Web Bug Detector 190
(H)elix1 writes: "I'm sure /. is about to be hit with this, but CNET just released a story about a web bug detector plug-in for IE called Bugnosis by the Privacy Foundation. An interesting toy, but the thing that grabbed my attention was the Web Bug Gallery. It would seem our beloved slashdot has them as well. Course, so did CNET, but that is a different story...." I think improved cookie-handling is much more useful in preventing tracking, but this is interesting because it provides visible feedback about tracking efforts.
Re:IE5 had this too (Score:1)
Cookies != Web Bugs (Score:1)
Cookies definitely can exasperate the problem by providing additional information. But bugs are not reliant on cookies. You can block all cookies and block all images and you will not block all web bugs. The reason advertising companies like to use cookies is that you can track additional information easily, because the browser obligingly stores the data and spits it back on demand, even after you shut the browser down and start it back up, often hours, days or weeks later.
For reference, check the Web Bug Report [securityspace.com] quote in the CNET article [cnet.com] and you'll notice that the report shows the types of bugs (imgs, iframes, etc.) that are present. A very large # of them are not images...
Web bugs (Score:2)
Re:hey guy, it's okay! (Score:4)
Therefore, buy XP and save the government valuable surveillance budget dollars.
Agent Bitterman, Superspy
President Chief Head Director of the Leadership Branch of the Executive Level of the CIA
Funny... (Score:3)
- A.P.
--
Forget Napster. Why not really break the law?
Re:Proxies that filter web bugs (Score:1)
--
Re:IE5 had this too (Score:1)
--
Re:Slashdot *is* OSDN (Score:2)
Why 'of course'? What benefit is it to VA that they know I read Freshmeat, Slashdot and Sourceforge but not QuestionExchange (mainly because of their sub-literate banner ad)? I've never noticed a difference in advertising content across the sites...
--
the telephone rings / problem between screen and chair / thoughts of homocide
Re:IE5 had this too (Score:2)
So you can accept all first party cookies, and be prompted about any third party ones.
- Steve
Re:IE5 had this too (Score:4)
Re:Apache Privacy Issues (Score:5)
Correction (Score:3)
------------
You only have to enable ActiveX control downloading in order to install
Bugnosis -- you can disable it after installation. That makes it really no
different than downloading an
download isn't scriptable, so other Web sites and email users will find it
harder to abuse.
Regards,
David
Prof. David Martin
University of Denver Math/CS
The cure will kill you worse than the disease (Score:4)
Re:Mozilla (Score:2)
/. has even better info. (Score:4)
As
--
echo '[q]sa[ln0=aln80~Psnlbx]16isb15CB32EF3AF9C0E5D727
Strip web bugs (naked!) (Score:2)
FilterProxy [wisc.edu] can remove web bugs by stripping them straight out of the html. Oh, and it removes ads too.
</plug>
--Bob
pretty cool (Score:2)
Just one annoying thing:
Every time it finds a web bug (definite web bug), it brings up the report. Makes reading
STOP TRACKING ME YOU COMMIES!
me = stupid (Score:2)
If you do the one pixel high thing, just watch the toolbar in IE5 for when the bug turns red if you want to know if you're being bugged...
Re:me = REALLY stupid (Score:2)
Re:Does Not Does Not (Score:2)
Re:What about Mozilla/Netscape and other browsers? (Score:2)
Re:Yes, that IS a webbug (Score:2)
http-referrer
user-agent
YOUR IP
that's pretty identifying if you're on a dedicated connection, i.e. surfing from work.
Re:Here they are: (Score:2)
That tells them what timezone you're probably in....
Then they could build demographics profiles -- for example, people who are on at 3 AM in the USA are probably students or security guards or something.
IE5 had this too (Score:3)
/. hypocrisy (Score:4)
Re:Apache Privacy Issues (Score:2)
The real humor is that some moderators didn't recognize this as a well-known non sequitur and marked it "Informative". Next time you may have to actually include the smiley to help out some of our "special" moderators...
Caution: contents may be quarrelsome and meticulous!
Re:Comments from a Bugnosis author (Score:2)
Actually that about the cookies isn't right. Looking at the OSDN image on Slashdot's page, OSDN can't pick up any slashdot.org cookies from it. Not unless the browser is failing to apply the same-domain rule, that is. You can do some things with Javascript to put osdn.com cookie information into the image request query string, but the OSDN code doesn't do that.
