Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Internet Explorer The Internet

IE "Persistence" Tracks Without Warning 227

Posted by Hemos from the stop-me-before-i-track-again dept.
A reader writes "Never mind if you've shut off cookies. If you are using IE 5+, the browser can still be used to track you, with no warning. An IE 5+ feature, "persistence", allows the browser to remember information, such as search queries. Which of course means that you can be uniquely identified and tracked. And since it is a feature, there is no warning either that this information is being stored or when it is given. Shutting off scripting in theory stops it. More on the story at www.news.c om ."
This discussion has been archived. No new comments can be posted.

IE "Persistence" Tracks Without Warning More

IE "Persistence" Tracks Without Warning

Comments Filter:
  • You know what I do when I find a site that is broken without javascript

    yeah, its called "view source". read the source, decide if its worth the effort to figure out what they intend to do with scripting, then go from there.

    the only good thing about jscript is that you can always view source. can't say the same with java ;-(

    --

  • I never said that I read every line of source code. I stated that it would be possible to do so. Of course I didn't say that I would nor do I have the time to. I've read a large amount of the Linux kernel as well as XFree. But I didn't read all of it or even close to all of it.

    The point is that some one just might read you bad code! You really think that a spy program or dangerous code would last long in the Open Source world? If there are not many users of the said product, then sure, you might get a way with it. But if you are successful and have lots of users, you will have lots of lines. So if 1000 people read 50 lines of code, then you have aprx 50000 lines read. Of course that is assuming that the same lines have not been read.

    I'm saying that I feel safer that code is not a problem if it is open. I'm not saying that it is safe. But as I mentioned, it takes alot more nerve to post code that has mischievious actions. But it doesn't take much for closed source to do so (!seineew era sreenigne epacsteN).

    It's just common sense....
    But common sense ain't too common!
    Steven Rostedt

  • Repetitive redundancy (Score:3)

    by yali ( 209015 ) on Monday September 11, 2000 @01:00PM (#787172)

    From Microsoft: "The consumer that enables first-party cookies is even more exposed. This should only be an issue for someone who has disabled all cookies and is concerned about unique identification."

    Translation: only people who care about their privacy care about their privacy. Gee whiz, mister, that makes it all okay!

  • So Windows users can be tracked- who cares? Anyone smart enough to care is running something else, or uses their browser in such a fashion that it doesn't really matter in the end anyway. But if it affects the Macintosh as well?

    I'm sorry folks, say what you will, but after three years of Macintosh useage, after running AOhelL, Lynx, Navigator 3-4, Communicator 4.XXX, IE 3, IE 4, Mozzila PR14 [I ran it three times, it crashed twice and refused to get past startup once], iCab, and iCab 2.x, Mac IE5 is the ONLY browser that meets my needs both aesthetically and from a work environment standpoint. And to have that comprimised? Hell, I may as well get a job in a steel mill or shoot myself in the head.

    With as little privacy as I have on the net, I'm starting to wonder why my phyiscal life is so empty.

  • ONE BIG PROBLEM WITH THAT (Score:4)

    by InfiX ( 160201 ) on Monday September 11, 2000 @02:54PM (#787174) Homepage
    it's good that that works and that it's that simple, but the fact remains that the vast majority of computer users never change the defaults on any of their applications. if something doesn't work quite the way the want it to, they don't bother poking around in the preferences to fix it. my father complains about the recent versions of microsoft word because of those "annoying red and green squiggly lines all over the place." i say "dad, you can get rid of those in two steps." he doesn't bother. with respect to something like this, where you can't even tell that it's happening, i would wager that next to no one (outside of those reading this forum) are going to do anything about it.
  • Really? You didn't know?

    That amazes me, I noticed this feature the second time I typed in "slashdot.org" in the address field. Look at that! User persistence!! Same thing when I noticed all of my previous searches on google. Or for that matter the second time I type in my username to login to slashdot. It was a pretty easy thing to see that "something" was different. And I was amazed when I realized that it kept happening after I closed IE and brought it back up. I love this feature.. I'm not turning it off.
  • But you're right. Most people couldn't care less. They'll give up their rights for conveinence. But that doesn't mean I should have to.


    You don't have too... feel free to unplug your computer.
  • I totally agree with you. I don't see how people can sit around and complain about being 'tracked' (not that I've seen anyone who does) and at the same time want all the free services that many web places supply.

    If I frequent an online shop I want them to know I'm back so they can show me the things I care about and none of the crap.
  • Alright everybody. I'll probably get modded down to the depths of Hell, but here's what I think. There are two types of people in this world - those who should be watched, and those who should not care. Why does it matter that your browsing habits are being followed? Is there a name that goes with this? Are you going to illegal sites that you don't want people to know about? If not, what is your paranoia? If so, the authorities should know.
  • Well, you must be paranoid too, you won't even use a user name to post, do you not want your comments attributed to your name? Is this anonymity important to you? Thought so.
  • Gimme a break! The user sets him/herself up to this. You have to install the service don't ya? Anyway, you keep your server/workstation in a secure space. I could make mincemeat out of a Linux box if I have direct physical access to it.

  • Re:This isn't as important as.... (Score:3)

    by JesusOfNazareth ( 193047 ) on Monday September 11, 2000 @03:07PM (#787181)
    Just as an exmaple.... advaya.com is doing this through spam (or as they call it, direct mail marketing). And they sell this service to other companies. The spams contain "1x1 gifs" along with links that point to places you wouldn't normally think they would point at. Like this:

    Check out these <A href=3D"http://bigstar.ad6.net:8080/jsp/t/bigstar? b=4BF5Y7ESKTJH34789T5HTJKLGN489EI495T> hot magazines for 90 days for FREE </A>

    It points to some server which records that you have clicked on this link, using that funky long string as your identifier. The string possibly holds some sort of demographic information.

    There's also a 1x1 gif that comes with the spam...

