Google Using DoubleClick Tracking Cookies 175
dstates sends news coming out of the letters the House Energy and Commerce Committee sent to a number of broadband and Internet companies about their policies and practices on user tracking. The committee has now made public 25 responses to its queries, and many companies, including Google, acknowledge using targeted-advertising technology without explicitly informing customers. The Committee is considering legislation to require explicitly informing the consumer of the type of information being gathered and any intent to use it for a different purpose, and a right to say "no" to the collection or use. The submitter notes that, while Google denies using deep packet inspection, if the traffic is a Google search or email to or from a Gmail account, Google does not need DPI to see the contents of the message. "The revelations came in response to a bipartisan inquiry of how more Internet companies have gathered data on customers. Edward J. Markey (D-Mass.) said 'Increasingly, there are no limits technologically as to what a company can do in terms of collecting information... and then selling it as a commodity to other providers.' Some companies like NebuAd have tested deep-packet inspection with some broadband providers Knology and Cable One. Google said that it had begun to use the DoubleClick ad-serving cookie that allow the tracking of Web surfing across different sites but said it was not using deep packet inspection. Google promotes the fact that its merger with DoubleClick provides advertisers 'insight into the number of people who have seen an ad campaign,' as well as 'how many users visited their sites after seeing an ad.' Microsoft and Yahoo acknowledge the use of behavioral targeting. Yahoo says it allows users to turn off targeted advertising on its Web sites; Microsoft has not yet responded to the committee."
Solution: Opera (Score:5, Informative)
1. Turn off cookies globally.
2. Turn on cookies for sites that need it by hitting F12 and hitting 'Accept cookes only from the site I visit'.
Done. No more doubleclick cookies.
Re: (Score:1, Funny)
But C is for cookie thats good enough for me.
Solution: Options (Score:5, Informative)
Re: (Score:1, Offtopic)
Re: (Score:2, Interesting)
Well, I wasn't implying that one should switch browsers per se. You're right about the other browsers, except that turning off third party cookies doesn't work the same for IE or Firefox as it does for Opera.
But Opera does give you a finer degree of control. You can actually either set 'Accept cookies only for the site I visit' or you can set 'Accept cookies' for the individual site. From the operawiki.info site cookies entry [operawiki.info]:
If you set the site preference to "Accept cookies", while visiting this domain, in addition to the cookies allowed by the "Accept cookies only from the site I visit" rule, content coming from a remote domain can set cookies for its corresponding domain and subdomains IF AND ONLY IF the remote domain also has a site preference that allows cookies for itself. This means that if you want to allow remote domains while visiting this domain, you need to manually add a site preference for each remote domain and set it to "Accept cookies only for the site I visit" or "Accept cookies".
"Accept cookies" for a site preference DOES NOT cause Opera to behave as if the global is set to "Accept cookies" when visiting the domain. This way you're not automatically getting opted in to remote domains. You have control over what remote domains you want to allow.
This is different then setting unchecking 'Accept third-party cookies'.
Re: (Score:2)
Re:Solution: about:config, not Options (Score:4, Informative)
There are basically two options to disable third party cookies in Firefox 2 versions.
The first would be to disable it manually by opening about:config from the address bar. Search for network.cookie.cookieBehavior and take a look a the value. If it is set to 0 you accept all cookies, 1 means you only accept cookies from the same server, 2 means you disable all cookies. Setting it to 1 has the same effect that the option in the old firefox browsers had: it disables third party cookies.
You could install an add-on as well that blocks third party cookies. One of the many extensions that does that is called CookieSafe [mozilla.org]. This one makes it possible to disable all cookies and allow them only for specific sites (whitelist).
Re:Solution: about:config, not Options (Score:4, Informative)
ESSENTIAL ADD-ONS (Score:3, Informative)
Like others have said, CookieSafe [mozilla.org] and CS Lite [mozilla.org] are like NoScript [mozilla.org] for cookies with the option to allow cookies for a specific site: permanently, for each session or once-off.
I currently use the above extensions as well as Adblock [mozilla.org], Filterset.G [mozilla.org] and RefControl [mozilla.org]. The latter set to "forge" (send the root of the site as the referrer).
