Slashdot Log In
Browser Privacy Test
Posted by
samzenpus
on Wed Dec 31, 2008 08:47 PM
from the which-one-works-best-in-a-frozen-home dept.
from the which-one-works-best-in-a-frozen-home dept.
lazyforker writes "A NYTimes blog post reports the results of security researcher Kate McKinley's tests of various browsers' (FireFox, Chrome, IE, Safari) privacy protection mechanisms. Specifically she tested their cookie handling. She also examined their handling of Flash's cookies. In summary: Safari on Mac OS X (in the 'private browsing' mode) is not so private ('quirky'). Safari on XP is not private at all. Flash behaves awfully everywhere."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Me know how to handle cookie! (Score:5, Funny)
Om nom nom nom nom!!!
Re: (Score:2, Funny)
My Privacy Test (Score:5, Funny)
I'm secretly in love with my best friend's wife, but I like gay midget porn.
[preview]
Damn, Firefox privacy test failed
Re:My Privacy Test (Score:5, Funny)
Next time, try "Post Anonymously"
...ah, hell, it's New Year's Eve. Go ahead and try your best friend's wife instead ;)
...or, you know, some midgets. Your call...
Parent
Re: (Score:2, Funny)
Re:My Privacy Test (Score:4, Funny)
You sick pervert!
Parent
Re:My Privacy Test (Score:4, Funny)
I'm secretly in love with my best friend's wife, but I like gay midget porn.
You think you have problems? Your best friend's wife's name is Steve. She has a beard and is 86cm tall.
Parent
One word (Score:5, Informative)
Flash behaves awfully everywhere
FlashBlock [mozdev.org]
NoScript works too but I find it sort of annoying because it stops half the web from working.
Re:One word (Score:5, Insightful)
NoScript works too but I find it sort of annoying because it stops half the web from working.
Exactly why I love it. Half the web annoys me.
Parent
Re: (Score:3, Insightful)
More like 90%. it's actually less annoying to "Temporarily allow all of this page" when necessary than it is the other way around.
Re:One word (Score:4, Interesting)
I agree. If the website doesn't bother to serve proper web pages to javascript disabled browsers, then it is not really worth it.
I'm not sure if that's true when you are using noscript. Certainly for flashblock it isn't true, because the site identifies your browser as being able to run flash.
In other words, they might have a flash and a non flash version, but they serve you the full flash version cause you *are* flash enabled, just blocked. With noscript you might get a javascript page, even though you block it. Of course that depends on how they implement the degradation of service, some websites will do it right.
That's apart from the fact that your assume that bad web programming means bad content. That's not the case. If I want to go to a site cause using it is beneficial to me, then I want to use it, whether they have smart or dumb people coding it.
I know I've found that with noscript I find myself constantly managing permissions, instead of browsing. Flashblock is a little less annoying, but obviously less complete in its blocking.
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
You can easily turn that on which you need to work. But stupid ad-serving junk, dumb statistics which delay loading significantly, annoying animations and downright mean stuff stays turned off for me.
I find NoScript absolutely vital to a useful web surfing experience, and it's always the first extension I install on new FF installations.
Flash (Score:5, Interesting)
Under what circumstances does Flash not behave awfully? Despite being a Linux fan, and more than a little cold on Microsoft (though I did buy an Xbox 360 - matter of price at the time...), I almost hope Silverlight takes off so Adobe have some serious, commercially driven competition for Flash. Maybe then they won't take their user base for granted and; oh I don't know, maybe put some work into making Flash GOOD?
Re: (Score:2)
Under what circumstances does Flash not behave awfully?
64-bit Debian Testing & Unstable (64-bit flash 10 alpha)
Re: (Score:2)
Re:Flash (Score:4, Interesting)
cf. http://www.anybrowser.org/campaign/ [anybrowser.org]
Sorry no, gnash or swfdec are not there yet, besides, whoever looked at porting them must have noticed they aren't portable despite being opensource, dependancy hell here I come. Just check the never finished BeOS port of gnash. I don't see silverlight being better anytime soon.
At least Java is open now, so it can be ported.
But it's not accessible to blind people for ex.
Why don't they make websites instead ?
Parent
Re: (Score:2)
The Linux community, which has less than 1% of marketshare on the desktop, has a rather incomplete open source version of the flash player. And you claim that the fact that the BeOS/Haiku community (I'll say it's 1% the size of the Linux community and consider that a generous estimate) hasn't ported it* is proof that porting it isn't possible?
* Wikipedia claims that there is an early port for BeOS, as well as RISC OS and BSD
Re:Flash (Score:4, Insightful)
Good heavens, someone is wrong on the Internet!
SWF is open, and we can glimpse the Flash Player's innards in Tamarin- but none of that even matters.
Pragmatically, is there a really important reason why you want the Flash Player to be entirely open? Would an open source Flash Player really be a better working piece of software than what we've got now?