    <IMG src=3D"http://bigstar.ad6.net:8080/jsp/t/bigstar.g if?b=56HJTY90JKHHJGGIJ5476">

    who knows what that does :P

    i'll let you judge for yourself if this is evil or not. i just wanted to point out a specific exmaple of where its being used. bye
  • Well, IE 5.0 is released for the Mac, too, and it supports DHTML, so it probably has this loophole in it as well. And it's ugly, and completely IE-specific. "Client-side cookies", basically, which is a really dumb idea. I'd trust server info to persist, but not client info...

    I think Gates is past that phase; now its all about control...
    ---
    pb Reply or e-mail; don't vaguely moderate [ncsu.edu].
  • Internet Explorer is evil.
    Combined with passport redirect cookie sharing [editthispage.com] and now persistent tracking, IE is a menace that should be eradicated from your computer.
    I wrote this [11st.com] article in August. After that I installed 98lite [98lite.net] and linux on my laptop.
    I'm also scared about the .Net version of Office due out in the spring.
    Just think every document running on an asp server run by MS. (shudder)
    • from the windows-help.net web site...
    • According to Microsoft, Office 10 will also offer significant new security features, including a central security panel; advanced password encryption; higher default security settings for Excel and PowerPoint; the option to not install Visual Basic for Applications with Office; and the functionality of the Outlook Email Security Update
    Makes you wonder...
  • Because there's no technical reason why they can't be more anonymous than meatworld ones--only problems with current implementations. If we can achieve happiness but don't bother, then aren't we being silly?
  • All the PoRn leaflets in my in box. JunkBuster my ass karma police.
  • This is why Linux is simpler to use.

    You whipe out the user and create a new one. Brand new slate.

    Every Joe can do this.....

    If you like to tinker with files you can just edit the cookie file, etc.... :^).

  • Long answer: in the example, replace ""http://www.stupidsite.com/" with the domain name in question. The pithy comment substituting for the path is obviously going to generate a 404. All of these sites are marketing driven (or they wouldn't annoy a geek) so someone will be examining the logs. If no one is examing the logs, then they're Clueless and Doomed anyway, so don't worry about it.

    Short answer: RTFM

  • From the article @ cnet.com...

    In the meantime, IE users can turn off the browser's scripting capabilities, on which IE persistence depends.

    The first thing to do immediately after installing ie5+ (before it uploads the contents of your hard drive to microsoft ;) is to disable scripting support! We've learned this from past experience with the never ending barrage of virii (viruses for the layman) that are in reality scripting exploits!! Since 'persistence' depends on scripting support, can we assume it's a virus? Maybe. Maybe not. The best bet is to not use m$ software. Period.

    This really stinks.

    --cr@ckwhore

  • Yes, but MS products have spawned a huge amount of 'HOWTO' and 'for Dummies' type books, so the so-called ease-of-use seems to be a fallacy for a lot of people. I find MS Office far too complicated and intrusive but unfortunately, I don't get a chance to use anything else at work and I don't really know how the competition compare in that regard.

  • Re:I have to say it... (Score:4)

    by tetrad ( 131849 ) on Monday September 11, 2000 @01:03PM (#787190)
    This kind of thing would have never happened if IE had been open sourced. This is also why Mozilla will take the market from IE.

    Mozilla will never take the market from IE, unless someone starts paying folks to use it. Most people don't give a rat's ass about features/loopholes/etc. like the one described in the story. What percentage of web users browse without using cookies? I don't know the answer to this, but I'd put money on it being a relatively small minority.

  • True, something like this wouldn't happen if the source was Free. However, there's also a matter of trust in the company. My favorite OS [be.com] is mostly [opentracker.org] closed source, but I have a great deal of trust in them. Yes, they could do something like track my every movement and everything I do, but they don't.

    -G

    Linux is only Free if your time is worth Nothing

  • I don't know what all IE might be transferring someplace on the 'net. Something strange happened to it on my system, though. After installing ZoneAlarm (ZoneLabs [zonelabs.com]) on my system, I set IE to have local access but not Internet access. Since that time, it won't load the startup page, which is on a web server on a system about ten feet away. If I switch it to have Internet access, it will load fine. Netscape works fine no matter which way I have it set.
  • Name me one example of Palm abusing their monopoly and I'll agree with you.
  • I tried to buy some porn the other day at the local bookshop. But guess what - people look at you when you pick it up off the shelf - like everyone in the store!

    Hehehe... You definitely bring up a good point. But remember here that the major issue is that when people go to the local porn shop, they know the privacy issues involved. What we're talking about here is that people have no idea what privacy issues are involved when they launch their browser. Most people will think that everything they're doing is totally anonymous, when in fact it's not. It is the responsibility of the software provider to make sure the user knows the privacy issues involved. That is the whole point of this discussion... (Well, I'm pretty sure anyway).

  • "Page Hit Counting" in IE 5.1 (Score:5)

    by quonsar ( 61695 ) on Monday September 11, 2000 @03:34PM (#787199) Homepage

    I use IE 5.1 and there is an option in the advanced tab called "Enable Page Hit Counting". Here is what the Help says about it (emphasis is mine):

    Specifies whether you want Internet Explorer to allow Web sites to track your Web page usage. Selecting this check box allows sites to create a log on your computer of which pages you view, even when you are viewing Web pages offline. That log is sent to the site the next time you go to it. By tracking the usage and popularity of specific Web pages, content providers can tailor future content to match your interests.

    Looks like this has been around a while as M$ fishes for the most innocuous name possible.

    "I will gladly pay you today, sir, and eat up

  • good point! if you must do graphics on-the-fly and don't want to burden the server, I guess a gfx-oriented jscript might make sense.

    fwiw, I've done plenty of dynamic gifs on my servers (for network management stuff) and I've never seen it become a major load.

    --

  • Would it be possible to make Nautilus or another non-javascript browser examine the javascript source code and guess what it does?

    It should be possible to get rid of all the non-functional buttons by finding url's imbedded in the javascript.

    "rollover" buttons should be detectable by the multiple images in the javascript.

    And otherwise, try to pick out quoted strings and display them as text.

  • Please, allow me to save potential readers time and summarize what the other replies to the parent will be stating/have stated in one form or another:

    "No.. YOU'RE WRONG. OK U mite be Rite dood... but M$ STILL SUX!!!!!!!!! F.U.!! M$ sSXuXSxuSux. It's SUXK! Why? Because M$ is SuKkY!!!!!!!"

