Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Microsoft Accuses Google of Violating Internet Explorer's Privacy Settings

Soulskill posted about 2 years ago | from the capitalizing-on-bad-publicity dept.

Google 197

New submitter Dupple writes with a followup to Friday's news that Google was bypassing Safari's privacy settings. Now, Microsoft's Internet Explorer blog has a post accusing Google of doing the same thing (in a different way) to Internet Explorer. Quoting: "By default, IE blocks third-party cookies unless the site presents a P3P Compact Policy Statement indicating how the site will use the cookie and that the site’s use does not include tracking the user. Google’s P3P policy causes Internet Explorer to accept Google’s cookies even though the policy does not state Google’s intent. P3P, an official recommendation of the W3C Web standards body, is a Web technology that all browsers and sites can support. Sites use P3P to describe how they intend to use cookies and user information. By supporting P3P, browsers can block or allow cookies to honor user privacy preferences with respect to the site’s stated intentions. ... Technically, Google utilizes a nuance in the P3P specification that has the effect of bypassing user preferences about cookies. The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter. Google sends a P3P policy that fails to inform the browser about Google’s use of cookies and user information. Google’s P3P policy is actually a statement that it is not a P3P policy."

cancel ×

197 comments

Sorry! There are no comments related to the filter you selected.

So... (5, Interesting)

The MAZZTer (911996) | about 2 years ago | (#39104033)

In other words, if your server delivers a garbage or blank P3P header, the browser assumes there are no privacy implications? Sounds like a hole in the standard to me, such headers should be ignored IMO. Though Google really should have tested this properly with all browsers before deploying it in production it sounds to me like an oopsie, not at all like the Safari thing.

Re:So... (5, Insightful)

samkass (174571) | about 2 years ago | (#39104083)

In other words, if your server delivers a garbage or blank P3P header, the browser assumes there are no privacy implications? Sounds like a hole in the standard to me, such headers should be ignored IMO. Though Google really should have tested this properly with all browsers before deploying it in production it sounds to me like an oopsie, not at all like the Safari thing.

Google has been claiming "oopsies" almost weekly over the last couple months. In this case they put this in their policy: 'P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 [google.com] for more info."' in what is meant to be a machine-readable field. Following the spec would have been easy-- omit the field altogether. Instead Google violates the spec in a way that benefits them. It's possible Google is just really incompetent over all these "oopsies", but they sure try to represent themselves as a company with above-average engineers. It has to be one or the other.

Re:So... (5, Insightful)

TheGratefulNet (143330) | about 2 years ago | (#39104147)

funny: I'll have to remember this to rub their noses in it, next time I run into a googler.

or, if they interview me, I'll ask THEM: "so, what is the proper response to a machine parsable field? TLV things or human-intended english? please support your answer."

sigh. I cannot give google a pass. they act like god's gift to networking yet they make 'mistakes' like this? sorry, but I don't buy it.

Re:So... (5, Insightful)

betterunixthanunix (980855) | about 2 years ago | (#39104205)

P3P sounds like a stupid idea anyway. How does it protect user privacy if something as trivial as the attack described above totally defeats it?

If the IE or Safari teams really cared about user privacy, they would be more strict about allowing sites to set or read cookies. This is just an excuse for Microsoft and Apple to publicly bash one of their competitors while continuing to not give two hoots about their users.

Re:So... (5, Funny)

ganjadude (952775) | about 2 years ago | (#39104243)

P3P, Im still trying to master P2P!

Re:So... (0)

Anonymous Coward | about 2 years ago | (#39104925)

I didn't even know Sony was still making portable gaming equipment.

Re:So... (3, Insightful)

ArsenneLupin (766289) | about 2 years ago | (#39104261)

P3P sounds like a stupid idea anyway. How does it protect user privacy if something as trivial as the attack described above totally defeats it?

P3P is a honor system anyways. The same effect could be obtained by a syntactically well-formed promise not to abuse the 3rd party cookies, but which google would never intend to keep...

Re:So... (0)

Anonymous Coward | about 2 years ago | (#39104469)

If what you say is right, why would Google release a do not track extension for Chrome?

What's happening here is quite simple. Microsoft and Apple are trying to score cheap PR points while at the same time trying to dent Google's business model because Microsoft specifically just cannot find a way to get that business model to work. MS and Apple don't care a bit about their users as they showed time and again.

Re:So... (2)

stanlyb (1839382) | about 2 years ago | (#39104549)

Does it matter that they are actually right about their accusations? Oh, wait, they are evil, guilty until....forever.

Re:So... (2, Interesting)

Anonymous Coward | about 2 years ago | (#39104659)

It does matter Microsoft is lying about this being a new revelation. Microsoft knew Facebook and Amazon do the same thing back in 2010 - so they obviously knew Google is doing this too. The timing of this is just cheap PR which is typical for Microsoft. Why don't they spend this time and effort in building a better standard and a better product?

Do not track... others (1)

SuperKendall (25149) | about 2 years ago | (#39105079)

If what you say is right, why would Google release a do not track extension for Chrome?

Two possible answers:

1) Google knows only a handful of people will download and install such things anyway, leaving the general population easily tracked.

2) You know they Google does not track you even with the extension installed how again? Preventing anyone BUT Google from tracking you is quite the competitive advantage.

Re:So... (0)

Anonymous Coward | about 2 years ago | (#39104271)

What does Google do to protect user privacy?
Oh, right... Google tries to steal user data.