I consider these the essential privacy/security add-ons for Firefox. I'm interested if anyone has any others to add to the list.
Re: (Score:2)
Re: (Score:3, Interesting)
I use:
Firefox 3 has it (Score:2)
At least, I think I found it. [imageshack.us]
Re: (Score:3, Informative)
An even better option is the Cookie Button extension for Firefox. It is basically a shortcut to add and remove sites from the exceptions list for cookies. That way you can set Firefox to accept but clear all cookies when closed, except those you elect to keep (to stay logged in to forums etc).
This protects your privacy by preventing tracking over sessions, while screwing things up for advertisers. It would be even better if there was some way to delete cookies over an hour old automatically, as that would p
Re: (Score:2)
The difficulty is in generating the bullshit data. You could just scramble the user ID in the cookie, but really you want to feed them lists of bullshit sites.
Re: (Score:2)
Or use Firefox, uncheck accept third-party cookies, and get the Permit Cookies extension so you can allow cookies on a site-by-site (even internal to site) basis and allow them for a sesson or persistent.
IF your browser handles 3rd part cookies properly (Score:3, Informative)
Not all versions of major browsers behave the way you expect them to when you try to disable third-party cookies.
Check out Steve Gibson's cookie forensics page [grc.com].
Here's a neat browser stats page [grc.com] showing graphically how GRC visitors have their 3rd party cookies configured by browser.
Re: (Score:2)
Comment removed (Score:4, Informative)
Or use the big hammer (Score:2)
You'd better turn off Javascript too (Score:2, Insightful)
That's not only overkill, it's annoying. Just do the "Accept cookies only from sites I visit" part and be done with it.
Besides, disabling cookies hardly stops them from tracking you. They could still hit you with a doublescript.js, which can be much more invasive than a cookie. Their server could glean your browser history based on link color, [mikeonads.com] instead of just track you around affiliated sites. And most doubleclick site already drop doubleclick javascripts on you for banner rotation. All doubleclick h
Re: (Score:2)
Why is this news? (Score:5, Insightful)
Did anyone really believe Google wasn't doing this?
Re: (Score:2, Funny)
This is an outrage! My advertising is relevant!
Re: (Score:2)
Both funny and insightful. I certainly don't mind seeing advertising if it's relevant to my interests.
I've learned about the existence of many things that I would have missed out on without targeted advertising through channels I trust, such as internet retailers I frequent (Newegg, Tiger Direct, Amazon), gaming news sites and webcomics (Penny Arcade), and mailing lists that I subscribe to.
If Google is tracking my browsing habits so they can better advertise to me, I say more power to them. This is after a
Re: (Score:2)
Right. This law is enforceable and useless.
The solution is a campaign to educate the general public that "Everything you do online can be monitored, copied, shared. And that includes all date you enter, all sites you visit, all clicks you make, etc."
Re: (Score:3, Interesting)
I noticed that the download of slashdot webpages would be delayed by some strange link to
http://www.google-analytics.com/ga.js [google-analytics.com]
http://www.ad.doubleclick.net/adj/ostg.slashdot/yro_p1_leader;logged_in=1;dcopt= [doubleclick.net]....
You can check this by clicking on Adblock in Firefox.
I do wonder if this allows doubleclick.net to see past "anonymous coward" postings.
Re: (Score:2)
It's not?
"The Committee is considering legislation" (Score:2, Redundant)
Translation: "better start donating to our campaigns."
Cynical? Yeah, I'm cynical. You don't get as old as me without being either stupid, cynical, or both. My bet is the legislation will either die in committee, or be watered down to the point of meaningless, or voted down.
duh (Score:1)
But But ... (Score:1)
Re: (Score:2)
Lessons in Googlespeak:
"Google does it" == "Not Evil."
Re:But But ... (Score:5, Funny)
>> their motto is "Don't be evil"
...where "don't be" approaches "be" for some values of evil.
Re: (Score:2)
why would they NOT use doubleclick's cookies? Did you think they paid $LARGEAMOUNT for doubleclick just to shut them down?
