Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Privacy

Is W3C's P3P Good Privacy? 118

Posted by Cliff from the sharing-those-first-impressions dept.
nileshch asks: "A very important development in recent times with regards to website users' privacy has happened with the W3C introducing the Platform for Privacy Preferences(P3P). P3P allows websites to create and maintain XML-based privacy policies for the entire website or sub sections of the site. These machine readable policies document what information is collected from users and how it is going to be used. Today, a few browsers like Mozilla/Netscape & Internet Explorer are committed to giving support for P3P (Mozilla here, IE here) . Although that support seems only skin-deep. I also find very few big sites adopting P3P seriously. Isn't it like the classic chicken-and-egg situation? Websites wait for full P3P support on browsers, browsers go slow on development because there isn't much feature demand happening on this front. Do you have P3P policies for your website? If not, what stops you from creating one? We all create hoopla over tiny privacy issues, user profiling and doubleclick.net . Then why isn't there much enthusiasm for P3P support in browsers?"
This discussion has been archived. No new comments can be posted.

Is W3C's P3P Good Privacy? More

Is W3C's P3P Good Privacy?

Comments Filter:

  • Why? (Score:5, Insightful)

    by NineNine ( 235196 ) on Saturday November 09, 2002 @11:18AM (#4632053)
    We all create hoopla over tiny privacy issues, user profiling and doubleclick.net . Then why isn't there much enthusiasm for P3P support in browsers?"

    Why? It's simple. Users don't care. Geeks do, but geeks don't make up a large percentage of the general population. The general population of Web users aren't nearly as paranoid.

    • Re:Why? (Score:3, Insightful)

      by Angry White Guy ( 521337 )
      You mean nearly as informed.
      A lot of people don't understand the tracking that goes on. They still see the internet as everyone being anonymous, just because they don't understand the technology.

      • Re:Why? (Score:5, Insightful)

        by koreth ( 409849 ) on Saturday November 09, 2002 @01:16PM (#4632520)
        No, they just don't care. I'm a geek who understands the tracking that goes on (I've written Web tracking software in the past) and for the most part, I don't care. If Joe's Bait & Tackle Shop can make an extra buck with the knowledge that I visit the Psychology Today website, more power to 'em. I see that as a slippery slope leading nowhere. I don't see it as worth my energy to object to data collection just for the sake of objecting to data collection, if no harm can come to me as a result.

        I suppose I see the Internet as being inherently non-anonymous (a sufficiently interested party could be tapping my cable modem, either by court order or surreptitiously) because I do understand the technology, so the fact that it's not anonymous isn't an issue I feel it's really fruitful to worry about. I'd far rather get worked up about things I have a nonzero probability of actually changing, or at least that do me harm. Mind you, my definition of "harm" includes things like sending me spam, but I see little evidence that web site information sharing will ever be responsible for more than a fraction of a percent of the mountains of spam that already hit my filters.

        In the instances when I really do want to resist observation by a third party, e.g. working from home which means I'm dealing with my company's trade secrets, I take care to encrypt everything I send. Even then, though, a sufficiently interested corporate spy or government agent could break into my house and install keyboard-monitoring software without my knowledge, or could be watching my monitor using a spy cam from the neighbor's roof. At some point you either have to go completely off the deep end with privacy paranoia or conclude that as an individual there's a point beyond which it's impossible to keep secrets from the world. From there it's a matter of figuring out where you think it's reasonable for that point to be, and it's on that score that well-informed people can disagree.

        Sun's Scott McNealy summed it up pretty well, I think ("You have zero privacy anyway. Get over it.") Obviously I'm in the minority here on Slashdot, but I think he's pretty much right.

        • Re:Why? (Score:3, Interesting)

          by Angry White Guy ( 521337 )
          That is a very depressive outlook on the internet. Why, because it's true. I guess that our ideals of what the internet could be often blinds us to what the internet is. I don't subscribe to any sites, and do nothing for them aside from suck up their bandwidth. And then I am shocked when they dissappear from cyberspace.

          Let them sell off my information. Let them spam me, let these sites *gasp* make money to survive. There is no such thing as a free lunch. I've told the users which I support that same statement over and over again when they download all those seemingly free programs like hotbar and bonzai buddy. And yet I can't get it through my thick skull that even though I pay to access the internet, my responsiblity doesn't stop there. If I am to continue to use these sites, should they not get paid?

          Remeber, information is free, but you have to pay the tarriffs and transportation costs.
          • Well heck, with most cookies, they dont' even directly benefit a site more than, say, helping them figure out what users go where... their site's flowthrough... Or where they come from or go to afterwards. Most cookies don't actually *do* anything other than help the websites with their marketing.

            I use cookies on my sites to help the users' experience. There's no other way to do it. If they don't want to accept cookies, that's fine. But they're losing out. It doesn't effect me as a web site owner either way.
            • There's no other way to do it.

              I don't know what you're trying to do but about the only problem with a user not accepting cookies is that they have to "login" to the site on each visit. You can track a user on a site by query-string/form.

              I'm only pointing this out as many sites don't work without cookies and I feel this is a poor state of affairs, mostly 'cos its due to lazy site building that depends on the session management features of the web server.

              I'd urge any slightly clue'd-up web developer who cares, to try build sites that operate without cookies. The reason is that, okay, it is slightly more hassle to build the first one, but once you've got the hang of building stateless applications, you get the benefit of vastly improved scalability! This is a good thing.

              So thats nice.
              • Well, first off the querystring is a very, very messy way of doing things, and introduce the potential for many, many more bugs in a web app.

