without the admins knowing about it.

No. "Installed" is just a detail and means nothing. On a locked down machine, nothing should be to run from user-writable directories. Clearly your machine was locked down by incompetents; you can be sure that in my university, Chrome wouldn't be able to "install" itself, since no code at all would be allowed to run.

Re:And people ask me why I don't use Chrome (0)

Anonymous Coward | more than 2 years ago | (#39074809)

Firefox installs just fine without admin privileges. Uh, not that I'd ever do such thing on a locked down image, mind you...

Re:And people ask me why I don't use Chrome (2, Interesting)

agentgonzo (1026204) | more than 2 years ago | (#39074837)

The installation of Chrome is one of the reasons that I hate it. You are given no choice as to where it installs. It doesn't install to a system-wide location, but installs (as you say) in user-writable profile space. That means that if you want to run chrome on your computer and you have many users, you need to install it for every user and it will be a separate place on the file-system with each separate installation. And separate settings in the user part of the registry. You *can't* do a system-wide installation (even if you want to!). It's just absolutely idiotic.

Re:And people ask me why I don't use Chrome (5, Informative)

Anonymous Coward | more than 2 years ago | (#39074985)

You *can* do a system-wide installation, it's just not obvious [google.com] .

Re:And people ask me why I don't use Chrome (0)

smooth wombat (796938) | more than 2 years ago | (#39074865)

I've seen as well and when I realized that you don't need to be an admin to install Chrome, I was ticked off. To put it mildly.

That is a gigantic security hole just waiting to be exploited. Further, there's a reason corporate machines are locked down. We don't want people, especially IT people, installing every random piece of software that asks the user to install it.

Rule #3 of IT that should never be broken [earthlink.net] : Never, ever, ever, EVER give a regular user administrative rights on their machine. Ever. Chrome breaks this rule with a wrecking ball.

It's bad enough that as an admin I am constantly harassed by Windows 7, "Do you want to allow...?" Yes, I'm a fucking admin, just install the damn thing! Now we have to put up with companies making it so every user can install whatever they want and expect us to figure out what they did. Aside from their search engine, I will never use any product of Google, and this crap especially so.

Re:And people ask me why I don't use Chrome (5, Insightful)

Xest (935314) | more than 2 years ago | (#39075245)

"That is a gigantic security hole just waiting to be exploited."

Right, so a browser that isolates itself to userspace is a gigantic security hole waiting to be exploited, yet a browser that requires admin privileges to install is not?

"Further, there's a reason corporate machines are locked down. We don't want people, especially IT people, installing every random piece of software that asks the user to install it."

So why are you letting people run arbitrary executables in the first place if you need that level of control of your systems?

"Rule #3 of IT that should never be broken: Never, ever, ever, EVER give a regular user administrative rights on their machine. Ever. Chrome breaks this rule with a wrecking ball."

Er no, that's exactly what it DOESN'T do.

"It's bad enough that as an admin I am constantly harassed by Windows 7, "Do you want to allow...?" Yes, I'm a fucking admin, just install the damn thing! Now we have to put up with companies making it so every user can install whatever they want and expect us to figure out what they did."

Well at least now we know you're really not qualified for your own profession. Really, you have a degree of IT security responsibility yet you complain when an OS alerts you to a request by an application for (or if you're a user, blocks you from providing) admin access, and say you just blindly accept, but then you complain when an application doesn't try and obtain admin access that you previously suggested should never be given to a user?

You haven't configured your network to limit what people can run and install, you've configured your network to only allow executables to work within the permissions defined for the currently active user account, Chrome is doing exactly that, thus the only problem is that how you've configured your network, isn't how you seem to beleive your network should be configured.

Re:And people ask me why I don't use Chrome (1)

icebraining (1313345) | more than 2 years ago | (#39075623)

If you're ticked off against Chrome, then I hope you don't find out about PortableApps [portableapps.com] . Oh, oops.

