Microsoft Accuses Google of Violating Internet Explorer's Privacy Settings 197
New submitter Dupple writes with a followup to Friday's news that Google was bypassing Safari's privacy settings. Now, Microsoft's Internet Explorer blog has a post accusing Google of doing the same thing (in a different way) to Internet Explorer. Quoting:
"By default, IE blocks third-party cookies unless the site presents a P3P Compact Policy Statement indicating how the site will use the cookie and that the site’s use does not include tracking the user. Google’s P3P policy causes Internet Explorer to accept Google’s cookies even though the policy does not state Google’s intent. P3P, an official recommendation of the W3C Web standards body, is a Web technology that all browsers and sites can support. Sites use P3P to describe how they intend to use cookies and user information. By supporting P3P, browsers can block or allow cookies to honor user privacy preferences with respect to the site’s stated intentions. ... Technically, Google utilizes a nuance in the P3P specification that has the effect of bypassing user preferences about cookies. The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter. Google sends a P3P policy that fails to inform the browser about Google’s use of cookies and user information. Google’s P3P policy is actually a statement that it is not a P3P policy."
So... (Score:5, Interesting)
Re:So... (Score:5, Insightful)
In other words, if your server delivers a garbage or blank P3P header, the browser assumes there are no privacy implications? Sounds like a hole in the standard to me, such headers should be ignored IMO. Though Google really should have tested this properly with all browsers before deploying it in production it sounds to me like an oopsie, not at all like the Safari thing.
Google has been claiming "oopsies" almost weekly over the last couple months. In this case they put this in their policy: 'P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 [google.com] for more info."' in what is meant to be a machine-readable field. Following the spec would have been easy-- omit the field altogether. Instead Google violates the spec in a way that benefits them. It's possible Google is just really incompetent over all these "oopsies", but they sure try to represent themselves as a company with above-average engineers. It has to be one or the other.
Re:So... (Score:5, Insightful)
funny: I'll have to remember this to rub their noses in it, next time I run into a googler.
or, if they interview me, I'll ask THEM: "so, what is the proper response to a machine parsable field? TLV things or human-intended english? please support your answer."
sigh. I cannot give google a pass. they act like god's gift to networking yet they make 'mistakes' like this? sorry, but I don't buy it.
Re:So... (Score:5, Insightful)
If the IE or Safari teams really cared about user privacy, they would be more strict about allowing sites to set or read cookies. This is just an excuse for Microsoft and Apple to publicly bash one of their competitors while continuing to not give two hoots about their users.
Re:So... (Score:5, Funny)
Re:So... (Score:4, Insightful)
P3P sounds like a stupid idea anyway. How does it protect user privacy if something as trivial as the attack described above totally defeats it?
P3P is a honor system anyways. The same effect could be obtained by a syntactically well-formed promise not to abuse the 3rd party cookies, but which google would never intend to keep...
Re: (Score:3)
> P3P is a honor system anyways. The same effect could be obtained by a syntactically well-formed promise not to abuse the 3rd party cookies, but which google would never intend to keep...
Yes, but that would not be legal. User tracking happens with the presumed consent of the user. Once a site known that the user does not want to be tracked and continues, or even tricks the browser into tracking despite a setting that demands the opposite, the tracking becomes illegal activity.
I am not sure most tracking
Re:So... (Score:4, Insightful)
Yes, but that would not be legal.
Exactly.
And what we're trying to argue here is that google's subterfuge should not be legal either. What they did was say something to the computer in such a weird way that it means exactly the contrary to a human. This can't be right.
It's as if a party A drafted a contract with a party B, and deliberately inserted some spelling errors in his promises to B, and later renegated on these promises under pretense that the text is just gobbledygook and thus not a legal commitment (all the while insisting that B should uphold his part of the deal). Very shady.
A honor system works because of the implicit threat of shaming (or suing) a would-be infringer. Google infringed. So we are trying to shame them by pointing out what they did. If you take this away by saying "but the scheme is broken, it can be subverted by just making false promises, so Google is ok in doing what they did and Microsoft is stupid by behaving according to standard (ha!)", then you are indeed breaking it by helping Google out of a well-deserved public shame.