Re:Managing cookies in Mozilla 0.9.1 (Score:2)
Pull up the Tasks menu, Security and Privacy, Cookie Manager, and hit the Cookie Sites tab. Find the sites you want to allow cookies for and remove them from the list of blocked sites.
Re:Comments from a Bugnosis author (Score:2)
Well, yes. But then again, Slashdot could add a module to the Web server that logged their cookie info along with the hit data and timestamps into a file and e-mail that file to anyone they felt like, too. Some shell scripting and a cron job and it'd be completely automatic. That's not Web bugs leaking the information to a third party, that's the main site deliberately giving that information to a third party. I may have concerns about the main site doing that, but Web bugs don't add anything to that concern IMHO seeing as the conduit exists without Web bugs.
And yes, I have thought about that sort of Apache ( and possibly IIS ) module. It's got applications for legitimate site statistics, not just unethical tracking.
Re:Comments from a Bugnosis author (Score:2)
Only point, though: if a site's coding custom Javascript to transfer their cookies to a third-party site, they're planning on synchronizing information in advance already. That or the ad site's handing them cut-and-paste code to use and they aren't checking it, and that can be seen in the HTML source. Pulled-in scripts where the JS in question doesn't appear in the page source won't work, because browsers enforce cookie-domain rules based on the source of the script, not the page pulling it in.
As for difficulty in synchronizing, think about the trio of timestamp, source IP address and referring URL. Off the cuff estimate, I could probably get 95% accuracy from those on any given hit, and over the course of a few hits I'd get effectively 100% accuracy for any given surfer. All automatic once it's created, no effort needed on the part of the operators once the software's installed.
As for what you call Web bugs being only for the info transfer, that depends on what sort of info transfer you're talking about. I can tell you right now that the OSDN 'bug' on Slashdot's pages doesn't do what you're suggesting, so right off there's a counterexample to your assertion. Ditto at least Hitbox's stuff. The only problem is that the illegitimate tracking ones and the legitimage statistics ones look almost identical in the code, until you start really digging into the Javascript ( if any ) and the back-end systems. That's a job that's too complicated usually for a simple plug-in.
As for HTML e-mail bugs, that assumes that a) the user's using a mail reader that renders HTML and b) that mail reader's dumb enough to pull in content not contained in the e-mail message. If your mail reader's a Web browser, then you're obviously open to all the exploits that can be applied to a Web browser. That's why I don't use a Web browser to read mail. :)
Re:Comments from a Bugnosis author (Score:2)
NAT makes the IP address ambiguous, yes. That's why I specified that triple instead. To make the triple ambiguous you need to have two people behind the same NAT box hit the same URL within a second or so of each other. That is a lot less likely, and if they hit different URLs then I can match the referrer in my logs against the URL in their logs and disambiguate the sources. Ditto if they hit it at different times. As far as time synchronization, see NTP. Time sync within a few hundred milliseconds isn't hard at all.
As for what the bug's there for, that's the whole point. "Page X on your site was viewed N times by M unique people." is a perfectly legitimate Web-site statistic. So is "Q people followed this path through your site and abandoned it at page B.". In fact a lot of sites could use smacked over the head with that latter statistic, to prove to the salescritters that huge Flash delays, overly-busy and confusing index pages and disruptive intersitial advertisements do indeed make people go elsewhere. Then one comes to Doubleclick and such, who use the same methods to record things like "Person Z browsed these pages on these sites today.". That's getting way past the bounds of acceptable, but it's being done by the same technique.
Just calling it "info transfer" and then saying that all info transfer is bad because some of it's bad is missing the point. The problem isn't that information is being transferred, it's what information is transferred and what's done with it. Dropping the OSDN image, where no personal information or tracking data can be transferred through it because of the way it's coded, into the same category as Doubleclick's bugs, which do transfer a tracking cookie back to a company that's said flat-out that tracking personal habits is their business, is at best disingenuous.
As for why the images are small and transparent, let me ask this: if the only purpose of the image is in fact to collect legitimate site statistics, what purpose does it serve to have it taking up more real-estate on the page and more bandwidth on the network than it absolutely has to to do it's job? Which leads right back to the same problem, that the logical, minimally-disruptive way of doing something legitimate is on the surface identical to what you'd do if you were trying to conceal evil intent. For myself I tend to be quick to block things I don't know, but it annoys me that I have to block or interfere with legitimate things in order to keep out the slime. I'd much rather LART the abusers off the net.
