Risk
1/28/2013
02:42 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%
Repost This

Google Faces Safari Privacy Claim In U.K.

Google is attempting to have similar claims dismissed in the U.S. for lack of harm.

10 Best Business Tools In Google+
10 Best Business Tools In Google+
(click image for larger view and for slideshow)
Overlooking the irony of fighting for privacy on a social network, a few users of Apple's Safari browser in the United Kingdom have marked Data Privacy Day by launching a Facebook page to coordinate possible legal claims against Google. The group seeks to punish Google for bypassing privacy controls in Apple's Safari browser on desktop and mobile devices as a means to present personalized content.

The law firm Olswang has been retained to coordinate any claims. The first claimant, Judith Vidal-Hall, said in a statement, "Google claims it does not collect personal data but doesn't say who decides what information is 'personal.' Whether something is private or not should be up to the Internet surfer, not Google. We are best placed to decide, not them."

Google's circumvention of privacy controls in Safari was revealed in February 2012 by Stanford graduate student Jonathan Mayer. Rachel Whetstone, Google's SVP of communications and public policy, explained at the time that the company bypassed Safari's controls "to enable features for signed-in Google users on Safari who had opted to see personalized ads and other content -- such as the ability to '+1' things that interest them."

[ Are you finding your access to some apps being restricted? Read Facebook Blocks Vine, Wonder Apps. ]

In November, Google agreed to pay $22.5 million to settle a Federal Trade Commission claim that it had violated a previous agreement with the agency by misrepresenting privacy assurances affecting users of Apple's Safari browser. It did so denying that it had violated its FTC consent decree.

Google declined to comment. But a week ago, the company asked for the dismissal of a similar case brought in the U.S. because its placement of cookies didn't really harm anyone.

In its filing, Google explains that what happened was an unforeseen consequence of developing a Google+ feature that allowed Google+ users to see personalized content. It did so by developing what it calls an Intermediary Cookie, to serve personalized content without breaching the anonymity that users are afforded on its ad network.

Apple's Safari browser defaults to blocking third-party cookies, which are used by ad networks. But it allows exceptions under certain circumstances. One exception is what's known as the "Safari One In, All In Rule," which allows all cookies from a given domain if one from that domain has already been stored in the user's browser. Another is the "Safari Form Submission Rule," which allows cookies from a third-party domain if the user submitted a form from that domain.

Google used the "Safari Form Submission Rule" to place its Intermediary Cookie and inadvertently opened Safari's doors to any cookie under the "Safari One In, All In Rule." As a consequence, Safari users began accepting cookies from Google's DoubleClick ad network despite representations to the contrary.

"To the extent that this unexpected outcome had any effect, it is only that a more tailored ad may have been displayed to the browser than otherwise would have been," Google said in its legal filing, noting that no specific harm had been documented as a result of its actions.

Dan Tench, a partner at Olswang, dismissed Google's explanation in an email. "We do not know what Google's response to our clients' complaints will be since we have received no reply to our letters," he said. "In any event, Google's explanation for its secret tracking would be no answer to our clients' complaints under U.K. law."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-0460
Published: 2014-04-16
The init script in kbd, possibly 1.14.1 and earlier, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/defkeymap.map.

CVE-2011-0993
Published: 2014-04-16
SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.

CVE-2011-3180
Published: 2014-04-16
kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

CVE-2011-4089
Published: 2014-04-16
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.

CVE-2011-4192
Published: 2014-04-16
kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double quotes in kiwi_oemtitle of .profile."

Best of the Web