It's the same as with robots.txt or similar schemes really. Trivially easy to ignore, but reputable spiders won't ignore it because they know that people will notice, and call them to it.
I am not sure most tracking sites bother with such fine distinctions, but they cannot hide from the law forever.
Only small sites need to hide. Big sites (apparently) don't need to, they're "too big to be considered rude" / "too big to be sued".
Re: (Score:2)
Genuinely curious here. What law exactly makes that illegal? I've never heard of such a law.
Re: (Score:2)
Re: (Score:2, Interesting)
It does matter Microsoft is lying about this being a new revelation. Microsoft knew Facebook and Amazon do the same thing back in 2010 - so they obviously knew Google is doing this too. The timing of this is just cheap PR which is typical for Microsoft. Why don't they spend this time and effort in building a better standard and a better product?
Re: (Score:2)
They are... [wikipedia.org]
Oh, you said better...never mind.
Do not track... others (Score:2)
If what you say is right, why would Google release a do not track extension for Chrome?
Two possible answers:
1) Google knows only a handful of people will download and install such things anyway, leaving the general population easily tracked.
2) You know they Google does not track you even with the extension installed how again? Preventing anyone BUT Google from tracking you is quite the competitive advantage.
Re:So... (Score:5, Interesting)
P3P sounds like a stupid idea anyway. How does it protect user privacy if something as trivial as the attack described above totally defeats it?
If the IE or Safari teams really cared about user privacy, they would be more strict about allowing sites to set or read cookies. This is just an excuse for Microsoft and Apple to publicly bash one of their competitors while continuing to not give two hoots about their users.
Reading your Gmail emails should very trivial for Google employees. That doesn't make it okay does it? One would expect Google to have higher standards.
You'd expect shady sites to "attack" a gentleman's agreement, not Google. If you think they're the same, would you be okay with hosting your mail on warez-email.com ? After all, they're both on the big bad internet.
Comment removed (Score:4, Interesting)
Re:So... (Score:4, Informative)
Gmail doesn't need third party cookies. This is about sites with +1 buttons. They allow Google to track all users across all sites that have them.
Re: (Score:2, Informative)
Re:So... (Score:5, Interesting)
If you're using Chrome, I highly recommend ScriptNo [google.com]. It took a while, but they've finally got a decent analogue of NoScript for Firefox. With it's most restricted settings, it pretty much blocks everything you don't whitelist yourself, and has a special "antisocial" mode that automatically blocks all the social networking bullshit every fucking site in the world has now.
ScriptNo and Adblock Plus are pretty much a necessity for web browsing these days, in my opinion.
Re: (Score:3)
Re: (Score:2)
Anyone know how to turn off the ones that pop up on slashdot? I can't moderate from my iPad since they came along - as they pop up when finger touches screen and steal the focus from the moderation drop down box.
I can't find any option in slashdot options, and there's no noscript for safari for iOS...
Re: (Score:2)
:...they have some of the best engineers of the planet."
That may be so, but the best engineers are still immersed in a corporate culture. A corporate culture that seems to have changed a lot since the pre-float days! It is quite different from the founders motto of those days!
I used to evangelize for Google, well before the float, that is. I am currently moving as completely as I can from all their services. I don't like the new deal about combining their various services one bit.
Re: (Score:2)
Re:So... (Score:4, Insightful)
Re:So... (Score:5, Insightful)
Quite simply, it allows stories like this - which is a good thing.
P3P allows a website to make a very obvious statement about their intentions, to a set specification - if the website specifically sets a P3P that they don't honour then it becomes a PR issue, as it has in this case.
Google were breaking the spec here, in such a way that creates a valid P3P statement in the process which says "we won't be doing anything untoward with your cookies" - the field they use is not a text field and therefor the content they put into it is ignored, resulting in a zero length list of items they *will* do with the cookies...
That definitely should get Google into the tech media at least.
