Risk
10/30/2012
01:55 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Yahoo To Ignore IE10 DNT Settings

Yahoo says Internet users' preferences aren't being accurately reflected by having "do not track" enabled by default.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
Memo from Yahoo to users of Microsoft Internet Explorer 10: Prepare to be tracked.

Yahoo, the company behind the eponymous search engine, announced Friday that it's the latest organization planning to ignore the "do not track" (DNT) setting, or flag, broadcast by IE10.

Yahoo's proffered reasoning is that by making the privacy control active by default, Microsoft is ignoring the wishes of its users. "Ultimately, we believe that DNT must map to user intent -- not to the intent of one browser creator, plug-in writer, or third-party software service," said a statement released by Yahoo, titled "In Support of a Personalized User Experience." "Therefore, although Yahoo will continue to offer Ad Interest Manager and other tools, we will not recognize IE10's default DNT signal on Yahoo properties at this time," it said.

[ Background: Do Not Track: 7 Key Facts. ]

Yahoo's Ad Interest Manager, introduced in 2009, is billed by the search company as "a central place where Yahoo visitors can see a concise summary of their online activity and make easy, constructive choices about their exposure to interest-based advertising served from the Yahoo Ad Network." The page allows users to curtail -- or fully opt out -- of so-called interest-based advertising. In other words, it's the type of feature that would be expressly enabled or disabled by DNT, should Yahoo wish to pay attention to that setting.

Yahoo's tortured reasoning drew criticism from Chester Wisniewski, a senior security advisor at Sophos Canada. "The argument is hollow and isn't open and honest. Yahoo wants to provide advertisers the ability to target its users to generate revenue," he said in a blog post.

But instead of making such advertising clear to users, or the benefit it provides even a selling point, Yahoo instead couches its argument in terms of user intent. "Why not be open and suggest to users that providing great financial, news, sports and entertainment content requires advertising partners?" said Wisniewski, noting that in contrast, Microsoft isn't hiding what it's doing. Notably, the "express" installation settings for IE10 explicitly state that DNT will be enabled, unless users opt to alter that setting. "If you want to talk big about privacy, put your money where your mouth is. I don't begrudge you your methods, but respect my choices," he said. "Microsoft fairly presents a choice and you need to honor it or become irrelevant."

In its public denouncement, Yahoo joins the Association of National Advertisers (ANA), which recently launched a concerted advertising effort aimed at discrediting Microsoft's DNT-active-by-default move, criticizing it for "unilaterally [imposing] choices on the consumer." ANA president and CEO Bob Liodice also warned in a statement that "Microsoft's decision undercuts the effectiveness of our brand owners' Internet advertising and undermines the industry's self-regulatory system."

Another Microsoft critic is the developer of Apache HTTP, Roy Fielding, who helped create the DNT standard. He proposed a patch for Apache, which runs nearly two-thirds of the world's websites, that would make Apache websites ignore IE10 DNT settings altogether, as a way to "deal with user agents that deliberately violate open standards" -- meaning Microsoft.

DNT was developed through the self-regulated Digital Advertising Alliance. Although some refer to it as a "standard," a more accurate description might be "negotiated truce," specifically between privacy advocates and advertising advocates. The White House has been pushing all concerned parties to implement some type of "do not track" principle, as part of the broader Consumer Privacy Bill of Rights introduced by the Obama administration earlier this year. But those proposals so far lack the force of law, and thus require advertisers to voluntarily agree to abide by them.

Time to patch your security policy to address people bringing their own mobile devices to work. Also in the new Holes In BYOD issue of Dark Reading: Metasploit creator HD Moore has five practical security tips for business travelers. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-0460
Published: 2014-04-16
The init script in kbd, possibly 1.14.1 and earlier, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/defkeymap.map.

CVE-2011-0993
Published: 2014-04-16
SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.

CVE-2011-3180
Published: 2014-04-16
kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

CVE-2011-4089
Published: 2014-04-16
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.

CVE-2011-4192
Published: 2014-04-16
kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double quotes in kiwi_oemtitle of .profile."

Best of the Web