HTML5 Draws Concern Over Risks To Privacy 163
Hugh Pickens writes "The NY Times reports that in the next few years, HTML5 will provide a powerful new suite of capabilities to Web developers that could give marketers and advertisers access to many more details about computer users' online activities. The new Web language and its additional features present more tracking opportunities because the technology uses a process in which large amounts of data can be collected and stored on the user's hard drive while online. Because of that process, advertisers and others could, experts say, see weeks or even months of personal data that could include a user's location, time zone, photographs, text from blogs, shopping cart contents, e-mails and a history of the Web pages visited. 'HTML5 opens Pandora's box of tracking in the Internet,' says Pam Dixon, the executive director of the World Privacy Forum. Meanwhile Ian Jacobs, head of communications at the World Wide Web consortium, says the development process for HTML5 will include a public review. 'There is accountability,' Jacobs says. 'This is not a secret cabal for global adoption of these core standards.'"
Browsers... (Score:5, Insightful)
The irony.... (Score:2, Insightful)
Re:Don't cookies do the same thing? (Score:4, Insightful)
Re:FUD (Score:3, Insightful)
browsers should (or probably will if they don't already) clear out most of those locations (except Flash, but you can't blame the browsers for that really) when you clear your private data
This is the only part of your post that I disagree with - if a browser allows a plugin to write to a location on disk in any form, then the browser should be responsible for further access to that location, and the maintenance of that location, not the plugin. Saying its Flashes fault that these things don't get removed is simply excusing the browser from its responsibilities.
Re:Browsers... (Score:3, Insightful)
And yes, the standard is terrible. Go read it. [w3.org]
-- Barbie
Didn't the '90s teach us? (Score:5, Insightful)
Re:FUD, Yes, But Some Truth and Risk Increase (Score:3, Insightful)
You must be new here :-p
Seriously, we already have latency problems caused by multiple sites doing their crap on every page load (look at the source for any page that includes tracking and ad javascript includes). We don't need web sites sifting through 5 meg of local storage (which they'll grow to 100 meg, just like the original cookie limits specification quickly succumbed to hyperinflation) because they'll want to store it in xml.
-- Barbie
HTML5 -- a new "language", standard or what? (Score:3, Insightful)
HTML5 -- is it a new language? Is it a set of extensions to HTML, Javascript, or is it more of a concept/phenomenon, like "Web 2.0"?
I read it as an extension of the HTML standard, but quite often its treated as a "new language" as opposed to an extension, upgrade, etc. I wonder if that's half the problem -- I think generally speaking, people are a little weary of many new things, technology wise, and failure to cast this as more of an upgrade than a wholly new entity (even if the new features make it so) probably has a lot to do with some of the scaremongering associated with it.
Re:Browsers... (Score:4, Insightful)
You are overly optimistic if you think Aunt Marge and Uncle Joe will have ever even seen or heard of "the little black box with the white letters" :)
Re:Don't cookies do the same thing? (Score:5, Insightful)
> Being able to store things with flash is fine...
No it isn't. Creatures such as Flash should never be able to store or read anything. They should be locked in their sandboxes with only the input the browser chooses to give them.
Re:Don't cookies do the same thing? (Score:1, Insightful)
No. It's simply not a problem for most people.
Neither is police brutality. Or Habeus Corpus. Or the bearing of arms.
The number of people affected by an action http://en.wikipedia.org/wiki/First_they_came... [wikipedia.org] has no bearing on whether the action is ethical or heinous.
Re:Didn't the '90s teach us? (Score:3, Insightful)
> ...we will turn to cross-platform plugins like Flash to actually get stuff done.
"Stuff" that doesn't need doing.
Re:FUD (Score:2, Insightful)
Javascript is blocked from writing to disk, and indeed doing a lot of things in certain circumstances (IE blocks a lot of JS when the page is opened locally and not through a remote server).
So again, to say its not the browsers fault is falsely excusing it from blame - the browser can certainly lay down a strict set of rules by which the plugins can and cannot work, and that certainly includes local file access.
Microsoft got shat on for this a long time ago about ActiveX, so the other browser makers now need to get an equal shitting on for anything else that they allow access to the internet via their browser without setting up suitable security restrictions.
This is most certainly a browser issue.
Re:Don't cookies do the same thing? (Score:4, Insightful)
What are you talking about? And who modded this insightful?
We're not talking about a civil rights issue, we're talking about an option you can turn on or off in your browser. It's not a problem for most people, so they don't turn it off. It's there to be turned off if you like. We're not even talking about getting rid of that option, we're just discussing sane defaults.
Can you give a decent explanation of how this relates to police brutality?
Re:How, Specifically? (Score:3, Insightful)
None of that has anything to do with HTML5.
Re:How, Specifically? (Score:3, Insightful)
Many of the new features of HTML5 exist to allow browsers to do the same things as plug-ins. A poorly written plug-in is a much bigger security vulnerability than the well-thought-out new features of HTML5, which were largely contributed by browser vendors themselves. The browser vendor has a vested interest in keeping the browser secure against attack. And they know how to accomplish that, because they're more familiar with their own internal security model and they're more motivated to follow it rigorously.
Implementing the same origin policy thoroughly and correctly is in the vendor's best interest. I'm pretty sure that HTML5 will make us more secure than the plug-in riddled environment we have now.