    That's about it, except in different words.

  • ScriptBusters! Yeah! (Score:2)

    by Anonymous Coward
    Bugs to the left, Hacks to the right. Kill all VB-script, Fight, Fight, Fight!
  • Too many sites are using scripting in a way that makes it impossible to use the site with (java)-scripting turned off. Many 'submit' buttons actually invoke simple javascript-functions that check values and then submit your form.

    Lately, I tried to turn off java-script in IE, but then turned it on within a few days again, after wondering why so many buttons and links didn't work. First thought my connection was just crap, but it wasn't...

    So, if turning off scripting is not an option for you (as it is for many people), what can you do against this?
  • Yeah, but that strategy does not really work for me. Just to keep the administration of my working hours up to date, I have to login to a site that uses javascript when logging in. And not booking my hours is not really an option :-)

    A solution I found is to add this site to the 'trusted' zone and turn on javascript in that zone, leaving it off in the 'internet' zone. Works great for me, and you can keep track of which site can possibly track you.

    As for my working hours, they'd better keep track of them :-)
  • My IE 5.5 special security edition beta or whatever it's called (the cookie-cutter one they released a few weeks ago) has this option.

    --

  • Comment removed (Score:3)

    by account_deleted ( 4530225 ) on Monday September 11, 2000 @04:00PM (#787218)
    Comment removed based on user account deletion

  • Re:"Page Hit Counting" in IE 5.1 (Score:3)

    by MrBogus ( 173033 ) on Monday September 11, 2000 @04:01PM (#787220)
    Yeah, take this as a friendly reminder to open your IE prefs...

    While you are there, there's a begger's banquet of potential security issues that you can mitigate. Microsoft was nice enough to provide the options, not nice enough to choose the secure default.

    Advanced Tab
    -----------
    Profile Assistant (Allows web sites to upload information about you from somewhere. The Windows Address Book?)
    Install on Demand (Web sites can install "Web Components" on demand. Vague enough for you?)
    Search from the Address Bar (Unless you want to tell MSN what you are looking for..)

    Security Tab
    ------------
    ActiveX control settings (duh)
    Tons of Script options which have known issues (which is why they are in this dialog box)
    Automatic Logon (Sends your weakly encrypted NTLM network password hash to anyone who asks)
  • The 1x1 gif confirms that your email address is active and that you viewed the email. Another strong argument for text based email readers, I'm afraid. I really home that both KDE and Gnome are taking this into account when they create their funky new email clients with the ability to read HTML content.

  • Re:Oh for some privacy (Score:3)

    by radja ( 58949 ) on Monday September 11, 2000 @10:20PM (#787222) Homepage
    my local bookshop gets payed in cash. all they know is that some long-haired annoying geek sometimes buy porn. but since this isn't strange they won't remeber that either. they don't know where I live, what other stores I've recently visted, and what my favourite food is. even if they knew my name, they wouldn't be allowed to sell it. I would like the same anonymity on the net.

    //rdj

  • Re:This is why LAW should require source disclosur (Score:3)

    by mangu ( 126918 ) on Monday September 11, 2000 @01:59PM (#787223)
    Yes, that's right. All software, commercial and non-commercial, should be MANDATED by law to include source code.

    Agree with you partially - I think only source code should be copyrightable. Copyrights are intended to protect ideas, not a side effect of those ideas.

    There's an interesting loophole in having binary files protected by copyrights: one could write a program that analyses an executable file, identifying all functions and respective calls. This software would then scramble the code, changing the position of the functions and fixing the calls accordingly. Would this be a copyright violation? To characterize a copyright violation should both files be absolutely identical, or would a certain sequence of identical bytes constitute a violation? If the latter, what about libraries -- a binary compiled with a certain library would make all subsequent programs linked with the same library illegal?

  • Yes, by all means, let's dump the best browser around because people can't dig a coupla dialogs to disable a convenience feature. People who haven't found that option or didn't care to turn it off, are mostly the same people that feature was designed for. This is not an MS bug; it's a double standard.
  • Neah... they're just feeding the Christians to the lions so to speak. How newsworthy is a bug in Mozilla? Half the people will repeat the many-eyes, shallow bugs thing all over again and then the page views would die down. Besides, the Slashdot Queue would have nothing else.

    Of course, they (that conglomerator of OSS sites, Andover.Net Inc) would much rather throw a beefy, meaty Microsoft bug at the starving flamers, err... /.ers I meant.

    I mean you have to go *three* dialogs down to turn that feature off! Unbelievable! If RMS had designed IE, there would have been an option right there in ~/.ierc! Of course it would have been tab-sensitive and in ~/.ierc's unique little syntax, but you could definitely find it with a good man page and a text editor...

    Double standards; not just for Redmond any more.


  • the only good thing about jscript is that you can always view source

    Bzzzzzt. Do not pass go:

    <script language="JavaScript" type="text/javascript" src="fux0red.js"></script>

    "I will gladly pay you today, sir, and eat up

  • The current CVS version of KMail (for the upcoming KDE 2.0) has 'view as HTML' as a per-folder setting, and the default is off. The idea is that you create a folder with HTML enabled and a rule that moves email from trusted HTML-mail senders into that folder when you get new email. Its a pretty neat feature.
  • Persistence is futile! - You will be Mozillinated! ;)



    "How much truth can advertising buy?" - iNsuRge [insurge.com.au] - AK47

  • Re:You have a lot more to worry about (Score:3)

    by ucblockhead ( 63650 ) on Monday September 11, 2000 @01:10PM (#787236) Homepage Journal
    It is not as easy as you think. The IE ActiveX control is pretty much built into the OS. This makes it pretty much a given that anyone who wants to render HTML in their app is going to be using IE. We aren't necessarily talking obvious browser apps, either. It is very, very likely that you are using IE at times and not even knowing it.
  • Redmond, WA (AP) -- Microsoft (NASDAQ: MSFT) today admitted that Internet Explorer, from version 4.2, has had the capability to phone the user's spouse or parents without warning and inform them of the user's browsing habits, including listing specific sites and the names of image and movie files downloaded.

