Microsoft Accuses Google of Violating Internet Explorer's Privacy Settings 197
New submitter Dupple writes with a followup to Friday's news that Google was bypassing Safari's privacy settings. Now, Microsoft's Internet Explorer blog has a post accusing Google of doing the same thing (in a different way) to Internet Explorer. Quoting:
"By default, IE blocks third-party cookies unless the site presents a P3P Compact Policy Statement indicating how the site will use the cookie and that the site’s use does not include tracking the user. Google’s P3P policy causes Internet Explorer to accept Google’s cookies even though the policy does not state Google’s intent. P3P, an official recommendation of the W3C Web standards body, is a Web technology that all browsers and sites can support. Sites use P3P to describe how they intend to use cookies and user information. By supporting P3P, browsers can block or allow cookies to honor user privacy preferences with respect to the site’s stated intentions. ... Technically, Google utilizes a nuance in the P3P specification that has the effect of bypassing user preferences about cookies. The P3P specification (in an attempt to leave room for future advances in privacy policies) states that browsers should ignore any undefined policies they encounter. Google sends a P3P policy that fails to inform the browser about Google’s use of cookies and user information. Google’s P3P policy is actually a statement that it is not a P3P policy."
Re:So... (Score:5, Insightful)
In other words, if your server delivers a garbage or blank P3P header, the browser assumes there are no privacy implications? Sounds like a hole in the standard to me, such headers should be ignored IMO. Though Google really should have tested this properly with all browsers before deploying it in production it sounds to me like an oopsie, not at all like the Safari thing.
Google has been claiming "oopsies" almost weekly over the last couple months. In this case they put this in their policy: 'P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 [google.com] for more info."' in what is meant to be a machine-readable field. Following the spec would have been easy-- omit the field altogether. Instead Google violates the spec in a way that benefits them. It's possible Google is just really incompetent over all these "oopsies", but they sure try to represent themselves as a company with above-average engineers. It has to be one or the other.
Re:So... (Score:5, Insightful)
funny: I'll have to remember this to rub their noses in it, next time I run into a googler.
or, if they interview me, I'll ask THEM: "so, what is the proper response to a machine parsable field? TLV things or human-intended english? please support your answer."
sigh. I cannot give google a pass. they act like god's gift to networking yet they make 'mistakes' like this? sorry, but I don't buy it.
IE's fault? (Score:5, Insightful)
When I was configuring P3P for Mozilla/Firefox, it distinguished between what exactly the P3P policy was stating. If the site didn't say in the P3P policy what it was doing with cookies, Firefox assumed the worst. It seems to me that if the IE devs were dumb enough to stop after seeing a P3P policy presented and didn't bother checking what it said, or if they assumed a lack of a statement indicated respect for privacy, that's a failure in IE. The code needs to start out assuming personal information is collected and used without consent, and then upgrade only if the P3P header specifically says something better. It's not like that's hard to implement.
Then again, we've seen similar problems in Microsoft software time and time again: they assume the best (input's valid, doesn't contain special characters, etc.) until they detect otherwise, even though best practices say to do the opposite (assume input's invalid until analyzed and proven correct, list the known non-special characters and filter out or escape everything not in that list).
Re:So... (Score:5, Insightful)
If the IE or Safari teams really cared about user privacy, they would be more strict about allowing sites to set or read cookies. This is just an excuse for Microsoft and Apple to publicly bash one of their competitors while continuing to not give two hoots about their users.
Re:So... (Score:4, Insightful)
P3P sounds like a stupid idea anyway. How does it protect user privacy if something as trivial as the attack described above totally defeats it?
P3P is a honor system anyways. The same effect could be obtained by a syntactically well-formed promise not to abuse the 3rd party cookies, but which google would never intend to keep...
Re:So... (Score:5, Insightful)
Google has been claiming "oopsies" almost weekly over the last couple months. In this case they put this in their policy: 'P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 [google.com] for more info."' in what is meant to be a machine-readable field. Following the spec would have been easy-- omit the field altogether. Instead Google violates the spec in a way that benefits them. It's possible Google is just really incompetent over all these "oopsies", but they sure try to represent themselves as a company with above-average engineers. It has to be one or the other.
Can't say I really can fault Google for this. Explaining why would require an understanding of how P3P 1.0 objects are configured and how limited those types really are.
P3P 1.1 work has stalled (albeit in provisionally final state) and is likely to not restart; in its absence is P3P 1.0 which exists firmly in the world-as-it-was of 2000/2001. It covers cookies and certain types of form transmission, but doesn't cover privacy aspects of other types of persistent data, new transmission protocols (like SPDY), advanced caching techniques, or HTML5 storage. Technology has advanced past the point that P3P 1.0 is useful -- and quite simply, it's doubtful it ever really was. If you visit the link Google supplies it explains some of their reasoning, and it's pretty dang valid for a post-2007 view of the Web.
Those chucking bombs over this would be better served to focus their efforts on either modernizing or replacing P3P 1.0 -- or, better yet, trying something radically different like PRIME or Policy-Aware-Web tried to do.
it's because IE implementation is buggy (Score:5, Insightful)
In IE iframes will block cookies if you don't have the right P3P policy. There where other bugs that would prevent your site's cookies from being read.
I've "faked" a P3P header just so users of certain IE browser versions could use my site.
At the end of the day the standard is a proposal and only MS thinks it's worth a hill of beans.