Re:No!! (Score:3)
There's also another point. All those Web bugs look identical from an HTML/HTTP point of view, but they're radically different from a data-collection point of view. Hitbox, for example, uses those bugs solely for site statistics. They can tell when two hits were from the same person and can tell a site things like how many people followed a given path through it, but they've no idea who a given person is and don't store any information on which paths a particular person followed in the database the sites access.
Disclaimer: I only program the systems for Hitbox/WebSideStory. I don't represent them or their opinions, they pay the executives to do that.
Use this thread to recommend similar products (Score:2)
There are various recommendations scattered througout this discussion for webwasher, adsoff, etc. It's hard to find 'em all.
Reply to this message with the product name in your subject line and put a link in the body if you've got one.
Persons wishing to add information about specific products can then reply to those messages. --Charlie
Cookie Pal from Kookaburra Software (Score:2)
KookaBurra Software [kburra.com] sells a product called "Cookie Pal" that allows you to filter cookies and responses to cookies in real time. Extremely configurable, shareware, inexpensive, works on MSWindows operating systems.
It can work with Netscape and Explorer simultaneously. I've been using it on my windows boxen for years quite happily.
--Charlie
D'oh! (Score:2)
--
Re:Mozilla (Score:2)
Besides, IE5.x has had the same functionality. And, power users can get Guidescope (http://www.guidescope.com/) or Junkbuster if they want to manage their cookies effectively.
Re:/. hypocrisy (Score:3)
Re:Cookie Monitor (Score:2)
I can deny all cookies from a domain, accept all cookies for a domain or view the cookie and decide if I want to accept it. I can see all the cookies that are set and delete them also.
------
IanO
Re:/. hypocrisy (Score:2)
Famous CT quote (Score:2)
See the website (Score:2)
It's just a registry dump from my computer from this morning. I really need to automate it.
Anyway, that's my list. Would love to compare.
Installed it, and got the OSDN bug on this article (Score:4)
If you're among the folks like me that have to use IE, use that Restricted Sites setting under the security tab (and while you're in there, crank that restricted zone up to disallow derned near everything). Also set your browser to warn you when you get cookies. Add entire that want to set cookies to your restricted zone. None of the muss and fuss of an ad filter (which breaks everything when I have to VPN to the office).
For the first couple of weeks, you'll be adding a few sites per week. I also added to mine the list someone posted of the sites that track users the most. I don't get cookies now, unless I'm actually shopping online.
Re:How Dare they?!?! (Score:3)
It uses a table, so the formatting on this will be way off
Bugnosis analysis of: Articles: Web Bug Detector (http://slashdot.org/comments.pl?sid=01/06/08/1220 230&op=Reply&threshold=-1&commentsort=0&mode=neste d&pid=18)
Highlighted images may be Web bugs.
Properties Contact Image URL
Tiny, Once, Domain, TPCookie (anon=anon_id&-1-vGtvAizyjA&boxex&%27whatsnew%27%2 C%27slashdot-main%27%2C%27freshmeat-main%27%2C%27n ewsforge-newsvac%27%2C%27sourceforge-news%27%2C%27 linux-news%27%2C%27open-mag%27%2C%27questionexchan ge-top10%27%2C%27themes-new%27%2C%27thinkgeek-new% 27&exboxes&%27whatsnew%27%2C%27slashdot-main%27%2C %27freshmeat-main%27%2C%27newsforge-newsvac%27%2C% 27sourceforge-news%27%2C%27linux-news%27%2C%27open -mag%27%2C%27questionexchange-top10%27%2C%27themes -new%27%2C%27thinkgeek-new%27) http://sd-
images.osdn.com/Slashdot/pc.gif?comments,992003991 337
Property name Description
Tiny image is tiny, so is probably not meant to be seen
Protocols image URL contains more than one Web protocol name (e.g., "http:" twice)
Cookie image URL overlaps with the cookie field too much
Lengthy image URL is unusually long
Domain image comes from a different domain than the main document
Once image is used only once in the document
TPCookie image comes from a different domain than the document and manipulates a cookie (Third Party Cookie)
Recognized compares the URL against a set of recognized Web sites
Slashdot *is* OSDN (Score:3)
-russ
Big Deal ! (Score:4)
Here they are: (Score:5)
<SCRIPT LANGUAGE="JAVASCRIPT">
<!--
now = new Date();
tail = now.getTime();
document.write("<IMG SRC='http://sd-images.osdn.com/Slashdot/pc.gif?in
document.write(tail);
document.write("' WIDTH=1 HEIGHT=1 BORDER=0><BR>");
//-->
</SCRIPT>
<NOSCRIPT>
<IMG SRC="http://sd-images.osdn.com/Slashdot/pc.gif?in
</NOSCRIPT>
Yep, there they are. Web bugs if I've ever seen 'em...