                And actually, the reason that I decided to go with cookies instead of the querystring/form method is because Netscape 4.7 had a very tough time with querystrings. There was a length limit, and it munged up lots of special characters, so extra formatting was required on every single page, and if your querystring got to be a certain length, it simply didn't work.
                • the querystring is a very, very messy way of doing things

                  Elegant it ain't. I think the querystring should really just be used for resource identification and *something else* used to maintain transient state information, but we're stuck with what we got!

                  introduce the potential for many, many more bugs in a web app.

                  How so?
                  Obviously you do have to organise you app such that you know that you've validated every bit of UA supplied information, but then thats a given in anycase. I guess if you've had agro from NS4.x then that'd be enough to put anyone off!

                  All that said, re-thinking about my points on "vastly improved" scalability, I was talking out of my arse, since using the querystring forces you to dynamically generate each page! I'll try to remember to think before I post in future!! :)
                  • Well, if you're talking about sessions, you're still talking about dynamically generated pages, so really the performance hit, which is negligible, is gonna be similar. But where the headache comes in is grabbing every query string on every page, adding to it if need be, rebuilding it with existing information that's irrelevant for the page you're on, etc. Whereas with sessions (using cookies), you just grab the info you need in each particular page, and it persists without any additional code.

                    Like, if you're writing, say, a basic shopping cart, then the items ordered need to be in the querystring every single page, even if the customer is say, reading the privacy policy. Also, it's all gone if the user, say, types in a different web page on your site manually.

                    The other way of using it is for holding a GUID from a DB, but then, you're looking at a lot more DB hits.

                    With sessions, as long as your webserver cleans 'em up, and you have enough memory in the webserver, it's a pretty good performance option, plus, you don't have to deal with the headache of rebuilding the querystring every page.... Or shit, I just thought of that... if you're doing a form submit, then you have to dynamically make a hidden field for everything in the querystring and submit the form normally. Ugh. Nasty.
              • Not only do they need to 'log on', but they need to keep logging on (like fark) or have their log on tied to an IP address. For huge sites this becomes a major headache, as it requires HUGE Databases of pointless information.

                Really, why should I have to store gigs of data so that people can chose what background color or what kind of porn they want to see when they visit my site?
        • I've written Web tracking software in the past and for the most part, I don't care ...

          Someone profiting by violating privacy, dosent care about privacy. Yep thats pretty much the problem with things right now

          • Well, actually, I felt the same way before I had that particular job (or I wouldn't have taken it; this was during the boom when tech jobs were growing on trees.) Maybe there's a causal relationship but it goes the other way.

            And it's not that I don't care about privacy. I close the bathroom door same as anyone else. I just don't have an expectation of perfect privacy in certain contexts, and Web surfing is one of them.

            "Information wants to be free" is a double-edged sword -- every one of us is an information source as well as a consumer.

            David Brin's "The Transparent Society" [amazon.com] has a good treatment of the issues, and I agree with most of what he has to say. Unless we put a stop to the development of information technology, the trend will be toward easier and more frequent gathering and wide dispersal of information, be it music, your surfing habits, the campaign donors of your favorite congressman, or next week's weather forecast. With the arguable exception of cryptography, just about every segment of the computer industry is devoted to increasing information flow. I believe that's a trend that ultimately results in far more good than harm. Which isn't to say there's no harm, but I don't think it's ever been possible to pick and choose the side effects of technological advancement.

        • I see that as a slippery slope leading nowhere.

          The slippery slope will lead to profiling agencies, much like credit reporting agencies, who sell your profile to employers, landlords, lawyers, law enforcement, and anyone else who wants to make a decision about you.

          they just don't care. I'm a geek who understands the tracking that goes on (I've written Web tracking software in the past) and for the most part, I don't care.

          This is one reason the Electronic Privacy Information Center argues that P3P is not a privacy enhancing technology [epic.org]. Websites will eventually demand that you reveal everything, or they won't let you access the site. If people don't care, they will comply. The end result will be like cookies (only with your name, age, address, and other personal data attached). Handing your full identity over to every site you visit will simply become the de facto standard.

          • The slippery slope will lead to profiling agencies, much like credit reporting agencies, who sell your profile to employers, landlords, lawyers, law enforcement, and anyone else who wants to make a decision about you.

            It will lead to that?

            I agree it might lead to that, though even then I'd remain skeptical of the negative impact; the implicit assumption is that any of those people will give a damn what I'm doing on the web. Some might, but then some landlords and employers already care about things they have no business caring about, so this is hardly a new threat. There are already laws on the books saying they can't refuse to hire me or rent me a room based on irrelevant information.

            More fundamentally, though, are you saying we should forbid people from exchanging information that could have harmful uses? To me that's the slippery slope; that way lies draconian DRM technology and the laws to back it up ("you might pirate our movies") not to mention simple censorship.

            If people are free to exchange information at will -- which is something I believe in -- there are consequences that cut both ways, and to me, at least, it's next to impossible to retain the good consequences while eliminating the bad ones.

            But we do agree, at least, that P3P isn't all it's cracked up to be. I think for a lot of site maintainers it's no more than "that thing I had to go read up on to get IE6 users to stop complaining that my site was forgetting their login names between visits."

    • Re:Why? (Score:2, Insightful)

      by dolo666 ( 195584 )
      Agreed. Most un-geek people know there are dangers that go with the internet, and most of those people have a very superstition-based understanding of computers.

      You should see how superstitious the people I know are when it comes to computers. I can't count the number of times someone has donned a panic-stricken look on their face when I told them something was wrong with their computer, the network or servers. They don't understand that it's my job to FIX the problem. Instead they panic, thinking the sky is falling.

      You have to be soooo careful when you talk about computer problems with some people.

