12 ms·

From the IE Team: Google Bypassing User Privacy Settings

313 points by ecaron 15y ago

deleted 15y ago
[deleted]
luser001 15y ago
I saw this header a few days ago in curl, and I wondered why Google would send something like this. Now I know. P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
capocani 15y ago
http://support.google.com/accounts/bin/answer.py?hl=en&answer=151657 http://support.google.com/accounts/bin/answer.py?hl=en&a... In some situations, the cookies we use to secure and authenticate your Google Account and store your preferences may be served from a different domain than the website you're visiting. This may happen, for example, if you visit websites with Google +1 buttons, or if you sign into a Google gadget on iGoogle. Some browsers require third party cookies to use the P3P protocol to state their privacy practices. However, the P3P protocol was not designed with situations like these in mind. As a result, we've inserted a link into our cookies that directs users to a page where they can learn more about the privacy practices associated with these cookies. Information that Google collects in association with these cookies is subject to our Privacy Policy. Doesn't seem nefarious.
- mbetter 15y ago
  Someone instructs their browser to not accept third party cookies, full stop. Google then does something, mumbles a bit, and then sets a third party cookie. How isn't this nefarious?
  - capocani 15y ago
    It's not as if the users set IE to read P3P headers so technically they didn't override any user settings. P3P is lacking: http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enough-for-a-cookie-to-fit-through/ http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enou...
    - huxley 15y ago
      So P3P is flawed and IE implements a flawed standard. Granted. Google is still using this flaw to override the user setting "Do not allow 3rd party cookies" to allow themselves to track users. There is no "technically" about this, they've misused the standard to override user settings.
      - mattmcknight 15y ago
        Not exactly. The user setting is inaccurate, as it actually should have said "Do not allow 3rd party cookies, except for those from sites which have a code that indicates they aren't tracking cookies or a code we don't understand." Instead it says "Third Party Cookies" with choices of Accept, Block, or Prompt.
        recoiledsnake 15y ago
        >Not exactly. The user setting is inaccurate, as it actually should have said "Do not allow 3rd party cookies, except for those from sites which have a code that indicates they aren't tracking cookies or a code we don't understand." That's exactly what they do. >Instead it says "Third Party Cookies" with choices of Accept, Block, or Prompt. No, it doesn't. You sound as if you have researched it, but you seem to be trying to mislead folks by spreading nonsense.
        mattmcknight 15y ago
        Hmm....you act as if you have looked at it, but you haven't. You simply lie.
    - ugh 15y ago
      Is that really so hard to understand? Google is intentionally using the loophole. They are intentionally circumventing users’ wishes. That’s nefarious. It’s first and foremost a moral failing. That’s exactly the problem. Just because it’s possible doesn’t mean it’s right. That the loophole exists is a separate issue that also has to be remedied – but it doesn’t make Google’s behavior any less evil.
  - freehunter 15y ago
    If by "mumbles a bit" you mean not supporting an unsupported and defunct proposed "standard" that doesn't work in practice and is only implemented in IE, then yeah.
    - kevingadd 15y ago
      It's a W3C recommendation. Scare quotes around the word standard are unnecessary, since a vast number of current web standards came out of W3C processes. Or is it not 'standards-compliant' when WebKit implements features that only WebKit has, even if they're from W3C standards?
      - eli 15y ago
        It's not really much of a standard if no one references it in the real world. And the W3C standards are most successful when they document how technology is already being used in the wild. Proscriptive web standards handed down from on high have historically not fared well. Plenty of W3C standards are duds.