-grendel drago
And more... (Score:3)
Oh My God! Rusty's tracking me! That Low-Life Capitalist Corporate Big Business Pig! What do he and Inoshiro want with me! Why can't you guys leave me alone!!!!
Re:Here they are. (Score:2)
Re:Proxies that filter web bugs (Score:2)
It parses the HTML returned by a site and removes tags that would load banner ads and web bugs (among other things). If the size attributes are in the IMG tag, I'd assume it uses those. If those attributes aren't included, it would need to download the image and check its size before deciding if it should include the tag.
I don't get it. (Score:2)
Hell, if you link to an image off-site, someone can get your IP address, etc. [With a little bit of javascript and a redirect, you can get a whole crapload of information about the person that you're not supposed to]
Personally, I refuse to download any software, not only because it's for IE, but because then the people I'm downloading from would know my IP address. [Can someone please tell me how people are supposed to send you content if you don't give them an IP address?]
Re:I don't get it. (Score:2)
In that case, as it's mostly banner ads sized images and 1x1s, then iCab strips them out, along with known banner ad sites, images that are located in
[And it only took a few mouse clicks to turn on the filtering settings]
Re:One word - Junkbusters (Score:2)
Another Junkbuster plug here.
Everyone who shows up at my cubicle at work marvels at how "fast" my web surfing is.
It's amazing what a difference it makes on some sites when you're downloading 3K of text content, 20K of surrounding Javshit (which I've disabled), and about 20K of site graphics, but at least I can skip the 60K of banner ads.
(Most of the time, I surf with images off and skip the site graphics too :)
Re:Correction (Score:2)
So why won't they just let me download the .EXE and run it at my leisure?
fancy shmancy (Score:2)
Anyone ever notice how Netscpae has a feature in Edit/Preferences that says "Only accept cookies sent back to original server" well use it. Personally I use Junkbuster with about 3 sites allowed to send me cookies. Only problem I get with this is when I visit Slashdot I'm never truly logged in until I post since no info is sent back up until I go to post.
There was a method about a year ago if I'm not mistaken between August - Novemember about an email trick or service to track whether someone read your email. Marketing companies are all run by Dr. Evil anyway so there isn't much you can do. You complain they remove X service and replace it with something more evil.
Sigh! (Score:2)
To all you who are off writing you panicky responses about evil cookies coming to get you, why don't you use a sane cookie filtering system like Junkbuster [waldherr.org]?
Don't like having DENY ALL/ALLOW EXPLICIT control? Or R/O cookies for certain sites? Than keep to your naked browsers with Javascirpt and other things turned on, and don't complain!
Plus you get the added benefit of no ads.
--
Re:Cookie Monitor (Score:2)
Cookie Monitor (Score:3)
Re:The cure will kill you worse than the disease (Score:2)
With ActiveX enabled, any website visited using IE can ask to run or install software by popping up a single dialog. It would not be difficult for a malicious site to see to it that the dialog pops up just as you're typing 'y' on the keyboard or just as you're about to click where the "yes" button will appear. By disabling ActiveX and only installing software manually (downloading a
Does Not Does Not (Score:5)
http://www.slashdot.org
Contained a bug from the Open Source Development Network (OSDN.com)
SLASHDOT is part of the OSDN pages by VA Linux.
It's not a 'bug'.
Bugnosis isn't smart enough to tell the difference between a real bug and a simple page counter, and probably can't be. We should really worry about much more important things and stop feeding paranoia.
Re:I don't get it. (Score:4)
Most good browsers will let you set them to only receive cookies from the host you are connecting to. And cookies should only get sent back to the host that they came from.
These "web bugs" allow a site to send information to a third party( eg Addvertiser, Government agency,
I hope this makes sense, I am not quite awake.
One word - Junkbusters (Score:2)
Re:I hate webbugs!! (Score:2)
Right on.