    • Re:Why? (Score:4, Insightful)

      by md17 ( 68506 ) <james@@@jamesward...org> on Saturday November 09, 2002 @11:37AM (#4632111) Homepage
      Users may not care, but businesses care when people can not use their web site, because someone has their browser privacy setting high and they are not accepting cookies without P3P. The first time I implemented P3P it increased online ordering by about 5%. Most end users don't realize that a shopping cart doesn't work correctly because their browser is denying cookies. They simply get frustrated and go to another site. But when businesses realize that P3P is an easy fix, there is really no question about whether or not to use P3P.

      <rant>
      It really bugs me when people start bagging on P3P and saying how crappy it is. Why don't you do something about it? Right now P3P is the best privacy standard out there. Until someone comes up with something better, lets use it!
      </rant>
      • Most end users don't realize that a shopping cart doesn't work correctly because their browser is denying cookies.
        so.. why do you use cookie?
        • ...if, for example, a user orders something on your site through a NAT firewall, say from a university dorm or something. Now supopose another student on the NAT happens to go to your website at the same time. If you are tracking by IP, these two appear to be the same user (due to the singular IP of the Internet gateway both of them share), so, essentially, you have just given full access to your customer's account to an unauthorized party, which of course, is a Very Bad Thing.

          This can also apply to home users, or businesses, or anywhere else a NAT is set up. Uh-oh.

          Throw some cookies in there and now suddenly each users request becomes uniquely identifiable, and although not entirely secure, it certainly is much more difficult than "accedentally."

          • Re:Why Cookies? (Score:3, Informative)

            by zsmooth ( 12005 )
            The alternative to using cookies is not tracking by IP address, but passing some session variable around every request. Yes, it's a pain (unless you use a framework that will handle it for you). Yes, it doesn't always work. I don't know of ANY web developer that would even consider tracking someone based on IP address, for the reasons you stated.
            • Hmm, yes I didn't think about that. Good call.

              Implemented simply with a GET request which has some kind of ID number in it. Essentially, though, Cookies are just a more sort of hidden way to do this.

              Whenever I see one of those absurdly long URLs with all kinds of session info in it, I wonder why the developers couldn't just use a little JavaScript and an <INPUT TYPE=HIDDEN VALUE="whatever">. When you click on a link, instead of using the HREF, use an onClick="go('thisLink.html')", where the go() function will set the appropriate hidden form values and use a form.submit(). The server will parse all nessesary info, including session info, from the POST request, and redirect or dynamically generate as nessesary. Of course, if the user takes action on an <INPUT TYPE=SUBMIT>, this becomes quite trivial.

              Of course, that's a lot of trouble for the same functionality you get from cookies, and in some situations (depending on implementation) could be a little too trusting of the end user as well... I never understood why people where bothered by cookies in the first place.
              • The same people that shut off cookies also shut off javascript - often shutting off javascript INSTEAD of cookies. The only real option is to put everything in the URL, which is damn ugly. Also, imo, increases the chance that someone will try to play around with the session ID in the URL, simply because it's there.
            • You can also use the SSL session key as a identifier. Of course, that requires the entire session to be encrypted, which is not practical in most situations.

      • Re:Why? (Score:1)

        by Dion ( 10186 )
        Well, if you add:
        P3P: CP="IE You suck ass and so do your users!"
        or something similarly content-free, then you are not really using P3P, you are only working around a misfeature in IE.

        Personally I find it annoying that IE has started to demand a P3P header just to work normally.

  • Who do the W3C think they are? (Score:4, Funny)

    by Angry White Guy ( 521337 ) <CaptainBurly[AT]goodbadmovies.com> on Saturday November 09, 2002 @11:19AM (#4632054)
    Who are they to tell us how to run the web? You'd think that they were a big group of people who pretty much invented the web by the way they act.

  • P3P is required (Score:1, Interesting)

    by Anonymous Coward
    Well, my issue with P3P was that my shopping cart, that is cookie based, stoped working on some IE6 browsers. It ends up that IE6 will not accept cookies from any server that does not use P3P compact headers when set at certain (read most) security levels. Nice to do, but it would be nice if anyone spoke of it in major forums before it happened. It took days to figure out what was wrong, and more time to figure out that it did not support (or require might be a better term) any form of P3P to operate. It just wanted compact headers. What I really want is some docs to figure out how to generate those headers. I actually had to spend some money to get some firm to generate those for me. I am not happy with this. Any free software to do this? Any good white paper on the subject?

    -GReg

    • Re:P3P is required (Score:5, Informative)

      by Angry White Guy ( 521337 ) <CaptainBurly[AT]goodbadmovies.com> on Saturday November 09, 2002 @11:26AM (#4632075)
      From the p3ptools website...

      3. You should also have a compact policy associated with the cookie itself. This is done by sending the compact policy string of text along with the HTTP header when setting the cookie. The format of this text will vary depending on which web server software package you are using on your site. See Deployment Guide Section 3.1 "Using HTTP Headers" and Deployment Guide Appendix A for a discussion of various implementations.

      The appendix is HERE [p3ptoolbox.org].
      • ... why so few people have implemented this. Our website [pricegrabber.com] actually has one of these thingys -- we just put it up, in fact, because its absence was causing trouble with some IE releases. Wading through the P3P docs to come up with a meaningful XML privacy description document is a non-trivial undertaking. The funny thing is that, IIRC, having this little shred of XML puts us ahead of a bunch of other commercial sites that don't do it.
    • Sure, lot's of software is available to create P3P policies, including compact headers.

      A nice one is IBM's P3P Policy Editor [ibm.com].