"$LARGEAMOUNT" = /s/\/d/$PUREEVIL/;
It's alright (Score:2, Funny)
And slashdot uses doubleclick & google-analyti (Score:5, Informative)
And slashdot uses doubleclick & google-analytics as well.
Try disabling scripts with firefox "noScript". I think /. is more readable without allowing doubleclick.net & google-analytics.com
Re: (Score:3, Informative)
127.0.0.1 google-analytics.com
in our hosts file...
Re: (Score:3, Informative)
Don't forget these, too:
127.0.0.1 www.google-analytics.com
127.0.0.1 ssl.google-analytics.com
While you're at it:
127.0.0.1 doubleclick.net
127.0.0.1 www.doubleclick.net
127.0.0.1 ad.doubleclick.net
127.0.0.1 ads.doubleclick.com
127.0.0.1 ads.doubleclick.net
127.0.0.1 ad2.doubleclick.net
127.0.0.1 ad3.doubleclick.net
127.0.0.1 ad4.doubleclick.net
127.0.0.1 ad5.doubleclick.net
127.0.0.1 ad6.doubleclick.net
127.0.0.1 ad7.doubleclick.net
127.0.0.1 ad8.doubleclick.net
127.0.0.1 ad9.doubleclick.ne
Not a problem (Score:4, Interesting)
Ahem. STOP SPENDING MY TAX DOLLARS ON THIS CRAP.
Anyone using a computer who doesn't understand why they shouldn't accept all cookies and scripts and click on everything shiny deserves (yes, really!) to have their actions remotely monitored and the resulting data sold to the highest bidder.
I don't want to drown in regulation just because some idiots can't be bothered to pull their collective head out before they use their systems.
Mod parent up (Score:1, Redundant)
n/t
Re: (Score:2)
1)ISP gives you a static IP
2)Monitor all traffic to/from said IP address
3)Sell for profit
That would be OK with you?
What if they also decided to block any and all encrypted traffic?
Re: (Score:2)
What if your ISP just starts to monitor all your traffic by IP? Do you have any reasonable expectation of privacy on the internet?
1)ISP gives you a static IP
2)Monitor all traffic to/from said IP address
3)Sell for profit
That would be OK with you?
Yes, it would.
Or better: yes, it is.
What if they also decided to block any and all encrypted traffic?
No, that's not OK, but at least I would know about it.
New Motto: (Score:1)
Ummm (Score:5, Insightful)
Re: (Score:2)
Or just not accepting any cookies at all from Google or Doubleclick.
A missprint in its mission statment. (Score:5, Funny)
"Don't Do Eval". not "Don't Do Evil". The guys at Google wanted to make sure all the employees wouldn't use the eval command to create possible security holes by executing string.
Opt out if you're worried (Score:5, Informative)
Google makes it easy to opt out of the doubleclick tracking cookie:
http://www.google.com/privacy_ads.html [google.com]
"Anyone may opt out of the DoubleClick cookie (for both the Google content network and DoubleClick ad serving) at any time by clicking the button above."
Re: Opt out if you're worried (Score:5, Informative)
Or you could put doubleclick.net & google-analytics.com in your hosts [someonewhocares.org] file and point the entries to 127.0.0.1 The advertisers still don't get it, intrusive adverts like on television don't work on the Internet
Re: (Score:2)
Re: (Score:3, Interesting)
The problem is, a disturbingly small amount of information is needed to distinguish you from ever
Conservative figures (Score:2)
Not really. I was intentionally taking conservative numbers, and focusing on the amount of information conveyed by the value (rather than the amount required to store it).
I think you mean 0..63, which is the same as saying 6..69, which gives reasonable coverage of 99.9% of the internet using population. But really, the information content is s
Re: (Score:2)
The point is, I don't have to. I just prosecute you both for the (alleged) DMCA violation, or Guantanamize you both for (allegedly) being a danger to The Homeland, or whatever.
