From the IE Team: Google Bypassing User Privacy Settings

http://blogs.msdn.com/b/ie/archive/2012/02/20/google-bypassing-user-privacy-settings.aspx

by ecaron • 14 years ago

313 173 14 years ago

blogs.msdn.com

luser001• 14 years ago

I saw this header a few days ago in curl, and I wondered why Google would send something like this. Now I know.

    P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

capocani2• 14 years ago

http://support.google.com/accounts/bin/answer.py?hl=en&a...

In some situations, the cookies we use to secure and authenticate your Google Account and store your preferences may be served from a different domain than the website you're visiting. This may happen, for example, if you visit websites with Google +1 buttons, or if you sign into a Google gadget on iGoogle.

Some browsers require third party cookies to use the P3P protocol to state their privacy practices. However, the P3P protocol was not designed with situations like these in mind. As a result, we've inserted a link into our cookies that directs users to a page where they can learn more about the privacy practices associated with these cookies.

Information that Google collects in association with these cookies is subject to our Privacy Policy.

Doesn't seem nefarious.

mbetter• 14 years ago

Someone instructs their browser to not accept third party cookies, full stop. Google then does something, mumbles a bit, and then sets a third party cookie.

How isn't this nefarious?

capocani2• 14 years ago

It's not as if the users set IE to read P3P headers so technically they didn't override any user settings.

P3P is lacking: http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enou...

freehunter7• 14 years ago

If by "mumbles a bit" you mean not supporting an unsupported and defunct proposed "standard" that doesn't work in practice and is only implemented in IE, then yeah.

mattmcknight4• 14 years ago

The nefarious bit is in IE- which, although it pretends to allow you to "instruct the browser not to accept 3rd party cookies, full stop," actually accepts third party cookies from any site with a P3P code it doesn't understand.

aaronsw• 14 years ago

The dishonesty of this statement is stunning. IE is designed to only accept the cookie if Google promises not to use it for tracking. Google wants to use the cookie for tracking so they provide a dishonesty promise and then explain they're lying because IE didn't have them in mind -- when this is exactly what IE had in mind.

narrator• 14 years ago

99% of people leave their settings at the default and don't give a damn and just want it to work. When it doesn't work it's broken. Period, end of story. They will say: "Shut up with your geeky explanation" when you explain to them your options. There may be a really long complicated answer as to why it doesn't work but 99% of users don't gives a crap. If you are a smart guy you can just use ad block. There, done.

Microsoft is very well aware of the fact that users never change the default settings and IMHO would love to use this to break Google by default and destroy their business model. This fits in well with the usual MS tactics of spreading paranoia, incompatibility, legal threats, obfuscation and confusion.

IMHO, Microsoft would love to exploit privacy fears to remove features from the web and break it so everyone just goes back to the desktop. In my opinion, if they could get away with breaking an ajax call, because hey they might be tracking you, they would in order to kill usability of web software in favor of the desktop software model. They will try anything they possibly can to win.

Did you ever see the list of IE6 features that got canned (e.g "Smart Tags") because of the antitrust investigation? It makes me shudder what the web would be like with these jerks in control.

gojomo• 14 years ago

Doesn't seem nefarious.

That's why it's a brilliant piece of passive-aggressive engineering!

It undermines both the letter and intent of P3P, while ostensibly informing the user. The exact same string is a lie to the protocol, but the truth when read by a person outside of the protocol-context!

It's kind of like a file that's both a legal and harmless GIF and a malicious executable Java JAR. (Look up [GIFAR vulnerability] for more details.)

huxley2• 14 years ago

According to the article, Google has done it in a way that indicates (according to the P3P protocol) "that the cookie will not be used for any tracking purpose or any purpose at all."

Basically they are abusing the standard to force P3P browsers to override the user's choice to block 3rd party cookies, by telling the browser that the cookie isn't intended for tracking, but Google is using it to track users.