Rule #3 of IT that should never be broken: Never, ever, ever, EVER give a regular user administrative rights on their machine. Ever. Chrome breaks this rule with a wrecking ball.

Chrome isn't able to give anyone any rights. It uses the rights the user already has. Maybe you should look at the people you configured that machine (maybe a mirror would be helpful?).

It's bad enough that as an admin I am constantly harassed by Windows 7, "Do you want to allow...?" Yes, I'm a fucking admin, just install the damn thing!

If you can't find out how to disable the UAC, you're in the wrong job.

Re:And people ask me why I don't use Chrome (-1, Troll)

geekoid (135745) | more than 2 years ago | (#39075047)

Then your image isn't lock down,l dumb ass.

" It may have put its settings in the user-writable area of the registry but it's very sneaky to do so"
WHAT? that's how it's supposed to work. You should be label to install thing into the user area if the user wants to, that's the fucking point.
The other browsers want you to install it in a way that gives them permission to do whatever they want. The other browsers are FORCING YOU to give up security in order to install and run them.

What the hell is wrong with people like you? a company makes a browser that gives the users options, adheres to standards, doesn't force you to violate your chosen security, and everyone is against it? Which would be fine if that actually could state a good reason.

But we get idiots like you who done't seem to know how their own computer is supposed to work, and clearly it's Google's fault for doing what you allow it to do.

Re:And people ask me why I don't use Chrome (3, Funny)

geekoid (135745) | more than 2 years ago | (#39075067)

"I dumb ass"? sigh.

Re:And people ask me why I don't use Chrome (0)

Anonymous Coward | more than 2 years ago | (#39075199)

Re:And people ask me why I don't use Chrome (1)

Anonymous Coward | more than 2 years ago | (#39075209)

Wasn't "I Dumb Ass" the sequel to "I Robot"?

Re:And people ask me why I don't use Chrome (1)

P-niiice (1703362) | more than 2 years ago | (#39075183)

'l dumb ass.'

I swear to god there's a Will smith reference in there but I can think of an appropriate dumbass to fit in for the robots

Re:And people ask me why I don't use Chrome (4, Informative)

GIL_Dude (850471) | more than 2 years ago | (#39075229)

If you need to block Chrome installs in your locked down environment you can: http://support.google.com/installer/bin/answer.py?hl=en&answer=146164 [google.com] . At one point early in Chrome's life (before the policies existed) we had a desire to block Chrome as it was playing havoc with our authenticated proxy servers (it would just hammer them with failed authentication requests). It plays nice with proxies now, so we don't do anything to either enable or disable Chrome.

A site prompted her to install it so she did ... (2)

perpenso (1613749) | more than 2 years ago | (#39075823)

... Yesterday I talked to someone and asked how she got it and she said that a site prompted her to install it so she did ...

This scenario needs to be a job interview question.

Re:And people ask me why I don't use Chrome (0)

Anonymous Coward | more than 2 years ago | (#39074711)

added google-analytics.com as a filter in ad-block plus. As well as facebook.com and twitter.com
No script, and ad-block plus are awesome in firefox.
Just from hitting 4 pages (my 4 home pages) I had 14 analytics blocks listed in ad-block.
I only allow cookies from about 8 sites.

Re:And people ask me why I don't use Chrome (2)

phrostie (121428) | more than 2 years ago | (#39074765)

Try Ghostery

I first started using it because of facebook, but after using it and seeing all the stuff that everyone else is tracking, i'm hooked.

https://addons.mozilla.org/en-US/firefox/addon/ghostery/ [mozilla.org]

Re:And people ask me why I don't use Chrome (-1)

Anonymous Coward | more than 2 years ago | (#39074771)

I trust Google more than I trust News Corp. i.e. Faux News and the WSJ.

Re:And people ask me why I don't use Chrome (3, Interesting)

jdgeorge (18767) | more than 2 years ago | (#39074829)

Interesting point. I've been on the publishing and browsing sides of this.