Re: (Score:3)
At which point any conforming client shouldn't let them do set or read cookies...
Re: (Score:2)
This is exactly what the problem is with the "Allow All" thinking. If everyone went with the "Deny All" and whitelist what is actually needed, we wouldn't have most of the damn problems we do as this shit wouldn't be possible to begin with
Re: (Score:2)
Actually, from what I can tell it doesn't say that they won't be doing anything untoward with the cookies. In order for them to make that statement they'd have to include one of the P3P policy tokens declaring that they didn't. In actual fact it's not a valid P3P policy at all precisely because it doesn't say anything about their privacy policies that's machine readable.
For some reason, Internet Explorer just assumes that any P3P policy not containing one of a specific set of forbidden policies is saying th
Re: (Score:2)
I believe the idea is that it is legally binding promise from the website operator to the user. It's not trying to be a technical fix.
Re:So... (Score:5, Interesting)
Actually, I would say it's worse in Microsoft's case because:
1) msn.com and live.com BOTH use the described technique to 'work around' P3P in IE 9
2) Microsoft's web site recommends doing this to work around an IE 9 'bug'.
Re: (Score:3)
So how do you propose companies like Apple and Microsoft distinguish between cases where they should follow established industry standards and specs or deviate from them?
They pay attention when the organisations proposing the standards suspend work on them? Note that this happened with P3P in 2007.
"After a successful Last Call, the P3P Working Group decided to publish the P3P 1.1 Specification as a Working Group Note to give P3P 1.1 a provisionally final state.
The P3P Specification Working Group took this step as there was insufficient support from current Browser implementers for the implementation of P3P 1.1. The P3P 1.1 Working Group Note contains all changes from the P3P 1.1 Last Call. The Group thinks that P3P 1.1 is now ready for implementation. It is not excluded that W3C will push P3P 1.1 until Recommendation if there is sufficient support for implementation. "
http://www.w3.org/P3P/ [w3.org]
Re:So... (Score:5, Informative)
Course it is deliberate. Question: So what?
It doesn't do anything to IE and is ignored by every other browser.
P3P is deprecated and has been for years - no other browser pays any attention to it.
All it does is make Google's products work properly with IE (not just ad tracking).
If I needed to add gibberish to one of my sites like that P3P policy to make it work, I would.
Re: (Score:3)
Re: (Score:2, Informative)
The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter.
Also can't give Microsoft a pass, especially if they're truly supposed to be ignoring undefined policies. It's not like Microsoft has ever been particularly supportive of standards they didn't develop, or like they've ever really developed a secure browser.
Re:So... (Score:4, Insightful)
In this case, "ignoring undefined policies" means that there are no stated privacy implications. If the P3P policy is blank then the site is saying there are no privacy implications for its cookies.
Re: (Score:2)
no, "no stated privacy implications" != "No privacy implications"... You have not been definitively told there are none, so the "safe" thing to do is to assume the worst and nuke it from orbit. TBH I'm not sure who wrote the spec the other way.
Re: (Score:2)
It definitely sounds backwards, and may be only like that so that when it was implemented that everything would continue to work like it already did. But, I disagree that an empty P3P header is the same as a missing P3P header, or "no stated privacy implications" != "No privacy implications". An empty P3P header implies that the server is responding to a request for P3P information, and has no implications to disclose (which is the correct response if that is true). A missing P3P header would mean that t
Re: (Score:3)
Short answer - don't! I'm sick and tired of all this bogus tracking crap. If you absolutely insist on having a +1, then also have a -1, so we can tell you how we really feel! Same as if you're going to have a Like button, also have a Hate button.
Re:So... (Score:5, Insightful)
Google has been claiming "oopsies" almost weekly over the last couple months. In this case they put this in their policy: 'P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 [google.com] for more info."' in what is meant to be a machine-readable field. Following the spec would have been easy-- omit the field altogether. Instead Google violates the spec in a way that benefits them. It's possible Google is just really incompetent over all these "oopsies", but they sure try to represent themselves as a company with above-average engineers. It has to be one or the other.
