Risk
10/30/2012
01:55 PM
Connect Directly
RSS
E-Mail
50%
50%

Yahoo To Ignore IE10 DNT Settings

Yahoo says Internet users' preferences aren't being accurately reflected by having "do not track" enabled by default.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
Memo from Yahoo to users of Microsoft Internet Explorer 10: Prepare to be tracked.

Yahoo, the company behind the eponymous search engine, announced Friday that it's the latest organization planning to ignore the "do not track" (DNT) setting, or flag, broadcast by IE10.

Yahoo's proffered reasoning is that by making the privacy control active by default, Microsoft is ignoring the wishes of its users. "Ultimately, we believe that DNT must map to user intent -- not to the intent of one browser creator, plug-in writer, or third-party software service," said a statement released by Yahoo, titled "In Support of a Personalized User Experience." "Therefore, although Yahoo will continue to offer Ad Interest Manager and other tools, we will not recognize IE10's default DNT signal on Yahoo properties at this time," it said.

[ Background: Do Not Track: 7 Key Facts. ]

Yahoo's Ad Interest Manager, introduced in 2009, is billed by the search company as "a central place where Yahoo visitors can see a concise summary of their online activity and make easy, constructive choices about their exposure to interest-based advertising served from the Yahoo Ad Network." The page allows users to curtail -- or fully opt out -- of so-called interest-based advertising. In other words, it's the type of feature that would be expressly enabled or disabled by DNT, should Yahoo wish to pay attention to that setting.

Yahoo's tortured reasoning drew criticism from Chester Wisniewski, a senior security advisor at Sophos Canada. "The argument is hollow and isn't open and honest. Yahoo wants to provide advertisers the ability to target its users to generate revenue," he said in a blog post.

But instead of making such advertising clear to users, or the benefit it provides even a selling point, Yahoo instead couches its argument in terms of user intent. "Why not be open and suggest to users that providing great financial, news, sports and entertainment content requires advertising partners?" said Wisniewski, noting that in contrast, Microsoft isn't hiding what it's doing. Notably, the "express" installation settings for IE10 explicitly state that DNT will be enabled, unless users opt to alter that setting. "If you want to talk big about privacy, put your money where your mouth is. I don't begrudge you your methods, but respect my choices," he said. "Microsoft fairly presents a choice and you need to honor it or become irrelevant."

In its public denouncement, Yahoo joins the Association of National Advertisers (ANA), which recently launched a concerted advertising effort aimed at discrediting Microsoft's DNT-active-by-default move, criticizing it for "unilaterally [imposing] choices on the consumer." ANA president and CEO Bob Liodice also warned in a statement that "Microsoft's decision undercuts the effectiveness of our brand owners' Internet advertising and undermines the industry's self-regulatory system."

Another Microsoft critic is the developer of Apache HTTP, Roy Fielding, who helped create the DNT standard. He proposed a patch for Apache, which runs nearly two-thirds of the world's websites, that would make Apache websites ignore IE10 DNT settings altogether, as a way to "deal with user agents that deliberately violate open standards" -- meaning Microsoft.

DNT was developed through the self-regulated Digital Advertising Alliance. Although some refer to it as a "standard," a more accurate description might be "negotiated truce," specifically between privacy advocates and advertising advocates. The White House has been pushing all concerned parties to implement some type of "do not track" principle, as part of the broader Consumer Privacy Bill of Rights introduced by the Obama administration earlier this year. But those proposals so far lack the force of law, and thus require advertisers to voluntarily agree to abide by them.

Time to patch your security policy to address people bringing their own mobile devices to work. Also in the new Holes In BYOD issue of Dark Reading: Metasploit creator HD Moore has five practical security tips for business travelers. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.