As someone developing technical information, it's extremely valuable to know the information Google Analytics provides. It helps tell content creators how useful their content is to the intended audience, whether to invest in translation (and to which languages), and whether it's worth developing more information on a given subject.

As a browser, I generally don't allow Google Analytics and other tracking mechanisms in NoScript, because of general paranoia about being tracked.

For now, I have developed a two-browser web-use approach: I use Google Chrome (or Chromium, depending) for everything I do as a signed-in Google user. For general web-browsing, I use Firefox with NoScript.

I'm somewhat conflicted about the fact that I'm hypocritical in my desire for Google Analytics data while I refuse to provide that useful data to web sites.

Perhaps what I really should do it have a third browser (or configuration), so I have one where I'm promiscuous within Gmail, Google+, and Calendar, a second where I allow traffic analytics when I'm browsing work-related information, and a third, paranoid config for... um... recreational browsing.

Re:And people ask me why I don't use Chrome (4, Interesting)

GameboyRMH (1153867) | more than 2 years ago | (#39075043)

Chrome is probably one of the few Google products you shouldn't have any privacy worries about. It doesn't behave differently to any other browser. Chromium is open source if you want some extra assurance.

As for reducing your Google information footprint, do what I do::

http://slashdot.org/journal/277383/making-google-keep-to-itself-with-multifox [slashdot.org]

Re:And people ask me why I don't use Chrome (1)

geekoid (135745) | more than 2 years ago | (#39075089)

A practice like what? Behaving as the user requested?

Take over your browser. Yeah, you just stick with browsers then need admin rights, and don't put information you request into a sandbox, that's much better.

Where's the money from? (3, Insightful)

Sez Zero (586611) | more than 2 years ago | (#39074465)

the practices of ad networks as well as Apple's efforts to stymie industry-standard practices.

If I were a company that made my money on hardware and my main competitor was a company that made their money on ads, I'd most definitely be trying to tweak my software to stymie "industry-standard" practices.

Re:Where's the money from? (1)

oh_my_080980980 (773867) | more than 2 years ago | (#39074633)

By allowing users to block cookies. Yeah real violation......since blocking cookies is an industry standard.

Re:Where's the money from? (1)

inpher (1788434) | more than 2 years ago | (#39074739)

Apparently this is how Apple "stymie industry-standard practices":

Now, from what I can tell, the first part of that story is true – Google and many others have figured out ways to get around Apple’s default settings on Safari in iOS – the only browser that comes with iOS, a browser that, in my experience, has never asked me what kind of privacy settings I wanted, nor did it ask if I wanted to share my data with anyone else (I do, it turns out, for any number of perfectly good reasons). Apple assumes that I agree with Apple’s point of view on “privacy,” which, I must say, is ridiculous on its face, because the idea of a large corporation (Apple is the largest, in fact) determining in advance what I might want to do with my data is pretty much the opposite of “privacy.”

Then again, Apple decided I hated Flash, too, so I shouldn’t be that surprised, right?

[...]

I don’t know, but when I bought an iPhone, I didn’t think I was singing up as an active recruit in Apple’s war on the open web. I just thought I was getting “the Internet in my pocket” – which was Apple’s initial marketing pitch for the device. What I didn’t realize was that it was “the Internet, as Apple wishes to understand it, in my pocket.”

Does not make any sense to me. First the author claim that Apple should have actively asked him do define the security settings and because it did not Apple is somehow evil. No operating system ever can actively ask their users to set up everything to a microscopic level, there has to be a default somewhere. It would take days to get through all the settings on my computer. I would say "fuck this" after fifteen minutes of configuring panels where I left almost everything set to the default anyway.

How could Apple agree with your stance on privacy unless you tell Apple your privacy wishes? The author seems to be well versed in computers and smartphones, I am sure he could figure out how to tell Apple how his privacy should be managed.

