Risk
1/28/2013
02:42 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Google Faces Safari Privacy Claim In U.K.

Google is attempting to have similar claims dismissed in the U.S. for lack of harm.

10 Best Business Tools In Google+
10 Best Business Tools In Google+
(click image for larger view and for slideshow)
Overlooking the irony of fighting for privacy on a social network, a few users of Apple's Safari browser in the United Kingdom have marked Data Privacy Day by launching a Facebook page to coordinate possible legal claims against Google. The group seeks to punish Google for bypassing privacy controls in Apple's Safari browser on desktop and mobile devices as a means to present personalized content.

The law firm Olswang has been retained to coordinate any claims. The first claimant, Judith Vidal-Hall, said in a statement, "Google claims it does not collect personal data but doesn't say who decides what information is 'personal.' Whether something is private or not should be up to the Internet surfer, not Google. We are best placed to decide, not them."

Google's circumvention of privacy controls in Safari was revealed in February 2012 by Stanford graduate student Jonathan Mayer. Rachel Whetstone, Google's SVP of communications and public policy, explained at the time that the company bypassed Safari's controls "to enable features for signed-in Google users on Safari who had opted to see personalized ads and other content -- such as the ability to '+1' things that interest them."

[ Are you finding your access to some apps being restricted? Read Facebook Blocks Vine, Wonder Apps. ]

In November, Google agreed to pay $22.5 million to settle a Federal Trade Commission claim that it had violated a previous agreement with the agency by misrepresenting privacy assurances affecting users of Apple's Safari browser. It did so denying that it had violated its FTC consent decree.

Google declined to comment. But a week ago, the company asked for the dismissal of a similar case brought in the U.S. because its placement of cookies didn't really harm anyone.

In its filing, Google explains that what happened was an unforeseen consequence of developing a Google+ feature that allowed Google+ users to see personalized content. It did so by developing what it calls an Intermediary Cookie, to serve personalized content without breaching the anonymity that users are afforded on its ad network.

Apple's Safari browser defaults to blocking third-party cookies, which are used by ad networks. But it allows exceptions under certain circumstances. One exception is what's known as the "Safari One In, All In Rule," which allows all cookies from a given domain if one from that domain has already been stored in the user's browser. Another is the "Safari Form Submission Rule," which allows cookies from a third-party domain if the user submitted a form from that domain.

Google used the "Safari Form Submission Rule" to place its Intermediary Cookie and inadvertently opened Safari's doors to any cookie under the "Safari One In, All In Rule." As a consequence, Safari users began accepting cookies from Google's DoubleClick ad network despite representations to the contrary.

"To the extent that this unexpected outcome had any effect, it is only that a more tailored ad may have been displayed to the browser than otherwise would have been," Google said in its legal filing, noting that no specific harm had been documented as a result of its actions.

Dan Tench, a partner at Olswang, dismissed Google's explanation in an email. "We do not know what Google's response to our clients' complaints will be since we have received no reply to our letters," he said. "In any event, Google's explanation for its secret tracking would be no answer to our clients' complaints under U.K. law."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6335
Published: 2014-08-26
The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and ...

CVE-2014-0480
Published: 2014-08-26
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL ...

CVE-2014-0481
Published: 2014-08-26
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a d...

CVE-2014-0482
Published: 2014-08-26
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors relate...

CVE-2014-0483
Published: 2014-08-26
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.