That's kinda of appalling privacy-wise.

Maybe it isn't maliciously intended, which is what you mean, but it is an intentional misuse of a browser feature to force user tracking.

recoiledsnake11• 14 years ago

Interesting, but are they using the cookies for ad tracking too, eg. adding pages with +1 buttons to your ad tracking profile?

> However, the P3P protocol was not designed with situations like these in mind.

In that case, the P3P protocol was EXACTLY designed with this in mind.

kstenerud2• 14 years ago

So does this mean that things such as "like" and "+1" buttons don't work unless you subvert the P3P protocol?

spullara• 14 years ago

It means that they don't work unless the user enables tracking by third parties on first party websites.

arebop• 14 years ago

Oh look, Google fails to fully support features only MSIE has [http://en.wikipedia.org/wiki/P3P#Criticisms]! Shame on them.

P3P was standardized but it never got traction due to various practical problems. For example, privacy policies vary in many, sometimes-subtle, ways and nobody could figure out how to build simple software to decide automatically how to respond to these policies on behalf of users. Don't take Google's word for it, see what facebook says: http://www.facebook.com/help/?page=219494461411349. epic.org doesn't use it either.

There are some appealing ideas in P3P but in real life it doesn't actually help users protect their privacy, even on sites that actually implement it (such as Bing). The P3P working group shut down long go (http://www.w3.org/P3P/).

This is article is just cheap shot at a competitor.

kevingadd3• 14 years ago

So the fact that P3P doesn't solve all the problems it set out to solve justifies Google intentionally using it to compromise visitors' privacy in a way that directly contradicts the purpose of the header? And this is okay because it's an MSIE feature they're circumventing?

eli12• 14 years ago

Well, you have a choice: send a bogus P3P header, or break some functionality for IE users.

untog3• 14 years ago

Oh look, Google fails to fully support features only MSIE has

P3P was standardized

Then it's a little unfair to describe P3P as some IE-only standard then, no? You make it sound like proprietary extension.

eli12• 14 years ago

Lets not get lost in semantics. True it's a documented standard, but only Microsoft supports it and given its many drawbacks no one else is likely to add support any time soon. It might as well be proprietary.

freehunter7• 14 years ago

I made the point in another post that it was a "standard" and my post was immediately made invisible. Sometimes you can never win when people insist on ignoring the point for the strawmen.

timothya• 14 years ago

He didn't say it's an "IE-only standard", he said it was an IE-only feature. It may be standardized, but that doesn't mean that it's implemented in other browsers.

ceejayoz6• 14 years ago

> Oh look, Google fails to fully support features only MSIE has [http://en.wikipedia.org/wiki/P3P#Criticisms]! Shame on them.

No, Google deliberately set a P3P header that confuses IE into letting Google bypass the user's privacy settings.

eli12• 14 years ago

I'd wager that very few P3P headers used in the wild are an accurate and complete representation of the privacy policy of the site. Most are either deliberately confusing IE (as you put it) or copied from a tutorial by a developer who just needed to fix the damn login button for stupid IE users.

Creating an accurate P3P header that captures the nuances of different ways data can be used is somewhere between difficult and impossible (I've tried).

emu• 14 years ago

It's a little disingenuous for the IE team to "discover" this just now. I'm pretty sure Google has been doing this for years, and it's well-known. (I certainly talked about it as part of a wider discussion about P3P policies with colleagues a year or so ago, and this isn't even my area of expertise.)