Then he somehow thinks Flash is an industry standard. This is what Apple allows to run in mobile Safari [w3.org] and disallowing non-standard (arguably proprietary) third party extensions is not really how you stymie industry-standard practices.

google does a lot more than that (4, Interesting)

alen (225700) | more than 2 years ago | (#39074521)

i have a few browsers on my iphone including a private browser. i've had it for years since before apple put the functionality into iOS. All it does is ride on top of stock safari on the iphone but creates a private browsing session.

i've noticed that some searches i did in the private browser come up as past searches in stock safari and on my laptop. which means that google is probably reading the UIDID or whatever it's called and using it to correlate users across devices even if they don't log into google

Re:google does a lot more than that (0)

Anonymous Coward | more than 2 years ago | (#39074729)

You can also turn on private browsing on the default safari browser on iphones by going to settings>safari and moving the slider

Re:google does a lot more than that (1)

alen (225700) | more than 2 years ago | (#39074751)

yes in iOS 5. but i've been using this for 3 years now and it does some things that stock safari doesn't. and i still keep my history in safari so i have to type 2 seconds less

Re:google does a lot more than that (1)

JeremyBanks (1036532) | more than 2 years ago | (#39075315)

iOS Safari has a built-in private browsing setting now. Have you given it a try?

I trust google as much as microsoft (1, Informative)

FudRucker (866063) | more than 2 years ago | (#39074573)

i rather use Linux

http://duckduckgo.com/ [duckduckgo.com]

Invisible forms all over the place (2, Interesting)

Anonymous Coward | more than 2 years ago | (#39074587)

Surely the 'invisible form' is not in itself new? I have always had the firefox/mozilla/etc 'security.warn_submit_insecure' set to 'true' and the warning pops up in all manner of places where you have done nothing but viewed a page.
I always hit 'cancel' as a matter of principle since when it first appeared for no apparent reason I took it to be someone's way of getting my browser to do something which I would either probably not want it to do or that they did not want me to know about.

On the other hand, it is a technique used by at least one or two types of forum software to update DST settings, so it's not always nefarious.

Advertisers of the world unite (3, Insightful)

jameslore (219771) | more than 2 years ago | (#39074613)

John Battelle's main thrust seems to be that Apple shouldn't be blocking advertisers from tracking users. Further, that he angry that Apple opted him out by default, rather than forcing him to opt-in to privacy.

Regardless of your views on the evil of (Apple|Google|whoever) this seems an odd argument. Unless you're an advertiser, of course.

Re:Advertisers of the world unite (1)

Nerdfest (867930) | more than 2 years ago | (#39074737)

It's not that strange a view. If I'm going to see ads, I'd like to see target ads. Apple doesn't seem to give you the choice (or at least, the default is to block ... I don't know if you can change it later).

But they're "Industry-standard practices!!!" (0)

Anonymous Coward | more than 2 years ago | (#39074763)

He really rips Apple a new one for its "efforts to stymie industry-standard practices."

His basic thrust is, big companies are evil, therefore bigger companies are more evil than smaller companies, Apple is a bigger company than Google, therefore what Apple wants is more evil than what Google wants. Apple wants to hide your personal information from Google by default, Google wants your personal information by default, therefore you should give your personal information to Google by default.

Which is, of course, absolutely not what I want.

Re:Advertisers of the world unite (1)

Anonymous Coward | more than 2 years ago | (#39074891)

John Battelle's main thrust seems to be that Apple shouldn't be blocking advertisers from tracking users

No surprise, this is a guy who has earned the bulk of his fortune running an ad network/agency that uses Google to deliver ad content. The rest of his money comes from lip-service hackneyed books about Google.

Blogging while drunk (1)

Animats (122034) | more than 2 years ago | (#39075445)

In the Battelle article, he admits he was blogging after drinking. Don't expect much.

sounds familiar (0)

Anonymous Coward | more than 2 years ago | (#39074635)

the cookies that facebook uses so facebook can track you on all the sites that have "you like this button"

Right or wrong... (1)

sootman (158191) | more than 2 years ago | (#39074641)

... it's really a clever hack. ("Hack" as in "clever workaround", not "ZOMGbreaking and entering!!!11") RTFA (not paywalled at the moment) and click on the infographic to see what they did.

