GAO Recommends Cookie Policy For U.S. Govt. 9
Jim Madison writes: "The General Accounting Office (GAO) has issued a report today 'Internet Privacy: Implementation of Federal Guidance for Agency Use of "Cookies".' In it, they recommended that Federal agencies abide by a four point standard for the use of cookies: (1) clear notice (2)compelling need (3) public stated privacy safeguards for tracking info, and (4)
approval by agency head. Only 8 of 65 agencies they checked in the study use persistent cookies, of which 4 did not even have privacy policies and none met the entire 4 point test. All agencies have agreed to comply; it sounds like a step in the right direction to me at least. What's the harm in the government collecting that info anyway, right?" Personally, I think the government should have to ask nicely before gathering any information via cookies, like Sen. Robert Torricelli has proposed for private firms. Other than that, these guidelines seem blandly sensible.
Privacy Complaints (Score:2)
I do not think that anyone should have the right to complain about persistant cookies collecting info about them. Cookies are simple to turn off, and in the time it takes to complain you could have just as easily turned them off.
Just my 4 cents (adusted for enflation)
GAO (Score:3)
Forget cookies -- you're munching on 1x1 GIF's (Score:4)
So you either turn off your cache (which you can't completely do in Exploder with its 1M minimum, but can thankfully in Netscrape) -- or you disable images....
Cha! Like ANYONE other than WAP users actually do that...
I guess what we could do is build a cookie-proxy system that would allow you to use cookies for the session -- but toast them automagically after logout.
Cookies are a fact of the net -- I simply cannot access my online bank account without them enabled -- sure i could switch banks because of this -- but i think in this case I would WANT the bank to have tracked access to my account.
The Government tracking my PR0N consumption is another matter all together ;)
Another step backward (Score:1)
The way I see it, as long as they don't go sharing, or even worse, selling our info, it's not too bad. How many .gov websites do you actually go to in the course of a day? I go to a .mil periodically, but since I log in, I think they already know how often I go there.
We need to concentrate on companies doing this, not the feds. Only accept cookies you need, and we have to get the government to force companies to allow an opt-out for their info selling programs.
Re:Forget cookies -- you're munching on 1x1 GIF's (Score:2)
You can't turn the cache in IE off but you can make it automatically empty every time IE closes. Just go to the "Advanced" tab of the Options dialogue and scroll down until you find the "security" section where you'll find an "Emoty Temporary Internet Files folder when browser is closed" option. Doesn't delete persistent cookies alas, but it does zap 1x1 bug images.
Why do cookies exist? (Score:3)
Anyhow, the fact is that for interactive sites, we have to be able to preserve state information, if for nothing else the ability to know which user is which, when they last logged in (and to prompt them to relogin if needed), etc. This in and of itself isn't a problem, IMO - I don't mind if a site knows how often I visit them or when.
The problem is when those sites start sharing info about where the users are going (ie, sharing info you don't want shared without telling you, or allowing you a way to opt-in/out of that plan), or tracking via ad banner cookies (same thing, except it is one company doing it, via their ads). Another possible issue is cookie stealing - that is, one company looking into the contents of another company's cookie - without the company or the user's knowledge.
What we need is either a state-based HTTP type protocol (ie, move away from stateless), or another manner of handling cookies. The first idea probably isn't possible or realistic - there are probably too many reasons not to do it (performance and bandwidth usage being the primary ones). The second is possible, at least for new browsers.
Cookies could set by IP, or something, and only other servers with that same IP (or by a masked range, set by the user?) could access that cookie. It is almost like that now. Other mods could be made to allow easy user management of cookies, as well. Perhaps force the setting and reading of cookies via https, so that only the issuing source can read the cookies? There are probably a ton of other changes to the system, probably even a few legalistic ones (or apply current laws the way they should be, if they apply).
Web Bugs (1x1 GIFs) are harder to stop - but a browser could be made to identify "possible" web bugs, and allow the user to set the browser to eliminate, expand or highlight possible web bugs on the page - even allow the user to click on a possible bug to see the code or CGI query behind it. While this wouldn't eliminate the problem, it would go a long way toward helping...
Worldcom [worldcom.com] - Generation Duh!
Countermeasures, arms race (Score:1)
Of course, the spies could escalate in any number of ways. Dynamically generated content could change the URL for every page load, eliminating the effective caching at some expense in server load. To counter that, a fix to the proxy might ignore "nocache" on images where the image is from a different site than the referrer. A patch to the browser might just ignore 1x1 images. And so it goes.
--
Re:Another step backward (Score:3)
The Feds are REQUIRED to do a census every 10 years by the Constitution [usconstitution.net]. Of course, all the demographic BS they collect isn't required.
IANAL, and so won't presume to tell you not to answer that BS, but constitutionally, they are required (and allowed) to ask how many people live in your house.
Re:Why do cookies exist? (Score:2)
Um, only the issuing source (or, depending on how it was sent, another server in the same domain) CAN read the cookies.
The issue comes about when sites exchange data correlating cookies to other data behind the scenes.