    • Re:P3P is required (Score:1, Informative)

      by Anonymous Coward
      There's a good free P3P editor (in Java) available on the IBM alphaworks site ( http://www.alphaworks.ibm.com/tech/p3peditor ) which I used to generate the policy for our site.It was very easy to use - the hardest part was reviewing the generated output with the suits in Customer Service =;)

  • P3P (Score:3, Informative)

    by dolo666 ( 195584 ) on Saturday November 09, 2002 @11:21AM (#4632060) Journal
    There are some papers about P3P HERE [p3ptoolbox.org].

    I think that if it puts spammers, pr0n peddlers and other crooks on the ropes, I'm all for it.
  • we wouldn't use our freaking credit cards, right? I suspect just a few people are making a lot of noise.

    • Huh? I use my credit card (online and otherwise), AND I also happen to care whether or not corporations are illegally (illegal in my country anyway) selling my personal information to third parties. I don't understand what you're trying to say. That using your credit card is somehow proof that you don't mind your personal information also being sold? I don't see how the two correlate.

      • Ultimately this info is purchased so that people can market stuff to you. This is what you hate. Does your CC market other products to you? Do they sell your info? Most do. They know what, where and when you buy. Or is it that you are afraid this is being sold to an evil org like SPECTRE?

        • Do they sell your info? Most do. They know what, where and when you buy

          No, thats paranoid. MOST of the places I've used my CC with, have NOT sold my personal information to anyone. And if they have, they sure haven't given me any reason to suspect that they have - I have only ever received ONE piece of junk (snail) mail that I did not know (for sure, but I have a strong suspicion, and it has nothing to do with my CC) how the company got my info. My main email address I have so far also managed to keep clean of junk (e)mail, just by being careful who I give it to, and creating 'special' email accounts for some places. For example, I use a special email address for Amazon, which has never received anything other than the occasional Amazon newletter.

          I mainly use my credit card for (a) ordering books (mostly from Amazon, but also from one South African online bookstore), (b) Paying my website host, and (c) a few miscellaneous retail/food purchases, i.e. restaurants, or occasionally buying clothes.

          Whats SPECTRE?

          Maybe in the US "Most sell your info", because the law is more corporation-friendly there, but in South Africa it is illegal for a company to sell your personal information without your EXPLICIT, SIGNED (clicking "I agree" does NOT count) and KNOWLEDGABLE consent. That is, they must be able to prove that you reasonably *knew* you were signing over to them the rights to sell your personal info to others. A few places do take chances, because it is usually difficult to find out *who* sold your personal info, but by and large most places are fairly well-behaved around here in this regard. My bank which issued my CC has a strong privacy policy (even though I can say nothing else good about them).

          So no, I'm not "just paranoid" about "evil organizations".

    • I can only agree, p3p is only useful for the paranoids that don't know what they are doing.

      P3P is useless as the untrustworthy sites will simply lie about what they do with the info, so it buys us nothing.

      IE+P3P+Hotmail is an annoying combo, because if you send people a link in mail to a hotmail account M$ think they need trap people in a frameset, neatly displaying "we ownz y00" and keeping people from bookmarking the site they are visting, however the most annoying effect is that it is impossible to get a cookie set in the framed site (so logging in just doesn't work on most sites), without a compact P3P header.

      Luckyly you can just add some garbage P3P header:
      P3P: CP="CAO ADM OUR IND PHY ONL PUR NAV DEM STA"
      and IE will allow the framed site to work normally, it did take a lot of angry users to find that particular IE+hotmail-misfeature.

      In closing: death to IE and hotmail, may they both be taken behind the barn and shot through the head ASAP!

  • The deal with cookies (Score:4, Insightful)

    by stevejsmith ( 614145 ) on Saturday November 09, 2002 @11:26AM (#4632076) Homepage
    Not really on topic at all, but I was always wondering, what's the big deal with cookies!? All they can do is store information THAT YOU GIVE THEM (or that they arbitrarily assign to you)! In fact, you don't even need cookies to do that. You can just do it with Perl or PHP. Yeah, sure, there are some flaws with cookies in IE, but there are flaws with everything in IE! Hell, Slashdot uses them! The media has somehow given them a bad name. Most sites require cookies, and they work quite well, actually. Would you really want to enter your user name and password for every like you click? No, I don't think so. I'll never understand...
    • The problem is they can be used to track you across websites, remember?

      Site A has an ad banner from Banner company X, which serves a cookie.
      Site B also has an ad banner, and company X now knows when you were on site A, and site B.
      Say both are dealing with tools, then company X will be in a perfect position to start profiling you. You have never given them this info consentually, but still they have information on you.
      • But can't you do that in an infinite amount of ways? I can think of two other ways to do that: JavaScript and Apache logs! Using Javascript commands you can see what websites the viewer went to before that. Using Apache you can see what viewer visited what, and then piece it together. Or better yet, use the Javascript in conjunction with PHP/Perl and then every time a user goes to a site with a banner from company X, they get another list of the site's you've visited. Eventually, they'll be able to recreate your entire web experience, especially if it's a big company such Doubleclick. How come nobody has ever made a fuss about the JavaScript commands or Apache logs?
        • You can't access a list of websites a viewer has visited using Javascript. History.back/go/forward are using to navigate a user's history, but the website can never learn that those urls actually are.

          Apache logs aren't viable because companies would have to sift through and parse their huge apache logs in tandem. If they use different log formats or different web servers (some people do use IIS you know, this becomes even harder.

          Two flawed ideas doesn't equal an infinite amount of ways.
          • What about the referrer command? Sure, it only goes back one page, but if you have a banner ad on every page, it gets the job done. And doesn't PHP have some way of seeing what the previous pages were? I think it does, but I could be wrong...
            • The best server logs can do is tie an IP address to a referring URL, which in the case of banner ads, is no new information. (The advertiser has to know what site the banner ad is on so that they can collect their revenue.) This information is probably encoded in the URL itself.