Re:Right or wrong... (4, Insightful)

sunderland56 (621843) | more than 2 years ago | (#39075593)

The headline of the article should really be "Safari's privacy controls are weak and ineffective".

If someone leaves your front door wide open, and a skunk wanders in, do you blame the skunk, or do you blame whoever left the door open?

I trust Google (-1, Flamebait)

Oswald McWeany (2428506) | more than 2 years ago | (#39074669)

I trust Google- if google is collecting data on me I'm sure it is for the good of man-kind not for any type of profit.

If you're blocking google from collecting information on you- that is information that could have gone to curing cancer, helping little old ladies cross the street, or teaching puppy dogs to avoid being kicked by cranky drugs.

If you hate google then you are pro-cancer; pro-old ladies being hit by cars and pro puppy dogs getting kicked.

SHAME ON YOU!

Re:I trust Google (-1)

Anonymous Coward | more than 2 years ago | (#39074873)

As a Cancer sufferer I find your trolling very offensive.

As a result, I hope that the folllowing happen to you in the next year.

you get Gangerene and lose both legs.
You get acid thrown in your face and you go blind.
you get foreclosed
and every inch of your skin is covered in boils that exude puss.

Re:I trust Google (1)

Tharsman (1364603) | more than 2 years ago | (#39074939)

But I was taught in school that sharing my private stuff openly can result in STDs... Now I must pick between AIDS or Cancer? ACK!!!

We found your privacy feature inconvenient. (3, Insightful)

VGPowerlord (621254) | more than 2 years ago | (#39074681)

Google says this mischaracterizes what the code does, claiming it simply enables 'features for signed-in Google users on Safari who had opted to see personalized ads and other content â" such as the ability to âoe+1â things that interest them.'

In other words: "We found the wall inconvenient, so we simply tunneled under it."

Yes, Google, which part of "bypass" do you not understand?

What you're doing now is going to result in an arms race between you and several of the major web browser authors, including, perhaps, your own Chromium project.

What's next in this arms race, the inability for iframes to have forms? The inability for JavaScript to submit forms? The inability for JavaScript to run in iframes?

Re:We found your privacy feature inconvenient. (2)

geekoid (135745) | more than 2 years ago | (#39074963)

"In other words: "We found the wall inconvenient, so we simply tunneled under it.""
no.
In other words " We are giving the user what they asks us to give them, that can turn it off."
This isn't an arms race, it isn't a war, it isn't..well anything of note.

If you replaced Apple with MS, the story would be about how poor MS security is..and I would still be saying the same thing: NTSH

Re:We found your privacy feature inconvenient. (1)

Improv (2467) | more than 2 years ago | (#39074999)

The user's browser settings should take precedence over some web service.

Re:We found your privacy feature inconvenient. (2)

VGPowerlord (621254) | more than 2 years ago | (#39075573)

In other words " We are giving the user what they asks us to give them, that can turn it off."
This isn't an arms race, it isn't a war, it isn't..well anything of note.

Except Google isn't giving the user what they ask for, they're attempting to make it so every site you visit transmits at least some data to Google for the sake of "convenience," which incidentally is something Facebook, another site well known for its "privacy" does.

Having said that, assuming Safari for iOS has the same settings as Safari for Mac does, you can turn on third-party cookies on in the Safari Preferences under Security. I believe the setting is to set Cookies to "Always" instead of "Only from sites I visit."

However, Google decided that wasn't good enough and wanted it to work despite the browser being set to disable cookies from sites other than the one you're visiting. Which, btw, is a hole in the Same Origin Policy that browsers are enforcing, but apparently not on form submissions.

Re:We found your privacy feature inconvenient. (0)

Anonymous Coward | more than 2 years ago | (#39074989)

Alternate headline: Safari browser contains bugs that are exploitable by 3rd parties.