Re:So... (4, Interesting)

recoiledsnake (879048) | about 2 years ago | (#39104499)

P3P sounds like a stupid idea anyway. How does it protect user privacy if something as trivial as the attack described above totally defeats it?

If the IE or Safari teams really cared about user privacy, they would be more strict about allowing sites to set or read cookies. This is just an excuse for Microsoft and Apple to publicly bash one of their competitors while continuing to not give two hoots about their users.

Reading your Gmail emails should very trivial for Google employees. That doesn't make it okay does it? One would expect Google to have higher standards.

You'd expect shady sites to "attack" a gentleman's agreement, not Google. If you think they're the same, would you be okay with hosting your mail on warez-email.com ? After all, they're both on the big bad internet.

Re:So... (3, Interesting)

hairyfeet (841228) | about 2 years ago | (#39104565)

Because then you have tens of millions of users screaming "My Gmail won't load!"? lets face it folks can "spin" all they want but Google ain't THAT dumb. they have some of the best engineers of the planet. So can we all just accept that "Do no evil" is nothing more than "Think different" aka marketing bullshit and realize that Google is only gonna do what is best for Google already?

Re:So... (3, Informative)

recoiledsnake (879048) | about 2 years ago | (#39104611)

Gmail doesn't need third party cookies. This is about sites with +1 buttons. They allow Google to track all users across all sites that have them.

Re:So... (2, Informative)

Anonymous Coward | about 2 years ago | (#39104801)

Exactly. And I don't want those buttons anyway. Most people don't want them. What this kerfluffle made me realize is that Chrome allows third-party cookies by default. It makes sense that an advertising company would do this I guess. But IE and Safari obviously don't allow them by default. Firefox I am not sure. I used to use FF a lot, but may have customized my settings. Right now it is set to allow the 3rd party cookies but treat them as session cookies and delete them when FF is closed. Chrome was just allowing them all. I went in and cleaned out a lot of cookies from sites I never had visited (advertising cookies) and told Chrome to quit accepting 3rd party cookies. So it at least shed light on which browser vendors are at least attempting to help users not be tracked.

Re:So... (4, Insightful)

noh8rz2 (2538714) | about 2 years ago | (#39104595)

don't blame the abuser! it's the victim's fault. she should have known better than to try to talk to him when he was stinking drunk again. Look what she made him do!

Re:So... (1)

Anonymous Coward | about 2 years ago | (#39104809)

So how do you propose companies like Apple and Microsoft distinguish between cases where they should follow established industry standards and specs or deviate from them? When either decides it's better for their users to do so? And they should just go ahead and not implement the standard properly instead of following up with the appropriate standards bodies? I'm confused about how Slashdot can be so pro-standard and then advocate ignoring them when it suits...

Re:So... (4, Insightful)

Richard_at_work (517087) | about 2 years ago | (#39104899)

Quite simply, it allows stories like this - which is a good thing.

P3P allows a website to make a very obvious statement about their intentions, to a set specification - if the website specifically sets a P3P that they don't honour then it becomes a PR issue, as it has in this case.

Google were breaking the spec here, in such a way that creates a valid P3P statement in the process which says "we won't be doing anything untoward with your cookies" - the field they use is not a text field and therefor the content they put into it is ignored, resulting in a zero length list of items they *will* do with the cookies...

That definitely should get Google into the tech media at least.

Re:So... (1)

mycroft16 (848585) | about 2 years ago | (#39104645)

I have to agree. With the quality of engineers that Google claims to have, this is a no-brainer. Especially in light of all the "oopsies" Google has had in the last year. This on top of the Safari incident after everything else adds up to bad news for Google.

Re:So... (4, Informative)

cheater512 (783349) | about 2 years ago | (#39104755)

Course it is deliberate. Question: So what?

It doesn't do anything to IE and is ignored by every other browser.
P3P is deprecated and has been for years - no other browser pays any attention to it.
All it does is make Google's products work properly with IE (not just ad tracking).

If I needed to add gibberish to one of my sites like that P3P policy to make it work, I would.

Re:So... (1, Informative)

wireloose (759042) | about 2 years ago | (#39104885)

from OP:

The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter.

Also can't give Microsoft a pass, especially if they're truly supposed to be ignoring undefined policies. It's not like Microsoft has ever been particularly supportive of standards they didn't develop, or like they've ever really developed a secure browser.

Question (1)

miltonw (892065) | about 2 years ago | (#39104201)

According to Google, there is no code in the P3P standard to accurately describe how Google uses cookies. In other words, they can't accurately describe it in standard P3P code.

I'm not trolling, I'm actually curious. If we assume that statement is accurate, how should a website fill use the P3P header?

In cases where P3P is not precise enough (4, Informative)

tepples (727027) | about 2 years ago | (#39104337)

According to Google, there is no code in the P3P standard to accurately describe how Google uses cookies. [In such a case,] how should a website fill use the P3P header?

The article answers this question by quoting a section from the P3P spec [w3.org] :

In cases where the P3P vocabulary is not precise enough to describe a Web site's practices, sites should use the vocabulary terms that most closely match their practices and provide further explanation in the CONSEQUENCE field and/or their human-readable policy. However, policies MUST NOT make false or misleading statements.