The point of the Evil Bit meme is that you can't build an accurate, effective solution to a fundamentally sociological problem with just technology. But there's
Re: (Score:2)
It depends on how they are aggregating the information, and with whom. If you give any of this information to sites you visit it could be tied together and used to identify you, even if no one site has enough information to do so. And it wouldn't be a concern if there weren't
Re: (Score:2)
Actually, for me http://0.0.0.0/ [0.0.0.0] goes to my Ruby on Rails server running on my computer as well.
Netstat shows it listening for any requests on (I assume any interface, loopback or other):
What is a good "really do not ever request this host" IP? Negative numbers?
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
A useful link.
Funny thing is that when I clicked on Opt-out I got the following error:
Apparently their opt-out i
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
While true, that's actually bad advice. Opting out shouldn't be considered viable for much of anything on the web because it generally depends on adding or setting an opt-out cookie.
So the opt-out cookies are gone when your browser clears all cookies on quitting (it SHOULD be set that way to help cope with other cookies) or you clear all cookies manually. So opting out is pretty much useless. If they were serious about doing something to help, the default (no cookie) behavior would be opted-out, and you'
not a problem .. (Score:2)
Which cookies to block? (Score:1, Interesting)
I used to always block doubleclick cookies. I'd hate to lose all my stored google cookies, so which ones do I need to block?
I can turn off targeted advertising... (Score:3, Informative)
...With or without Yahoo's option.
AdBlock Plus [adblockplus.org]
Block all cookies by default (Score:3, Informative)
In this day and age, just block all cookies by default, and allow ones from sites you use. This will even block "doubleclick" cookies as those aren't from the site you are visiting.
This doesn't address IP address, but it is a step.
Privoxy or a Blocking hosts file is your friend. (Score:2)
Honestly, I dont care about the legit uses anymore this stuff is so out of hand that I am helping lots of people non techy and techy alike to install blocking hosts files and privoxy on their home computers to eliminate this crud.
Friends dont let friends surf the net without adblocking.
Use CS Lite if you're using Firefox (Score:3, Interesting)
CS Lite [mozilla.org]
This will let you block all those types of cookies, and as well give you MUCH better cookie management in Firefox. It lets you just deny cookies globally and just enable them for sites you want, without being a total pain in the ass
Combine that with Adblock Plus, with the tracking filters, and you can get past all this tracking stuff without having to use no-script, which considering how javascript heavy most sites are today, is like swatting a fly with a sledgehammer
DFP (Score:2, Interesting)
Disingenuous much? (Score:4, Insightful)
I find it ironic that this government, who greedily gobbles up vast volumes of data at every opportunity, would be barking up this tree.
Re:Disingenuous much? (Score:4, Insightful)
"Do as I say, don't do as I do".
It's not just for religion anymore.
Re: (Score:3, Informative)
The US does not have a parliamentary form of government. The adminstration (the "government" in European parlance) is distinct from the Congress, which is what is holding these hearings and is controlled by the opposition.
Re: (Score:2)
Not the same (Score:5, Insightful)
Google's targeted advertisements seems reasonable; When you decide to use their free services, you should know that advertising is a part of the deal.
Broadband providers using DPI, on the other hand, is like the USPS opening your private mail and then profiting off of what they learn about you. It's all about the expectation of privacy. Broadband providers need to transfer bits and stay out of the content business. If they start doing this, there will be no way to use the internet with any modicum of privacy.
Re: (Score:2)
there will be no way to use the internet with any modicum of privacy.
Let me fix that for you:
there will be no way to use the internet with any modicum of privacy, apart from SSL.
And Doubleclick doesn't need DPI either... (Score:5, Informative)
You see, they don't just get the cookie, they also get the referrer field, so Google doesn't just get to see that it is "Nicholas Weaver" who's surfing the web, but can see that I am composing a reply to this article, because the referrer field in the doubleclick adds and google analytics on slashdot allow them to know this!
Re: (Score:2)
Just block the referrer field using a firewall (assuming it has that option).
Re: (Score:2)
That breaks some sites -- no I don't particularly want to debate how retarded relying on any user supplied info is.
Just use Firefox with RefControl [mozilla.org] set to "forge" (send the root of the site as the referrer).
