10 ms·

What does "bypassed privacy settings of Apple’s Safari browser" mean? Ignoring the DNT header? Setting third party cookies? Something about ITP? This article h

by Sephr 8y ago

What does "bypassed privacy settings of Apple’s Safari browser" mean? Ignoring the DNT header? Setting third party cookies? Something about ITP? This article has practically no details about the actual accusation.

kyrra 8y ago
It seems it's related to the same issue the FTC went after Google for: https://www.ftc.gov/news-events/press-releases/2012/08/google-will-pay-225-million-settle-ftc-charges-it-misrepresented https://www.ftc.gov/news-events/press-releases/2012/08/googl...
- DannyBee 8y ago
  Yeah, the facts seem identical. I'm actually a little surprised it wouldn't be over the statute of limitations, but i also don't know all the filing details here.
  - mjw1007 8y ago
    For what it's worth, their FAQ says « If this happened in 2011, why is the claim only being brought now? In 2015, three individuals brought a claim against Google claiming their privacy rights had been breached by Google using the Safari Workaround. That case, Vidal Hall v Google, settled on confidential terms, but the Court found that the claim raised serious issues which merited a full trial. That case opened the door to holding Google to account by bringing an action on behalf of the millions of iPhone users affected by Google’s actions and claim the compensation they may be owed. » The current case seems to have been filed in November 2017.
ocdtrekkie 8y ago
> Specifically, Google used a bit of JavaScript code – the workaround – to bypass Safari’s default blocking of third-party cookies (set by domains other than those being visited) in order to allow sites within its DoubleClick ad network to track users. https://nakedsecurity.sophos.com/2017/11/30/google-sued-over-iphone-safari-workaround-data-snooping/ https://nakedsecurity.sophos.com/2017/11/30/google-sued-over...
- ams6110 8y ago
  While I don't condone bypassing a users intent, I'm struggling to see the damage claim here. So some Safari users got more targeted ads than they would otherwise have seen. Does that merit financial compensation?
  - samb1729 8y ago
    > So some Safari users got more targeted ads than they would otherwise have seen. Does that merit financial compensation? Given that the way it occurs is by allowing Google to more accurately profile the users, I'd say yes.
  - newscracker 8y ago
    It's more about being tracked and profiled through third party cookies than just seeing targeted ads. In my view, it merits compensation for the users and stiff penalties and punishments for the perpetrator (Google, in this case).
  - pyrale 8y ago
    On the other hand, does violating human rights (such as the right to privacy) deserve punitive litigation ? Yes, certainly.
  - jhayward 8y ago
    > So some Safari users got more targeted ads than they would otherwise have seen. So, some users had their browsing habits illegally harvested, stored, analyzed, and sold to an unknown number of parties for an unknown number of purposes, many of them adverserial in nature to the well-being of the individual. So what?
    - fixermark 8y ago
      It will be interesting to see how many of the items on that list the plaintiffs can prove in a court of law, as such proof would be necessary to claim of damages... Well, in US law at least, as I understand it. I'm a lot less familiar with the UK. But even under a civil-court "preponderance of evidence" standard, wouldn't you have to prove some material harm to be eligible for damages (not just the potential of the data perhaps maybe being misused possibly)?
Ajedi32 8y ago
It's been a long time since this incident occurred, but from what I remember, Safari had/has a (non-default?) setting that blocked third party cookies, but allowed them upon user interaction. At some point Google added +1 buttons to their ads, and some aspect of how they implemented that tricked Safari into thinking the user interacted with the ad even when they didn't and allowed cookies to be sent. After this was pointed out Google updated the +1 buttons to no longer trigger this behavior in Safari. (Correct me if I'm wrong; this all happened years ago so I may be misremembering.)
- yuhong 8y ago
  I mentioned it in the essay: http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozilla-essay-final.html http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozi...
- ballenf 8y ago
  > After this was pointed out Google updated the +1 buttons Has Google ever claimed that the code had an innocent purpose and the privacy-bypass was purely accidental in nature? The descriptions of the code imply that not breaking Safari's privacy features required much less and much simpler code than what was in place. If they didn't, then it wasn't so much as having it "pointed out" as "found out". The context at the time (as best I recall) was this came on the heals of the wifi-snooping street view cars that cracked weak wifi encryption and recorded traffic, so maybe people weren't in the mood to listen to any defense.
  - abraham 8y ago
    The street view cars didn't crack any encryption. https://www.theguardian.com/technology/2010/may/15/google-admits-storing-private-data https://www.theguardian.com/technology/2010/may/15/google-ad...

by Sephr 8y ago

kyrra 8y ago

It seems it's related to the same issue the FTC went after Google for: https://www.ftc.gov/news-events/press-releases/2012/08/google-will-pay-225-million-settle-ftc-charges-it-misrepresented https://www.ftc.gov/news-events/press-releases/2012/08/googl...