    The capability, described as a "feature" by Microsoft, came to light on the BugTraq mailing list three days ago after an angry user revealed that his copy of IE 5.1 had phoned his wife to tell her about his subscription to hotmonkeylovin.com.

    "This is a perfectly standard feature of any web browser," said a Microsoft spokesman. "As with all aspects of life on the internet, there is a tradeoff here between a very valuable capability and a vanishingly small, almost theoretical loss of privacy."

    Free Software Foundation guru Richard M. Stallman was unavailable for comment. A source close to the programmer said that Stallman was "busy reformatting his Windows partition."

  • Re:It's a Feature! (Score:3)

    by Black Parrot ( 19622 ) on Monday September 11, 2000 @01:13PM (#787238)
    > > "This feature has a trade-off, like almost every other feature on the Web--in this case, between functionality and a minor, potential privacy exposure," said Michael Wallent, product unit manager for IE at Microsoft. "The consumer that enables first-party cookies is even more exposed. This should only be an issue for someone who has disabled all cookies and is concerned about unique identification."

    <babblefish>Unless you find all the other security problems we built into IE, there's not much reason to worry about this one. If you use IE, they're going to get the information, one way or another.</babblefish>
    --
  • You could use Konqueror, the browser included in the upcoming KDE 2.0 release. It allows you to specify your JavaScript and cookie acceptance settings on a site-by-site basis.

  • Re:Better Documentation A Start? (Score:3)

    by Spoing ( 152917 ) on Tuesday September 12, 2000 @12:42AM (#787242) Homepage
    Clearly documented explanations of the security features that one can toggle in the Internet Options -> Security tab would be one thing, but the lack of context-specific, right-click help (try it and see) or even the word persistence in the indexed help file (search and see) is somewhat silly.

    While I agree, I think you're expecting too much from Microsoft's documentation group. They have different -- and Annoying(tm) -- ideas about what should go in a help system. Let me say up front that I neither agree or misunderstand why they dumb-down the docs -- we aren't thier main clients!

    It's like an anti-man-page attitude; say How to do something not What something is or Why it is valuable. Much of the help provided is along the lines of "Print prints somethig to a printer" or worse "This button prints". In context, these might be OK...but the lack of extra details anywhere is just part of the design goal. Less is better...since it's not really necessary, is it? Anything more detailed would be confusing to a typical user.

    MS is, after all, the company that don't document the switch /MBR for thier fdisk program (try it - fdisk /?)...why give detailed help on something that is much more of a user-level tool then a disk partitioning tool?

  • But why doesn't it shut off when you have your security level set as high as it can be?
    It does.
    Why didn't they place the controls for such a device in a more obvious location?
    What would be more obvious than Options->Security?
    Does "user data persistence" even give you a clue as to what it's actually doing?
    You've got me there. It doesn't even have a help topic, like many of the security settings. That's a bit of a pain.

  • Re:Repetitive redundancy (Score:3)

    by Azog ( 20907 ) on Monday September 11, 2000 @02:08PM (#787255) Homepage
    Indeed. Here's a classic line from the Microsoft manager quoted in the article:
    This feature has a trade-off, like almost every other feature on the Web--in this case, between functionality and a minor, potential privacy exposure..."
    And, as always, Microsoft has made the call to sacrifice security and privacy for functionality.

    Seriously, this must be a Microsoft corporate policy. Maybe a Microsoft-employed Slashdot reader can spill the beans, and point us to the internal web site or policy manual that says:
    "If you ever need to choose between security and functionality, choose functionality. If you ever need to choose between stability and backward compatibility, choose backward compatibility. If you ever need to choose between adhering to the internet standard or adding a proprietary feature, why are you even thinking about it! Add the proprietary feature - of course! And don't document it, either!".
    Or something like that. Come on, give it up, we know it's in there somewhere!

    Torrey Hoffman (Azog)
  • Id have to say most companies dont want to release the source code of their products because:

    a) They are afraid that someone will actually see how shitty they made the program

    b) Have no idea there is an open source movement out there

    c) They want to keep all their eggs in one basket so to speak.

    And don't forget:

    d) Such decisions are made by lawyers and managers, who have no idea how software is created.

  • This isn't as important as.... (Score:3)

    by caetin ( 157275 ) on Monday September 11, 2000 @01:14PM (#787260)
    oh, say, bug files? Now you can't even turn those off.. for those of you who do not know, bug files are little 1x1 gifs (or any other image/html/etc format) that links to a page somethin like: ... very suspicious address? indeed. With the right server-side encoding (php can do it, asp can do it, cgi can do it) you can make the browser think its getting a 1x1 image, when in reality its sending unique identification information. Unfortunately i don't remember the link to the place that had a nice big write up on it. They had a list of some big and oft-visited sites which used this method. Next time you're bored check out some big sites's source and see if you see any questionable image tags. Makes local stored data from stupid searches seem kinda trivial now doesnt it?

  • Better Documentation A Start? (Score:5)

    by great throwdini ( 118430 ) on Monday September 11, 2000 @01:16PM (#787261)

    From the article [cnet.com]

    Hint, the link is there to remind you to read it

    Microsoft defended the feature and pointed out that the vast majority of Web surfers already are knowingly vulnerable to the same level of exposure. "This feature has a trade-off, like almost every other feature on the Web--in this case, between functionality and a minor, potential privacy exposure" [...]

    Not to rant, but I cannot understand how such specious reasoning would find its way out of the mouth of a Microsoft representative. How could they possibly argue that since users are already at much greater risk from other features/exploits, one more "minor" inconvenience shouldn't matter?

    Clearly documented explanations of the security features that one can toggle in the Internet Options -> Security tab would be one thing, but the lack of context-specific, right-click help (try it and see) or even the word persistence in the indexed help file (search and see) is somewhat silly.

