Risk
10/30/2012
01:55 PM
Connect Directly
RSS
E-Mail
50%
50%

Yahoo To Ignore IE10 DNT Settings

Yahoo says Internet users' preferences aren't being accurately reflected by having "do not track" enabled by default.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
Memo from Yahoo to users of Microsoft Internet Explorer 10: Prepare to be tracked.

Yahoo, the company behind the eponymous search engine, announced Friday that it's the latest organization planning to ignore the "do not track" (DNT) setting, or flag, broadcast by IE10.

Yahoo's proffered reasoning is that by making the privacy control active by default, Microsoft is ignoring the wishes of its users. "Ultimately, we believe that DNT must map to user intent -- not to the intent of one browser creator, plug-in writer, or third-party software service," said a statement released by Yahoo, titled "In Support of a Personalized User Experience." "Therefore, although Yahoo will continue to offer Ad Interest Manager and other tools, we will not recognize IE10's default DNT signal on Yahoo properties at this time," it said.

[ Background: Do Not Track: 7 Key Facts. ]

Yahoo's Ad Interest Manager, introduced in 2009, is billed by the search company as "a central place where Yahoo visitors can see a concise summary of their online activity and make easy, constructive choices about their exposure to interest-based advertising served from the Yahoo Ad Network." The page allows users to curtail -- or fully opt out -- of so-called interest-based advertising. In other words, it's the type of feature that would be expressly enabled or disabled by DNT, should Yahoo wish to pay attention to that setting.

Yahoo's tortured reasoning drew criticism from Chester Wisniewski, a senior security advisor at Sophos Canada. "The argument is hollow and isn't open and honest. Yahoo wants to provide advertisers the ability to target its users to generate revenue," he said in a blog post.

But instead of making such advertising clear to users, or the benefit it provides even a selling point, Yahoo instead couches its argument in terms of user intent. "Why not be open and suggest to users that providing great financial, news, sports and entertainment content requires advertising partners?" said Wisniewski, noting that in contrast, Microsoft isn't hiding what it's doing. Notably, the "express" installation settings for IE10 explicitly state that DNT will be enabled, unless users opt to alter that setting. "If you want to talk big about privacy, put your money where your mouth is. I don't begrudge you your methods, but respect my choices," he said. "Microsoft fairly presents a choice and you need to honor it or become irrelevant."

In its public denouncement, Yahoo joins the Association of National Advertisers (ANA), which recently launched a concerted advertising effort aimed at discrediting Microsoft's DNT-active-by-default move, criticizing it for "unilaterally [imposing] choices on the consumer." ANA president and CEO Bob Liodice also warned in a statement that "Microsoft's decision undercuts the effectiveness of our brand owners' Internet advertising and undermines the industry's self-regulatory system."

Another Microsoft critic is the developer of Apache HTTP, Roy Fielding, who helped create the DNT standard. He proposed a patch for Apache, which runs nearly two-thirds of the world's websites, that would make Apache websites ignore IE10 DNT settings altogether, as a way to "deal with user agents that deliberately violate open standards" -- meaning Microsoft.

DNT was developed through the self-regulated Digital Advertising Alliance. Although some refer to it as a "standard," a more accurate description might be "negotiated truce," specifically between privacy advocates and advertising advocates. The White House has been pushing all concerned parties to implement some type of "do not track" principle, as part of the broader Consumer Privacy Bill of Rights introduced by the Obama administration earlier this year. But those proposals so far lack the force of law, and thus require advertisers to voluntarily agree to abide by them.

Time to patch your security policy to address people bringing their own mobile devices to work. Also in the new Holes In BYOD issue of Dark Reading: Metasploit creator HD Moore has five practical security tips for business travelers. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4973
Published: 2014-09-23
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in ESET Smart Security and ESET Endpoint Security products 5.0 through 7.0 allows local users to gain privileges via a crafted argument to a 0x830020CC IOCTL call.

CVE-2014-5392
Published: 2014-09-23
XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference.

CVE-2014-6646
Published: 2014-09-23
The bellyhoodcom (aka com.tapatalk.bellyhoodcom) application 3.4.23 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6647
Published: 2014-09-23
The ElForro.com (aka com.tapatalk.elforrocom) application 2.4.3.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6648
Published: 2014-09-23
The iPhone4.TW (aka com.tapatalk.iPhone4TWforums) application 3.3.20 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Best of the Web
Dark Reading Radio