I also don't much mind what companies do with tracking cookies --- I recommend using the Vanilla Cookie extension to Chrome to create a whitelist of persistent cookies. It rather nicely avoids the problem.

kylemaxwell3• 14 years ago

I've been a Google fanboi for years and defended them in the public square when they've been accused of nefariousness. But these revelations of intentionally ignoring users' privacy settings have shaken me. Maybe it's time to put them into the Facebook category, where I removed my account years ago.

tensor2• 14 years ago

It's not so much that they are intentionally ignoring users privacy as they preferring the privacy settings their users have directly given them rather than those set in the browser. I've long been opted out from all of Google's ad tracking, on their site and elsewhere:

http://www.google.com/privacy/ads/ http://www.google.com/ads/preferences

Privacy is something that few of these companies truly respects. Does Google really respect it? Probably not as much as they'd like you to believe, but at least they are willing to discuss it and provide opt out solutions.

recoiledsnake11• 14 years ago

Why not actually follow the P3P standard and then have a flag in the Ad preferences page to enable 3rd party cookies?

>...as they preferring the privacy settings their users have directly given them rather than those set in the browser.

That's extremely misleading. That's a default as well and not something that the user have "directly given them". I seriously doubt more than 0.1% of Google users have ever visited that page.

kylemaxwell3• 14 years ago

I'm not really happy with preferring their opt-out setting when I've already made an opt-out setting in my browser. I don't believe for a moment that Apple or Microsoft care about my privacy any more than Google does, but if I've made a choice and communicated that via browser settings, I expect information providers to respect that choice and not try to exploit the browser in an attempt to bypass my choice.

eddieplan9• 14 years ago

And before you know it, you will need to opt out of tracking of GoogleDrone[1]. The whole privacy controversies would go away if tracking is opt-in rather than opt-out.

[1] http://www.ww4report.com/node/10857

im3w1l2• 14 years ago

Maybe the world is neither black nor white.

marshray3• 14 years ago

Yes, but maybe there are other search engines that work well enough run by companies that aren't engaged in the business of selling out my identity.

MatthewPhillips• 14 years ago

Don't just talk about doing it; do it. Use DuckDuckGo.com instead. It was founded by a fellow HNer.

Stormbringer3• 14 years ago

Waiting for the inevitable DuckDuckBro spin-off

Stormbringer3• 14 years ago

"I've been a Google fanboi for years and defended them in the public square when they've been accused of nefariousness. But these revelations of intentionally ignoring users' privacy settings have shaken me. Maybe it's time to put them into the Facebook category, where I removed my account years ago."

Okay, wait. There's multiple problems here.

The first one is this: that you are only now objecting, and not upset at all about Google handing over dissidents to the Chinese govt to torture and/or kill.

Human fucking life fucking has no fucking value to you? Priorities???

Secondly, they haven't been accussed of nefariousness, they have been caught red-handed, bald faced lied about it in public, only back-pedalled when presented with irrefutable evidence, and then convicted in court. Now, you can try to spin that as "accused", but you're going to need to set the spin cycle longer than normal, because that doesn't wash (sic) with the rest of the world.

Lastly, the problem with replacing Google is finding a good replacement. Bing is useless. The only thing close to gmail for free email (and it's barely in the same ballpark) is yahoo.

kylemaxwell3• 14 years ago

Please don't make assumptions about what I've said in the past. I've been very vocal about their involvement in China, including emailing them, blogging, and telling everyone I know about it. However, since they changed their handling of China, I thought it wasn't relevant to this particular discussion.

I agree with your intensity, though perhaps not its specific mode of expression.

batista• 14 years ago

The first one is this: that you are only now objecting, and not upset at all about Google handing over dissidents to the Chinese govt to torture and/or kill. Human fucking life fucking has no fucking value to you? Priorities???

How is that different from Google/ISPs handling over persons of interest to any other government, including yours? Or you think what is allowed in that case shouldn't be allowed for China's case? Are dissidents of China better than dissidents of any other country, to deserve special treatment?

nostromo2• 14 years ago

This seems to be a problem with the design of P3P more than anything.

Browsers: "3rd-party cookies are blocked unless you add a P3P header..."

Websites: "Ok. What should be in the header?"