I'm thinking that the reverse approach might be helpful here.
That is, instead of filtering to remove webbugs, they should be culled out carefully and rebroadcast to some zombies that will keep those nosy sites more than tickled with a flood of requests.
Of course they didn't check up on the article (Score:2)
a) Michael would actually have to do some investigating
b) he would have to use IE.
Two things that the Slashdot crew will never do.
MOD THIS UP!! (Score:3)
Re:/. hypocrisy (Score:2)
Re:iCab (Score:2)
"One World, one Web, one Program" - Microsoft promotional ad
Re:Installed it, and got the OSDN bug on this arti (Score:3)
Windows stores these restricted sites in a location in the registry, here's an example:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\C
"*"=dword:00000004
I made a big list of these using one of those websites that list tracking networks and a short Perl script, then edited it for the particular machine I was on (Windows 2000 requires the header "Windows Registry Editor Version 5.00" whereas older versions of Windows require "REGEDIT4").
You can export these lists and share them with everyone but be careful when you accept these as people can add themselves to unrestricted zones if you don't read the registry files (note the dword value at the end, should be "4").
Re:I don't get it. (Score:2)
As far as downloading, people can still send you things if they don't have YOUR IP address - some kind of proxy system would do.
Re:Apache Privacy Issues (Score:2)
It's already there:
I run across this meta-moderating all the time.
Re:What about Mozilla/Netscape and other browsers? (Score:2)
I've installed the webbug detector but am about to uninstall it as it merely seems to be an annoyance designed to make me aware and complain to the offending site, but does nothing (that I can tell) to protect me from these evil creatures. I don't like to be annoyed...
--
Re:What about Mozilla/Netscape and other browsers? (Score:2)
I realized that was possible, but my point really was that the software did not protect but merely detect. So, in addition to being easy prey to webbuggers I can choose to be alerted when being bugged. Whoop-dee-doo.
Call me when the program stops, deflects or damages (say by corrupting the database?) the webbuggers.
--
Hosting Images From (A Higher Bandwidth) Server (Score:2)
If you poke around in the html you'll see that the images are hosted at "www.inetarena.com/~pjrc", and of course my site is "www.pjrc.com". Saddly, this web bug thingy will probably tell you that I'm conspiring with inetarena.com to track you, when in fact they're just my ISP providing some server space for the images. There are not web bugs on my site.
I really ought to set up the image server with a domain name like images.pjrc.com. That costs extra (ISPs love to find things to charge for that don't cost anything)... but the cost isn't the primary concern. My little ISP has changed admins and they're not as stable as one might expect paying for frame relay service. I'll probably move to a new ISP soon, and that'll be a good time to set up a proper name for the image server.
The point is that it makes a lot of sense for a site to host bandwidth hogging files from a different server. In my case, it's to facilitate spending my creative energy in my free time on the site (didn't do much on it for a couple years without direct access to the server). I regularily poke around looking at people's html source, and I've seen several major sites use a different server for images, PDF files, etc. It's not an uncommon practice, and there's a lot of good reasons to do it other than tracking users. From what I can see, it looks like the folks at the Privacy Foundation [privacyfoundation.org] aren't aware of this.
Re:Hosting Images From (A Higher Bandwidth) Server (Score:2)
They classify each image according to a variety of criteria, including the size (pixels, not bytes), if it was from a different domain, if it sent cookies, and some other things I don't recall at the moment. They classify each image based on the number of criteria that are matched, and each image is either a web bug (red), warning (yellow), or not significant (or something like that). They don't document exactly what the criteria are, but it looks like they won't consider an image a web bug unless it's "tiny"... again, no specific documentation of what size an image must be to be considered tiny. The images on my site probably fall into the warning or non-issue categories.
It didn't go so far as to actually set up a machine (or virtual machine with vmware) and actually install windows, IE and their plugin.
Proxies that filter web bugs (Score:4)
One of the most interesting ones is webwasher (http://www.webwasher.com - for windows & linux, free for personal use, not open source).
Webwasher does not use regular expressions to filter images: it filters them by size. Most banner ads have a standard size (for ex 468x60). Webwasher has a list of known banner sizes and filters all images which match the list of sizes. And it's efficiency is very impressive!