Can't say I really can fault Google for this. Explaining why would require an understanding of how P3P 1.0 objects are configured and how limited those types really are.
P3P 1.1 work has stalled (albeit in provisionally final state) and is likely to not restart; in its absence is P3P 1.0 which exists firmly in the world-as-it-was of 2000/2001. It covers cookies and certain types of form transmission, but doesn't cover privacy aspects of other types of persistent data, new transmission protocols (like SPDY), advanced caching techniques, or HTML5 storage. Technology has advanced past the point that P3P 1.0 is useful -- and quite simply, it's doubtful it ever really was. If you visit the link Google supplies it explains some of their reasoning, and it's pretty dang valid for a post-2007 view of the Web.
Those chucking bombs over this would be better served to focus their efforts on either modernizing or replacing P3P 1.0 -- or, better yet, trying something radically different like PRIME or Policy-Aware-Web tried to do.
Re:So... (Score:5, Insightful)
Google is using +1 buttons to track visitors browsing on 3rd party sites to enhance their ad profiles for users. This is explicitly why P3P was even made as a standard. Circumventing the standard by sending invalid data while saying nothing exactly fits the definition is a cop-out.
Re:So... (Score:5, Informative)
You're splitting hairs here.
P3P 1.0 doesn't allow for multi-site delclarations, only "cross-site" declarations. There can be one -- and only one -- P3P policy; by the standard it doesn't allow but ONE policy and states that others, if present, should be ignored. This just isn't how the Web works these days. Cloud services have pretty much become a defacto standard, but P3P forces site administrators to take a P3P policy from the integrated service and mash it into their own policy (and hope the service policy never changes). This just isn't practical.
A site admin CHOOSES to use +1 buttons and FB like buttons. Inclusion of these objects would optimally prompt an admin to adjust their _own_ P3P policy, but it's just a plain 'ol administrative nightmare to manually take the respective organizations' policies and create a master policy out of all of them. It's fully manual; it has no concept of "merging" policies to present users with enough information to make informed choices on the multitude of SaaS services sites now use. That's the issue.
The darn thing is broken. Period. Hard to claim "cop-out" when dealing with a protocol that's stuck in 2001.
Re: (Score:2)
So the offending part can all by itself circunvent the barriers the standar dictates against him. Isn't that alone enough reason to abandon the standard? Or we do expect the dishonet to act honestly on the web?
I'm not defending Google, by the way. I just don't understand why Microsoft (or anybody else) is trusting the "evil bit" when it claims a package isn't evil.
Re: (Score:2)
It's possible Google is just really incompetent over all these "oopsies", but they sure try to represent themselves as a company with above-average engineers. It has to be one or the other.
I'll be an annoying Philosophy 101 kid and state right off the bat that's a false dichotomy.
Anyway, anybody who's worked in the tech sector(or read enough Dilbert, or both) knows that even the "above-average" engineers are boneheads. I'll give you a few real-life examples I have encountered - an engineer who though it would be a good idea to couple zinc anodes to a titanium plate to be deployed under the sea, the engineer who didn't overdesign a power circuit which resulted in exploding power t
Re:So... (Score:5, Insightful)
From my reading of Microsoft's long blog post, Google didn't violate the spec. IE does not correctly implement the spec and Google is abusing that by using a legal but illogical header. If Google doesn't say what they are doing with the data, then IE shouldn't provide it. Instead, Google says "I'm not telling you anything about my intent" and IE says "Good enough. The key's under the mat. Lock up when you're done." The whole system is trust based. Google doesn't promise anything and IE doesn't care. Google is being shady and Microsoft is being incompetent.
My biggest problem here is Microsoft releasing this now in a lengthy blog post and trying to tie it to the Safari dust up. They know that the blogs will not include their full release and will instead carry the headline like you see here. This is a PR move at least as dishonest as what Google appears to be doing with their P3P header.
Re: (Score:3)
> Google didn't violate the spec
The list is supposed to be populated with the code(s) of what they're doing with the info. They're lying by not stating they're tracking users browsing habits when they visit pages with +1 buttons. Leaving it blank is not in the spec.