    Why would I have to journey to the developer's corner [microsoft.com] (link lifted from article) to learn what features are present in my browser? Maybe it's time that end-users insist on better [more immediate] documentation from Microsoft, especially with regards to things categorized under the heading of security

    ps - SlashDot still has its woes when dropping in long URLs. God bless the preview button

  • I don't think so, but more than one poster has mentioned something about a userdata persistence option [slashdot.org]...
    ---
    pb Reply or e-mail; don't vaguely moderate [ncsu.edu].
  • Some people may not care who sees what websites you visit, etc., but I do. I don't want this information shared with other companies who can then use me as a target consumer for their products.

    Think about how much this goes on in every day life......

    If you have a supermarket discount card (like a Star Market Card), everytime you use it for purchases, retailers use it to track exactly what you've purchased, how much you spent and how often you shop. This information can then be shared (as with what website you visit) with product manufacturers who the feel you may be interested in their products.

    Insurance claims. The information on your medical records is not protected by federal law, but something as inane as a video rental records are. Everytime you make an insurance claim and signing the form, you authorize doctors to release sensitive information to insurers and other third parties, like the Medical Information Bureau, which keeps records of health problems on some insurnace applictions and forms and informs insurers about pre-exisiting conditions, making it potentially harder to receive quality insurance. These records can be shared with various companies, but in half of the states in the US, you don't have the legal right to see your own medical records.

    A practice that is picking up speed in restaurants is the use of cameras spying on diners. The chefs then watch the diners so they can time when to serve the next course. I find this pretty scary that someone is watching my every bite.....

    Everyone knows that cell phones aren't safe, don't say anything on them or on portable phone that you don't want your worst enemy to hear. It can easily intercepted, and I know this from first hand experience, living in a dorm, a few of suitemates would sit around every night and listen in on numerous conversations going on the dorm every night!!!!

    Consumer advocates and the Clinton Administration say financial privacy has been further endangered by a federal law passed last year that made it easier for banks to merge with other financial firms, such as brokerages and insurance companies. Though the law includes provisions to protect consumer privacy, critics say that there are loopholes that could lead, for example, to a bank denying a loan to a customer because its health-insurance affiliate's data reveals that he or she is being treated for a life-threatening illness.

    There are hundreds of ways that the private citizen is becoming less and less private, and it is sickening.

    For more, check out LHJ.
  • That "100 USA" strip inside the paper in the $100 bills is a beacon transmitter that can be tracked by the Space Shuttle. I saw it in a documentary. [imdb.com]

  • Re:You have a lot more to worry about (Score:3)

    by costas ( 38724 ) on Monday September 11, 2000 @01:31PM (#787268) Homepage
    I personally have taken the version of VIM with embedded Python, spliced in Python's built-in HTTP client classes, and use vi to view the source text, with the garbage tags stripped out.

    I would've used Emacs for this, but I cannot trust LISP (the language's emphasis on parenthesies is antithetical to a prototypical architecture of a secure steganographical system) and I am worried that RMS may one day demand that the pages I view be switched to the GPL since I am using a GPL program to look at them.

    I am now working on a kernel patch for /dev/web, which would map the Web's raw feed to a device that I can just cat to my standard out.

    Explorer kicks ass, BTW.

  • Frankly, I've got to agree with you here. As a society, we have created copyrights out of whole cloth (no Virginia, you aren't just entitled to them) to promote the further advancement of the arts and sciences.

    So why should software be copyrightable if the part that permits the most significant advancement (the source) is kept under lock and key? They don't even need to supply it to users directly - just being required to deposit a copy with the Library of Congress in order to register the copyright would be enough to make me happy.

    We already require this for patents; software is an amalgamation of a creative written work (copyright) and a functional device (patent) so why not require it? It's not as though it would be hard to find out who was copying the source code for non protected purposes (Fair use would of course apply)
  • >I tried to use the junkbuster proxy behind IE, and half the time, IE went directly to the site in question, bypassing junkbuster

    How's that again? That doesn't seem likely. I've used IJB for a while as my proxy on my home firewall, IE doesn't have any other way out of my home LAN (masq set up for lots of things, :80 not one of them) so if IE were to ignore the connection settings (half the time?) I wouldn't be able to surf (the times when I use IE5).

    I do agree with the sentiment, 'when in doubt, diable'.
  • Then, watch as it gobbles up RAM, chokes on the simplest pages, and, oh, don't forget to install the nightly builds!
    ---
  • I'm confused. It looks like some weird version of Netscape -- except there's an "E" where the "N" should be, it has lots of security problems, and it doesn't seem to work on Linux. Is this somebody's idea of a joke?
    --
  • Your rant about RMS was stupid, but I like your other two ideas. /dev/web sounds interesting. I wish I knew more about devices and the kernel to consider it's implications.

    The real worth of your post, however, is this idea with Python used to use VI as your browser. Perhaps you have the source of this work up somewhere?

  • Oh for some privacy (Score:4)

    by SIGFPE ( 97527 ) on Monday September 11, 2000 @01:23PM (#787302) Homepage
    I tried to buy some porn the other day at the local bookshop. But guess what - people look at you when you pick it up off the shelf - like everyone in the store! It's worse - when you go and pay you actually have to interact with another human! It's even worse - they remember who you are and the next time you go shopping there and your wife comes along it's very embarassing. I think there must be some kind of multinational corporation conspiracy thing going on with the retailers in cahoots with the publishers in order to track me. Scary stuff.
    --
  • This just in on comp.risks (digest 21.04) -

    Date: Fri, 8 Sep 2000 15:03:39 GMT
    From: rubin@research.att.com (Avi Rubin)
    Subject: Windows NT/2000 "Lock Computer" allows palm sync

    In Windows NT and 2000, you can hit Alt-Ctr-Del, and one of the options is to lock the computer. Then, a password is required to unlock it. A reboot also requires a password to log in, so it would seem that this is a pretty safe state to leave your computer in when stepping away from your desk.

    The other day, I pushed the button to sync my palm pilot, and it worked. Then I realized that I had locked my computer. I did some testing on Windows
    NT and 2000, and apparently, the Palm synchronization always works when the computer is locked.