Re:In cases where P3P is not precise enough (4, Informative)

irregular_hero (444800) | about 2 years ago | (#39104715)

The article answers this question by quoting a section from the P3P spec [w3.org] :

In cases where the P3P vocabulary is not precise enough to describe a Web site's practices, sites should use the vocabulary terms that most closely match their practices and provide further explanation in the CONSEQUENCE field and/or their human-readable policy. However, policies MUST NOT make false or misleading statements.

This is correct. However, as stated further down in the same section, the effect of such policies is to be positive and declarative (meaning the policy should state what the site DOES do, not what it DOES NOT do), and be informative to the user. The standard allows for user agents to then use the P3P policy to make it the basis for "authorization" but then goes on to state that implementers of user-agents can make their own decisions as to what the declarations mean in the context of the connection.

This has led to situations where browsers that implement P3P and tie it to certain "security features" end up with a browser implementation that works dramatically different than other browsers for the very same privacy declaraion. In most cases, browsers do not even IMPLEMENT a user-readable informational dialog for P3P -- it is by standard the browser implementers' decision.

If you're keeping score at home, that's bad.

Re:So... (5, Insightful)

irregular_hero (444800) | about 2 years ago | (#39104281)

Google has been claiming "oopsies" almost weekly over the last couple months. In this case they put this in their policy: 'P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 [google.com] for more info."' in what is meant to be a machine-readable field. Following the spec would have been easy-- omit the field altogether. Instead Google violates the spec in a way that benefits them. It's possible Google is just really incompetent over all these "oopsies", but they sure try to represent themselves as a company with above-average engineers. It has to be one or the other.

Can't say I really can fault Google for this. Explaining why would require an understanding of how P3P 1.0 objects are configured and how limited those types really are.

P3P 1.1 work has stalled (albeit in provisionally final state) and is likely to not restart; in its absence is P3P 1.0 which exists firmly in the world-as-it-was of 2000/2001. It covers cookies and certain types of form transmission, but doesn't cover privacy aspects of other types of persistent data, new transmission protocols (like SPDY), advanced caching techniques, or HTML5 storage. Technology has advanced past the point that P3P 1.0 is useful -- and quite simply, it's doubtful it ever really was. If you visit the link Google supplies it explains some of their reasoning, and it's pretty dang valid for a post-2007 view of the Web.

Those chucking bombs over this would be better served to focus their efforts on either modernizing or replacing P3P 1.0 -- or, better yet, trying something radically different like PRIME or Policy-Aware-Web tried to do.

Re:So... (4, Insightful)

recoiledsnake (879048) | about 2 years ago | (#39104521)

Google is using +1 buttons to track visitors browsing on 3rd party sites to enhance their ad profiles for users. This is explicitly why P3P was even made as a standard. Circumventing the standard by sending invalid data while saying nothing exactly fits the definition is a cop-out.

Re:So... (5, Informative)

irregular_hero (444800) | about 2 years ago | (#39104817)

You're splitting hairs here.

P3P 1.0 doesn't allow for multi-site delclarations, only "cross-site" declarations. There can be one -- and only one -- P3P policy; by the standard it doesn't allow but ONE policy and states that others, if present, should be ignored. This just isn't how the Web works these days. Cloud services have pretty much become a defacto standard, but P3P forces site administrators to take a P3P policy from the integrated service and mash it into their own policy (and hope the service policy never changes). This just isn't practical.

A site admin CHOOSES to use +1 buttons and FB like buttons. Inclusion of these objects would optimally prompt an admin to adjust their _own_ P3P policy, but it's just a plain 'ol administrative nightmare to manually take the respective organizations' policies and create a master policy out of all of them. It's fully manual; it has no concept of "merging" policies to present users with enough information to make informed choices on the multitude of SaaS services sites now use. That's the issue.

The darn thing is broken. Period. Hard to claim "cop-out" when dealing with a protocol that's stuck in 2001.

Re:So... (1)

marcosdumay (620877) | about 2 years ago | (#39105131)

So the offending part can all by itself circunvent the barriers the standar dictates against him. Isn't that alone enough reason to abandon the standard? Or we do expect the dishonet to act honestly on the web?

I'm not defending Google, by the way. I just don't understand why Microsoft (or anybody else) is trusting the "evil bit" when it claims a package isn't evil.

Re:So... (2)

Ethanol-fueled (1125189) | about 2 years ago | (#39104535)

You said,

It's possible Google is just really incompetent over all these "oopsies", but they sure try to represent themselves as a company with above-average engineers. It has to be one or the other.

I'll be an annoying Philosophy 101 kid and state right off the bat that's a false dichotomy.

Anyway, anybody who's worked in the tech sector(or read enough Dilbert, or both) knows that even the "above-average" engineers are boneheads. I'll give you a few real-life examples I have encountered - an engineer who though it would be a good idea to couple zinc anodes to a titanium plate to be deployed under the sea, the engineer who didn't overdesign a power circuit which resulted in exploding power transistors, the engineer whose published programs are riddled with misspellings, the engineer who didn't design for standard industry sizes resulting in having to stretch gaskets to get them to fit, the multitude of engineers who don't comment their code except for their initials at the tops of the source files, and the list goes on and on.

Re:So... (4, Insightful)

CowTipperGore (1081903) | about 2 years ago | (#39104699)

From my reading of Microsoft's long blog post, Google didn't violate the spec. IE does not correctly implement the spec and Google is abusing that by using a legal but illogical header. If Google doesn't say what they are doing with the data, then IE shouldn't provide it. Instead, Google says "I'm not telling you anything about my intent" and IE says "Good enough. The key's under the mat. Lock up when you're done." The whole system is trust based. Google doesn't promise anything and IE doesn't care. Google is being shady and Microsoft is being incompetent.