See my other comment [slashdot.org] for more privacy/security add-ons.
DoubleClick?? DENIED! (Score:1)
Evil... (Score:4, Insightful)
Obvious? (Score:2)
The submitter notes that, while Google denies using deep packet inspection, if the traffic is a Google search or email to or from a Gmail account, Google does not need DPI to see the contents of the message.
Google can read your Gmail? Shocking! Who doesn't know this?
Tinfoil hats are the way to go (Score:3, Insightful)
This isn't news to me. I proudly wear a tinfoil hat and therefore have always assumed Google and every other search engine does everything technically possible to track my internet usage. And I behave accordingly. Firefox deletes ALL private data each time I close it. I don't do ANYTHING on the Internet that would be upsetting if it were public knowledge.
So, you see, those of us wearing tinfoil hats aren't recluses that hide in the forest and survive on nuts and berries to avoid the grid. Instead, we are people who simply avoid the grid if and when we do want privacy and don't get upset when we get some confirmation of what we've known all along: the grid ain't private.
And as for targeted advertising, everyone's got it all wrong. Targeted advertising is the ONE thing that I DO want them to track me for. After all, seeing ads for things I might actually want to buy rather than crap I don't want is a Good Thing. Targeted Advertising IS consumer friendly. It's feeding the data into health insurance eligibility and credit scores and potentially inaccurate data into legal proceedings that's scary.
So everyone needs to stop worrying about advertising and start demanding that congress pass a law stating that if a company collects information about you and shares it with a third party without your explicit consent, that information is considered "public" in that it can count towards liable claims. Don't worry about what they share. Worry about your right to sue them if sharing the info causes you harm.
Re: (Score:2)
And as for targeted advertising, everyone's got it all wrong. Targeted advertising is the ONE thing that I DO want them to track me for. After all, seeing ads for things I might actually want to buy rather than crap I don't want is a Good Thing. Targeted Advertising IS consumer friendly. It's feeding the data into health insurance eligibility and credit scores and potentially inaccurate data into legal proceedings that's scary.
So everyone needs to stop worrying about advertising and start demanding that congress pass a law stating that if a company collects information about you and shares it with a third party without your explicit consent, that information is considered "public" in that it can count towards liable claims. Don't worry about what they share. Worry about your right to sue them if sharing the info causes you harm.
Hear hear! I think this every time someone goes off on someone doing targeted advertising. "Oh noes they might show me something I want to buy, whatever shall I do???" If its done in a non-intrusive, and non-prejudicial manner, and its based on the current session, then its better then getting random crap like broadcast television.
Re: (Score:2)
"targeted"? Don't make me laugh.
The idea of "targeting" is that an ad matches e.g. 2 people in a 1000 instead of 1 person in a 1000. A 100% improvement that means the ad is still a complete waste/theft of time for 99.8% of the population instead of 99.9%.
Mass market advertising is based on the premise that it's okay to steal lots of people's time to make one sale. The only difference between spam and mass market advertising is degree.
---
Advertising pays for nothing. Who do you think pays marketer's salari
Re: (Score:2)
Re: (Score:2)
Oh, I'm sorry that the exact wording of a slashdot post isn't specific and clear enough to go directly into law. Perhaps I meat Congress should do it's job and pass a law that DOES protect consumers by giving them legal remedies, the details of which should be worked out by our duly-elected officials.
Of course, I fear you're right. Any attempt to pass such a bill would probably end up, like CAN-SPAM, as something that does the exact opposite of what the average citizen would expect it to do.
Anyway, I just t
An observation (Score:4, Insightful)
Maybe it's just me, but has anyone else noticed the pattern of a roughly daily "Google invades your privacy" story?
I'm not saying they're accurate or not: for all I know it's just an astroturfing campaign. It's just a significant trend around here.
Re: (Score:2)
Re: (Score:2)
Everybody hates a goodie-two-shoes. The "don't be evil" slogan creates too much cognitive dissonance in the minds of people who believe, with 100% conviction, that corporations are inherently evil. "Google ate my privacy" is thus a great angle, even though it's not really backed up by reality.
