Risk
10/30/2012
01:55 PM
Connect Directly
RSS
E-Mail
50%
50%

Yahoo To Ignore IE10 DNT Settings

Yahoo says Internet users' preferences aren't being accurately reflected by having "do not track" enabled by default.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
Memo from Yahoo to users of Microsoft Internet Explorer 10: Prepare to be tracked.

Yahoo, the company behind the eponymous search engine, announced Friday that it's the latest organization planning to ignore the "do not track" (DNT) setting, or flag, broadcast by IE10.

Yahoo's proffered reasoning is that by making the privacy control active by default, Microsoft is ignoring the wishes of its users. "Ultimately, we believe that DNT must map to user intent -- not to the intent of one browser creator, plug-in writer, or third-party software service," said a statement released by Yahoo, titled "In Support of a Personalized User Experience." "Therefore, although Yahoo will continue to offer Ad Interest Manager and other tools, we will not recognize IE10's default DNT signal on Yahoo properties at this time," it said.

[ Background: Do Not Track: 7 Key Facts. ]

Yahoo's Ad Interest Manager, introduced in 2009, is billed by the search company as "a central place where Yahoo visitors can see a concise summary of their online activity and make easy, constructive choices about their exposure to interest-based advertising served from the Yahoo Ad Network." The page allows users to curtail -- or fully opt out -- of so-called interest-based advertising. In other words, it's the type of feature that would be expressly enabled or disabled by DNT, should Yahoo wish to pay attention to that setting.

Yahoo's tortured reasoning drew criticism from Chester Wisniewski, a senior security advisor at Sophos Canada. "The argument is hollow and isn't open and honest. Yahoo wants to provide advertisers the ability to target its users to generate revenue," he said in a blog post.

But instead of making such advertising clear to users, or the benefit it provides even a selling point, Yahoo instead couches its argument in terms of user intent. "Why not be open and suggest to users that providing great financial, news, sports and entertainment content requires advertising partners?" said Wisniewski, noting that in contrast, Microsoft isn't hiding what it's doing. Notably, the "express" installation settings for IE10 explicitly state that DNT will be enabled, unless users opt to alter that setting. "If you want to talk big about privacy, put your money where your mouth is. I don't begrudge you your methods, but respect my choices," he said. "Microsoft fairly presents a choice and you need to honor it or become irrelevant."

In its public denouncement, Yahoo joins the Association of National Advertisers (ANA), which recently launched a concerted advertising effort aimed at discrediting Microsoft's DNT-active-by-default move, criticizing it for "unilaterally [imposing] choices on the consumer." ANA president and CEO Bob Liodice also warned in a statement that "Microsoft's decision undercuts the effectiveness of our brand owners' Internet advertising and undermines the industry's self-regulatory system."

Another Microsoft critic is the developer of Apache HTTP, Roy Fielding, who helped create the DNT standard. He proposed a patch for Apache, which runs nearly two-thirds of the world's websites, that would make Apache websites ignore IE10 DNT settings altogether, as a way to "deal with user agents that deliberately violate open standards" -- meaning Microsoft.

DNT was developed through the self-regulated Digital Advertising Alliance. Although some refer to it as a "standard," a more accurate description might be "negotiated truce," specifically between privacy advocates and advertising advocates. The White House has been pushing all concerned parties to implement some type of "do not track" principle, as part of the broader Consumer Privacy Bill of Rights introduced by the Obama administration earlier this year. But those proposals so far lack the force of law, and thus require advertisers to voluntarily agree to abide by them.

Time to patch your security policy to address people bringing their own mobile devices to work. Also in the new Holes In BYOD issue of Dark Reading: Metasploit creator HD Moore has five practical security tips for business travelers. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3861
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element.

CVE-2014-3862
Published: 2014-09-02
CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log.

CVE-2014-5076
Published: 2014-09-02
The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as demonstrated by the drozer framework.

CVE-2014-5452
Published: 2014-09-02
CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allows remote attackers to conduct XSS attacks via a document containing a table that is improperly handled during unrestricted xsl:copy operations.

CVE-2014-6041
Published: 2014-09-02
The Android Browser application 4.2.1 on Android allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u0000 character, as demonstrated by an onclick="window.open('\u0000javascript: sequence.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.