Re:So... (Score:4, Informative)
Not even Microsoft supports your argument. From their blog post:
Technically, Google utilizes a nuance in the P3P specification that has the effect of bypassing user preferences about cookies. The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter.
Rather than ignoring it, IE is assuming that Google told them something positive.
Re:So... (Score:5, Insightful)
1) We need to call out companies that do this type of thing. Not just with P3P but anytime they abuse the system or game it. They need to be made to understand that a very vocal set of folks will make it known what they are doing and that it is bad for their business to be found gaming trust systems.
2) We need better systems that don't just trust whatever a company says about their intentions with our data.
Re: (Score:2)
What Google is doing certainly is outside the spirit of the P3P system. They clearly are doing it on purpose.
That said, P3P was an incomplete idea that has sat around a decade or so waiting to be finished. This issue has been documented and pretty well known for at least two years. It wouldn't be an issue if Microsoft correctly parsed the P3P header. Microsoft bringing this up now and trying to lay all the blame on Google is a calculated PR pile on.
Re: (Score:3)
Re: (Score:2)
To be fair, these are just technicalities. People with a grudge going over their practices with a fine-toothed comb. Remember the Wall Street Journal is owned Rupert Murdoch and that Microsoft is Microsoft. The people making the claims here have a bone to pick in both cases. Google is only doing with their +1 button what Facebook does with their like button--except that Facebook actually keeps tracking you when you log out.
Yes, Google is violating the spec to make things work they way they want them to,
In cases where P3P is not precise enough (Score:5, Informative)
According to Google, there is no code in the P3P standard to accurately describe how Google uses cookies. [In such a case,] how should a website fill use the P3P header?
The article answers this question by quoting a section from the P3P spec [w3.org]:
Re:In cases where P3P is not precise enough (Score:5, Informative)
The article answers this question by quoting a section from the P3P spec [w3.org]:
This is correct. However, as stated further down in the same section, the effect of such policies is to be positive and declarative (meaning the policy should state what the site DOES do, not what it DOES NOT do), and be informative to the user. The standard allows for user agents to then use the P3P policy to make it the basis for "authorization" but then goes on to state that implementers of user-agents can make their own decisions as to what the declarations mean in the context of the connection.
This has led to situations where browsers that implement P3P and tie it to certain "security features" end up with a browser implementation that works dramatically different than other browsers for the very same privacy declaraion. In most cases, browsers do not even IMPLEMENT a user-readable informational dialog for P3P -- it is by standard the browser implementers' decision.
If you're keeping score at home, that's bad.
Re: (Score:2)
Anything that relies on "voluntary" cooperation is flawed. Either you accept that 99% of the internet will ignore it and quityerbitchin', or... you create a privacy standard that is client-enforced and leaves no room for loose interpretation.
Just because people think they can shame Google into playing nice, doesn't mean those Doubleclick rat bastards will, nor any 3rd world fraudster, which means this whole P3P thing is a joke.
Re: (Score:2)
Just because people think they can shame Google into playing nice, doesn't mean those Doubleclick rat bastards will
I think Google owns Doubleclick. But you're right, privacy has to start with the client.
Re: (Score:2)
Anything that relies on "voluntary" cooperation is flawed. Either you accept that 99% of the internet will ignore it and quityerbitchin', or... you create a privacy standard that is client-enforced and leaves no room for loose interpretation.
Just because people think they can shame Google into playing nice, doesn't mean those Doubleclick rat bastards will, nor any 3rd world fraudster, which means this whole P3P thing is a joke.
I am sure you will say the same thing if Google employees starts reading your email for fun and profit.
"Oh it's okay, it's your fault for trusting a site on the internet, stop demanding them to stop it, would warezemail.com stop?".
Re: (Score:2)
I am sure you will say the same thing if Google employees starts reading your email for fun and profit.
The ECPA doesn't call for voluntary compliance. Please stop using this silly analogy.