      - freehunter 15y ago
        Why does everyone always assume quotes are used as scare quotes? I quoted "standard" because it's not a standard. If the standards body no longer exists and no one follows the standard, it's not a standard.
        pessimizer 15y ago
        That's the definition of scare quotes. "Scare quotes are quotation marks placed around a word or phrase to indicate that it does not signify its literal or conventional meaning." "If scare quotes are enclosing a word or phrase that does not represent a quotation from another source they may simply serve to alert the reader that the word or phrase is used in an unusual, special, or non-standard way or should be understood to include caveats to the conventional meaning." http://en.wikipedia.org/wiki/Scare_quotes http://en.wikipedia.org/wiki/Scare_quotes
  - mattmcknight 15y ago
    The nefarious bit is in IE- which, although it pretends to allow you to "instruct the browser not to accept 3rd party cookies, full stop," actually accepts third party cookies from any site with a P3P code it doesn't understand.
    - dos1 15y ago
      So do you work at Google or are you just a fanboy? IE is not being nefarious in this case. IE is following a standard that Google is actively abusing. Not sure why you have such an infatuation with Google, but I dare say: Everything in moderation.
      - tikhonj 15y ago
        Could you please avoid personal attacks? They add nothing to your argument while making the discussion less pleasant and civil. I don't mean to single you out, but I've just been seeing too many of them lately.
    - recoiledsnake 15y ago
      >The nefarious bit is in IE- which, although it pretends to allow you to "instruct the browser not to accept 3rd party cookies, full stop," actually accepts third party cookies from any site with a P3P code it doesn't understand. No, if you select that option, it actually blocks all third party cookies.
      - mattmcknight 15y ago
        No, it actually doesn't (or this discussion wouldn't be happening).
- aaronsw 15y ago
  The dishonesty of this statement is stunning. IE is designed to only accept the cookie if Google promises not to use it for tracking. Google wants to use the cookie for tracking so they provide a dishonesty promise and then explain they're lying because IE didn't have them in mind -- when this is exactly what IE had in mind.
  - narrator 15y ago
    99% of people leave their settings at the default and don't give a damn and just want it to work. When it doesn't work it's broken. Period, end of story. They will say: "Shut up with your geeky explanation" when you explain to them your options. There may be a really long complicated answer as to why it doesn't work but 99% of users don't gives a crap. If you are a smart guy you can just use ad block. There, done. Microsoft is very well aware of the fact that users never change the default settings and IMHO would love to use this to break Google by default and destroy their business model. This fits in well with the usual MS tactics of spreading paranoia, incompatibility, legal threats, obfuscation and confusion. IMHO, Microsoft would love to exploit privacy fears to remove features from the web and break it so everyone just goes back to the desktop. In my opinion, if they could get away with breaking an ajax call, because hey they might be tracking you, they would in order to kill usability of web software in favor of the desktop software model. They will try anything they possibly can to win. Did you ever see the list of IE6 features that got canned (e.g "Smart Tags") because of the antitrust investigation? It makes me shudder what the web would be like with these jerks in control.
- gojomo 15y ago
  Doesn't seem nefarious. That's why it's a brilliant piece of passive-aggressive engineering! It undermines both the letter and intent of P3P, while ostensibly informing the user. The exact same string is a lie to the protocol, but the truth when read by a person outside of the protocol-context! It's kind of like a file that's both a legal and harmless GIF and a malicious executable Java JAR. (Look up [GIFAR vulnerability] for more details.)
- huxley 15y ago
  According to the article, Google has done it in a way that indicates (according to the P3P protocol) "that the cookie will not be used for any tracking purpose or any purpose at all." Basically they are abusing the standard to force P3P browsers to override the user's choice to block 3rd party cookies, by telling the browser that the cookie isn't intended for tracking, but Google is using it to track users. That's kinda of appalling privacy-wise. Maybe it isn't maliciously intended, which is what you mean, but it is an intentional misuse of a browser feature to force user tracking.
- recoiledsnake 15y ago
  Interesting, but are they using the cookies for ad tracking too, eg. adding pages with +1 buttons to your ad tracking profile? > However, the P3P protocol was not designed with situations like these in mind. In that case, the P3P protocol was EXACTLY designed with this in mind.
- kstenerud 15y ago
  So does this mean that things such as "like" and "+1" buttons don't work unless you subvert the P3P protocol?