Browsers: "Anything... it doesn't matter. Just add the header then 3rd-party cookies are fine"

Websites: "Ok, we'll just add a P3P header saying 'Ceci n'est pas une P3P header' then. Problem solved."

gwillen• 14 years ago

If you read more closely, it's not enough to _have_ a header; the header must also indicate that cookies are not used for tracking.

The problem is, that indication is made with _lack_ of a particular token; and google includes a fake P3P header with no tokens in it. Thus, according to the protocol, google's header indicates that it does not use cookies for anything at all.

dudus2• 14 years ago

It's just plain wrong. The cookies can be used for tracking. You just need to tell what kind of tracking and what you do with that information. http://news.ycombinator.com/item?id=3615381

cooldeal7• 14 years ago

I would expect shady sites from the dark parts of the internet to actively lie but Google?

What do you think about robots.txt then? Isn't that a standard that isn't enforced as well?

jonhohle• 14 years ago

I would expect every site to be extremely liberal with what they request, since, in this case, there is little to no indication to the user as to what's being sent to whom. Developers are going to add the header to get the data because that's what's necessary to get their stuff working.

Ultimately, P3P comes down to the honor system. Unfortunately, that doesn't work on the internet.

pak4• 14 years ago

This is not a reply to your comment! See http://pastebin.com/raw.php?i=qV5bkCjG for more info.

nostromo2• 14 years ago

clever :)

Btw, I'm not defending Google, they're clearly not acting perfectly here. I'm simply pointing out that this is a clear case of, "what did you expect to happen?" Any spec that still sets a cookie that is declared as not being used for any purpose seems deeply flawed.

I also found it interesting that Microsoft called out Google and not Facebook, which gives the article a political overtone.

masklinn• 14 years ago

> This seems to be a problem with the design of P3P more than anything.

Granted, the standard is written to be abused. On the other hand, Google's behavior is basically "well if you don't say no it's not rape. What, you were bound and gagged at the time? Well nothing I can do about that".

DanBC• 14 years ago

Please don't use a violent real world crime as an analogy to things like setting cookies.

Tichy2• 14 years ago

So I take it the MS ad network doesn't track users?

cooldeal7• 14 years ago

Of course it does. The question is, does it still do that even if the browser explicitly told it not to.

If you have some evidence that it does, I am looking forward to seeing it. But more likely, I think you just read the headline and jumped in to comment.

Tichy2• 14 years ago

There are countless tracking mechanisms besides cookies, for example flash cookies and so on. They have been used for years. I would be surprised if any ad network would opt to not use them (I don't like it, but still).

slig• 14 years ago

It's been a while. And fb does it too.

http://security.stackexchange.com/questions/8489/should-anyo...

barista• 14 years ago

And that is a perfectly valid reason for Google to do it as well and bash Facebook while they are at it.

mjs• 14 years ago

There's an "IT Security" stackexchange?! WTF?! How many almost identical communities does stackexchange need?

smackfu• 14 years ago

One for each question that is moved out of StackOverflow, of course.

tylerritchie• 14 years ago

There aren't very many almost identical, but there are a lot of communities that have significant overlap.

  - Superuser
  - Serverfault
  - Database Administrators - 8.9 questions/day
  - IT Security - 6.9 questions/day
  - Healthcare IT - 1.1 questions/day

The stackexchange community is all about forking. Clearly Healthcare IT, IT Security, and Database Administrators could all be tagged questions in serverfault. But apparently serverfault.com/questions/tagged/heathcare didn't sit well with the 298 people who committed to the beta. Separating power-users from IT professionals (superuser vs serverfault)is certainly reasonable even though there is a large overlap of knowledge there.

Of course, without the forks, as an IT person there might be a question if your cryptography related question should go in cryptography.SE or serverfault. With a dedicated site the "correct" location for those questions is easier to determine.

But if we're going to talk about overlapping stackexchanges we have to look at those populated predominantly by programmers, because... well, they are the master forkers.