Re: (Score:3, Insightful)
No. The browser is supposed to ignore the whole thing if it doesn't find anything it understands. Why MS doesn't make IE just go with the default of NO in those cases, I don't know.
Of course, why Google sends such a non-statement is questionable as well.
Re: (Score:2)
In other words, if your server delivers a garbage or blank P3P header, the browser assumes there are no privacy implications? Sounds like a hole in the standard to me, such headers should be ignored IMO.
And the standard agrees with you. Even Microsoft admits as much in their blog post:
The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter.
Re: (Score:2)
Yup. This sounds like the whole "GPL\0 is not the license this module is offered under. This module is proprietary." thing that was going on with some proprietary kernel modules a few years ago. In that case it really didn't have any negative impact to the end-user - just to kernel developers.
While this is a bit of an exploit in P3P, I despise loopholes, so I'm not going to give Google a free pass here...
Re: (Score:2)
Microsoft is just using the same kind of "logic" that my ex-wife did during our divorce. Accuse, accuse, accuse with all the bad information they can manufacture.
It doesn't matter if you're innocent or not; most folks will only remember the accusation.
Get the facts and you'll see what this is really all about; Microsoft trying to beat down a competitor using any and all tactics they can
This is like Jack the Ripper (Score:3)
Re: (Score:2)
No it's not. It's one company making a complaint about another.
If this is the beginning of the big companies goading one another into following standards, it's great news for the user.
But it probably isn't.
Re: (Score:2)
Re:This is like Jack the Ripper (Score:4, Insightful)
The problem with that line of thought is that it allows one person to dominate the discussion by shouting nonsense. If someone keeps saying un- and half-truths repeatedly, and you take the time to independently analyze the validity of what they say, you never have any time to consider the viewpoints of others or to form your own opinions.
It's much easier, and indeed human nature, to eventually decide that source doesn't contribute anything meaningful to the discussion, and ignore it entirely.
Examples:
a) Microsoft and anything about unfair trade practices (to some people)
b) 126.67.234.x and spam (to many spam filters, and I just made up that IP address range)
c) Political talking heads who fill various cable news channels 24/7
d) Boys who previously cried wolf
Hm...interesting approach... (Score:2)
We have see proposal after proposal based on the idea that either users should be forced to opt-out of invasions of their privacy, or that the people who want to violate
Re: (Score:2)
Opera too gets a lot of money from Google.
IE's fault? (Score:5, Insightful)
When I was configuring P3P for Mozilla/Firefox, it distinguished between what exactly the P3P policy was stating. If the site didn't say in the P3P policy what it was doing with cookies, Firefox assumed the worst. It seems to me that if the IE devs were dumb enough to stop after seeing a P3P policy presented and didn't bother checking what it said, or if they assumed a lack of a statement indicated respect for privacy, that's a failure in IE. The code needs to start out assuming personal information is collected and used without consent, and then upgrade only if the P3P header specifically says something better. It's not like that's hard to implement.
Then again, we've seen similar problems in Microsoft software time and time again: they assume the best (input's valid, doesn't contain special characters, etc.) until they detect otherwise, even though best practices say to do the opposite (assume input's invalid until analyzed and proven correct, list the known non-special characters and filter out or escape everything not in that list).
Re: (Score:2)
It looks to me that Google is doing exactly what their p3p policy says they will do. It also looks to me like IE is assuming that simply because there is a reference to a p3p that it says whatever the developer thinks a pep should say, rather than whatever it actually says.
I'm not saying that Google shouldn't be setting up a situation where 3rd party cookies may be accepted when they are not wanted. I don't know how the p3p in place was decided upon, but just because I have a valid drivers license, doesn't
Re:IE's fault? (Score:5, Informative)
It looks to me that Google is doing exactly what their p3p policy says they will do.
No, it's doing the exact opposite. P3P is a list of things you *WILL USE* the cookie data for, not what you *WILL NOT* do. Per the spec, if it's not a valid tag it gets ignore, remove all the invalid stuff and google is effectively sending P3P="", or in other words, they wont use it for anything.