Also, the Flash Player has support for screen readers and SEO indexing. Flash has support for lots of things that just aren't implemented in 90% of the SWFs you'll come across. A poorly scripted program says little about the platform it runs on. You wouldn't blame the Mozilla Foundation for bad websites, would you? That wouldn't make any sense.
I agree that Flash is not a standard, although wide adoption of SWF as a web standard is possibly a stronger motivation for Adobe to clean up the player than any competitive pressure that Silverlight may provide. And despite not being a standard, people will continue to use Flash to create web content, because it is a successful medium.
Just not the right medium for handling online banking. Wrong tool for that task. (Sorry Arcot.)
Parent
Re:Flash (Score:5, Interesting)
SWF is open
every time someone repeats this lie i end up posting a link to this film: http://www.youtube.com/watch?v=zoNvsiBTQDE [youtube.com]
Pragmatically, is there a really important reason why you want the Flash Player to be entirely open? Would an open source Flash Player really be a better working piece of software than what we've got now?
it would allow me to do everything a wanted with a non-intel architecture. flash is the last bastion of hardware (and operating system) lock-in for me.
Parent
Microsoft is Still Evil! Hurray! (Score:2)
Privacy issues aside, I've never had any trouble with Flash. Quite the contrary: Flash applications always seem to have fewer bugs and hassles than other embedded applications. I'm particularly grateful that the Flash media player is displacing MS Media Player, Real Player, and Quicktime, all of which are obnoxious as hell.
I should mention that I run The Evil OS. Probably the difference in your experience is due to your running Linux. You might find it instructive to try running a few Silverlight apps on Li
Re:Microsoft is Still Evil! Hurray! (Score:5, Insightful)
I like your logic: Aside from a single tile, Columbia's last mission went flawlessly.
Seriously, though: you've underlined the single greatest problem in computer security today - what we don't see can hurt us. I've written about this [imagicity.com] at greater length elsewhere, but to put it simply, privacy is the battleground of our decade.
The struggle to come to terms with privacy will manifest itself in the legal, moral and ethical arenas, but it arises now because of technology and the cavalier approach that the vast majority of people take to it.
The ramifications of our ability to transmit, access and synthesise vast amounts of data using technology are consistently underestimated by people because of the simple fact that, as far as they're concerned, they are sitting in the relative privacy of their own room with nothing but the computer screen as an intermediary.
On the consumer side of things, this creates what Schneier calls a Market for Lemons [imagicity.com] in which the substance of the product becomes less valuable than its appearance. As long as we have the illusion of security, we don't worry about the lack of real protection.
On the institutional side, we see countless petty abuses of people's privacy. There is nothing stopping a low-level employee from watching this data simply out of prurient interest. In fact, this kind of abuse happens almost every time comprehensive surveillance is conducted. In a famous example, low-level staffers in the US National Security Agency would regularly listen in [go.com] on romantic conversations between soldiers serving in Iraq and their wives at home. The practice became so common that some even created 'Greatest Hits' compilations of their favourites and shared them with other staffers.
They would never have done so had the people in question been in the room, but because the experience is intermediated by an impersonal computer screen, which can inflict no retribution on them, their worst instincts get the better of them.
When discussing software in the 21st Century, we cannot ever treat privacy as just one incidental aspect of a greater system. Privacy defines the system. Starting an argument by throwing it aside in the first subordinate clause gives little weight to any argument that follows.
Parent
Who is Kate McKinley? (Score:4, Interesting)
I was just wondering who Kate McKinley really is. Most of all, I am skeptical as to whether she is even qualified to be called a "security researcher" at all.
Why? Because Wikipedia returns [wikipedia.org] no hits for "Kate McKinley" and a Google search returns [google.ca] results that are sketchy or even anemic when it comes to browser security at best.
May be I should also put up my own research...may be, then call my self a "Security researcher."
Re:Who is Kate McKinley? (Score:5, Funny)
I was just wondering who Kate McKinley really is. Most of all, I am skeptical as to whether she is even qualified to be called a "security researcher" at all.
Why? Because Wikipedia returns [wikipedia.org] no hits for "Kate McKinley" and a Google search returns [google.ca] results that are sketchy or even anemic when it comes to browser security at best.
Maybe she's a privacy expert too.
Parent
Re: (Score:2, Insightful)
First links I tried, after reading the header of the paper, saying:
Re:Who is Kate McKinley? (Score:4, Insightful)
That and the way the paper is written makes me suspicious as well.
Parent
Re: (Score:2)
and a Google search returns [google.ca] results that are sketchy or even anemic when it comes to browser security at best.
Well, I guess she takes her privacy seriously.
Re:Who is Kate McKinley? (Score:4, Insightful)
Well, yes, yes you could. Why on earth does the author of the paper have to be on Google or Wikipedia? All the information you need is in the paper itself including an explanation of the methodology and _the freaking damn code itself_!