  - stackoverflow
  - Programmers
  - Code review
  - Theoretical Computer Science
  - Code Golf
  - Signal Processing 
  - Computational Science

I left out the language specific ones like Mathematica and TeX. I also omitted Software QA and Cryptography.

Apparently theoretical physicists and applied? physicists are unable to co-exist on one stackexchange.

Anyway, clearly the stackexchange community thinks that forking is the answer. I think tagging is superior and I think fragmenting the community gets fewer able eyes focused on questions. Forking doesn't really hurt google users trying to find answers to questions that have already been answered.

Even while not being a professional developer I would stick Code golf, code review, and Programmers into one stack exchange. I'd also put Signal Processing, Mathematica, Tex, and Compuational Science back in Stack Overflow and let the theoretical CS folks stay separate.

Joakal• 14 years ago

Reddit has something similar with these:

http://reddit.com/r/netsec

(Check related subreddits)

jtchang• 14 years ago

P3P is a load of garbage as it is implemented/written.

There is no real enforcement behind it and it just causes lots of confusion. Seriously I have to go lookup what each of these acronyms are in order to figure out how my privacy is being violated? What guarantees do I even have that you are obeying P3P and not simply sending it to make me feel good.

Hell while we are at it we should implement P3P for phone apps. I'm sure Path (and others) will stop uploading your address book if the P3P says "ADDRBKNOUP"

mikemaccana• 14 years ago

>Seriously I have to go lookup what each of these acronyms are in order to figure out how my privacy is being violated?

No, you don't. This is mentioned in the article.

driverdan• 14 years ago

I came to the comments to say pretty much the same thing. While it's a good idea in theory, P3P is a terrible standard. It's hard to implement because there are so many acronyms and no easy reference for them.

As mentioned in the article, IE has had the basic implementation of blocking 3rd party cookies if you don't use P3P for a while. I've always wanted to use honest P3P headers but it's such a PITA to generate them correctly site-by-site. Many frameworks include a generic P3P header by default with little or no mention in documentation so that's what I end up using.

I spent many hours read specs, tutorials, and trying out P3P generators to no avail. Finally I decided it's not worth my time and just used default framework P3P headers.

powertower2• 14 years ago

> There is no real enforcement behind it

You could say the same thing about robots.txt.

sequoia• 14 years ago

...and you would be correct.

im3w1l2• 14 years ago

"What guarantees do I even have that you are obeying P3P and not simply sending it to make me feel good."

This sounds like the perfect job for a legion of lawyers.

devindotcom• 14 years ago

Yeah, this isn't quite the same level as the Safari one, which was a bit of a tempest in a teacup to begin with. In both cases you can partially blame the browser, though more so in this case.

yanw• 14 years ago

So the WSJ publishes another one of it’s alarmist articles about Google and Safari during the weekend and Microsoft wants to capitalize by pretending it just now discovered that P3P (a defunct and shitty protocol) is useless and no one uses it.

NYT September 17, 2010:

http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enou... If you rely on Microsoft’s Internet Explorer’s privacy settings to control cookies on your computer, you may want to rethink that strategy. Large numbers of Web sites, including giants like Facebook, appear to be using a loophole that circumvents I.E.’s ability to block cookies, according to researchers at CyLab at the Carnegie Mellon University School of Engineering. A technical paper published by the researchers says that a third of the more than 33,000 sites they studied have technical errors that cause I.E. to allow cookies to install, even if the browser has been set to reject them. Of the 100 most visited destinations on the Internet, 21 sites had the errors, including Facebook, several of Microsoft’s own sites, Amazon, IMDB, AOL, Mapquest, GoDaddy and Hulu.

Google doesn’t support a broken feature that is exclusive to IE somehow it’s their fault. If anyone ever doubted Microsoft's PR sleaziness and propaganda tactics that blog post is proof.

recoiledsnake11• 14 years ago

>So Google doesn’t support an IE exclusive broken feature

I am tired of this constant meme in the comments. It's one thing not to support a standard, it's another to actually go to the effort of actively subverting it.