Re:We found your privacy feature inconvenient. (1)

Mistlefoot (636417) | more than 2 years ago | (#39075019)

Read your quote. "opted to see".

Why is a wall blocking someones ability to opt in to a service? If I opt in for any service I would not normally expect a piece of software to use a different technique to add additional walls. Since Safari is the only browser that does that it's pretty obvious were the fault lies.

Re:We found your privacy feature inconvenient. (4, Interesting)

VortexCortex (1117377) | more than 2 years ago | (#39075389)

The retarded part of this whole thing is that Apple's Safari was allowing 3rd party cookies AT ALL when 3rd party cookies are disabled. Remember, Apple sells ads on its platforms too. Now, it's QUITE simple to detect if any action actually came from a user initiated event. This is how most pop-up blockers have worked since 2000, including the ones built into our browsers. The JS that creates a new window/tab is blocked unless the JavaScript is executed as the result of actual user interaction... Point being: Apple knows how to detect if its a user action or not.

Additionally, when I was testing Safari a few years ago, any cookie that was already set would keep being sent to the server even after you disabled all cookies -- That option just disabled "new" cookies from being created. The old ones were still sent, not sure if this is still the behaviour because I stopped using their systems when their systems lied to -- or, at best, misled -- their users. Their settings have always been specious. Apple doesn't have a good track record when it comes to cookies.

The fact that Safari assumed that form submittal was a user initiated event is a big problem here too. This "invisible form" submission is how we did "Ajax" like Web2.0 features before XML HTTP Request objects were around. JS populates a form in a hidden iframe, submits, then the JS on the page, or in the iframe from the server, changes the main page without reloading it. If Safari is confusing this with a user action, I'd be calling Apple programmers on the carpet, "Did you do this?!? BAD CodeMonkey! BAD! No Banana, or APPL!" (it's actually difficult for me to believe this isn't Apple's intended design)

Don't get me wrong, I hate tracking more than the next guy, and instead prefer content based relevancy, but many users have Opted In to the Google Ad network. It's getting harder to opt out of parts of it w/ their new privacy policy. I keep separate accounts for G+, Gmail & Youtube because I don't want an action on one to ban me from the other. Point being, if you're logged in, you've logged in, and you agreed that it's fine for Google to target ads at you. They can't very well give you targeted ads in exchange for your privacy if they can't see if you're logged in or not via cookie...

I don't blame just Google for finding a way to get opted-in Safari users the content they opted-in to, even if it's ads. I also blame Apple for saying "3rd party cookies are disabled", when in reality, 3rd party cookies ARE SLIGHTLY DISABLED, unless you interact with the Ad, or we think you might have done so... You know, because We (Apple) also want to use those 3rd party cookies.

Here's an idea: SAFARI SHOULD BLOCK ALL 3RD PARTY COOKIES [PERIOD]! Otherwise, the "Block 3rd party Cookies" option actually doesn't.

Cookies are the easy-mode tracking channel. Many other methods exist [samy.pl] . Hell, Mozilla removed the UI for 3rd party cookie disabling since it was so damn easy to work around. Had to use about:config for a while there, but now Firefox has the 3rd party cookies UI again. [mozilla.org] At the very base layer your IP address and time stamps are all the ad networks need. Blacklist the sites. Some Ad-block extensions actually make a request before not displaying the content -- Mission Failed.

Posted to remove a bad mod... figured I'd contribute in the process.

Safari has a long history of cookie problems (5, Informative)

MrLint (519792) | more than 2 years ago | (#39074743)

IIRC the first 3 major versions of Safari on OS X totally ignored the setting for 'don't allow 3rd party cookies'. I had to file a bug that apple.com was setting these cookies w/ safari.

These assertions are really empty for me personally, since apple's site has partners that set these cookies, and apple's devs couldn't bother to implement this feature right.