Thus, using webwasher, it's very easy to filter all web bugs which are usually 1x1
Alas, webwasher is not opensource and has some issues. But I think that the idea behind this product is great and I'd love to see it implemented in an opensource proxy
The way webwasher handles cookies is also very interesting: you can specify 3 sorts of cookies
- the good ones (allow them, keep them)
- the neutral ones (allow them, delete them after 24 hours)
- the bad ones (always block)
The default policy for unknown cookies is to set them to neutral; that lets the user visits site normally (without the occasional glitches that happen when you block all cookies with sites that won't let you browse without allowing them), without compromising the privacy of the users for cookies are deleted after 24 hours.
Web Bugs And Corporate Policy (Score:5)
First post insanity aside (trust me, it's only fun for about 5 minutes and bad for your karma because moderators despise it), there's this quote featured in the CNN article [cnet.com] (yes, I do actually read the related articles before posting flamebait):
"Our goal with the software is to reveal how Web bugs are tracking all of us on the Internet and to get companies to 'fess up' about why they are using them," Richard Smith, the Privacy Foundation's chief technology officer, wrote in his privacy tip sheet.
"Any company that uses Web bugs on their site should say so clearly in their privacy policies and explain the following: why they are being used, what data is sent by a bug, who gets the data, and what they are doing with it," he added.
There are two things that I'd like to point out about those statements. First of all, companies with web sites are (in most countries) legally required to tell you about what kind of data they collect and what they do with it. The majority of such privacy statements either consist of the usual "we don't collect any information that can personally identify you" variety or they are hidden beneath so many links at the very bottom of the most obscure pages in the site that your average user never reads them.
Second of all, I agree with your point regarding the suggestion that companies should be required to thoroughly explain what kind of bugs they use (if any), what's sent and received and where the data goes. I personally think it's a great idea. And it's all well and good for sites that deploy their own web bugs. But what about the web sites who use web bugs belonging to other websites (e.g sites who use DoubleClick web bugs, or Slashdot using a web bug from OSDN)? The application should be the same, of course, but how is that handled from a legal perspective? Who is responsible for the "bug"? The company who wrote/owns it, or the company that deploys it? Answers to any of these questions are more than welcome (particularly by someone involved in the legal profession), as I'm sure that there's at least some of us Slashdot readers that would like to know.
Self Bias Resistor
"Imagination is more important that knowledge." - Albert Einstein
Bah! (Score:4)
We don't need no stinkin' Bug Detector!
--- note sarcasm ---
Slashdot and Web Bugs (Score:2)
The LCD screen on it displays the Slashdot web bug as a 1 pixel white spot above the banner. If Slashdot didn't have a black background, I wouldn't have seen it.
I find it curious, that with all the discussion on privacy and our rights on line, that Slashdot would use web bugs. I imagine that when it comes right down to it they had to make a choice: no web bug or money, and they went for the money.
With all the talk about the higher priciples of Information Wants To Be Free, Privacy, Rights, Free Software, Etc., the inclusion of this tracking technology into Slashdot really shows that the Dollar is really more powerful than some would like to admit.
inaccuracies? (Score:2)
If Spend.com sent the infomation to Bug.com without going through Alice's computer, then all Bug.com could learn is that someone created a login at Spend.com with the e-mail address alice@example.com.
Wait a minute. spend.com knows all of the information that they discuss (ip, browser type, etc). What prevents spend.com from transmitting this information to bug.com through a separate channel without Alice's knowledge? -bs
A way around it (Score:2)
Comments from a Bugnosis author (Score:5)
Many people have been asking (cursing, etc. :) for Mozilla, Mac, Opera etc. support. I think it would be great to investigate, and I have a student trying to learn something about Mozilla now. We just don't have the expertise yet. I'd be very interested in hearing from potential contributors. Heck, just a plugin or diff that shows how we can tap into browsing events and access the DOM in Mozilla could make it possible for us to proceed. Frankly, IE support was pretty easy because of all the books and sample code out there. Besides, we had just finished a long-winded report [privacyfoundation.org] on IE browser extensions & their privacy practices when we started this project, which made Bugnosis pretty easy to envision.
We decided not to make Bugnosis a Web bug blocker, just a good analysis and exposition tool. See, the problem with many "privacy enhancing technologies" is that they put the burden on users to protect themselves. I firmly believe that being concerned about privacy shouldn't mean that you have to make it a huge personal priority, say, by committing time to downloading, maintaining, and upgrading yet another piece of software. Privacy should just be built in. Bugnosis shows how the current infrastructure is being used, and so contributes to the debate on what reasonable standards should be. In the privacy arms race, I'd much rather be a reporter in the trenches than an arms manufacturer -- even defensive arms.