My biggest problem here is Microsoft releasing this now in a lengthy blog post and trying to tie it to the Safari dust up. They know that the blogs will not include their full release and will instead carry the headline like you see here. This is a PR move at least as dishonest as what Google appears to be doing with their P3P header.

Re:So... (2)

mystikkman (1487801) | about 2 years ago | (#39104769)

> Google didn't violate the spec

The list is supposed to be populated with the code(s) of what they're doing with the info. They're lying by not stating they're tracking users browsing habits when they visit pages with +1 buttons. Leaving it blank is not in the spec.

Re:So... (3, Informative)

CowTipperGore (1081903) | about 2 years ago | (#39104975)

Not even Microsoft supports your argument. From their blog post:

Technically, Google utilizes a nuance in the P3P specification that has the effect of bypassing user preferences about cookies. The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter.

Rather than ignoring it, IE is assuming that Google told them something positive.

Re:So... (4, Insightful)

GIL_Dude (850471) | about 2 years ago | (#39104891)

Well, it is certainly trust based and open for abuse (people can certainly lie in the header). However, what Google should be doing is not providing a P3P header at all. It is only someone who is openly abusing the trust system who would create a P3P header that doesn't contain any P3P information. It is fairly clear that it was done on purpose - to abuse the trust system. Is that system a crap design? Yes. Yes, it is. Should major companies be out there abusing it if they want us to trust them? No. No, they should not. It is pretty clear from this that:

1) We need to call out companies that do this type of thing. Not just with P3P but anytime they abuse the system or game it. They need to be made to understand that a very vocal set of folks will make it known what they are doing and that it is bad for their business to be found gaming trust systems.
2) We need better systems that don't just trust whatever a company says about their intentions with our data.

Re:So... (1)

Anonymous Coward | about 2 years ago | (#39104135)

In other words, if your server delivers a garbage or blank P3P header, the browser assumes there are no privacy implications? Sounds like a hole in the standard to me, such headers should be ignored IMO. Though Google really should have tested this properly with all browsers before deploying it in production it sounds to me like an oopsie, not at all like the Safari thing.

"sounds to me like an oopsie"

odds are if this was the othe way around and microsoft had "forgotten" to do somthing and had thus comprimised a standard designed to help protect privacy there would be an uproar on our hands.

to many people take it for granted that google arent "evil" and when they do things that are "evil" give google benifit of the doubt that other comanys wouldnt (and shouldnt) be afforded.

even if this is an "oopsie" corperate mistakes like this should be punnished.

captcha : disgust

Re:So... (1)

ozmanjusri (601766) | about 2 years ago | (#39104991)

FTFY

odds are this was the othe way around and microsoft had "forgotten" to do somthing

Bingo.

Microsoft is just being opportunistic with some Google-bashing. In practice, Google is not complying with a vendor (Microsoft)-specific standard which many other sites also don't comply with.

When good browsers do apply that standard, the Google server response is human-readable text, including hyperlink, explaining why Google doesn't support the standard.

Re:So... (1)

billcopc (196330) | about 2 years ago | (#39104279)

Anything that relies on "voluntary" cooperation is flawed. Either you accept that 99% of the internet will ignore it and quityerbitchin', or... you create a privacy standard that is client-enforced and leaves no room for loose interpretation.

Just because people think they can shame Google into playing nice, doesn't mean those Doubleclick rat bastards will, nor any 3rd world fraudster, which means this whole P3P thing is a joke.

Re:So... (1)

similar_name (1164087) | about 2 years ago | (#39104359)

Just because people think they can shame Google into playing nice, doesn't mean those Doubleclick rat bastards will

I think Google owns Doubleclick. But you're right, privacy has to start with the client.

Re:So... (1)

mystikkman (1487801) | about 2 years ago | (#39104789)

Anything that relies on "voluntary" cooperation is flawed. Either you accept that 99% of the internet will ignore it and quityerbitchin', or... you create a privacy standard that is client-enforced and leaves no room for loose interpretation.

Just because people think they can shame Google into playing nice, doesn't mean those Doubleclick rat bastards will, nor any 3rd world fraudster, which means this whole P3P thing is a joke.

I am sure you will say the same thing if Google employees starts reading your email for fun and profit.

"Oh it's okay, it's your fault for trusting a site on the internet, stop demanding them to stop it, would warezemail.com stop?".

Re:So... (0)

Anonymous Coward | about 2 years ago | (#39104987)

That's why I wouldn't use warezmail.com, yes. I trust Google to not read my email, yet I still expect them to try to harvest information for targeting ads from it. Similarly I expect them to try to harvest this information from +1 buttons idiots sprinkle on their site, so I pro-actively stop that kind of shit client-side because I don't benefit from it (as opposed to them taking care of spam filtering and storage for email). In short, I accept that Google will do data mining but not reading by a human and as a consequence will only give data to Google if it benefits me. Fuck warezmail.com, I don't trust them with anything.

Re:So... (1)

Anonymous Coward | about 2 years ago | (#39104929)

You are trying to solve a social problem with technology ("client enforced" privacy standard with "no room for loose interpretation"). It doesn't work like that.