    There are several risks/attacks:

    - I take a blank palm pilot to your computer, which is locked, and I sync with it and copy all of your palm pilot data. Many people keep a master list of accounts and passwords on their pilot, among other valuable/sensitive data.

    - In a more malicious version of the previous attack, I sync all your palm data. Then, I zero out the contents of each record in every database. Then I sync again. The result is very likely that I will delete all of the data on the PC, and that the next time you sync, all of the data will be deleted on the palm. I know of a case where this "attack" worked in practice, by accident.

    - I write a palm hack that does whatever I want it to do to your data. I then sync with your PC, and the hack gets copied to your pilot desktop. The next time you sync, the hack is installed on the palm.

    I am sure there are other attacks that I haven't thought of. Anyway, I think that if Windows NT/2000 is going to have an option to lock the computer, it must make access to something as important as all of the Palm Pilot databases inaccessible. Perhaps turn off access to the serial port, USB, port, etc, and not just the keyboard.

    Avi http://avirubin.com/
    Ah, well. We should have known Microsoft had an, uh, innovative definition of "locked".

    --
  • Yeah, coz you'd never get specious reasoning on Slashdot.

    Let's all laugh at the funny Microsoft man.

  • Re:You have a lot more to worry about (Score:3)

    by FFFish ( 7567 ) on Monday September 11, 2000 @01:35PM (#787306) Homepage
    So remove MSIE completely. In the future, return any software that turns out to require MSIE components.

    The process is quite nicely automated by [98Lite] [98lite.net] which, despite the site name, actually has utilities that will remove MSIE from Win95, Win98, WIN98SE, and WinME. It'll nuke MSIEv3 through v5.x, and it does it safely.

    Worth a shot, at any rate!


    --

  • My personal hate is a numbered list where I want 1,2,3,3a,4 and Word wants 1,2,3,4,5.

  • BZZZZZZZT! Browser cache????

    URL ??? "www.somedumbasses.com/callMe/Leeet.js"

    Save As ???

    ...that's 'Dumas'

  • It looks to me like this can be easily disabled (Score:4)

    by Anonymous Coward on Monday September 11, 2000 @12:51PM (#787314)
    I just looked at IE, and under security settings, it gives you the option of disabling "userdata persistence".
  • Not to rant, but I cannot understand how such specious reasoning would find its way out of the mouth of a Microsoft representative.

    Ummmm...we are talking about a Microsoft representative here ... :)

    Maybe it's time that end-users insist on better [more immediate] documentation from Microsoft, especially with regards to things categorized under the heading of security

    <facetious mode%gt; But Microsoft's applications are so easy to use, they don't need documentation. I mean, you know, Linux is so much harder to use than Windows, so they actually need it, but Microsoft....nahh...it's just point and click. </facetious mode>

  • So? (Score:3)

    by quantum bit ( 225091 ) on Monday September 11, 2000 @12:52PM (#787317) Journal
    Hee, hee, I've had this turned off for forever. It's under the advanced options and I never really knew what it did, but I didn't like the sound of "Userdata Persistence"...

    rm -rf /

  • I tend to agree with my peers on this one. In fact, I don't think they go far enough with this concept. I don't like that I have to be logged in on a server computer in order to run software. Some server side apps (especially multiple ones from different vendors) need to have Administrator access to run. I would rather that the computer could be started and these services were run without a login... since I hate leaving a computer running that is already logged in as Administrator (root, to most folks here).

    Now, it would be easy to make the screen saver kick in and lock the computer, but what happens in the event of a reboot (malicious or power failure). The idea of this knocking out my Rational server until somebody walks into the room and types a password is rediculous. I can't have it automatically log in as Administrator, because in the minute before the screen saver kicks in, the malicious guest 0wnz me.

    Maybe I'm just dumb. I'm a software developer, not a network administrator. But, in my limited experience, I haven't found a way to auto-run anything without a login.

    Overall, the idea of locking a WinNT computer is that the user can't start altering settings/data easily. But, applications should certainly continue running. If Palm decided that they don't mind protecting their data when running on a "Locked" computer, I don't fault Microsoft.

  • Are Macs also being affected by this loophole? Is Gates trying to get everyone's information to make us buy more of his products?!
  • Just stop using IE. That's as simple as it can get. Besides all the security flaws that come out every hour, it's a nightmare for users.
    I work with a government forensics lab, and you wouldn't believe how easy it is to find out exactly where you've been, locally. IE stores everything you do in index.dat/user.dat/temporary internet files/cookies/application data, and a dozen more places in un-readable locked files, and in the registry.

    You would think, if it's THIS easy to grab from the local side, how many places are left open for the outside world to read?
    Just drop IE. Use opera, then you just have to erase your vlink4/cache4, and a few other things to clear up most of your activities.
  • Java in the browser can also offer you:
    • Security enhancements (like proprietary handshakes a la SSL, ...)
    • Handling callback from the server (with signed applets)
    • Have a richer user interface: compared to HTML, AWT is not so bad, after all.
    • Access to legacy application: you can make your applet talk CORBA or other TCP-IP protocols to your back-end applications.
    • Make Java applets load third-party dynamic libraries like smartcard-reader, fingerprint tools, etc ... (signed applets again)
    • Run a ftp server on your machine!
  • Very funny, and very true. Why do people expect that online transactions should be any more anonymous than physical ones? Are we so afraid that others should know what we're doing? Privacy is important, but it's not the end-all to life.

    -----------

    "You can't shake the Devil's hand and say you're only kidding."

  • They might not be using it now, but they will be, if they can. Companies would love to have a tracking mechanism that can't be disabled by privacy-minded individuals.
  • A lot of FTP servers do this. Most of them say, right up front, that you presence is being logged. And why shouldn't they? They're providing you with a service and, in exhange, they're logging your actions. Most of the time this is done purely for security reasons, however if they decided to sell that info, as logged statistical information about their visitor base... I don't think there's anything wrong with that.

    -----------

    "You can't shake the Devil's hand and say you're only kidding."

  • Check IE preferences. Make sure that the "Automagically check for Updates" (or something like that....) is not turned on. This setting will make it so that your browser doesn't call home before going to your start page. That is most likely what your experiencing.