              While in some cases, an IP address might be sufficient to tie one person from one site to another, it can neither be trusted to be persistent nor unique. Users may be re-assigned a new dynamically-allocated IP address from one hour to the next, and multiple users may share a single HTTP proxy (or NAT system). How many AOL users share a common set of HTTP proxies?
      • The problem is they can be used to track you across websites, remember?

        Then deny cookies from third parties. Even IE can do that.

        You can even use IE's P3P support to check their privacy policy and allow them to set cookies if you agree to it.

        Cookies are fine. Cookies are the only sensible method of tracking state across the web, be that simple user logins to web applications. The alternative is just as easily leaked URL-encoded session information, and you can't reject that automatically.

  • good privacy... (Score:2, Insightful)

    by Anonymous Coward
    ...comes with good ethics.... good ethics comes with good motives... good motives comes with epathy and understanding. All branches are limbs of the same tree - problems within a society are the dysfunction of that society. Change the society and things like this would not need to be discussed; they'd be a forgone conclusion.

  • New version? (Score:1, Funny)

    by 3141 ( 468289 )
    I'm quite happy with P2P, though I might upgrade when P3.11P comes out.
  • As far as I can tell, even Slashdot, the bastion of privacy (paranoi) isn't using it either. Tough to advocate something that you don't do yourself, huh?
    • Slashdot is not a single entity.

      Slashdot doesn't use well standardised XHTML/CSS, either. Nor does Slash, the code back-end, use many good programming principles that any Slashdot editor and most users would advocate - or at least so I've been told. Nor do a great many Slashdotters use an open-source OS (remember that poll about operating systems a while ago, some people still have the more shocking parts of the results in their sig)

      Ergo, saying "Slashdot is not using it" is not saying much at all...

  • Useless idea (Score:3, Insightful)

    by woogieoogieboogie ( 598162 ) on Saturday November 09, 2002 @11:32AM (#4632097)
    The flaw in P3P is that it assumes people have preferences in these matters. Most people simply do not care. For those who do care, it is even more flawed because nobody has the will power to avoid their favorite websites because of disagreements over the sites privacy policies. How many Slashdotters would quit using Slashdot if Slashdot needed to sell some customer information to stay afloat?

    It is a solution looking for a problem

  • At my company, we have a corporate website and individual portals for our clients, all of which implement P3P. It's essentially mandatory, once your customers start using IE6. I would prefer to have the customers abandon M$ entirely, but most can be expected to follow the path of least resistance, which means IE6 more often than not.

    Many (15%?) people set their "cookie security" to "high". This makes cookies fail on all non-P3P websites, causing all kinds of application misbehaviors. So we either have an inconvenient/hard-to-follow set of instructions about enabling cookies, or we set up P3P on the server side. In our case, we never share or cross-market our client data with anyone, so P3P is administratively simple as well.

    On the other hand, I don't see what stops the sleazier companies from simply lying about privacy via P3P. After all, these are some of the same people who sell everything you do to Doubleclick and quietly switch your privcacy preferences to "yes, spam me" (hint: 4-letter auction site; starts with "E"). What's another lie when there is direct marketing revenue at stake?

    • On the other hand, I don't see what stops the sleazier companies from simply lying about privacy via P3P

      This seems to me to be THE major flaw in this idea. The sort of companies who want to gather your personal information and sell it to third parties without your consent are, in most cases, PRECISELY those companies who are are not going to tell they are doing it. If they were at all ethical (*), they wouldn't gather and sell your info to begin with.

      (*) Apart from unethical, in many countries other than the US, it is also outright illegal to do so.

      • Apart from unethical, in many countries other than the US, it is also outright illegal to do so.

        I would view it no differently from a company posting a readable privacy policy on their site saying they don't sell your information. If they sell it, that should be against the law.

        At a minimum, one might assert that the privacy policy is part of a contract I'm agreeing to by providing them with my personal information. If I provide that to them because they lied in their privacy policy, I might have grounds to sue.

        I'd be interested in a real lawyer's take on this..
    • The biggest IE6 issue with privacy is not the P3P requirements that only happen on 'High', but the 3rd party cookie blocking that happens on medium. It's there to stop Doubleclick, et al, but it wreaked havoc on an application my ex-employers were offering as framed content for other comany's web sites. Again, no warning from Microsoft that the rules of the game were changing.
      • I blame Doubleclick for this, at least as much as Microsoft. Thanks to Doubleclick, it was inevitable that the browsers would become hostile to 3rd party cookies. M$ simply did it first.

        Considering how little IE does to suppress popups and other crap, it's odd that M$ suddenly decided to declare war on 3rd party cookies.

        It never occurred to me that there could be a non-marketing application for 3rd party cookies, so I don't mind having IE ditch them.
  • The sly part is Microsoft implementing P3P without telling anyone. Session management across the web getting slayed, and developers left slack jawed in frustration as to why.

    I'm for self-regulation. P3P is self-regulation. I think it's a good idea...but only when everyone knows about it!

  • Too Complex? (Score:3, Insightful)

    by smd4985 ( 203677 ) on Saturday November 09, 2002 @11:52AM (#4632153) Homepage
    i'm not overly familiar with p3p (p2p i understand ;) ), but my ex-girlfriend has a website devoted to viewpoints on p3p (http://www.p3p-viewpoints.org/). from what i understand, the major issue with p3p is that it is overly complex. some user studies have shown that users don't effectively understand what p3p means or how it affects them. more info at the website...
    • I agree with this, but just as much from the server side as the client side.

      If every Joe Website has to spend a half-hour either reading through the formidible XML specification, or filling out 16 pages of a web application to generate a P3P policy, nobody is going to do it. The "compact" policy is a step in the right direction, but still either requires a significant amount of up-front investment reading and learning P3P or the same 16-page online P3P generator process.