  - spullara 15y ago
    It means that they don't work unless the user enables tracking by third parties on first party websites.
    - kstenerud 15y ago
      So if someone goes to Mashable and clicks a "like" button, it won't work unless they specifically allow 3rd party tracking on Mashable? And then again on the WSJ, and again on Youtube? Or is it that they need to allow Facebook tracking once and then it works on all sites that have a "like" button? If it's the former, then I'd say P3P is horribly broken and bypassing it for "like" buttons would be the only way to make things work. And even if it's the latter, giving a site carte blanche tracking rights seems too coarse for comfort (unless you could grant permission ONLY for "like" buttons and nothing else).
arebop 15y ago
Oh look, Google fails to fully support features only MSIE has [http://en.wikipedia.org/wiki/P3P#Criticisms http://en.wikipedia.org/wiki/P3P#Criticisms]! Shame on them. P3P was standardized but it never got traction due to various practical problems. For example, privacy policies vary in many, sometimes-subtle, ways and nobody could figure out how to build simple software to decide automatically how to respond to these policies on behalf of users. Don't take Google's word for it, see what facebook says: http://www.facebook.com/help/?page=219494461411349 http://www.facebook.com/help/?page=219494461411349. epic.org doesn't use it either. There are some appealing ideas in P3P but in real life it doesn't actually help users protect their privacy, even on sites that actually implement it (such as Bing). The P3P working group shut down long go (http://www.w3.org/P3P/ http://www.w3.org/P3P/). This is article is just cheap shot at a competitor.
- kevingadd 15y ago
  So the fact that P3P doesn't solve all the problems it set out to solve justifies Google intentionally using it to compromise visitors' privacy in a way that directly contradicts the purpose of the header? And this is okay because it's an MSIE feature they're circumventing?
  - eli 15y ago
    Well, you have a choice: send a bogus P3P header, or break some functionality for IE users.
    - kevingadd 15y ago
      The functionality being "broken" is functionality that users DO NOT WANT and have EXPLICITLY OPTED OUT OF by configuring their browser to reject tracking cookies. If they weren't tracking cookies, you could send a VALID P3P header and your app would work.
      - eli 15y ago
        Actually it's the default in IE, not a feature people opted into. I'd be a lot less sympathetic to Google if it was a feature people opted into rather than one that IE users were unaware of.
emu 15y ago
It's a little disingenuous for the IE team to "discover" this just now. I'm pretty sure Google has been doing this for years, and it's well-known. (I certainly talked about it as part of a wider discussion about P3P policies with colleagues a year or so ago, and this isn't even my area of expertise.) I also don't much mind what companies do with tracking cookies --- I recommend using the Vanilla Cookie extension to Chrome to create a whitelist of persistent cookies. It rather nicely avoids the problem.
kylemaxwell 15y ago
I've been a Google fanboi for years and defended them in the public square when they've been accused of nefariousness. But these revelations of intentionally ignoring users' privacy settings have shaken me. Maybe it's time to put them into the Facebook category, where I removed my account years ago.
- tensor 15y ago
  It's not so much that they are intentionally ignoring users privacy as they preferring the privacy settings their users have directly given them rather than those set in the browser. I've long been opted out from all of Google's ad tracking, on their site and elsewhere: http://www.google.com/privacy/ads/ http://www.google.com/privacy/ads/ http://www.google.com/ads/preferences http://www.google.com/ads/preferences Privacy is something that few of these companies truly respects. Does Google really respect it? Probably not as much as they'd like you to believe, but at least they are willing to discuss it and provide opt out solutions.
  - recoiledsnake 15y ago
    Why not actually follow the P3P standard and then have a flag in the Ad preferences page to enable 3rd party cookies? >...as they preferring the privacy settings their users have directly given them rather than those set in the browser. That's extremely misleading. That's a default as well and not something that the user have "directly given them". I seriously doubt more than 0.1% of Google users have ever visited that page.