P3P may well be useless but saying that the assumption of cooperation automatically leads to failure is just plain wrong. Think about payment systems; I'm sure there are theoretically secure technologies for money transfer... but what is still one the most common methods in the real world? handing over a piece of magnetic plastic and writing your name on a paper.A system fully based on trusting complete strangers has been the basis of our economy for a long time and it's worked wonderfully (to me the amount of fraud is surprisingly low).

Re:So... (2, Insightful)

sjames (1099) | about 2 years ago | (#39104367)

No. The browser is supposed to ignore the whole thing if it doesn't find anything it understands. Why MS doesn't make IE just go with the default of NO in those cases, I don't know.

Of course, why Google sends such a non-statement is questionable as well.

Re:So... (1)

stanlyb (1839382) | about 2 years ago | (#39104533)

Nope, they are simply saying that Google does not support P3P policy, hence, what? What is the punishment for a site that does not support it? Marking it as Evil?

Film at 11 (1)

Anonymous Coward | about 2 years ago | (#39104043)

Browser requires link to allow cookies, website provides link, browser allows cookies. Film at 11.

This is like Jack the Ripper (2)

Spy Handler (822350) | about 2 years ago | (#39104067)

telling us that Charles Manson does bad things...

Re:This is like Jack the Ripper (0)

Anonymous Coward | about 2 years ago | (#39104117)

Yes and it also warns users that Google is not following the rules.

Re:This is like Jack the Ripper (0)

Anonymous Coward | about 2 years ago | (#39104639)

telling us that Charles Manson does bad things...

... and has no impact on the validity of they're saying. Who gives a fuck if you don't like the messenger. Doesn't make the message any less true.

Re:This is like Jack the Ripper (1)

AK Marc (707885) | about 2 years ago | (#39104889)

Wait, so Rush Limbaugh talking about Nancy Pelosi was unbiased and just as true as anything the NYT says about Nancy?

Re:This is like Jack the Ripper (3, Insightful)

SydShamino (547793) | about 2 years ago | (#39105035)

The problem with that line of thought is that it allows one person to dominate the discussion by shouting nonsense. If someone keeps saying un- and half-truths repeatedly, and you take the time to independently analyze the validity of what they say, you never have any time to consider the viewpoints of others or to form your own opinions.

It's much easier, and indeed human nature, to eventually decide that source doesn't contribute anything meaningful to the discussion, and ignore it entirely.

Examples:
a) Microsoft and anything about unfair trade practices (to some people)
b) 126.67.234.x and spam (to many spam filters, and I just made up that IP address range)
c) Political talking heads who fill various cable news channels 24/7
d) Boys who previously cried wolf

Re:This is like Jack the Ripper (1)

cupantae (1304123) | about 2 years ago | (#39104879)

No it's not. It's one company making a complaint about another.
If this is the beginning of the big companies goading one another into following standards, it's great news for the user.
But it probably isn't.

"Do no evil"......or..... (1)

landofcleve (1959610) | about 2 years ago | (#39104099)

NOT!!!

Re:"Do no evil"......or..... (0)

Anonymous Coward | about 2 years ago | (#39104617)

Do mo' evil

A broken standard was shipped (1)

Anonymous Coward | about 2 years ago | (#39104113)

And it's Google's fault, of course.

Dear Microsoft Iexplore team (0, Offtopic)

FudRucker (866063) | about 2 years ago | (#39104133)

if a website (including google) can bend your browser over and sodomize it then they will, so instead of crying about a website violating some rule of conduct just build a secure operating system & browser that can not be taken advantage of (since they are supposed to be integrated and inseparable)

Re:Dear Microsoft Iexplore team (4, Insightful)

smelch (1988698) | about 2 years ago | (#39104357)

Yeah, just build a secure OS and browser that doesn't allow people to use cookies as tracking cookies. Oh shit, the only way to do that would be to not support cookies at all. And holy crap, IE allows you to turn cookie support off.

You don't really understand the problem here, do you? It's a potential ethics violation by Google, not a technical violation. It's like if a company published inaccurate ingredients on a can of nuts, and you're bitching about shoddy can manufacturing.

Re:Dear Microsoft Iexplore team (4, Interesting)

maxwell demon (590494) | about 2 years ago | (#39104525)

The problem is that, according to the standard, the browser should ignore any policy it cannot understand. Ignoring a policy means acting as if it wouldn't exist. If no policy exists, IE's behaviour with default settings is to not allow the cookie. Therefore by the standard, it shouldn't accept cookies when it doesn't understand the policy. If IE doesn't do that, it's the browser's fault.

Re:Dear Microsoft Iexplore team (2)

DavidRawling (864446) | about 2 years ago | (#39105001)

I'm with you on this one - well, partially at least. The problem is that the spec doesn't really plan for a site saying "We don't want to tell you that we do lots of stuff that may or may not be parseable in this header, so here's some text plus a URL for the browser to not show". Microsoft should definitely have assumed the worst case scenario for PII use, not the best case.

Now I'll agree that the URL is valid - but it's completely useless because no browser on earth actually shows that info. The engineer who decided the compact policy reference should be JUST the URL because the other parts of the spec aren't perfect deliberately chose to obfuscate Google's information use, just as much as Microsoft chose not to show the P3P URL to users (except when it's buried in the UI - I haven't seen it ever work).

Let's also not forget that Google chose not to make the XML version available to the browser for evaluation - so there's a second deliberate avoidance of any machine-readable information. And the fact that it's twice avoided is the red flag to me.