Trivial example - try and find three people in the whole world who have had their lives seriously worsened by some personal information Google has released.
Re: (Score:2)
Why is this method bad? (Score:1)
If they want to do this to improve targeted advertising, go ahead. I'd rather targeted advertising than random advertising since no advertising isn't an option.
Re: (Score:2)
I'd rather targeted advertising than random advertising since no advertising isn't an option.
I suggest you refer to several of the above posts, and perhaps to a Google search on the subject. (Virtually) no advertising certainly is an option.
Re: (Score:2)
The GP is not talking about it being "an option" for the companies. It is an option for technical people who can get around advertising with minimal effort. If you're going to be a geek then there's no reason for you to suffer along with the masses.
Re: (Score:2)
You might not care, and Google might not care, but others may very well be interested, and that is where the privacy concerns come in.
Imagine instead if you were doing a search on terms like "boxcutters", "American Airlines R&D" and "how to speak Farsi". There are quite a few entities out there
Full Disclosure. (Score:2, Insightful)
Re: (Score:2)
Why would you need to use a different search engine? Theirs works fine without any cookies or scripts.
But isn't Google already opt-in? (Score:3, Insightful)
Isn't DELIBERATELY having all your email intentionally sent to Google, about as opt-in as things can get? We have known all along that Google reads the email that the users opt to have sent to them.
I am starting to really get pissed off at the weirdo "modern" privacy movement. It used to be that we worried someone was watching us. But now we're taking active steps to push our "private" information into other people's faces, while still expecting them to not pay attention to what we are giving them. It's starting to get really absurd.
The first step to protecting your privacy isn't to regulate the spies. No, the first step is to stop cooperating with the spies. If you won't take that step, then your privacy obviously doesn't mean jack shit to you, so quit crying to the government to do something about it.
Stop sending I-looked-at-this-webpage packets to doubleclick. Stop sending your private email to Google, and stop sending your search requests to Google. You are giving them this stuff. You fucking opted in.
Dear Slashdot: Any good alternatives to GMail? (Score:2)
GMail is great so long as you feel you can trust Google. They aren't quite at the point where I distrust them, but they're heading that way, and it's just a matter of time anyway. (And once you no longer trust them, it's too late because they own your old mail.)
So what are some decent alternatives to gmail? I want something independent of my ISP, and it's going to have to be a pay service since I don't want ads. They have to have a decent privacy policy, secure IMAP, and be likely to exist for 5+ years
Re: (Score:2)
I did use myrealbox until Novel dropped them. Last I checked they were being run by some mysterious operation across the border in Canada (with who knows what legal ramifications). That was a while back.
Deep Packet Inspections (Score:2)
"Deep Packet Inspection" is a buzzword from dumbasses who don't understand technology. It means "we had this information before, now we're looking at it." DPI means that rather than forwarding a packet, they forward AND examine it. This is like being handed a clear plastic bag full of pot to deliver to the guy in the next town, and claiming you're not aware of the contents; it's RIGHT THERE if you take a look. No special tools or manipulation of any persons or machines. It's just THERE.
I always thought (Score:3, Insightful)
That people who used Gmail for anything remotely personal are fucking nuts. 5 years, 10 years down the road do you really think that all of your personal Gmail information won't be either a) sold to advertisers, insurance companies, and financial institutions and b) stolen by hackers?
The original Google founders have no idea what a monster they are creating. An essential, and most times helpful monster, but a monster none the less that will someday turn on everyone. I'm looking into only using a proxy for all Google searches, you should too.
I wonder (Score:2)
doubleclick.net TRUE / FALSE 1920499288 id OPT_OUThome
it is the only cookie that loads when my browser starts.
Of course Firefox had to change with 3.0 so I can't read the cookie file now, dumbasses. Why does it have to be sqlite instead of text? It doesn't get saved anyway.
CustomizeGoogle (Score:4, Interesting)
There's CustomizeGoogle, a Greasemonkey script which will, among other things, randomize the replies to Google's cookies. Unfortunately, it's rather slow, and may result in Javascript "script running too long" errors. Right idea, though.