Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/24/2011
02:33 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Mozilla, Google Propose Defenses Against Ad Tracking

Will self-regulation will be any more effective in the future than it has been in the past?

In the wake of a Federal Trade Commission threat last month to take action against companies that violate consumers’ privacy though behavioral ad tracking, Google and Mozilla this week proposed new tools to help consumers gain more control over ad tracking cookies.

The FTC's December report, "Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers," calls for the implementation of a “Do Not Track” mechanism," similar in concept to the National Do Not Call Registry.

Yet even as the report suggests that industry self-regulation hasn't worked, it continues to recommend self-regulation, without imposing any substantive penalties for lack of compliance.

Google on Monday acknowledged the shortcomings of existing self-regulatory measures, such as the Network Advertising Initiative and the Self-Regulatory Principles for Online Behavioral Advertising. The principal problem with such programs in Google's eyes is that users who have chosen to opt-out of ad tracking have that decision erased if they ever clear their browser cookies. Also, past settings may not cover ad tracking cookies placed by companies that launched after the user set his or her ad tracking preferences.

So Google is offering a browser extension called Keep My Opt-Outs, which will store a user's opt-out preferences even if he or she subsequently deletes his or her browser cookies. This extension is intended to serve as a complement to Google's existing Advertising Cookie Opt-out Plugin.

"[W]e’ve designed the extension so that it should not otherwise interfere with your Web browsing experience or Web site functionality," explain Google product managers Sean Harvey and Rajas Moonka in a blog post. "This new feature gives you significant control without compromising the revenue that fuels the Web content that we all consume every day."

Mozilla meanwhile is proposing a Do Not Track HTTP header that will allow browser users to transmit their desire to opt-out of behavioral ad targeting to Web servers.

"When the feature is enabled and users turn it on, Web sites will be told by Firefox that a user would like to opt-out of [online behavioral advertising]," said Alex Fowler, Mozilla's head of global privacy and public policy, in a blog post. "We believe the header-based approach has the potential to be better for the Web in the long run because it is a clearer and more universal opt-out mechanism than cookies or blacklists."

Anup Ghosh, founder and chief scientist of Invincea, a browser security company, finds both approaches lacking. Mozilla's proposal, he says, is a "paper tiger."

"It's basically up to Web sites to do something or nothing with [users' preference information]," he said in a phone interview. "It's not enforceable."

Microsoft recently discussed a similar privacy feature in Internet Explorer 9. Ghosh says that while he was initially critical of what Microsoft was doing, the Mozilla proposal makes him think better of what's coming in IE9, even though Microsoft's privacy plan puts the onus on the user to identify the cookies to be blocked.

Without any penalties for lack of compliance, Mozilla's proposal, he suggests, ends up harming those companies that choose to comply rather than those that do not.

Google's approach, he observes, requires users to download and install software. "Most users aren't going to be doing that," he said.

Faced with solutions of dubious efficacy, users may resort to technology that already works: ad blocking extensions. Ghosh concedes that ad blocking extensions will prevent cookies from being placed. "But the industry doesn't want to go that way," he said. "Advertising pays for free content."

That leaves open the question of how much the ad industry really wants to pay for privacy.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32606
PUBLISHED: 2021-05-11
In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-free. (This does not affect earlier versions that lack CAN ISOTP SF_BROADCAST support.)
CVE-2021-3504
PUBLISHED: 2021-05-11
A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to...
CVE-2021-20309
PUBLISHED: 2021-05-11
A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to ...
CVE-2021-20310
PUBLISHED: 2021-05-11
A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this...
CVE-2021-20311
PUBLISHED: 2021-05-11
A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker processed by an application using ImageMagick. The highest threat from t...