Re: (Score:2, Insightful)
Wrong. "P3P=" isn't saying they won't use it for anything, it's not saying anything about what they'll use it for. You're supposed to be able to trust anything said in the P3P header, but nothing in the P3P spec says they have to say anything. And if they don't say anything about a specific subject, best practice is to assume the same as if they hadn't included the P3P header at all (at least regarding whatever item you're looking at at the moment).
If you need someone to drive a vehicle for you and they won
Re: (Score:2)
It looks to me that Google is doing exactly what their p3p policy says they will do.
No, it's doing the exact opposite. P3P is a list of things you *WILL USE* the cookie data for, not what you *WILL NOT* do. Per the spec, if it's not a valid tag it gets ignore, remove all the invalid stuff and google is effectively sending P3P="", or in other words, they wont use it for anything.
Then, since Google's p3p policy is sent as just a URL, shouldn't IE be ignoring it since its not valid?
Re: (Score:2)
Then your understanding would be incorrect. The P3P compact policy isn't a list of the "bad" things the site says it will do. It's a list of the things, both good and bad, that the site promises to abide by. An empty tag isn't a promise not to do anything bad, it's a lack of a promise either way. Think of it as deciding whether to loan money to someone or not and asking them to say whether they intend to pay the money back or take it and disappear. If they refuse to say either way, you're not going to take
Re: (Score:3)
Google intentionally breaks a W3C standard for its profit and it's totally MS' fault and Google is the knight in shining armor that deserves no blame whatsoever. Wow, just wow.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Right, so why the fuck does IE send data if the policy didn't give a reason? Because it's broken, that's why. Everything else is secondary, fix your browser first because that's what is leaking the damn information then, AND ONLY THEN we can worry about what severs should and shouldn't do.
Re: (Score:2)
Re: (Score:2)
it's because IE implementation is buggy (Score:5, Insightful)
In IE iframes will block cookies if you don't have the right P3P policy. There where other bugs that would prevent your site's cookies from being read.
I've "faked" a P3P header just so users of certain IE browser versions could use my site.
At the end of the day the standard is a proposal and only MS thinks it's worth a hill of beans.
Which cookie are we talking about here? (Score:2)
Just asking... I do not think we are talking about a tracking/advertising cookie here. I'm very certain google uses first-party cookies for tracking/advertising (meaning it's your site and not google that sets/owns the cookie). And first-party cookies needs no P3P. Or am I wrong?
Re: (Score:2)
Don't Be Evil (Score:2)
Remember DoubleClick? (Score:5, Interesting)
Remember DoubleClick? The sleazy advertising company that everyone loved to hate? Remember when they merged with Abacus Direct, creating a merged company that would mine and combine everything from web cookies to physical addresses, names and phone numbers? Remember when this privacy issue was such an obvious risk that the FTC launched investigations into it? Or when they were widely categorized as malware purveyors, or when they were caught serving drive-by malware infections?
Remember when they merged with a search company, changed their name to Google and kept doing all the same things?
No? Thought not.
Don't be Evil (Score:2)
So, does running a truck through loopholes, bad specs, known bugs, etc.---when the intent is clear---constitute being evil?
Evil bit? (Score:4, Insightful)
This whole P3P thing just sounds like the evil bit all over again.
How exactly is P3P supposed to protect users' privacy?
Life Imitates Art (Score:2)
As Rene Magritte would say: "Ceci n'est pas une politique P3P."
A P3P Policy which isn't a P3P Policy? (Score:3)
That's very surreal, Google.
René Magritte would approve [wikipedia.org].
What? (Score:2)
Re: (Score:2)
enough is enough, google confirmed evil. (Score:2)
Once or twice is a mistake, but google have been doing "evil" things repeatedly for a while now. I'm moving my stuff to iCloud (don't laugh). As a paid service (with mac purchase, subscription for additional data, etc) the payment is not my privacy.
Blaming it on the browser is a cop out. if you're NOT evil, you wouldn't exploit it. I'm sure if the shoe was on the other foot (and someone was exploiting say, a hole in google's network to steal trade secrets) google would be mighty pissed.