DannyBee 8y ago
Yeah, the facts seem identical. I'm actually a little surprised it wouldn't be over the statute of limitations, but i also don't know all the filing details here.
- mjw1007 8y ago
  For what it's worth, their FAQ says « If this happened in 2011, why is the claim only being brought now? In 2015, three individuals brought a claim against Google claiming their privacy rights had been breached by Google using the Safari Workaround. That case, Vidal Hall v Google, settled on confidential terms, but the Court found that the claim raised serious issues which merited a full trial. That case opened the door to holding Google to account by bringing an action on behalf of the millions of iPhone users affected by Google’s actions and claim the compensation they may be owed. » The current case seems to have been filed in November 2017.

ocdtrekkie 8y ago

> Specifically, Google used a bit of JavaScript code – the workaround – to bypass Safari’s default blocking of third-party cookies (set by domains other than those being visited) in order to allow sites within its DoubleClick ad network to track users. https://nakedsecurity.sophos.com/2017/11/30/google-sued-over-iphone-safari-workaround-data-snooping/ https://nakedsecurity.sophos.com/2017/11/30/google-sued-over...

ams6110 8y ago
While I don't condone bypassing a users intent, I'm struggling to see the damage claim here. So some Safari users got more targeted ads than they would otherwise have seen. Does that merit financial compensation?
- samb1729 8y ago
  > So some Safari users got more targeted ads than they would otherwise have seen. Does that merit financial compensation? Given that the way it occurs is by allowing Google to more accurately profile the users, I'd say yes.
- newscracker 8y ago
  It's more about being tracked and profiled through third party cookies than just seeing targeted ads. In my view, it merits compensation for the users and stiff penalties and punishments for the perpetrator (Google, in this case).
- pyrale 8y ago
  On the other hand, does violating human rights (such as the right to privacy) deserve punitive litigation ? Yes, certainly.
- jhayward 8y ago
  > So some Safari users got more targeted ads than they would otherwise have seen. So, some users had their browsing habits illegally harvested, stored, analyzed, and sold to an unknown number of parties for an unknown number of purposes, many of them adverserial in nature to the well-being of the individual. So what?
  - fixermark 8y ago
    It will be interesting to see how many of the items on that list the plaintiffs can prove in a court of law, as such proof would be necessary to claim of damages... Well, in US law at least, as I understand it. I'm a lot less familiar with the UK. But even under a civil-court "preponderance of evidence" standard, wouldn't you have to prove some material harm to be eligible for damages (not just the potential of the data perhaps maybe being misused possibly)?

Ajedi32 8y ago

It's been a long time since this incident occurred, but from what I remember, Safari had/has a (non-default?) setting that blocked third party cookies, but allowed them upon user interaction. At some point Google added +1 buttons to their ads, and some aspect of how they implemented that tricked Safari into thinking the user interacted with the ad even when they didn't and allowed cookies to be sent. After this was pointed out Google updated the +1 buttons to no longer trigger this behavior in Safari. (Correct me if I'm wrong; this all happened years ago so I may be misremembering.)

yuhong 8y ago
I mentioned it in the essay: http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozilla-essay-final.html http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozi...
ballenf 8y ago
> After this was pointed out Google updated the +1 buttons Has Google ever claimed that the code had an innocent purpose and the privacy-bypass was purely accidental in nature? The descriptions of the code imply that not breaking Safari's privacy features required much less and much simpler code than what was in place. If they didn't, then it wasn't so much as having it "pointed out" as "found out". The context at the time (as best I recall) was this came on the heals of the wifi-snooping street view cars that cracked weak wifi encryption and recorded traffic, so maybe people weren't in the mood to listen to any defense.
- abraham 8y ago
  The street view cars didn't crack any encryption. https://www.theguardian.com/technology/2010/may/15/google-admits-storing-private-data https://www.theguardian.com/technology/2010/may/15/google-ad...