Risk
9/29/2011
02:25 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Amazon Silk Browser Prompts Privacy Worries

The fast Web surfing Amazon promises on its Kindle Fire tablet involves a record of what you visit on the Net.

Amazon's most significant announcement on Wednesday was not the introduction of its Kindle Fire tablet. Rather, it was the Web browser that will ship with the Kindle Fire, Amazon Silk.

Amazon Silk is based on WebKit, the open source browser engine that forms the foundation of the Apple Safari and Google Chrome browsers. But Silk's technical ancestry isn't as important as its split personality: Silk can operate as a traditional browser, in "off-cloud mode," but it also can take advantage of Amazon's cloud computing infrastructure to optimize Web page files so they load more quickly.

In "cloud mode," Silk relies on Amazon Web Services as a proxy service: Amazon becomes the middleman responsible for fulfilling the user's Web page requests. Imagine how useful all that data will be to Amazon as business intelligence.

Chester Wisniewski, senior security advisor at Sophos Canada, says Silk presents an obvious privacy problem. "All of your Web surfing habits will transit Amazon's cloud," he wrote in a blog post. "If you think that Google AdWords and Facebook are watching you, this service is guaranteed to have a record of everything you do on the Web."

[ Take a visual tour of Amazon's forthcoming Kindle Fire. ]

What Amazon is doing isn't unprecedented. The Opera Mini browser relies on remote servers to optimize Web data. BlackBerry browsers may be assigned to a BlackBerry Enterprise Server, which serves as an intermediary between the user and the Internet.

Like an ISP, Amazon will have access to data about the Internet activities of Kindle Fire users. Indeed, Amazon compares Silk's awareness of its users to that of an ISP.

"[L]ike most Internet service providers and similar services that enable you to access the Web, the content of webpages you visit using Amazon Silk passes through our servers and may be cached to improve performance on subsequent page loads," the company states in its Silk Terms & Conditions.

Amazon notes that it temporarily logs Web URLs and identifiers like IP and MAC addresses to help with technical issues. "We generally do not keep this information for longer than 30 days," the company states, which means there may be circumstances when data is retained for longer periods.

But unlike an ISP, Amazon will also be presenting SSL certificates on behalf of users, and will thus have even more intimate knowledge of what users are doing online.

As Wisniewski observes, a U.S. court order would make it easy to monitor the online activities of a Kindle Fire user, at least in "cloud mode." Other governments are also likely to see Amazon as a one-stop data shop for Kindle Fire users, to judge by RIM's experience in India and the United Arab Emirates.

Unified communications isn't like other online apps. Get the infrastructure right or risk some major hang-ups. Read all about it in the new all-digital InformationWeek supplement. Download it now. (Free with registration.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jcox617
50%
50%
jcox617,
User Rank: Apprentice
10/1/2011 | 4:42:53 PM
re: Amazon Silk Browser Prompts Privacy Worries
Test
darkmatter
50%
50%
darkmatter,
User Rank: Apprentice
9/30/2011 | 3:17:41 PM
re: Amazon Silk Browser Prompts Privacy Worries
This is the best intelligence device ever developed to gather information on customers coupled with an efficient selling engine behind it. Amazon has developed a Trojan horse (not covered with wooden planks but nice silky fur) capable of identifying your habits, knowing your friends, understanding your quirks, satisfying most of your wishes and desires ... and a point-of-sales nearby you 24/7. What is better than Amazon Fire for a consumerist society? The Greeks gave the wooden horse free of charge to the Trojans. Amazon asks for $199. Too much?
jrapoza
50%
50%
jrapoza,
User Rank: Apprentice
9/29/2011 | 8:56:08 PM
re: Amazon Silk Browser Prompts Privacy Worries
I agree with Brian. I'm almost less concerned with this then I am with how my ISP can track surfing data. I'm pretty sure I know how Amazon will use this data (to improve their own capability to sell stuff). With the ISPs, I'm less sure how they are using data and more concerned about what they are doing with it.

Jim Rapoza is an InformationWeek Contributing Editor
Bprince
50%
50%
Bprince,
User Rank: Ninja
9/29/2011 | 8:22:28 PM
re: Amazon Silk Browser Prompts Privacy Worries
From the perspective of developing intelligence on customers, this sounds fine. But I think they should be clear on how long they retain data and what type of data they retain so people can make a decision about privacy based on all the facts.
Brian Prince, InformationWeek contributor
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: So...are we supposed to be the elves or the reindeer?
Current Issue
Five Things Every Business Executive Should Know About Cybersecurity
Don't get lost in security's technical minutiae - a clearer picture of what's at stake can help align business imperatives with technology execution.
Flash Poll
Dark Reading Strategic Security Report: The Impact of Enterprise Data Breaches
Dark Reading Strategic Security Report: The Impact of Enterprise Data Breaches
Social engineering, ransomware, and other sophisticated exploits are leading to new IT security compromises every day. Dark Reading's 2016 Strategic Security Survey polled 300 IT and security professionals to get information on breach incidents, the fallout they caused, and how recent events are shaping preparations for inevitable attacks in the coming year. Download this report to get a look at data from the survey and to find out what a breach might mean for your organization.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Security researchers are finding that there's a growing market for the vulnerabilities they discover and persistent conundrum as to the right way to disclose them. Dark Reading editors will speak to experts -- Veracode CTO and co-founder Chris Wysopal and HackerOne co-founder and CTO Alex Rice -- about bug bounties and the expanding market for zero-day security vulnerabilities.