Re:Dear Microsoft Iexplore team (Score:5, Insightful)
You don't really understand the problem here, do you? It's a potential ethics violation by Google, not a technical violation. It's like if a company published inaccurate ingredients on a can of nuts, and you're bitching about shoddy can manufacturing.
Re:So... (Score:3, Insightful)
No. The browser is supposed to ignore the whole thing if it doesn't find anything it understands. Why MS doesn't make IE just go with the default of NO in those cases, I don't know.
Of course, why Google sends such a non-statement is questionable as well.
Re:So... (Score:5, Insightful)
Google is using +1 buttons to track visitors browsing on 3rd party sites to enhance their ad profiles for users. This is explicitly why P3P was even made as a standard. Circumventing the standard by sending invalid data while saying nothing exactly fits the definition is a cop-out.
Re:So... (Score:4, Insightful)
Evil bit? (Score:4, Insightful)
This whole P3P thing just sounds like the evil bit all over again.
How exactly is P3P supposed to protect users' privacy?
Re:IE's fault? (Score:2, Insightful)
Wrong. "P3P=" isn't saying they won't use it for anything, it's not saying anything about what they'll use it for. You're supposed to be able to trust anything said in the P3P header, but nothing in the P3P spec says they have to say anything. And if they don't say anything about a specific subject, best practice is to assume the same as if they hadn't included the P3P header at all (at least regarding whatever item you're looking at at the moment).
If you need someone to drive a vehicle for you and they won't say whether they have a driver's license or not, do you assume they've got one and it's valid for the vehicle you need them to drive? No, you assume they don't.
Re:So... (Score:5, Insightful)
From my reading of Microsoft's long blog post, Google didn't violate the spec. IE does not correctly implement the spec and Google is abusing that by using a legal but illogical header. If Google doesn't say what they are doing with the data, then IE shouldn't provide it. Instead, Google says "I'm not telling you anything about my intent" and IE says "Good enough. The key's under the mat. Lock up when you're done." The whole system is trust based. Google doesn't promise anything and IE doesn't care. Google is being shady and Microsoft is being incompetent.
My biggest problem here is Microsoft releasing this now in a lengthy blog post and trying to tie it to the Safari dust up. They know that the blogs will not include their full release and will instead carry the headline like you see here. This is a PR move at least as dishonest as what Google appears to be doing with their P3P header.
Re:So... (Score:5, Insightful)
1) We need to call out companies that do this type of thing. Not just with P3P but anytime they abuse the system or game it. They need to be made to understand that a very vocal set of folks will make it known what they are doing and that it is bad for their business to be found gaming trust systems.
2) We need better systems that don't just trust whatever a company says about their intentions with our data.
Re:So... (Score:5, Insightful)
Quite simply, it allows stories like this - which is a good thing.
P3P allows a website to make a very obvious statement about their intentions, to a set specification - if the website specifically sets a P3P that they don't honour then it becomes a PR issue, as it has in this case.
Google were breaking the spec here, in such a way that creates a valid P3P statement in the process which says "we won't be doing anything untoward with your cookies" - the field they use is not a text field and therefor the content they put into it is ignored, resulting in a zero length list of items they *will* do with the cookies...
That definitely should get Google into the tech media at least.
Re:Wait, how is this not an IE issue? (Score:4, Insightful)
Re:This is like Jack the Ripper (Score:4, Insightful)
The problem with that line of thought is that it allows one person to dominate the discussion by shouting nonsense. If someone keeps saying un- and half-truths repeatedly, and you take the time to independently analyze the validity of what they say, you never have any time to consider the viewpoints of others or to form your own opinions.
It's much easier, and indeed human nature, to eventually decide that source doesn't contribute anything meaningful to the discussion, and ignore it entirely.
Examples:
a) Microsoft and anything about unfair trade practices (to some people)
b) 126.67.234.x and spam (to many spam filters, and I just made up that IP address range)
c) Political talking heads who fill various cable news channels 24/7
d) Boys who previously cried wolf
Re:So... (Score:4, Insightful)
In this case, "ignoring undefined policies" means that there are no stated privacy implications. If the P3P policy is blank then the site is saying there are no privacy implications for its cookies.
Re:So... (Score:4, Insightful)
Yes, but that would not be legal.
Exactly.
And what we're trying to argue here is that google's subterfuge should not be legal either. What they did was say something to the computer in such a weird way that it means exactly the contrary to a human. This can't be right.
It's as if a party A drafted a contract with a party B, and deliberately inserted some spelling errors in his promises to B, and later renegated on these promises under pretense that the text is just gobbledygook and thus not a legal commitment (all the while insisting that B should uphold his part of the deal). Very shady.
A honor system works because of the implicit threat of shaming (or suing) a would-be infringer. Google infringed. So we are trying to shame them by pointing out what they did. If you take this away by saying "but the scheme is broken, it can be subverted by just making false promises, so Google is ok in doing what they did and Microsoft is stupid by behaving according to standard (ha!)", then you are indeed breaking it by helping Google out of a well-deserved public shame.
It's the same as with robots.txt or similar schemes really. Trivially easy to ignore, but reputable spiders won't ignore it because they know that people will notice, and call them to it.
I am not sure most tracking sites bother with such fine distinctions, but they cannot hide from the law forever.
Only small sites need to hide. Big sites (apparently) don't need to, they're "too big to be considered rude" / "too big to be sued".