Stanford researcher: Google Circumvents iOS Privacy protection in AdSense ads

http://www.eff.org/deeplinks/2012/02/time-make-amends-google-circumvents-privacy-settings-safari-users

by achille • 14 years ago

102 50 14 years ago

eff.org

drp4929• 14 years ago

Google, what's wrong with you? Do what Path did.

Bud• 14 years ago

Too late to do that. Apple is patching it in the next iOS update.

myko• 14 years ago

You mean they're updating Safari with a patch created by Google engineers months ago to fix the issue: http://trac.webkit.org/changeset/92142

Tyrannosaurs6• 14 years ago

The whole is "Don't be Evil" history thing is asked too often, frequently around things which probably aren't even borderline but this feels a valid case of calling them on it.

Deliberately exploiting a loophole to circumvent privacy controls is scummy behaviour, the sort of thing you expect from the industry's bottom feeders, not from one of the biggest companies in the game and certainly on that professes some sort of conscience.

You can argue its not really evil but it's hard to say its not another step towards that, and this time it seems hard to suggest that it's contractors or some peripheral part of the company.

Symmetry• 14 years ago

I don't see any reason to think that upper management is any less committed to "Don't Be Evil" than they've ever been, and as long as Larry and Sergey are in charge it'll probably remain that way. But the larger a company gets the harder it is to impose that sort of thing on everybody, and the more stupid and random stuff a company will do, and some of that will end up being intentionally or effectively evil. Growing by acquisition rather than organically is probably making it worse than it has to be, too.

Tyrannosaurs6• 14 years ago

Company culture and values always come from the top. If you have an arsehole CEO he or she tend to recruit those with similar characteristics and create a culture where that behaviour thrives. That's repeated at he next level, the level below that and so on.

It may be as little as a shifting set if priorities so don't be evil is less important and other things a little more and with that the cracks appear.

I'm not suggesting that they're now spending their days plotting how to enslave us all but I similarly can't believe that there hasn't been some shift, conscious or unconscious.

brudgers• 14 years ago

>"Deliberately exploiting a loophole to circumvent privacy controls is scummy behaviour"

  If (scummy < creepy){console.log("film@11")};
  else google = evil;

Tracking users is Google's core business. I'd be surprised if they were the only people who have figured out how to do this sort of thing.

Holding Google to some higher standard than other companies is naive at best. Its management has the same duties to the stockholders as any other company.

Tyrannosaurs6• 14 years ago

You're missing the point.

Don't be evil isn't the standard I set for them, it's the standard they set for themselves.

jemeshsu• 14 years ago

Appalled by such a response. There is a thin line between being a fanboy to being a slave.

chc• 14 years ago

Just a helpful reality check (since it's easy to lose perspective when you're outraged): Every site that uses JSONP is deliberately exploiting a loophole to circumvent privacy controls.

eddieplan9• 14 years ago

How so?

Last time I checked, JSONP is a workaround for Single-Origin-Policy. If a site A uses JSONP to consume service from B, then A bets its money on B's good will. I don't see B can steal anything other than A's in-browser data.

draggnar• 14 years ago

What is the answer? Regulations? At some point will the government step in to protect people and their rights?

I know I know.. the services are laid out and people know that their information is being sold. But does that mean it's right? Sub-prime mortgages were legal and led to a disaster. My fear is that not having a set of guiding principals in regard to privacy will result in over-regulation or some other bad scenario.

cpeterso2• 14 years ago

If Google uses security holes in Apple's browser to "enhance" user tracking, what might Google do if they had their own browser?

emehrkay3• 14 years ago

Yeah, I dont understand the Chrome love from the typical "hacker." I personally use Webkit Nightly.

jrockway8• 14 years ago

I use Chromium. That way, I can read the code and still get a really good browser. My analysis is: they only send information back to Google when you explicitly request it.

(But what if Debian ships me a version of gcc that embeds secret tracking code into any version of Chromium I compile? Oh the fear, uncertainty, and doubt!)

RexRollman• 14 years ago

I didn't know about Webkit Nightly. Thanks for pointing that out.

jrockway8• 14 years ago

Google provides a list of what they do right here:

http://www.google.com/chrome/intl/en/privacy.html

shareme• 14 years ago

a question why is no one concerned about the Safari hole in context of Apple?

Seems tome that you have more to worry about in Apple than Google as there many others using the same exact hole.

emehrkay3• 14 years ago

This makes me think that Google had ulterior motives when bundling flash with Chrome. Having the latest, most-secure version of flash is a win for Google, its users, and the web in general, but having flash installed allows for usage of flash cookies which can read your info across browser sessions -- info that they'd probably want.

To Chrome's credit, I believe it is the only browser that allows users to delete flash cookies.

* removes tin foil hat

joejohnson• 14 years ago

Knowing that a large percent of the user base won't use it/know about it, maybe they include the ability to delete flash cookies so that later they can say, "you can opt out at any time!"

eyeareque• 14 years ago

You can delete flash cookies with other browsers too, but you need to visit a adobe site in order to do so: http://www.macromedia.com/support/documentation/en/flashplay...

othermaciej• 14 years ago

You can delete Flash cookies and in fact all data that a site could use to track you in Safari, including plugin-related data, cache, etc.

Just go to the Privacy pref pane and click on Details under Cookies and other Web Site Data. For example, for kongregate.com, I see that I have Cache, Cookies, Plug-ins and Local Storage holding potential tracking data, and I can delete it all with one click.

Nick_C• 14 years ago

I've said this before, but for others who missed it, here's one of my crontab entries:

  # Remove Flash cookies and everything to do with Flash, 
  # including left-over Flash files in /tmp
  15  13 * * Wed  /usr/bin/rm -rf /home/nick/.macromedia/Flash_Player/*
  16  13 * * Wed  /usr/bin/rm -rf /tmp/Flash*

emehrkay3• 14 years ago

Thank you

drunkenmasta• 14 years ago

I'd like to thank Jonathan Mayer and others like him that go through code and find these secrets and then release them for the public good. You make a great difference.

Stanford researcher: Google Circumvents iOS Privacy protection in AdSense ads

Related Stories