Who else has been doing this? (Score:3)
Everyone seems to be getting all het-up about Google abusing trust, being deceptive, yada yada... But it's a fact: Google get headlines worldwide.
In a world of clouds, +1s, and Likes, people want to circumvent the 2001 P3P objectives because that's how they want the web to work in 2012. So if IE is quietly ignoring P3P for Google, what other unknown, untrusted, and non-headline-grabbing sites might have been doing the same thing for the last 10 years? It seems other browsers ignore P3P as pointless, but not IE.
It may be that by Google risking a minor PR hit, they might encourage Microsoft to drop the charade of P3P protection, and just maybe get enough people interested in pursuing a real solution.
Patch Tuesday? (Score:2)
Re:Dear Microsoft Iexplore team (Score:5, Insightful)
You don't really understand the problem here, do you? It's a potential ethics violation by Google, not a technical violation. It's like if a company published inaccurate ingredients on a can of nuts, and you're bitching about shoddy can manufacturing.
Re:Dear Microsoft Iexplore team (Score:4, Interesting)
The problem is that, according to the standard, the browser should ignore any policy it cannot understand. Ignoring a policy means acting as if it wouldn't exist. If no policy exists, IE's behaviour with default settings is to not allow the cookie. Therefore by the standard, it shouldn't accept cookies when it doesn't understand the policy. If IE doesn't do that, it's the browser's fault.
Re: (Score:3)
I'm with you on this one - well, partially at least. The problem is that the spec doesn't really plan for a site saying "We don't want to tell you that we do lots of stuff that may or may not be parseable in this header, so here's some text plus a URL for the browser to not show". Microsoft should definitely have assumed the worst case scenario for PII use, not the best case.
Now I'll agree that the URL is valid - but it's completely useless because no browser on earth actually shows that info. The engineer
Re: (Score:3)
No. According to the standard, the browser should ignore any policy _statement_ it doesn't understand. That's very different from what you said, because a _policy_ is a list of statements indicating what the cookies are used for. A policy containing no statements is the way for a site to use P3P to say "we don't use the cookies for anything".
So the the standard requires that a policy with only invalid statements be treated like a policy with no statements at all, which is the "these cookies are not used
Re: (Score:2)
That link is much ado about nothing. If the user has agreed to the conditions of the Bing bar, it uploads the keyword and the link that was clicked on. No other information like the results returned or the ranking of the results is sent to MS. This is used as one of the many signals by Bing. I fail to see how this is the same as "serving results from Google".
Re: (Score:2)
>It serves results from Google [blogspot.com]. And that sites been up an awful long time for any errors, misconceptions and ... FUD to have been discovered and corrected by now,
OMG, I've just found conclusive proof that the earth is flat!!!
The below site hasn't been updated in ages and is still up, it means whatever it says is true!!!
http://www.alaska.net/~clund/e_djublonskopf/Flatearthsociety.htm [alaska.net]
Off for a drive to the edge of the earth. Hope they have erected a barrier so people won't fall off.
Re:Wait, how is this not an IE issue? (Score:4, Insightful)
Re: (Score:2)
People don't mind the advertising so much - it's the tracking that bugs us the most. The all-prevasive, obsessive-cumpulsive, privacy-invading stalking behavioural tracking ...
Just like we don't mind ads on TV - we either watch them, channel surf, or go do a couple minutes worth of housework, but if TV ads watched us back, we'd find that unacceptable as well.
Cookies to preserve state in client-server web apps == good. Cookies to track peoples behaviour == bad. Cross-site cookies == bad by definition.
Re: (Score:2)
Freetards - alive and well, and now with twice the stupidity.
Re: TV - over-modulated ads haven't been much of a problem since BEFORE the regulations requiring normalization of sound - unless you bought a cheap set that didn't have auto volume control. As for the length of time of TV ads, I prefer a 3-minute block of ads - it lets me put away the dishes or fold some laundry or make the bed or any one of a number of things that need to be done.
Re: Radio - if you don't like the ads on it, again, the technic