  - kylemaxwell 15y ago
    I'm not really happy with preferring their opt-out setting when I've already made an opt-out setting in my browser. I don't believe for a moment that Apple or Microsoft care about my privacy any more than Google does, but if I've made a choice and communicated that via browser settings, I expect information providers to respect that choice and not try to exploit the browser in an attempt to bypass my choice.
    - 15y ago
nostromo 15y ago
This seems to be a problem with the design of P3P more than anything. Browsers: "3rd-party cookies are blocked unless you add a P3P header..." Websites: "Ok. What should be in the header?" Browsers: "Anything... it doesn't matter. Just add the header then 3rd-party cookies are fine" Websites: "Ok, we'll just add a P3P header saying 'Ceci n'est pas une P3P header' then. Problem solved."
- masklinn 15y ago
  > This seems to be a problem with the design of P3P more than anything. Granted, the standard is written to be abused. On the other hand, Google's behavior is basically "well if you don't say no it's not rape. What, you were bound and gagged at the time? Well nothing I can do about that".
  - DanBC 15y ago
    Please don't use a violent real world crime as an analogy to things like setting cookies.
- gwillen 15y ago
  If you read more closely, it's not enough to _have_ a header; the header must also indicate that cookies are not used for tracking. The problem is, that indication is made with _lack_ of a particular token; and google includes a fake P3P header with no tokens in it. Thus, according to the protocol, google's header indicates that it does not use cookies for anything at all.
  - dudus 15y ago
    It's just plain wrong. The cookies can be used for tracking. You just need to tell what kind of tracking and what you do with that information. http://news.ycombinator.com/item?id=3615381 http://news.ycombinator.com/item?id=3615381
- cooldeal 15y ago
  I would expect shady sites from the dark parts of the internet to actively lie but Google? What do you think about robots.txt then? Isn't that a standard that isn't enforced as well?
Tichy 15y ago
So I take it the MS ad network doesn't track users?
- cooldeal 15y ago
  Of course it does. The question is, does it still do that even if the browser explicitly told it not to. If you have some evidence that it does, I am looking forward to seeing it. But more likely, I think you just read the headline and jumped in to comment.
  - Tichy 15y ago
    There are countless tracking mechanisms besides cookies, for example flash cookies and so on. They have been used for years. I would be surprised if any ad network would opt to not use them (I don't like it, but still).
slig 15y ago
It's been a while. And fb does it too. http://security.stackexchange.com/questions/8489/should-anyone-support-implement-p3p-policies-do-they-matter-are-they-legally http://security.stackexchange.com/questions/8489/should-anyo...
- barista 15y ago
  And that is a perfectly valid reason for Google to do it as well and bash Facebook while they are at it.
- mjs 15y ago
  There's an "IT Security" stackexchange?! WTF?! How many almost identical communities does stackexchange need?
  - smackfu 15y ago
    One for each question that is moved out of StackOverflow, of course.
  - tylerritchie 15y ago
    There aren't very many almost identical, but there are a lot of communities that have significant overlap. - Superuser - Serverfault - Database Administrators - 8.9 questions/day - IT Security - 6.9 questions/day - Healthcare IT - 1.1 questions/day The stackexchange community is all about forking. Clearly Healthcare IT, IT Security, and Database Administrators could all be tagged questions in serverfault. But apparently serverfault.com/questions/tagged/heathcare didn't sit well with the 298 people who committed to the beta. Separating power-users from IT professionals (superuser vs serverfault)is certainly reasonable even though there is a large overlap of knowledge there. Of course, without the forks, as an IT person there might be a question if your cryptography related question should go in cryptography.SE or serverfault. With a dedicated site the "correct" location for those questions is easier to determine. But if we're going to talk about overlapping stackexchanges we have to look at those populated predominantly by programmers, because... well, they are the master forkers. - stackoverflow - Programmers - Code review - Theoretical Computer Science - Code Golf - Signal Processing - Computational Science I left out the language specific ones like Mathematica and TeX. I also omitted Software QA and Cryptography. Apparently theoretical physicists and applied? physicists are unable to co-exist on one stackexchange. Anyway, clearly the stackexchange community thinks that forking is the answer. I think tagging is superior and I think fragmenting the community gets fewer able eyes focused on questions. Forking doesn't really hurt google users trying to find answers to questions that have already been answered. Even while not being a professional developer I would stick Code golf, code review, and Programmers into one stack exchange. I'd also put Signal Processing, Mathematica, Tex, and Compuational Science back in Stack Overflow and let the theoretical CS folks stay separate.