      It's annoying, especially when your site doesn't really deal much with user data. Why should I spend so much of this time just to document the fact that yes, I collect HTTP server logs, and yes, I run them through a log analysis system?

      For the users, it's the same. For those that bother to look at their browser settings, in IE it's just "low", "medium" or "high". If the setting looks OK, that's what they pick. But then things break for them and they don't know why, and that trivial privacy setting turns out to be a little more restrictive than they really care about, so they set it lower or turn it off.

      The vast majority of people just don't care, and those that do care find that few web sites volunteer their privacy information with P3P anyway, except those that make a business out of tracking people with cookies. They almost certainly have P3P policies already, but who knows if they're truthful or accurate?

  • We had to... (Score:2, Informative)

    by neosiv ( 320921 )
    My company's website needs cookies enabled. So a week ago when we ran a survey all of a sudden all of our IE 6 users were not working at all. We had no idea of why these users could not get through other than that they had IE 6 and their cookies were not enabled. We searched the web for any signs of this and yet still nothing. It wasn't until one of our employees looked at the IE site and saw the section about P3P that we figure out what was wrong. Essentially all our cookies were being rejected by IE 6.0 because we did not have a P3P policy.
    The next day we created a policy and haven't had a problem with IE 6 cookies since. Sad but true. Any site that relies on cookies are going to need a P3P policy.
    • ..write a script to gently but firmly ask politiely that your visitors arriving using IE would have a better and more secure "total internet surfing experience" if they "upgraded their browsers" to "a better one" then provide some links to them.

      Like, why keep taking it and taking it and taking it and taking it? Don't insult them, just show them a different thing that's "better" for them. Most people just slap don't know, the "internet"is "windows and explorer" because it came with their new conpooter and "microsoft" somehow "owns" the internet. We have to do everything we can to get this brainwashing reversed..
  • > Then why isn't there much enthusiasm for P3P
    > support in browsers?"

    When I care about a site's privacy policy (and sometimes I do) I read it myself. I'm not about to trust my browser to tell me it's ok. When I don't care, I don't care. What good is P3P to me?

  • P3P is flawed (Score:4, Insightful)

    by zachlipton ( 448206 ) on Saturday November 09, 2002 @11:59AM (#4632173)
    Part of the reason why the adoption of P3P has been so slow is that it may actually make privacy problems worse.

    The problem is that users (and perl programmers) tend to be lazy. And lazy users check the little "this is the default setting so stop showing me dialog boxes" checkboxes in order to make things easier for them. The problem with this is that with P3P, a website can "claim" to not sell/rent your email address, but because the user set their default options to accept that, their address is automatically sent to the website and they don't have the opportunity to consider the implications and evaluate it themselves.

    Also, P3P is a total PITA to write and the one editor that I know of (free from ibm) seems to be long since dead (and downright confusing too). It can also open companies up to legal trouble since a discrepency between a P3P file and the actual practices of the website could be grounds for a lawsuit (IANAL).

    • Re:P3P is flawed (Score:5, Insightful)

      by Jon Peterson ( 1443 ) <jon@@@snowdrift...org> on Saturday November 09, 2002 @12:16PM (#4632259) Homepage
      That pretty much sums it up. It's a complete pain to implement. Getting your management to sit down and write (and sign off on) a decent privacy policy is hard enough, but to then translate that into some arcane XML format both difficult and pointless.

      "So, remind me why our extremely clear and readable privacy policy that explains the nuances of medical ethics and the Internet has to be re-hashed into someone elses over-complex set of quasi-technical categories?"

      "It's so that users can simply select from a small number of generic pre-set privacy levels, and let their browser manufacturer tell them whether we take good care of their data!"

      It's a dumb idea. It's a miss-appliance of technology.

  • P3P not that hard (Score:1, Insightful)

    by Anonymous Coward
    I implemented P3P support for our web site at a previous company I worked for.
    P3P isn't that hard to figure out... Anyone who actually reads the W3C docs, and Microsoft's docs on how IE implements P3P, can easily support P3P. And it wasn't a "surprise", Microsoft had been telling the world that IE6 would support P3P from about a year before IE6 came out.
    It took about 1 day to set up and implement P3P on our web sites (some IIS, some Apache/PHP).

    How useful is it? It depends on web sites honestly reporting their information in the P3P info. I'm sure most big legit companies accuratly report their privacy policy in the P3P info.

    But what's to stop some unscrupulous Web site from lying? It's not like it's against the law to lie in your P3P info... Nobody is going to punish you for doing it. So, does it really make the web safer?

  • p3p is not a PET (Score:4, Interesting)

    by ajkessel ( 539491 ) <adam@rosi-kessel.org> on Saturday November 09, 2002 @12:20PM (#4632279) Homepage
    The Electronic Privacy Information Center [epic.org] has published a report on Why P3P is not a PET (Privacy Enhancing Technology) [epic.org] (PDF file). It's worth a read as it challenges a lot of the justifications and goals of P3P.
    • The Electronic Privacy Information Center has published a report on Why P3P is not a PET (Privacy Enhancing Technology) [epic.org] (PDF file). It's worth a read as it challenges a lot of the justifications and goals of P3P.

      In the report, the Vice President of Sales at iVillage complains that because of P3P; Internet Explorer incorrectly mislabeled the privacy policy of iVillage as inadequate. (Page 5, first paragraph in the PDF report [epic.org].)

      Well, their privacy policy [ivillage.com] *is* inadequate. Their policy is too freeeeaaakking long. It's nine pages long and contains three thousand seven hundred words. I am not going to read that every time I discover a new web site.