Hm...interesting approach... (1)

betterunixthanunix (980855) | about 2 years ago | (#39104173)

Sounds like you are asking the bad guys to cooperate with you. If you want to protect user privacy, do not allow sites to set arbitrary cookies, do not allow iframes to set or read cookies, and so forth. Does anyone really think that Google is going to voluntarily respect privacy, when their entire business is based on tracking people?

We have see proposal after proposal based on the idea that either users should be forced to opt-out of invasions of their privacy, or that the people who want to violate users' privacy will cooperate and not commit such violations. How about giving browsers some teeth, and creating browsers that actually protect user privacy without regard to advertiser profits?

Re:Hm...interesting approach... (0)

Anonymous Coward | about 2 years ago | (#39104223)

Sounds great, but all of the browser vendors (save Opera) are in bed with advertisers.

Internet Explorer: Microsoft: Bing
Chrome: Google (ads and analytics)
Firefox: Google (ads and analytics)
Opera: ????

Re:Hm...interesting approach... (1)

recoiledsnake (879048) | about 2 years ago | (#39104245)

Opera too gets a lot of money from Google.

Re:Hm...interesting approach... (0)

Anonymous Coward | about 2 years ago | (#39104917)

Opera just recently announced they're buying two ad-serving networks. [slashdot.org]

What does Bing do? (1)

ardeez (1614603) | about 2 years ago | (#39104183)

What does Bing do?

Re:What does Bing do? (0)

phonewebcam (446772) | about 2 years ago | (#39104527)

It serves results from Google [blogspot.com] . And that sites been up an awful long time for any errors, misconceptions and ... FUD to have been discovered and corrected by now, so we'll just leave it to the astroturfers to mod down the truth whilst enjoying their hugely entertaining comedy squirming around having been caught red handed. This happens every time that link is mentioned on Slashdot. Why, its almost like the $5 per handset Android extortion - there's clearly no way to deal with such disgusting behaviour other than paying shills to bury it.

Re:What does Bing do? (1)

recoiledsnake (879048) | about 2 years ago | (#39104683)

That link is much ado about nothing. If the user has agreed to the conditions of the Bing bar, it uploads the keyword and the link that was clicked on. No other information like the results returned or the ranking of the results is sent to MS. This is used as one of the many signals by Bing. I fail to see how this is the same as "serving results from Google".

Re:What does Bing do? (1)

mystikkman (1487801) | about 2 years ago | (#39104997)

>It serves results from Google [blogspot.com]. And that sites been up an awful long time for any errors, misconceptions and ... FUD to have been discovered and corrected by now,

OMG, I've just found conclusive proof that the earth is flat!!!

The below site hasn't been updated in ages and is still up, it means whatever it says is true!!!

http://www.alaska.net/~clund/e_djublonskopf/Flatearthsociety.htm [alaska.net]

Off for a drive to the edge of the earth. Hope they have erected a barrier so people won't fall off.

As much as I dislike Microsoft... (-1)

Anonymous Coward | about 2 years ago | (#39104185)

...I guess it's time to start boycotting each and every Google product. Fucking hypocrites.

--
Marcan, asshole [mailto] and proud.

IE's fault? (5, Insightful)

Todd Knarr (15451) | about 2 years ago | (#39104187)

When I was configuring P3P for Mozilla/Firefox, it distinguished between what exactly the P3P policy was stating. If the site didn't say in the P3P policy what it was doing with cookies, Firefox assumed the worst. It seems to me that if the IE devs were dumb enough to stop after seeing a P3P policy presented and didn't bother checking what it said, or if they assumed a lack of a statement indicated respect for privacy, that's a failure in IE. The code needs to start out assuming personal information is collected and used without consent, and then upgrade only if the P3P header specifically says something better. It's not like that's hard to implement.

Then again, we've seen similar problems in Microsoft software time and time again: they assume the best (input's valid, doesn't contain special characters, etc.) until they detect otherwise, even though best practices say to do the opposite (assume input's invalid until analyzed and proven correct, list the known non-special characters and filter out or escape everything not in that list).

Re:IE's fault? (1)

rusty0101 (565565) | about 2 years ago | (#39104305)

It looks to me that Google is doing exactly what their p3p policy says they will do. It also looks to me like IE is assuming that simply because there is a reference to a p3p that it says whatever the developer thinks a pep should say, rather than whatever it actually says.

I'm not saying that Google shouldn't be setting up a situation where 3rd party cookies may be accepted when they are not wanted. I don't know how the p3p in place was decided upon, but just because I have a valid drivers license, doesn't give me authority to drive any vehicle known to exist. My curiosity may be such that if someone offers to let me try my hand at operating a Peterbuilt tractor, I might give it a go, but that's not part of the class of license that I carry and can present.

Re:IE's fault? (4, Informative)

OverlordQ (264228) | about 2 years ago | (#39104351)

It looks to me that Google is doing exactly what their p3p policy says they will do.

No, it's doing the exact opposite. P3P is a list of things you *WILL USE* the cookie data for, not what you *WILL NOT* do. Per the spec, if it's not a valid tag it gets ignore, remove all the invalid stuff and google is effectively sending P3P="", or in other words, they wont use it for anything.