jtchang 15y ago
P3P is a load of garbage as it is implemented/written. There is no real enforcement behind it and it just causes lots of confusion. Seriously I have to go lookup what each of these acronyms are in order to figure out how my privacy is being violated? What guarantees do I even have that you are obeying P3P and not simply sending it to make me feel good. Hell while we are at it we should implement P3P for phone apps. I'm sure Path (and others) will stop uploading your address book if the P3P says "ADDRBKNOUP"
- mikemaccana 15y ago
  >Seriously I have to go lookup what each of these acronyms are in order to figure out how my privacy is being violated? No, you don't. This is mentioned in the article.
- driverdan 15y ago
  I came to the comments to say pretty much the same thing. While it's a good idea in theory, P3P is a terrible standard. It's hard to implement because there are so many acronyms and no easy reference for them. As mentioned in the article, IE has had the basic implementation of blocking 3rd party cookies if you don't use P3P for a while. I've always wanted to use honest P3P headers but it's such a PITA to generate them correctly site-by-site. Many frameworks include a generic P3P header by default with little or no mention in documentation so that's what I end up using. I spent many hours read specs, tutorials, and trying out P3P generators to no avail. Finally I decided it's not worth my time and just used default framework P3P headers.
- powertower 15y ago
  > There is no real enforcement behind it You could say the same thing about robots.txt.
  - sequoia 15y ago
    ...and you would be correct.
- im3w1l 15y ago
  "What guarantees do I even have that you are obeying P3P and not simply sending it to make me feel good." This sounds like the perfect job for a legion of lawyers.
devindotcom 15y ago
Yeah, this isn't quite the same level as the Safari one, which was a bit of a tempest in a teacup to begin with. In both cases you can partially blame the browser, though more so in this case.
yanw 15y ago
So the WSJ publishes another one of it’s alarmist articles about Google and Safari during the weekend and Microsoft wants to capitalize by pretending it just now discovered that P3P (a defunct and shitty protocol) is useless and no one uses it. NYT September 17, 2010: http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enough-for-a-cookie-to-fit-through/ http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enou... If you rely on Microsoft’s Internet Explorer’s privacy settings to control cookies on your computer, you may want to rethink that strategy. Large numbers of Web sites, including giants like Facebook, appear to be using a loophole that circumvents I.E.’s ability to block cookies, according to researchers at CyLab at the Carnegie Mellon University School of Engineering. A technical paper published by the researchers says that a third of the more than 33,000 sites they studied have technical errors that cause I.E. to allow cookies to install, even if the browser has been set to reject them. Of the 100 most visited destinations on the Internet, 21 sites had the errors, including Facebook, several of Microsoft’s own sites, Amazon, IMDB, AOL, Mapquest, GoDaddy and Hulu. Google doesn’t support a broken feature that is exclusive to IE somehow it’s their fault. If anyone ever doubted Microsoft's PR sleaziness and propaganda tactics that blog post is proof.
- recoiledsnake 15y ago
  >So Google doesn’t support an IE exclusive broken feature I am tired of this constant meme in the comments. It's one thing not to support a standard, it's another to actually go to the effort of actively subverting it. They are supporting it by sending out (fake) P3P headers. If they didn't support it, they wouldn't send P3P headers. As simple as that.