  • Some Resources (Score:5, Informative)

    by maggard ( 5579 ) <michael@michaelmaggard.com> on Saturday November 09, 2002 @12:33PM (#4632328) Homepage Journal
    Gotta recommend IBM's great little free Java-based P3P Policy Editor [ibm.com] as a fast & straighforward way to create compact polcies.

    Also for folks using Windows IE (the majority) ATT&T offers up their free eternally-beta AT&T Privacy Bird [privacybird.com] which gives folks visual and auditory feedback (both controlled/turned off in Prefs) on site's P3P settings. Quite informative actually, I discovered just how awful Yahoo's policies are when I used their headline aggregator (just who are they selling my newsreading habits to?) [rhetorical question]

    The P3P folks have put together a great website at P3P Public Overview [w3.org] which is chock-full of useful information. On the other hand here is an interesting critique [anu.edu.au] and here another [gigalaw.com], suprisingly both by lawyers. Security guru Richard Smith also has an important (though hopefully now fixed?) page on supercookies [computerbytesman.com] and how MS IE 6's touted protections can be got around.

    Mozilla [mozilla.org] of course supports P3P and it's useful to understand just how MS IE 6 suppports [microsoft.com] and applies [microsoft.com] P3P and cookies [microsoft.com].

    • I'm sure IBM's tool is fine, but it's not free (it's got a standard 30 or 90 day IBM Alphaworks license) and the Installshield installer is unusable on Linux -- it looked through every file on my system trying to find a JVM). I posted a note on the IBM site asking for an update with a workable installer.
  • OK, I run a personal site powered by PHP. I try to keep my site as HTML-compliant as I possibly can, so far everything is fine until I added a Flash header to my site.

    Somehow there is a severe lack of info on how to make Flash codes HTML compliant. I figured maybe I should use the <OBJECT> tag to somehow smuggle the Flash code from an external file.

    OK, end of unrelated rant, now for the P3P thingy. I figured this will be important for my site in the future because I'm considering engaging in e-commerce (very small scale), so what the heck.

    The thing is, the examples of P3P XML files I looked at from various sources always contain sensitive elements like business.contact-info.postal.address (using loosely, I know that it's supposed to be .postal.street, .postal.city bla bla). If I'm a full-fledged business, that info might not be so sensitive... heck, I would want everyone to know the physical location of my business.

    But what if it's a home-based business? I surely don't want customers knowing my home address and dropping in whenever they like, a main reason why I chose to do online business in the first place. So in order to safeguard the privacy of my customers, I now seem to be compromising my own.

    If there is a proper workaround for this issue (without any legal problems), can some intelligent and experienced individual point it out to me? Are all those business.contact-info.* tags required in the first place? It seems that every compliant site have them.

    Thanks in advance.
    • Set up a P.O. Box or use a mail forwarding service.
      Mailboxes etc. has a handy resource for a majority of small business questions. Check it out here. [mbe.com]

      This isn't a plug ( I don't work for them), but your business is their business. Even if you don't use their services, their small business page has great information on it.
    • I declined to put this contact information in my P3P policies and the sites that I did this for validate fine with w3c's validator. As near as I can tell, they don't appear to be mandatory. You might have to read the spec closely to see if that's accurate or not.

      Remember, P3P is just a web recommendation. It's neither a standard nor law. There's nothing legal or illegal at this point about the contents of these policies (or lack thereof), except perhaps if you deliberately lie and say you aren't doing something that you really are doing.
  • As lawyers are likely required to review the privact policy, I believe that the spec is impossible to implement, specifically:
    - the spec refers to 'compact' policy. I have not seen an example of a contract or agreement that would meet 'compact' by any stretch of the imagination.
    - the spec refers to non-ambiguity.I have not seen an example of a contract or agreement that is not purposely ambiguous.
    - statements are positive. What, no 'except', 'subject to', 'contrary to above' ??
    - finally, xml is well formed.
    • > I have not seen an example of a contract or
      > agreement that is not purposely ambiguous.

      You've not seen many contracts, then. Most lawyers strive to eliminate ambiguity.

      Any lawyer who puts ambiguity in a contract of adhesion (which these things are) is a fool. The courts will always interpret such ambiguities in the consumer's favor.
  • Data miners use the GUIDs in these cookies to see
    how often a given user comes back to the site. If
    everybody set their cookies to expire it would drive
    them up a wall.

    Either that or we should all standardize on one MSN
    cookie so we all have the same GUID.
    • Yeah, that's a great idea. You should write an article: How to Be a Complete Web Leech and Screw Over Every Site You Visit For Free!

      I mean really, isn't it *terrible* that web sites might know how often you come back to the site? You know what that leads to, right...? First it's that, and from that, they can figure out your height, weight, favorite food, and even dick size! You'd better protect that privacy at all costs!

  • One problem remains (Score:2, Interesting)

    by thasmudyan ( 460603 )
    I think P3P is a step in the right direction. With tools like this one from IBM every site owner can create his P3P policy very easily. Those policies will help categorize sites and provide a nice filtering possibility.

    Of course one problem remains: since it's entirely up to the site owner, he/she can enter EVERYTHING. There is no way to know whether a particular site stays true to the poolicy it has created. Your data isn't safe just because the one stealing (and selling) it says it is. On the other hand, there is probably no way of verifying stuff like this, so P3P is the best shot we got.

  • What stops me? (Score:2, Insightful)

    by Afty0r ( 263037 )
    "Do you have P3P policies for your website? If not, what stops you from creating one?"

    Return on investment.

    Creating a P3P policy would take alot of my time - I would have to research and learn the format and possiblities of the language, then write the policy, reconcile it with various departments within the company, then finally integrate into the site, and potentially have to deal with questions from confused visitors.

    Implementing P3P on my site would cost me no money, but a great deal of time.