    And as far as the other response, "Local means Local Computer"... No, local means local network. I'm sure you knew that, but....

    ~Hammy
    That Win95 Jump & Jive!
  • Has news.com just discovered that IE caches previous search requests? This feature has been in the product for months.

    You're missing the point. Although news.com did not do a very good job of explaining the problem. You should read the security advisory and the related links at the advisory page. Basically, the web page author can put MS scripting into the page that loads and saves data in the persistence object just like you can do in cookies. A quote from the MS web page regarding this technology:

    The userData behavior persists data across sessions, using one UserData store for each object. The UserData store is persisted in the cache using the save and load methods. Once the UserData store has been saved, it can be reloaded even if Microsoft® Internet Explorer has been closed and reopened.

    Sounds just like cookies, eh? I can tell you that I didn't know that IE5+ had this feature before reading this article. Did you?

  • In related news... (Score:3)

    by logistix ( 152482 ) on Monday September 11, 2000 @01:24PM (#787339)
    I was just at a ftp server that grabbed my IP and reverse-resolved my name even though I was logged in "anonymously". This could be used to track me too.

    And no, it wasn't IIS.
  • Good point. Hopefully the people wanting to know more information about methlabs might be a little more selective on their search. I mean if they searched for "marijuana", I don't see what the big deal. The feds aren't going to check out every dude looking for marijuana on the internet. ( I can't really say the people searching for it probably don't use it, because that is most definately not the case)
  • Hmm... so you're suggesting that MS should have locked all input devices coming in to the box, when you hit "Lock computer". I guess that would include the NIC, mouse and keyboard. Unlocking the machine would be a tad challenging then, I imagine.

    Surely the blame doesn't lie with the manufacturer of the device that doesn't check with the OS for what it should do. Or the author of the program. Because "they" are Palm Computing, which is a *good* monopoly, because of course they are not Microsoft.

    I see now.

  • Any old geeks here remember when every electronic device (TV, radio, alarm clock, etc.) came with a full schematic of the device? Well the schematics didn't hurt sales of electronics nor result in counterfiet copies being made... and neither too will they if software is required to come with source. And no one fears piracy of automotive design because some 3rd party (Haynes or Chilton) releases a book on your car with complete break away assembly diagrams and functional descriptions of all the parts. Again, neither will releasing source with software result in piracy... because if you going to pirate the source, why not just pirate the software and safe effort? Thus, releasing source will not harm product sales.

    Only your last point (about why not just pirate the software) is at all valid, and even it is total nonsense. Your other points are merely worse.

    If you have the source, you can more easily remove any copy protection methods. You think you see "cracks" of programs to remove a CD-check quickly now? Just watch how quickly that software hits the warez sites/newsgroups when the malicious "give-away-other-people's-software" types get their hands on the source.

    Comparing people having the source to people having schematics for electronics or the plans to a car is also complete nonsense. With those things you have to acquire and frequently fabricate parts, and then go through a lengthy assembly process. Surely some people actually did this back in the day with those schematics of amplifiers and so on, but for the most part, it was not the case. But all you have to do to compile something from the source is to put it into the development environment and click (or select from the menu) the "Make" option. A few minutes later, you have all the libraries and executables, assuming their project/make files are set up correctly.

    Also, Chilton's manuals are basically based on reverse engineering, but they do not actually tell you how to build a car, only how to service one. Furthermore, they suck compared to a Factory Service Manual, so they can only barely be seen as a competing product. They do not provide the level of detail you get from a FSM. In any case, those manuals are based on a tear-down and rebuild of the car in question, and they don't tell you how to build one - That would be arguably illegal.

    In summary:

    • Releasing the source would make it easier to "crack" software.
    • If they can keep the software from being cracked for a while, they can sell more of it.
    • Therefore, releasing source is probably not an option for most companies.

    Mind you, they really ought to give away the source to free software...

  • Who really doesn't care if my movements on the web are tracked? I mean, what's the big deal?
  • Just an aside..
    But many people who use 'open-source' stuff would never read the source, and never look for things.

    The key point is that, these days, if you do not seek to understand what is going on, you are vulnerable.

  • It seems that everytime some minimal flaw in a Microsoft product ignites the idea that much shame should be dropped upon the Redmonian company. Companies don't make mistakes, people do. Companies are made of people.. I am up to betting that developers of Linux and related software products have even introduced far more serious bugs.

    anyways .. I'd prefer that Slashdot not obsolete my bugtraq subscription. We have already established that MSIE is introduced 5 bugs for every 1 fixed.. let it be .. and REMEMBER THE ALAMO! (i mean Bugtraq: http://www.securityfocus.com/ [securityfocus.com] TOAST: Here's to hoping for the re-purification of Slashdot -- like in the past!

    Anybody else getting the impression that there must not be too much newsworthy submissions in the queue causing Slashdot to resort to such posts as this? Has computing has gotten to the point that many topics are better understood by the "general public" for the niche that Slashdot once filled?

    <constructive editorialism!/>


  • He was a famously bad speller.

    A famously creative speller, you mean. An inspiration to us all; in that sense like Shakespeare, who even occasionally mis-spelled (? but wouldn't he be the authority?) his own name as "Shaxpere." You owe it to yourself to violate at least one law a day. I mean, whose language is it, theirs or yours?

    Yours WDK - WKiernan@concentric.net

  • How would it know how to parse the scripting?

    Simple. It is not totally ignorant of javascript. It knows how to "parse" it. And then it has a bunch of rules like "the tokens "foo" and "(" next to each other mean they are calling foo() and that probably means I should do this...

    Actually just seeing all the string contants and assumming they are URL's should work and hardly requires even a "parser".

  • It is easily fixed (Score:5)

    by Idaho ( 12907 ) on Monday September 11, 2000 @12:57PM (#787360)
    And you don't have to turn off javascript. It's just in the IE Preferences dialog, but it's enabled by default.

    To turn it off, do the following in IE:

    Click Tools->Internet Options.
    Choose the 'Security' tab.
    Click the 'Custom level' button
    Search for 'Userdata persitence' (it's near the bottom, in the 'Miscellaneous' section)
    Select the 'disable' option.