Any CS students interested in working with us? We'll be setting up at Boston University in the fall.
David
Mozilla (Score:4)
Cool, but Someone's gotta watch the watchdogs... (Score:2)
Is bugnosis open-source?
And if it's not, how do I know that it's not spying on me?
Re:Mozilla (Score:2)
But if you want excellent cookie control-- not to mention some real control over Java[Script]* then the browser to have is Konqueror.
So? (Score:2)
Now I find myself left wondering wether it's ok for one website to transmit this sort of information to another website. I'm even wondering why they try to sneek it into the client like this instead of just sending each other grepped weblogs.
What's useful about this?
And what are the privacy implications?
Web bugs = bad name, not so bad tactic (Score:3)
"All your cookies are belong to us" (Score:2)
In other news: "Do Nothing" Congress Becomes "Highly Ineffectual" Congress [ridiculopathy.com]
Re:Web Bugs And Corporate Policy (Score:3)
"Any company that uses Web bugs on their site should say so clearly in their privacy policies and explain the following: why they are being used, what data is sent by a bug, who gets the data, and what they are doing with it," he added.
The submitter writes:
It would seem our beloved slashdot has them as well.
Of course, a number of Slashdot readers were already familiar with this topic -- those of us who sometimes read at -1 have seen this subject raised and modded down, and then addressed by Slashdot editors who are then modded down by angry trolls. Or you can read about it on one of the troll web sites.
And this is the way all information about Slashdot is handled. Why did moderation go completely nuts a month ago? The only official word was in a -1 post from Michael buried in a -1 thread. Beyond that, you have to read (site whose name I won't mention to avoid getting 200 idiot sporks and crapflooders on my case) to find out what's going on. As always, security through obscurity doesn't work; it only confines the information to the people you least want to have it.
The bottom line, though, is that it comes down to trust. There's never been an official explanation of what the web bugs here do but while I don't, for instance, trust the editors to have any concept of what it means to be logically or ethically consistent, I do believe that they wouldn't do anything outrageous to my privacy.
Unsettling MOTD at my ISP.
AdSubtract (Score:2)
I use it for the cookie-blocking, but the ad-blocking is a nice side effect. I let ads through for those sites that I regularly visit and aren't riddled with seizure-inducing 150x600 pixel monstrosities. Hmm... come to think of it, only four sites I visit these days even fits into that category!
It keeps stats. I block about 300 cookies, 40 popups, and 700 ads over the course of a day.
Re:Does Not Does Not (Score:2)
OSDN _used_ a webbug - a 1x1 pixel trans gif.... It could very well be just a page counter. Looking at the one I see right now.
IMG SRC="http://sd-images.osdn.com/Slashdot/pc.gif?coreguardless of what it is doing, that looks like one to me. guess I could check the source and see what it is up to...
Anyhow, web bugs - like cookies or anything else - can be used for both good or evil. There was no judgment here, just a chuckle at who they listed as sites with web bugs.
Re:I don't get it. (Score:5)
Cookies are not the big deal. I can block those. Its the 1x1 gifs that kick off an HTTP request, with additional params that bother me.
Look at a few and you will see...
http://svr/path/[*.dll|.gif|etc]?param0=xxxx (amps)param1=xxxx...That, my friend, gives you something far better than just a server log entry. And there is no blocking it... unless you start taking notes and set up your host table to say *.evilsite.com is at 127.0.0.1
Apache Privacy Issues (Score:5)
Trolls throughout history:
??? Wrong thread ??? (Score:2)
Re:Cookie Monitor (Score:2)
If I had a choice I would prefer a browser that helps me to manage the various cookies (or better cookie-requests) rather than showing me all those cookies in a monitor window.
Cookie management here denotes something which allows to:
Compared to Netscape-style cookie warnings, such management would be actually usable and useful. It would give the user actual control instead of a simple cookies/no cookies choice. And such a scheme would preserve the option of using cookies where they offer some added value to the user, like in personalisation of sites.
Personally, I don't want to monitor cookies, I just want to ignore most of those having a lifetime of more than a few days. Web browsers should support this type of control.