    TIME IS MONEY
  • NO ONE actually believes anything these sites say. They will sell their grandmothers organs for a dime, and we know that if they are violating their policies left and right, nothing will happen. Even if the company says no, as soon as they switch hands or go under that potential capital will be utilized one way or another. The key is successfull obsfuscation on the client side. You can't avoid footprints, so leave HUGE one in clown shoes all over the place, in different ID's.
  • Personally, I had never heard of it. Since I wrote the webserver I am running (replaced Apache), I am pretty sure that I don't currently support it. Might take a look at it though....

    However, Opera aleady allows me to block the popups....

    And, what marketer is going to use P3P when they read this:
    "Imagine that, in an effort to reduce the mail she receives, Cindy has told her browser that she wants to be warned whenever a site says that it will use her information to send her marketing promotions."

    It only helps if those you want to block decide to use it.

  • p3p adoption and tradeoffs (Score:2, Informative)

    by mnot ( 71203 )

    Ernst & Young have a regular P3P Dashboard Report [ey.com][PDF] that summarizes adoption of P3P by large Web sites.

    Privacy is a difficult issue; P3P has been derided because it doesn't do enough (actively negotiate or protect your privacy), because it does too much (intrusion into the browser, difficult to implement) and generally because it's too complex.

    As a result, it's a compromise that noone is 100% happy about, but it does give us something to work with. Standards that try to do everything for everyone almost always fail.

    The W3C is, next week, holding a workshop [w3.org] to look at the future of P3P; I haven't had a chance to read the position papers yet, but the fact that they're holding a workshop shows that they know there's more work to do.

  • P3P means nothing (Score:3, Interesting)

    by cybpunks3 ( 612218 ) on Saturday November 09, 2002 @03:48PM (#4633204)
    Just because there is a P3P privacy policy doesn't mean the policy itself is being truthful or accurate. There is no real accountability or certification of P3P policies, so companies can put any sort of generic boilerplate BS in their P3P policies and as long as there IS one, the browser will accept cookies, etc...

    It can say "oh yeah, we're not selling your information to 3rd parties or anything" when in fact they are. If you trust what it says, then you allow the site to set cookies. You shouldn't be trusting the word of the site itself. It should be a 3rd party certification.

    That's not really protecting privacy, IMHO.

    If P3P policies could be used as evidence in court cases for misrepresentation, then it might force companies to provide more accurate P3P policies, but I haven't heard of any lawsuits coming from inaccurate P3P policies. You'd have to KNOW their policy was misleading in order to take them to court anyway, which is hard to do.


  • There is no external auditing of P3P that I can see.

    I set this up on one website I built, but why? I was able to say whatever I wanted. If my browser acted on this sort of information I would be forced to disable it, since it is not, and cannot be trusted without an external verification.

  • The story and comments here are incorrect.

    Mozilla doesn NOT, in fact, support P3P. It did at one point. Support was removed, because, as I understand it, P3P is "dumb".

    Netscape reincludes it in there releases, but it hasn't been in Mozilla proper for some time now.
  • WC3.exe? 3PvP?

    Am I the only one who read the headline and thought: "Well, I've never had a privacy problem playing Warcraft III 3Player skirmish!"

    Oh, bloody hell. I'm just a game dweeb. Never mind.
  • There is nothing to prevent the web site operator from lying between their teeth in setting a false P3P policy.

    P3P Seal of trust? Good and strong as the weakest link of chain. Just think Thawte or Verisign.

    P3P embedded in Mozilla or IE browsers? Yeah, right. Gotta see the code in order to trust the browser.

    How much trust and confidence does that inspire to "We, the Web Surfers?"

    None, Nothing, Na-da!

  • Mozilla support (Score:2, Informative)

    by Cloud K ( 125581 )
    Quote: browsers like Mozilla/Netscape & Internet Explorer are committed to giving support for P3P

    Mozilla, commited to P3P?

    I refer you to this bugzilla thread:
    http://bugzilla.mozilla.org/show_bug.cgi? id=128639

    which has been going since March. Several people supported P3P, but the people in charge weren't having any of it.
  • Hrm, I take it you can setup a p3p thing in the same way you setup a cookies.txt. Just drop the thing in the right URL?

    Are there any tools out there that let you edit a p3p XML file quickly and easily? I'm to lazy to look up the specs and edit an XML file in notepad right now (and I have other things to do).
  • Aside from the somewhat confusing specification (I have copied a working P3P xml file, and made changes and still can't get it to work "right" in IE) I can't figure out how to make the P3P standard cover our particular case.

    As a "web application" development and hosting company (read: writing and hosting custom shopping carts mostly), I can make a P3P policy that covers our use of the information easily. However, what about the 30+ companies I host for? Do I need seperate policies for each of them? If I write a policy for them, and they don't like it, will they sue me? Even if the policy is true? Can I write one policy for the whole batch and hope that the "good" companies don't sue me for being included with the companies that sell all your information AND your newborn babies for cash?

    Not only that, but the information-sharing parts aren't all that hot... all of them appear to assume that the policy creator/hoster is the "primary" user of information... in my case, I only use administrative access (backups, restores) to the information, its the individual companies who use the personal information.

    I could use "other-recipient", but I have this bad feeling that browsers will balk at that. The definition of "ours" talks about other entities that we collect data for, but it just seems a little shady that way.

    In the end, I suppose I'll wind up having each company create their own.
  • I insisted that we do it for our site (a large financial services company). It's a very large piece of work if done properly, but we're getting there.
  • ...is this really 50% better than P2P? Cuz I'll abort my limewire download right now.
  • Oh, I though P3P was P2P, just cooler! :]

Slashdot Top Deals

If all else fails, lower your standards.

Close