    That's it!
  • Also oddly enough, I discovered after reading other posts and deciding it was a seperate issue, that the "Userdata Persistence" option is also in 5.1. It is found on the security tab instead of the advanced tab.

    So, in 5.1, they have "Enable Page Hit Counting" and "Userdata Persistence", and in 5.5 they have "Userdata Persistence", and the page hit counting thing is unlabelled but still present. Damn, I'd like to hear what Microsleaze has to say about this crap. And I wonder, does this all have anything to do with Passport, about which Woody [woodyswatch.com] wrote some nasty shit in his latest newsletter. It would seem that Passport is little more than a cookie circumvention process which provides site owners with way more data than cookies can. As if M$ intends to trumpet the unwashed masses with the news that they are now safe from the evil cookie, leaving unsaid of course that the "solution" is much worse.

    "I will gladly pay you today, sir, and eat up

  • Has news.com just discovered that IE caches previous search requests? This feature has been in the product for months.

    Just mouseover the cached queries and hit the delete key on your keyboard.

  • Does this really surprise anybody? How many 'features' do MS products have that piss you off by doing things you didn't ask you to? Just the other day, I was writing a paper in Word that used bulleted highlite points. Got it the way I wanted it, saved it, re-loaded it later and the bullet numbers were completely screwed up. Fixed it, saved it, re-loaded it, same thing. WTF? Point is, this is par for the course for MS, and shouldn't really surprise anybody. They don't care whether or not it makes life hard for those that know what they're doing--if it saves some dumb-ass from RTFM, then it's a good feature to them.

    At the same time, I don't see this as that big of an issue. If somebody can come up with a worst-case scenario of an exploit for this 'feature' that will format my hard-drive, then I'll be concerned. Until then, I must accept the fact that I use Windows, and must therefore deal with this kind of crap.

    ---

  • I always have javascript turned off. You know what I do when I find a site that is broken without javascript? I leave and never come back.

    "Free your mind and your ass will follow"

  • Try this yourself if you've got IE5 or higher... Go to www.microsoft.com, click on the Support menu up top, then click on Knowledgebase...

    Enter some search terms and look through the wondrous bugzilla that MS runs... Just give it one or two search terms or something... Now close out, wipe out your History, wipe out your Temporary Files and all the hoohah. Then wipe out cookies.

    Now come back in and check Knowledgebase. Hurrah! It remembers your search term, because you've got SECRET INFOES in some XML file buried deep somewhere.

    BORING.

  • Switch to an open source browser! Volunteer developers have no interest in building a browser that's going to spy on it's users...

    Unless, of course, they're an Evil Genius [evilgeniuses.org].

    The problem with the available open-source browsers is that they don't have IE's functionality. As lame as IE is, it has better standards support (And I don't mean the M$-defined standards, either) and more functionality (And here I am talking about Micro$haft-specific stuff, like activeX and client-side VBscript.) They also support CSS more fully than any other browser, and last I checked, that included arena [yggdrasil.com], the W3C's (now yggdrasil [yggdrasil.com]'s)standards-flagship buggy-as-all-hell featureless browser.

    Of course, Arena is basically now all but dead. The only sign of life that I could see is that it still has a webpage. It's been replaced in the W3C with Amaya [w3.org], which claims it "supports HTML 4.0, XHTML 1.0, HTTP 1.1, MathML 2.0, and many CSS 2 features". Amaya has an ungodly slow display engine.

    By contrast, in a quote from the W3C website (C&P'd from Amaya, BTW) we see the following: "000327 Microsoft shipped Internet Explorer 5 for the Macintosh. It apparently supports full CSS1, the first browser to do so." IE5.5/windows still doesn't do this, reportedly. I don't have a test suite handy, so I can't verify any of this one way or another.

    Mozilla is tres crashy. Netscape is agonizingly slow. Arena is slow and painful, ditto for Amaya. Opera finally has Java working properly, or so I hear (haven't run it recently) so I guess you can take it seriously, but the default layout made me shudder. It's also not as easy to customize (Or at least, to understand what you're doing) as I had thought it would naturally be. I guess the Mac users have a couple of other options, but they're missing major functionality, too, right?

    So what's left? If you discount IE for privacy reasons - nothing. Though I do use Mozilla for Mail, and occasionally K-Meleon to check out a small webpage quickly, or to load something that IE has network problems with. And Netscape and Mozilla both have dramatically faster implementations of Javascript and GIF89a animation.

  • the only good thing about jscript is that you can always view source. can't say the same with java ;-(

    Java has one thing over jscript: you can draw graphics. Jscript misses functions to draw lines and curves. If you don't want to use java, the server is burdened with generating a gif file for every graphic that's requested, and it takes much more bandwidth to send a gif than it would take to send a set of "moveto/lineto" calls, if they existed in jscript or html.

  • Here I was, making a stupid sarcastic post --yeah the rip on RMS was cheap, but so is this thread, me thinks-- and someone had to actually consider my joke on its technical merits. I like that.

    So, yes I am pretty sure /dev/web is doable (no, I aint working on it), and probably already done in Inferno or Plan 9. Probably a hack involving wget (or actually, Python :-) would go a long way there.

    As for the Vim browser: no I haven't done it (I am happily surfing on IE 5.5, thanks), but somewhere on vim.org, I have seen a vim-with-embedded-python. And python does allow you to send and receive stuff through http transparently, so yes, it is theoretically possible to built an entire browser within vi. Why? I dunno. I am using IE, remember?

  • ...I cannot understand how such specious reasoning would find its way out of the mouth of a Microsoft representative. How could they possibly argue that since users are already at much greater risk from other features/exploits, one more "minor" inconvenience shouldn't matter?

    It is amazing what "Public Relations" folks can come up with. This is essentially a "troll"; it attempts to change the focus of a discussion by raising a partially related, but potentially inflamatory point. Most good journalists/interviewers wouldn't let them get away with this without providing a counterpoint.

Slashdot Top Deals

Lisp Users: Due to the holiday next Monday, there will be no garbage collection.

Close