Re:Proxies that filter web bugs (Score:2)
OK, so how does webwasher know how large the image is before it sends the http request? If it gets the image and then refuses to bother you with it if it's deemed a web bug, then webwasher is worthless. Indeed, it's less than worthless, since it luls you into a false sense of security. Once that http request is sent, the web buggers have your personal data (whatever info was sent in that http request) plus your IP address (so they can send you the image). After that, they don't give a rat's ass if you do or do not view the 1x1 gif.
Re:I don't get it. (Score:3)
What bothers me most is the scale on which the tracking is done; since so many sites use particular ad agencies (say doubleclick) they can build a list of many of the sites I've visited. For example, say I browse a gay porn site, then I browse a Quake3 games site, then I visit Amazon to look for comic books. Double-click need only have an information-supplying affiliation with one of those that may have my "real" personal details, name etc (for example Amazon), from that they can build a fairly extensive database of what I do online. All without my consent, which is against the law in my country, but in the US it seems companies can do this openly with no fear, so I'm guessing its not illegal in the US.
No!! (Score:3)
I see no problem with them...it's just a tactic for getting usage statistics about your site. And what's wrong with that
You missed the point. Thats fine, there is nothing wrong with that, but that is not the issue here. Web bugs are not attempt to gather statistics at a specific site, web bugs are attempts to track surfing across multiple unrelated sites. For example, say I visit a gay porn site, which have some doubleclick ads with hidden bugs in. Then off I go to Amazon.com to order a book about fly fishing, and unbeknownst to me, once again doubleclick has web bugs on Amazons site. So now a company (doubleclick) has a database linking the same user to those two completely unrelated activities. Now all doubleclick needs to do is establish some sort of affiliation with Amazon, and whammo, doubleclick suddenly knows my name, and has a database indicating that I have bought books on fly-fishing, like gay porn, browse slashdot, am anti-Microsoft, enjoy reading The Onion every Wednesday, whatever, they have a huge database on me. All without my consent or knowledge (which happens to be illegal in my country, but it would seem not in the US.) Sure you can say "don't use cookies" or "delete your cookies regulary", but what the fuck, thats not a solution, thats purely symptomatic treatment of the REAL problem, which is that these companies should be strictly prohibitied from doing this sort of thing in the first place. Either way, more than 80% of people are not even going to know how to delete their cookies or will just be too ignorant of the problem to care. Americans seem to love treating the symptoms of a problem but ignoring the actual problem itself.
And you may not think doubleclick would be able to collect much info - but trust me on this - double is EVERYWHERE. It is virtually impossible to do casual web browsing for more than a few hours without getting doubleclick cookies. Try it. Delete all your cookies, browse for a while (casual browsing, e.g. some slashdot, maybe some cnn or other news sites, maybe some gaming sites etc), and see what cookies you have. Chances are extremely good you have doubleclick.net, bfast.com, hitbox.com, flycast.com, avenuea.com and a few of the other very common ones.
We're not talking about web statistics or cookies here. Get the facts straight.
Re:Proxies that filter web bugs (Score:2)
Webwasher does not use regular expressions to filter images: it filters them by size.
Excellent! Does it block them based on the <IMG> tag attributes, or does it go ahead and load the image headers? Guidescope [guidescope.com] uses a central database of image URLs that users have chosen to block individually. Now if I can find a way to chain Webwasher and Guidescope together, my solution will be complete.
iCab (Score:4)
Yet another reason iCab [icab.de] is my favorite browser.
It has the most sophisticated filtering system I've seen. You can filter cookies using many criteria, including (my favorite) blocking cookies that come from a different domain from the main page. AND you can filter IMAGES by size, w/ options to exclude sizes including 1x1px (this blocks most web bugs) as well as most common advertisement sizes, like the ubiquitous banner. What you get instead is a blank banner-(or whatever-)sized space with an icon of a coffee filter in the corner. Hee!
And speaking as a web designer, the feature doesn't compromise the legitimate use of spacer GIFs.* Page design is preserved, and who cares if the 1-px. GIF is actually loaded or not.
*Yes, I know that with CSS we shouldn't need spacer GIFs. I will rejoice when browser support for CSS is consistent enough for us to rely on them. Meanwhile, though, clients still tend to expect web pages to be as as precisely designed as print, and sometimes you gotta cheat. But that's another discussion.
hey guy, it's okay! (Score:3)
Must be the early morning lack of coffee (Score:5)