And yes, my bitterness permeates everything:)

Re:Safari has a long history of cookie problems (2)

MrLint (519792) | more than 2 years ago | (#39075495)

Actually I want to clarify. I recall better now that at least the first version of Safari did not have this feature. Later versions did, but it did not work.

AppleGoogleFacebook (0)

Anonymous Coward | more than 2 years ago | (#39074821)

The spying is out of hand. I am a man, not a cookie tracked USERID !!!

On the other hand .... if google can break Apple's "walled garden" (some might call it prison), then I'm sort of okay with it.

not an exploit? (0)

Anonymous Coward | more than 2 years ago | (#39074825)

If it can be done without using exploiting a bug it's not so much cheating (I may even say it's not evil-evil) as just using tricks. If you ever done something for the web you know that tricks are commonplace. Now things are a bit better, but during the time of IE5 and 6 tricks were bread and butter, you couldn't do anything without them.

In denial (-1)

Anonymous Coward | more than 2 years ago | (#39074833)

Someone's in denial on God.
What exactly do you think tongues is?

Spirits puppet people -- spirituality 101.

Crack open a book, randomly.

God says...
C:\LoseThos\www.losethos.com\text\WALDEN.TXT

ble for its depth and purity as to merit a
particular description. It is a clear and deep green well, half a
mile long and a mile and three quarters in circumference, and
contains about sixty-one and a half acres; a perennial spring in the
midst of pine and oak woods, without any visible inlet or outlet
except by the clouds and evaporation. The surrounding hills rise
abruptly from the water to the height of forty to eighty feet,
though on the southeast and east they attain to about one hundred
an

Sounds to me... (1)

goathumper (1284632) | more than 2 years ago | (#39074835)

This sounds to me more like a defect in Safari's cookie handling than a problem on Google's part. Sure it's a dicey practice anyway to overtly try to circumvent those security and privacy features, but if the browser in question had implemented them properly in the first place this would be a non-issue.

Re:Sounds to me... (1)

crmarvin42 (652893) | more than 2 years ago | (#39075069)

Why can't it be both?

Apple has a responsibility to their customers (me) that the software works as described. Blocking cookies "always" should always block cookies. OTOH, Google as a service provider should accede to the wishes of their users or simply deny them services. What they did was say "ok, we'll do what you want" and then ignore that implied promise. Both sides here are covered in feathers.

As a result I'm now looking for added layers to prevent Google from working around Apple, and to ensure that what Apples software is supposed to be doing is in fact being done in the form of a Cookie manager.

Re:Sounds to me... (0)

Anonymous Coward | more than 2 years ago | (#39075293)

It sounds to me like Google is just doing what it normally does and Safari's blocking is simply not working as advertised. It is in no way Google's responsibility to know the inner workings of every browser. It does not sound in any way like Google decided to manufacture a back door into Safari.

Re:Sounds to me... (0)

Anonymous Coward | more than 2 years ago | (#39075227)

Apple has a 'privacy' feature that is implemented in a way it is trivial to bypass. Google and other advertisers want this functionality, and see the work around, and implement it. Google is at fault. Folks, we've been doing this in web development since day one, its hacks and kludges that got us much of the functionality we enjoy. People looking at a problem and finding a way to implement it that may not be ideal, but works. You may not like this particular feature, but it's not nefarious for a developer to step a bit outside the spec.

Maybe apple fixes it's implementation or decides to remove the 'feature' since it doesn't work? What were they thinking? "Well, there's no way really to do that without breaking other shit, so we'll just put a checkbox here that says you can. That should do it." Good job Apple, this is what we expect from you, shiny on the outside, but filled with shit.