Parent
Re:Who is Kate McKinley? (Score:4, Interesting)
Who cares who she is? The paper she's credited with writing is by no means revolutionary...
Here's a couple of easy tips to help maintain a minor level of privacy while browsing:
- Disable Third-Party cookies (Option under "privacy" tab under Firefox versions >3.0).
- Add entries to your local hosts file fudging the DNS of known "WebSpy", sorry, I mean "WebAnalytics" domains.
My current hosts file contains entries similar to the following (but a few more than I list here):
--- Hosts File Example ---
127.0.0.1 localhost
127.0.0.1 www.google-analytics.com
127.0.0.1 google-analytics.com
127.0.0.1 ths.news.com.au
127.0.0.1 adsfac.net
--- End Hosts File Example ---
Host File Locations: /etc/hosts /etc/hosts
Windows - %SystemRoot%\system32\drivers\etc\hosts
Most Unixes -
Mac OS X -
The reason for utilizing the hosts file is to prevent such things as uniquely-generated transparent images (GIFs for instance) being used as inserts in pages to track your browsing in the advent you disable cookies, just add new domains/hosts to the file as you find them.
In any case, the point is more or less moot, you can minimize your privacy issues, but as any good security professional knows, where there's a will there's a way... and you can be tracked in a number of ways, understanding of how HTTP [wikipedia.org], DNS [wikipedia.org] and other transfer protocols (also lower-level protocol layers) work will help you minimize your exposure though... if you're concerned, read up on the OSI/ISO network model [wikipedia.org] and how IP [wikipedia.org] and TCP [wikipedia.org] work.
Parent
Re: (Score:3, Funny)
What the average Slashdotter wants to know is: Is she hot ?
You be the judge [facebook.com].
Re: (Score:2)
What the average Slashdotter wants to know is: Is she hot ?
Here's some more [facebook.com] Kates. Take your pick.
Fundamental flaw in survey (Score:4, Informative)
Microsoft's Internet Explorer, as the mos tpopular browser, disproves tha tpopularity does not equate to the perception of security.
A better basis for the selection of browsers would be to select those thought to be secure. That would eliminate IE and Safari at the start, and it might even add Opera.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
.
You prove my point. Thank-you.
Re: (Score:3, Informative)
Re: (Score:2)
.
As, it appears, did the "researcher". So what does that say about this "security" study?
Clean out the '\Flash Player' folder (Score:3, Informative)
Re:Clean out the '\Flash Player' folder (Score:4, Interesting)
Parent
Re: (Score:3, Informative)
But kill ~/.macromedia, and ~/.adobe/Flash_Player =)
Re:Clean out the '\Flash Player' folder (Score:4, Informative)
Parent
cringe-inducing bug in konqueror (Score:2, Informative)
Posting this anonymously, for reasons that will soon be evident.
Here's a really nasty privacy bug in konqueror. Let's say you visit gaymidgetsex.com. Then you go to View : View Document Source. Well, on my default install of Ubuntu, this doesn't actually show you the html source code of the web page. Instead, it downloads the html file to /tmp and opens it in OpenOffice, which attempts to render it as an OpenOffice document -- it doesn't actually show you the html source, which is what you asked it to do.
Re:cringe-inducing bug in konqueror (Score:4, Informative)
Posting this anonymously, for reasons that will soon be evident.
You do realize that you didn't have to use your real sexual preferences as an example, don't you?
Parent
Re:cringe-inducing bug in konqueror (Score:4, Informative)
WTF gave you the idea that's a konqueror bug? Why would opening a document in OOo, which isn't even developed/shipped by the same (upstream) people as konqueror, be a konqueror bug?
No, rather, as AC already posted, konqueror will with default associations as shipped by upstream (KDE), using the "view source" function, open pages using kwrite or kate or kedit. Assuming it's not a PEBCAK issue of the local sysadmin or user, OOo at least as shipped by Ubuntu appears to change that default by associating HTML (or possibly XML) files with itself, at a higher priority than kwrite/whatever-else. That's either Ubuntu's fault or OOo's (or the sysadmin/user for overriding the distribution defaults, if that's why the associations are set the way they are), but it certainly isn't KDE/Konqueror's, as KDE isn't what setup those associations, it's just doing what it's supposed to and following the file associations config as setup on the system it's installed on, as overruled by the config of the user running it, if they have chosen to do so.
Looked at a different way, it would be either OOo's bug, for having a recent documents history that can't be disabled (if that's indeed the case), or a user PEBCAK, for not disabling said history or wiping it out after opening a document they don't wish to appear in said history.
Parent
Safari's privacy mode is for local privacy (Score:3, Insightful)
solution on Firefox .. (Score:3, Informative)
Re: (Score:3, Funny)
Re: (Score:2, Funny)
12. Profit!
Re: (Score:3, Funny)
It's spelled spelled.
That is, unless you're British.
Re: (Score:2)