Re:IE's fault? (1, Insightful)

Todd Knarr (15451) | about 2 years ago | (#39104673)

Wrong. "P3P=" isn't saying they won't use it for anything, it's not saying anything about what they'll use it for. You're supposed to be able to trust anything said in the P3P header, but nothing in the P3P spec says they have to say anything. And if they don't say anything about a specific subject, best practice is to assume the same as if they hadn't included the P3P header at all (at least regarding whatever item you're looking at at the moment).

If you need someone to drive a vehicle for you and they won't say whether they have a driver's license or not, do you assume they've got one and it's valid for the vehicle you need them to drive? No, you assume they don't.

Re:IE's fault? (0)

Anonymous Coward | about 2 years ago | (#39104831)

I just wasted a bunch of time searching the spec and I can't find anything to confirm what you or the handful of others defending IE6's behavior. There's no default in the spec of promising anything. I looked, because I couldn't believe the spec could be that stupid. It's not. If I'm wrong, show the part of the spec that agrees with you.

Re:IE's fault? (0)

Anonymous Coward | about 2 years ago | (#39104327)

Why on earth would Google return a P3P policy that only contains "P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info" instead of just, oh I don't know, not sending anything at all in the absence of a policy?

Re:IE's fault? (1)

arose (644256) | about 2 years ago | (#39105045)

If it's not a policy IE shouldn't accept it as one.

Re:IE's fault? (0)

Anonymous Coward | about 2 years ago | (#39105087)

You completely missed the point. Please research how P3P actually works before posting again. Absence of a policy means nothing should be sent, not a "policy" that says "this is not a policy." It's absurd, and so was your reply.

Re:IE's fault? (1)

thatbloke83 (1529851) | about 2 years ago | (#39104675)

But I thought that we were supposed to assume that everyone is innocent until proven guilty? :)

Re:IE's fault? (2)

recoiledsnake (879048) | about 2 years ago | (#39104695)

Google intentionally breaks a W3C standard for its profit and it's totally MS' fault and Google is the knight in shining armor that deserves no blame whatsoever. Wow, just wow.

Re:IE's fault? (0)

Anonymous Coward | about 2 years ago | (#39105189)

Agree. I can't believe the acrobatics that the Google apologists are going through to defend this. I would expect this from some home brew or shady site, but not Google. Let's call foul when we see it rather than trying to put lipstick on a pig shall we?

Re:IE's fault? (1)

Anonymous Coward | about 2 years ago | (#39105151)

Actually, IE does assume something bad is going to happen with your data by default, and only assumes something good is going to happen if you futz around with the P3P header.

Firefox assumes something good is going to happen by default. You don't even have to set a P3P header to get it to think that.

Compare reading and writing of cookies from sites displayed in an iframe between the two browsers. FF will allow it no matter what, IE will only allow it with a P3P header (set in the headers of the site being displayed in the iframe) set correctly (or incorrectly, whatever).

.NET Shit addon for Firefox in WINDOWS UPDATE (-1)

Anonymous Coward | about 2 years ago | (#39104251)

What about shit like this in Windows Update?

Firefox Add-ons to Support .NET Application Deployment .NET Framework 4

The Windows Presentation Foundation (WPF) plug-in for Firefox and the .NET Framework Assistant for Firefox enable XAML browser applications (XBAPs), loose XAML, and ClickOnce applications to work with the Mozilla Firefox browser.
http://msdn.microsoft.com/en-us/library/cc716877.aspx [microsoft.com]

Older article but there are probably newer ones on the web:

Microsoft updates its controversial Firefox plug-in for .NET 3.5
http://betanews.com/2009/06/25/microsoft-updates-its-controversial-firefox-plug-in-for-net-3-5/ [betanews.com]

it's because IE implementation is buggy (5, Insightful)

Twillerror (536681) | about 2 years ago | (#39104301)

In IE iframes will block cookies if you don't have the right P3P policy. There where other bugs that would prevent your site's cookies from being read.

I've "faked" a P3P header just so users of certain IE browser versions could use my site.

At the end of the day the standard is a proposal and only MS thinks it's worth a hill of beans.

Re:it's because IE implementation is buggy (1)

Anonymous Coward | about 2 years ago | (#39104385)

They certainly didn't code to the "standard." You can clearly read it on the P3P page:

      P3P user agents MUST NOT rely on P3P compact policies that do not comply with the P3P 1.0 or P3P 1.1 specifications or are obviously erroneous.
      Such compact policies SHOULD be deemed invalid and the corresponding cookies should be treated as if they had no compact policies. The following
      guidelines are designed to reduce the chance that a P3P user agent will accept an invalid compact policy.

So if IE were conforming to, well any standard at all, let alone the P3P one, it would do what the standard says with Google's malformed P3P - ignore it as if it didn't exist and act accordingly. This is not a 'nuance' as the author suggests but rather one company blatantly violating the proposed standard (Google) and another failing to code to the condition correctly (Microsoft). Yet another case of two jerks wanting a public battle in which both sides are in the wrong.

Pissing matches make for poor reading material, IMO.

Which cookie are we talking about here? (1)

Lussarn (105276) | about 2 years ago | (#39104355)

Just asking... I do not think we are talking about a tracking/advertising cookie here. I'm very certain google uses first-party cookies for tracking/advertising (meaning it's your site and not google that sets/owns the cookie). And first-party cookies needs no P3P. Or am I wrong?

