Dataium Settles Browser History Sniffing Charges

The car buyer tracking firm was accused of using JavaScript to illegally identify websites visited by 181,000 named consumers, and selling harvested information.

Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
11/27/2013 | 7:48:42 AM
Re: Rare glimpse
 How much tracking are you willing to trade for useful websites? 

That's a hard question to answer in the dark. The Dataium case puts a spotlight on how little consumers know about the behind-the-scenes tracking that goes on. I think we're all well aware that Amazon has algorithms that tells us what books or products we might be interested in. But there needs to be greater transparency about the extent to which companies are sharing that information with partners. 
User Rank: Apprentice
11/27/2013 | 4:52:24 AM
Re: Rare glimpse
One of the chilling aspects is that just by searching for cars online, even if you haven't registered on a website, data brokers -- including the likes of Equifax, TransUnion, and Experian, which recently confirmed a massive data breach at a subsidiary -- are not only seeing that information, but likely adding it to records that include your real name, address, email addresses, phone numbers, shopping preferences, financial details, and more. 

Furthemore, if that's the case for cars, then by extension every click you make on every website might be getting tracked in the same manner. All of which raises the question of how much tracking are you willing to trade for useful websites? 
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
11/26/2013 | 2:43:18 PM
Rare glimpse
Fascinating story  & the details are indeed a rare glimpse into the extent of data mining that takes place unbeknown to most consumers. Hats off to the NJ AG's office for pursuing this!
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-09
The Telephony component in Apple OS X before 10.11, when the Continuity feature is enabled, allows local users to bypass intended telephone-call restrictions via unspecified vectors.

Published: 2015-10-09
The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.

Published: 2015-10-09
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.

Published: 2015-10-09
The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5877.

Published: 2015-10-09
The Login Window component in Apple OS X before 10.11 does not ensure that the screen is locked at the intended time, which allows physically proximate attackers to obtain access by visiting an unattended workstation.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.