They are supporting it by sending out (fake) P3P headers.

If they didn't support it, they wouldn't send P3P headers. As simple as that.

ootachi3• 14 years ago

Yeah, this is not an excuse at all.

You can't argue in defense of Google from an "it's nonstandard" angle, because Google is all about nonstandard Web extensions these days -- to a much larger extent than Microsoft.

You can't argue in defense of Google from a "they didn't know enough about how IE works" angle. They're Google. They created Chrome Frame, people. They know enough to solve this engineering problem.

The pro-Google bias on HN is astounding.

ceejayoz6• 14 years ago

> So Google doesn’t support an IE exclusive broken feature and somehow it’s their fault.

Google is supporting the feature, in a way that appears deliberately intended to bypass the user's privacy settings.

ABS• 14 years ago

I don't side with Google on this one but here is an interesting tidbit: Microsoft support site advocated the same trick... a reference to this can be found on page 6 of this PDF

http://www.ftc.gov/os/comments/privacyreportframework/00453-...

DaveMebs• 14 years ago

This is a totally disingenuous comment. From the linked PDF (note: this also occurs on page 7, not page 6, for those who wish to verify):

"We discovered that Microsoft’s support website recommends the use of invalid CPs as a work-around for a problem in IE. Specifically, a FRAMESET or parent window that references another site inside a FRAME considers the referenced site as a third-party, even if it is first-party content located on the same server [10]. Microsoft suggests the following invalid CP: CAO PSA OUR. This CP is clearly invalid since it does not contain any RETENTION or CATEGORIES tokens. Even if the CP were valid, Microsoft’s recommendation undermines the purpose of P3P since it encourages web administrators to use CPs that do not represent their actual data practices. We found several technical blogs recommending similar solutions [11], [19]."

So yes, a Microsoft support site did recommend a set of invalid CPs, but this is clearly not the same trick. This is a legitimate set of CP tokens that is used to workaround an issue where 1st party content appears to IE as 3rd party content. This token set is invalid because RETENTION/CATEGORIES tokens are missing, but the web author's intent here is (theoretically) honest.

Google, on the other hand, is providing no tokens whatsoever. Instead, in their P3P header they provide a human-readable string and a link to their privacy policy. This is not an invalid but intellectually honest set of tokens that is designed to comply with the spirit of the standard, if not the letter. This is an attempt to bypass the standard in order to allow 3rd party cookies, regardless of user settings.

The fact that you are equating these two practices is completely dishonest. Even a cursory glance through this document makes it clear that the Microsoft support site is advocating something completely different and is doing so in order to enable a fairly legitimate scenario.

jackalope• 14 years ago

This is like teams of foxes selling chicken coops and accusing the other teams of the improper placement of "No Foxes Allowed" signs. If third party cookies are bad, disallowing them should be the default, regardless of some policy header no user ever heard of or can decipher.

If they really cared, they'd include a way to disallow any third party resource without having to install a plugin like RequestPolicy. That would go a long way towards fighting tracking (and multiple exploits).

mike-cardwell2• 14 years ago

It is not in Googles or Microsofts interest to do that with their browsers. They both have a very large commercial interest in people using browsers that make it easy to track them.

This is the main reason I stick with Firefox. I don't want to use a browser built by an advertising company.

ceejayoz6• 14 years ago

The vast majority of Mozilla's revenue comes from a search deal with Google.

scotty792• 14 years ago

How can you bypass something that is not a barrier? P3P is useless.

P3P means "we would never..." in computer speech which is unenforceable therefore useless.

Google just make no promises via P3P and places link there explaining that it doesn't and why it doesn't.

Fortunately implementations of the P3P do the right thing and fold.

recoiledsnake11• 14 years ago

>How can you bypass something that is not a barrier?

So if tomorrow Chrome uploads all your keystrokes to Google, will that be a valid defense?

