Risk
1/23/2009
05:49 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

White House Web Site Revisits Privacy Policy

Staffers address privacy concerns after a 1-by-1-pixel image file loaded by Web page code for tracking purposes is revealed.

With the Obama administration now in place, White House media staff has been reviewing the WhiteHouse.gov Web site this week to address issues raised by privacy advocates.

Embedded YouTube videos, which previously loaded and deposited a persistent third-party YouTube cookie in visitors' browsers automatically, have been moved behind an image of the video player that must be clicked to initiate loading. This addresses an inconsistency in the White House site's privacy policy, which stated that there was a way to view videos without receiving a persistent cookie.

The review could lead to changes in the site's privacy policy designed to clarify its privacy practices.

This action appears to be in keeping with a commitment to be responsive to community concerns. In the first blog post on the new WhiteHouse.gov on Tuesday, Macon Phillips, director of new media for the White House, solicited user input and said that "this online community will continue to be a work in progress as we develop new features and content for you."

Revamped on Tuesday, the new WhiteHouse.gov Web site immediately elicited criticism for transmitting data about its visitors to WebTrends, a Web analytics company, without adequate disclosure.

On the Interesting People e-mail list, maintained by Carnegie Mellon computer science professor David Farber, Karl Auerbach, CTO of at InterWorking Labs and an attorney, warned Tuesday that the WhiteHouse.gov site contains a Web bug.

A Web bug, also known as a Web beacon by those who prefer terminology less suggestive of surveillance (WebTrends uses "Clear GIF"), is a file loaded by Web page code for tracking purposes. It often comes in the form of a 1-pixel-by-1-pixel image file, which is too small to be noticed but nonetheless registers in server logs like any other file.

The Web bug on the WhiteHouse.gov home page is fetched by JavaScript code -- called via the script at www.whitehouse.gov/includes/webtrends.js or through the URL enclosed in [noscript] tags -- that collects data about the visitor's computer configuration and packs that information into the URL used to request the Web bug.

Thus, in the process of receiving the remote request from WhiteHouse.gov to serve a 1-by-1-pixel graphic, WebTrends also receives certain details about those visiting the White House Web site.

Auerbach observed in an e-mail that while he recognized some of the data requested -- his screen resolution and whether he had Microsoft Silverlight installed -- the other data gathered by WebTrends was unclear.

In a separate e-mail message sent to Farber's list, Steven Champeon, CTO of Hesketh.com, deciphered the WebTrends JavaScript.

Previous
1 of 4
Next
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Why else would HR ask me if I have a handicap?"
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.