Risk
1/28/2013
02:42 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Faces Safari Privacy Claim In U.K.

Google is attempting to have similar claims dismissed in the U.S. for lack of harm.

10 Best Business Tools In Google+
10 Best Business Tools In Google+
(click image for larger view and for slideshow)
Overlooking the irony of fighting for privacy on a social network, a few users of Apple's Safari browser in the United Kingdom have marked Data Privacy Day by launching a Facebook page to coordinate possible legal claims against Google. The group seeks to punish Google for bypassing privacy controls in Apple's Safari browser on desktop and mobile devices as a means to present personalized content.

The law firm Olswang has been retained to coordinate any claims. The first claimant, Judith Vidal-Hall, said in a statement, "Google claims it does not collect personal data but doesn't say who decides what information is 'personal.' Whether something is private or not should be up to the Internet surfer, not Google. We are best placed to decide, not them."

Google's circumvention of privacy controls in Safari was revealed in February 2012 by Stanford graduate student Jonathan Mayer. Rachel Whetstone, Google's SVP of communications and public policy, explained at the time that the company bypassed Safari's controls "to enable features for signed-in Google users on Safari who had opted to see personalized ads and other content -- such as the ability to '+1' things that interest them."

[ Are you finding your access to some apps being restricted? Read Facebook Blocks Vine, Wonder Apps. ]

In November, Google agreed to pay $22.5 million to settle a Federal Trade Commission claim that it had violated a previous agreement with the agency by misrepresenting privacy assurances affecting users of Apple's Safari browser. It did so denying that it had violated its FTC consent decree.

Google declined to comment. But a week ago, the company asked for the dismissal of a similar case brought in the U.S. because its placement of cookies didn't really harm anyone.

In its filing, Google explains that what happened was an unforeseen consequence of developing a Google+ feature that allowed Google+ users to see personalized content. It did so by developing what it calls an Intermediary Cookie, to serve personalized content without breaching the anonymity that users are afforded on its ad network.

Apple's Safari browser defaults to blocking third-party cookies, which are used by ad networks. But it allows exceptions under certain circumstances. One exception is what's known as the "Safari One In, All In Rule," which allows all cookies from a given domain if one from that domain has already been stored in the user's browser. Another is the "Safari Form Submission Rule," which allows cookies from a third-party domain if the user submitted a form from that domain.

Google used the "Safari Form Submission Rule" to place its Intermediary Cookie and inadvertently opened Safari's doors to any cookie under the "Safari One In, All In Rule." As a consequence, Safari users began accepting cookies from Google's DoubleClick ad network despite representations to the contrary.

"To the extent that this unexpected outcome had any effect, it is only that a more tailored ad may have been displayed to the browser than otherwise would have been," Google said in its legal filing, noting that no specific harm had been documented as a result of its actions.

Dan Tench, a partner at Olswang, dismissed Google's explanation in an email. "We do not know what Google's response to our clients' complaints will be since we have received no reply to our letters," he said. "In any event, Google's explanation for its secret tracking would be no answer to our clients' complaints under U.K. law."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2208
Published: 2014-12-28
CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string.

CVE-2014-2209
Published: 2014-12-28
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.

CVE-2014-5386
Published: 2014-12-28
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initial...

CVE-2014-6123
Published: 2014-12-28
IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through 9.0.0.1, and 9.0.1 allow local users to obtain sensitive credential information by reading installation logs.

CVE-2014-6160
Published: 2014-12-28
IBM WebSphere Service Registry and Repository (WSRR) 8.5 before 8.5.0.1, when Chrome and WebSEAL are used, does not properly process ServiceRegistryDashboard logout actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.