>P3P means "we would never..." in computer speech which is unenforceable therefore useless.

Stopping Chrome from uploading your bank passwords with today's update is unenforceable as well and hence thereby useless.

scotty792• 14 years ago

Right. So if you are afraid of that then don't use Chrome.

And if you are afraid that cookies can be used for tracking then disable them in your browser.

P3P imho is useless because people whom I don't want to be tracked by will serve all the reassuring tokens in P3P and do whatever they want anyway.

I want my +1 buttons to work and if that means pulling curtain on some security theater then so be it.

tlogan• 14 years ago

There are some comments here that say: P3P is garbage as implemented, so it is ok for Google to invest some time and engineering effort to trick P3P and track users via cookies.

Not sure if that the valid answer but it has some merits if everybody is doing that (like downloading adress book from iPhone).

Now, I have the following question: if a random website is catch doing this, is it going to marked as un-safe by security scanners?

voidr• 14 years ago

What about IE tracking what users are searching for?

Microsoft should admit that they only care about privacy when it's convenient for them.

ceejayoz6• 14 years ago

> What about IE tracking what users are searching for?

What about it? A browser isn't a website, so P3P doesn't apply. Its written privacy policy applies, and likely allows such behaviour.

> Microsoft should admit that they only care about privacy when it's convenient for them.

I think the point being made is: so should Google.

CurtHagenlocher• 14 years ago

Microsoft, Google and Apple all agree that your privacy should not be sacrificed for the sake of their competitors making a buck.

recoiledsnake11• 14 years ago

>What about IE tracking what users are searching for?

What about it? Tell me more.

They don't even enable Bing suggestions by default.

evmar2• 14 years ago

After Microsoft introduced cookie-blocking features in IE they've been dancing around how to get users to block ads without telling users to install the blockers directly.

Here's the blacklist they suggest in their post, which they recommend "as a protection": http://ie.microsoft.com/testdrive/browser/p3p/google.txt

The "-d" lines block domains entirely, which I believe means this has the consequence of blocking Google ads entirely.

recoiledsnake11• 14 years ago

>The "-d" lines block domains entirely, which I believe means this has the accidental consequence of blocking Google ads entirely.

Err what? Why would disabling cookies disable displaying ads?

You seem to be overly concerned about Google being unable to track the browsing habits of some people.

evmar2• 14 years ago

At least as best as I can gather from the TPL docs, they block "all third party content", which includes iframes (the mechanism used for ads).

http://ie.microsoft.com/testdrive/Browser/TrackingProtection...

lawnchair_larry• 14 years ago

Privacy violations should be opt-in. That's what is wrong with privacy on the web.

gyardley2• 14 years ago

Google really should have the cojones to stand up and state their actual position plainly, which as far as I can tell is this:

"If you haven't taken an active, positive step to block our +1 buttons, we're going to assume you don't really care and we'll do whatever we can to show them to you, no matter what your browser's default settings are. Why? Well, because we think the default settings are bullshit, and 99 times out of 100 they're only that way because they're the default. They don't reflect actual user preferences, they reflect other browsers messing with our business plans."

Not only is that an intellectually honest position, it's a lot more accurate than assuming all IE users who haven't changed their settings don't want +1 buttons.

nikcub3• 14 years ago

then how would you actually block third-party cookies as a Safari user?

powertower2• 14 years ago

According to the sentiment here, that's your problem, not Google's!

Tyrannosaurs3• 14 years ago

And you know for a fact that it's set to that because it's the default and that I haven't reviewed it and decided that I'm ok with how it's set out of the box do you?

I review pretty much every browser setting but change only about 5%. You have no way of telling how the setting ended up with its current value and without that that position is bullshit.

gyardley2• 14 years ago

First, don't confuse me with Google. I'm talking about the argument Google's implicitly making here through their actions, which I wish they'd just say out loud so we could have a real and proper discussion about these issues.

