Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/24/2011
02:33 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Mozilla, Google Propose Defenses Against Ad Tracking

Will self-regulation will be any more effective in the future than it has been in the past?

In the wake of a Federal Trade Commission threat last month to take action against companies that violate consumers’ privacy though behavioral ad tracking, Google and Mozilla this week proposed new tools to help consumers gain more control over ad tracking cookies.

The FTC's December report, "Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers," calls for the implementation of a “Do Not Track” mechanism," similar in concept to the National Do Not Call Registry.

Yet even as the report suggests that industry self-regulation hasn't worked, it continues to recommend self-regulation, without imposing any substantive penalties for lack of compliance.

Google on Monday acknowledged the shortcomings of existing self-regulatory measures, such as the Network Advertising Initiative and the Self-Regulatory Principles for Online Behavioral Advertising. The principal problem with such programs in Google's eyes is that users who have chosen to opt-out of ad tracking have that decision erased if they ever clear their browser cookies. Also, past settings may not cover ad tracking cookies placed by companies that launched after the user set his or her ad tracking preferences.

So Google is offering a browser extension called Keep My Opt-Outs, which will store a user's opt-out preferences even if he or she subsequently deletes his or her browser cookies. This extension is intended to serve as a complement to Google's existing Advertising Cookie Opt-out Plugin.

"[W]e’ve designed the extension so that it should not otherwise interfere with your Web browsing experience or Web site functionality," explain Google product managers Sean Harvey and Rajas Moonka in a blog post. "This new feature gives you significant control without compromising the revenue that fuels the Web content that we all consume every day."

Mozilla meanwhile is proposing a Do Not Track HTTP header that will allow browser users to transmit their desire to opt-out of behavioral ad targeting to Web servers.

"When the feature is enabled and users turn it on, Web sites will be told by Firefox that a user would like to opt-out of [online behavioral advertising]," said Alex Fowler, Mozilla's head of global privacy and public policy, in a blog post. "We believe the header-based approach has the potential to be better for the Web in the long run because it is a clearer and more universal opt-out mechanism than cookies or blacklists."

Anup Ghosh, founder and chief scientist of Invincea, a browser security company, finds both approaches lacking. Mozilla's proposal, he says, is a "paper tiger."

"It's basically up to Web sites to do something or nothing with [users' preference information]," he said in a phone interview. "It's not enforceable."

Microsoft recently discussed a similar privacy feature in Internet Explorer 9. Ghosh says that while he was initially critical of what Microsoft was doing, the Mozilla proposal makes him think better of what's coming in IE9, even though Microsoft's privacy plan puts the onus on the user to identify the cookies to be blocked.

Without any penalties for lack of compliance, Mozilla's proposal, he suggests, ends up harming those companies that choose to comply rather than those that do not.

Google's approach, he observes, requires users to download and install software. "Most users aren't going to be doing that," he said.

Faced with solutions of dubious efficacy, users may resort to technology that already works: ad blocking extensions. Ghosh concedes that ad blocking extensions will prevent cookies from being placed. "But the industry doesn't want to go that way," he said. "Advertising pays for free content."

That leaves open the question of how much the ad industry really wants to pay for privacy.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16632
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
CVE-2021-32073
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2021-33033
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
CVE-2021-33034
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
CVE-2019-25044
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.