Re:Which cookie are we talking about here? (1)

viperidaenz (2515578) | about 2 years ago | (#39105183)

As stated in the URL they send in the invalid P3P policy, they use third party cookies to make Google+ +1 buttons work and other unimportant things

Wait, how is this not an IE issue? (0)

Anonymous Coward | about 2 years ago | (#39104401)

How is this a Google issue and not an IE issue?

If a site offers a tainted cookie, isn't it the responsibility of the browser to reject it? How exactly is a browser "tricked" into accepting it?

Re:Wait, how is this not an IE issue? (3, Insightful)

AK Marc (707885) | about 2 years ago | (#39104953)

Google is offering up the tainted cookies, so it's a Google issue. IE is mishandling the cookies, so it's a Google issue, or so says MS. If either of them handled the standard correctly, there would be no issue. Neither follow it, so both have issues.

Don't Be Evil (1)

EverlastingPhelps (568113) | about 2 years ago | (#39104419)

Did we say evil? We mean Don't Get Caught.

Re:Don't Be Evil (0)

Anonymous Coward | about 2 years ago | (#39104557)

You've got that wrong - it was:

Don't! Be Evil!

Remember DoubleClick? (5, Interesting)

SSpade (549608) | about 2 years ago | (#39104467)

Remember DoubleClick? The sleazy advertising company that everyone loved to hate? Remember when they merged with Abacus Direct, creating a merged company that would mine and combine everything from web cookies to physical addresses, names and phone numbers? Remember when this privacy issue was such an obvious risk that the FTC launched investigations into it? Or when they were widely categorized as malware purveyors, or when they were caught serving drive-by malware infections?

Remember when they merged with a search company, changed their name to Google and kept doing all the same things?

No? Thought not.

Re:Remember DoubleClick? (1)

Anonymous Coward | about 2 years ago | (#39104777)

> ...the FTC launched investigations...

Ever wonder what became of those "investigations"?

No? Thought not. ;-)

Don't be Evil (1)

mschaffer (97223) | about 2 years ago | (#39104483)

So, does running a truck through loopholes, bad specs, known bugs, etc.---when the intent is clear---constitute being evil?

The Good the Bad and the Bull (0)

Anonymous Coward | about 2 years ago | (#39104583)

Google bad....Bing good. And so goes the bullshit from Redmond, read this bullshit however you wish it is just continuation of the already advanced "screw Google" campaign... http://www.dailyfinance.com/2009/08/28/microsofts-secret-screw-google-meetings-in-d-c/ which unfortunately has now become a daily post item essential on Slashdot. Until the Microsoft shills are stopped from posting shit like this on Slashdot the only reason I come here is to see how much damage they have done to a once very relevant tech forum.

Evil bit? (3, Insightful)

mwvdlee (775178) | about 2 years ago | (#39104613)

This whole P3P thing just sounds like the evil bit all over again.
How exactly is P3P supposed to protect users' privacy?

Hows about... (0)

Anonymous Coward | about 2 years ago | (#39104651)

Google honor the DNT header? I've got javascript and meta redirects disabled and it's really irritating when google start redirecting their search results to track clicks.

Time to have opt-in as a default (0)

Anonymous Coward | about 2 years ago | (#39104665)

It's really time that tracking, cookies, online advertising became opt-in instead of opt-out. I block EVERYTHING by default now and have for some months. I started off with just Adblock Plus, but that wasn't good enough. Then I added a very aggressive hosts file with over 300k entries. Still not good enough. It seems there are new tracking mechanism being put in place almost daily. Basically I have to whitelist content and sites I want to see because of the absolute cesspool of Internet monetization out there. Ghostery doesn't cover nearly enough bad stuff. Basicaly I want websites down to the bare metal and I've pretty much got it down to a science now, but it took awhile and the right combination of tools and command line tricks to get this far.

I refuse to see any online ads, get tracked, and allow websites to use me for profit when I am not allowed to realize any of that profit myself. No thanks. I block all social media "like" buttons and scripts because they track you even when you do not have a profile with the respective service. It's getting ridiculous and I know I'm not the only one angry over this stuff. I already pay to use the Internet so my bandwidth and eyeballs are mine. It's surprising just how quick sites load without all the useless, evil dreck.

Re:Time to have opt-in as a default (0)

Anonymous Coward | about 2 years ago | (#39104851)

I refuse to see any online ads, get tracked, and allow websites to use me for profit when I am not allowed to realize any of that profit myself.

Do you know how you profit yourself? By looking at the content created by those who host those pages you block the ads on.

I guess they should just be providing that content to you gratis.

Eh? (0)

Anonymous Coward | about 2 years ago | (#39104739)

What muppets still use IE anyway? :s

Pot, kettle... (1)

sxyzzx (125040) | about 2 years ago | (#39104787)

For some reason, they neglected to mention that Microsoft's own sites have also been found doing EXACTLY THE SAME THING [cmu.edu] . Weird.

Mozilla and Opera? (0)

Anonymous Coward | about 2 years ago | (#39104915)

Any word from, or about, Mozilla and Opera yet?

Life Imitates Art (1)

divide overflow (599608) | about 2 years ago | (#39105055)

>Google’s P3P policy is actually a statement that it is not a P3P policy.

As Rene Magritte would say: "Ceci n'est pas une politique P3P."

A P3P Policy which isn't a P3P Policy? (2)

idontgno (624372) | about 2 years ago | (#39105089)

That's very surreal, Google.

René Magritte would approve [wikipedia.org] .

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>