Of course Google doesn't know your preferences for a fact. Of course Google has no way of knowing. But based on their behavior, it seems they just don't care.

An intellectually honest Google would argue 'Look, the default behavior of your browser is badly broken, because they've made it impossible to distinguish between the small number of people who care about this third-party cookie stuff and the rest of the world, who doesn't care an iota. You care about it? So sorry, take it up with your browser manufacturer and their goofy choice of defaults.'

They don't have the guts to make this argument with words, of course, but this is exactly the argument they're making with their actions.

lunarscape• 14 years ago

The need to justify it like that just screams how wrong it is. They want to exploit users and will do anything to achieve that. The default settings hindered them so they worked around it. Privacy shouldn't be "opt-in". Your statement sounds like a thief justifying his crime by claiming that since Mrs Smith didn't install a $20,000 security system in her house she really didn't care enough about her property and that makes his "business model" of burglary okay.

oakgrove• 14 years ago

Episode 32432432 in the pissing match between MS and anybody who dares make a dollar in the computing industry. Yawn

jdavid• 14 years ago

I flagged this because it's just Microsoft trying to flame war with Google. These headers have been an annoyance every time I have had to consider them.

This is a clear example of Microsoft's 'extend' and 'embrace' strategy that destroyed so many platforms. The MS series of browsers were the only ones to adopt this before being recommended as a spec. The spec was never adopted.

jsz0• 14 years ago

Spitting in the face of user intent like this is really crossing the line of what is acceptable in my opinion. I'm not really concerned about my privacy but I do need to have some faith that the settings I am choosing are being respected. If I allow Google+ to use my webcam should I expect Google to turn it on and watch me all the time? That's not too far removed from what they are doing here.

nitrogen• 14 years ago

I can't say I would side with either party in this case. P3P sounds about as robust a protocol as RFC 3514 (the evil bit), and Google could just as easily display a warning to any user whose browser rejects third-party cookies.

https://www.ietf.org/rfc/rfc3514.txt

shtylman• 14 years ago

Can someone explain to me why it isn't the browsers responsibility to enforce this instead of relying on websites to "do the right thing"?

justinlau• 14 years ago

It's a new low for Microsoft to use MSDN as a corporate mudslinging soapbox.

joshfraser• 14 years ago

Having battled with P3P in the past, I sympathize with Google. I don't have a problem breaking dumb rules. And P3P is dumb on multiple levels.

Volpe• 14 years ago

Googles explanation (set inside the P3P cookie):

http://support.google.com/accounts/bin/answer.py?hl=en&a...

Stormbringer3• 14 years ago

Is "Google does evil shit and violates users privacy" even news-worthy anymore? Isn't that the default?

Yeah you heard me Google-tards. Down-vote me like you always do, I got karma to burn baby burn.

andersh• 14 years ago

From your user page, I see that your IT company likes/dislikes conform to one of the approved off-the-shelf opinionsets. [ticks box] Carry on.

prtamil• 14 years ago

It reminds me of a quote from Dark Knight "You either die a hero or you live long enough to see yourself become the villain" .

dudus2• 14 years ago

I was going to post a comment with details of what the microsoft's P3P CP policy means. But it got so damn long that I had to write a blog post. http://news.ycombinator.com/item?id=3615381

mrinterweb• 14 years ago

For some reason, it feels too soon for the IE team to be calling foul on web standards implementation.

meow• 14 years ago

Keeping Google's blunders aside, the P3P policy as described seem to be a joke. Do they really expect third party sites to be honest with a browser ? At least they had to do some magic on Safari.. this seems too straight forward and begging to be abused...

tete• 14 years ago

Easy fix: use DuckDuckGo

https://duckduckgo.com/

Don't let them track and bubble you:

http://donttrack.us/

http://dontbubble.us/

From the IE Team: Google Bypassing User Privacy Settings

Related Stories