The also are doing redirect links now (1)

Anonymous Coward | more than 2 years ago | (#39074851)

A few days ago I also noticed they started doing redirect links for search results. They used to do this for ads, but not it includes the links you are really looking for. The real link is still in the URL which I have started extracting by hand, but it makes google a lot more painful to use.

not new really... (1)

Narcocide (102829) | more than 2 years ago | (#39074917)

This is hardly the first time this has happened. Its been pretty much common practice since day one in the web advertising industry to pretty much assualt every single client-level security barrier as far as trackability and domain encapsulation in any browser with the full force of their research budgets. What is surprising to me is that in all these years this is the first time anyone else has figured it out apparently.

haha (0, Flamebait)

geekoid (135745) | more than 2 years ago | (#39074931)

Man. if this is the stretch people have to go through to blame Google for something, Google must be doing pretty damn good.

Seriously, this is, yet again, another NTSH article about Google. They are doing what the user opted in for them to do.

Re:haha (0)

Anonymous Coward | more than 2 years ago | (#39075109)

It's funny, city of portland IT drone Garrett Moffitt, you are so pro google in any article you can be. One might accuse you of bias... It's all perspective. In this case, Google was treading a slippery slope. Hopefully they'll get a bit of bad PR and change this. No big deal.

Stick to updating your cat's blog.

Re:haha (5, Insightful)

crmarvin42 (652893) | more than 2 years ago | (#39075113)

How so?

My cookie settings were as described "only accept from sites I visit". Google tricks my browser into thinking I've visited a site I did not, in fact, visit. They do this by submitting a form and intentionally making in invisible to me. At what point did I "Opt in" to this behavior??

I'm not excusing Apple's complete security failure here, but how exactly is Google not also culpable for this violation of my trust?

well (1)

x0d (2506794) | more than 2 years ago | (#39074937)

"When I was back there in seminary school, there was a person there who put forth the proposition of 'Don't be evil'..."

another thing is: (3, Insightful)

larry bagina (561269) | more than 2 years ago | (#39075281)

Google claims you can use the Ads Preferences Manager to disable this "feature". But wait! They previously claimed that it wasn't necessary to disable that feature because Safari defaulted to no 3rd party cookies.

Fuck me with a greased up Yoda doll, if they're going to blatently lie, why would they respect your desire to pot out of it?

Assuming they're not evil, they want to fill the web with their +1 buttons so they needed to turn on 3rd party cookies which unintentionally (not that they mind) enabled all their ad tracking.

Which is to say Google isn't evil but Google+ is.

And Chrome users trust Google? (1)

assertation (1255714) | more than 2 years ago | (#39075299)

Articles like this make me think using Chrome is only moderately safer than using a web browser made by Facebook, if they made one.

Uncool (2)

dittbub (2425592) | more than 2 years ago | (#39075313)

Man, google used to be so cool. What happened?

What I hear: (0)

Anonymous Coward | more than 2 years ago | (#39075363)

Apple: WAH. WAH. WAH. We're not making enough money. WAH.

I don't know who to trust less, Google or Apple. (3, Interesting)

mmell (832646) | more than 2 years ago | (#39075395)

Oh, wait . . .

Google brings me porn, warez and pirate music/video. All Apple's ever done is prove themselves one of the biggest patent whores on the planet.

Damn! That doesn't settle a thing. Guess I won't trust either of 'em.

Steve Job's revenant... (1)

forkfail (228161) | more than 2 years ago | (#39075493)

... stalks the corridors of Apple headquarters, inflicting great harm on anyone who quavers in their resolve to destroy Google.

Might come under the Computer Fraud and Abuse Act (3, Interesting)

Animats (122034) | more than 2 years ago | (#39075641)

This might violate the Computer Fraud and Abuse Act. [cornell.edu] The threshold phrase there is "exceeds authorized access". Explicitly bypassing a security measure is usually considered to satisfy that definition of criminal conduct.

Attempts to use the Computer Fraud and Abuse act have failed with regard to "Flash cookies", because the plaintiff was unable to show $5000 in damages [scribd.com] , even across a large number of users. But since then,. Google has offered a deal where users give up their privacy for $25 in gift cards. [google.com] Google has now put a price tag on privacy, which can be used as evidence against them in valuing future intrusions.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?