  - ootachi 15y ago
    Yeah, this is not an excuse at all. You can't argue in defense of Google from an "it's nonstandard" angle, because Google is all about nonstandard Web extensions these days -- to a much larger extent than Microsoft. You can't argue in defense of Google from a "they didn't know enough about how IE works" angle. They're Google. They created Chrome Frame, people. They know enough to solve this engineering problem. The pro-Google bias on HN is astounding.
jackalope 15y ago
This is like teams of foxes selling chicken coops and accusing the other teams of the improper placement of "No Foxes Allowed" signs. If third party cookies are bad, disallowing them should be the default, regardless of some policy header no user ever heard of or can decipher. If they really cared, they'd include a way to disallow any third party resource without having to install a plugin like RequestPolicy. That would go a long way towards fighting tracking (and multiple exploits).
- mike-cardwell 15y ago
  It is not in Googles or Microsofts interest to do that with their browsers. They both have a very large commercial interest in people using browsers that make it easy to track them. This is the main reason I stick with Firefox. I don't want to use a browser built by an advertising company.
  - ceejayoz 15y ago
    The vast majority of Mozilla's revenue comes from a search deal with Google.
    - mike-cardwell 15y ago
      Yes. And I have already heard the conspiracy theories.
scotty79 15y ago
How can you bypass something that is not a barrier? P3P is useless. P3P means "we would never..." in computer speech which is unenforceable therefore useless. Google just make no promises via P3P and places link there explaining that it doesn't and why it doesn't. Fortunately implementations of the P3P do the right thing and fold.
- recoiledsnake 15y ago
  >How can you bypass something that is not a barrier? So if tomorrow Chrome uploads all your keystrokes to Google, will that be a valid defense? >P3P means "we would never..." in computer speech which is unenforceable therefore useless. Stopping Chrome from uploading your bank passwords with today's update is unenforceable as well and hence thereby useless.
  - scotty79 15y ago
    Right. So if you are afraid of that then don't use Chrome. And if you are afraid that cookies can be used for tracking then disable them in your browser. P3P imho is useless because people whom I don't want to be tracked by will serve all the reassuring tokens in P3P and do whatever they want anyway. I want my +1 buttons to work and if that means pulling curtain on some security theater then so be it.
    - ugh 15y ago
      I see this as a predominantly moral issue. Google seems to expose itself as the people whom I don’t want to be tracked by by engaging in shady behavior. That is exactly the problem. Yes, anyone who wants to can circumvent it anyway, but that doesn’t stop us from judging those who do so negatively†. Google can be held accountable in this case (by, for example, complaining loudly about what they do) and there is nothing wrong with doing so. Just because it’s possible doesn’t mean it’s right. That the protocol sucks is in that context a separate and unrelated issue. It may be security theater, but that doesn’t make Google’s behavior any more moral†. — † Insert clever analogy here. I’m too lazy to think about one, though.
tlogan 15y ago
There are some comments here that say: P3P is garbage as implemented, so it is ok for Google to invest some time and engineering effort to trick P3P and track users via cookies. Not sure if that the valid answer but it has some merits if everybody is doing that (like downloading adress book from iPhone). Now, I have the following question: if a random website is catch doing this, is it going to marked as un-safe by security scanners?
voidr 15y ago
What about IE tracking what users are searching for? Microsoft should admit that they only care about privacy when it's convenient for them.
- ceejayoz 15y ago
  > What about IE tracking what users are searching for? What about it? A browser isn't a website, so P3P doesn't apply. Its written privacy policy applies, and likely allows such behaviour. > Microsoft should admit that they only care about privacy when it's convenient for them. I think the point being made is: so should Google.
- CurtHagenlocher 15y ago
  Microsoft, Google and Apple all agree that your privacy should not be sacrificed for the sake of their competitors making a buck.
- recoiledsnake 15y ago
  >What about IE tracking what users are searching for? What about it? Tell me more. They don't even enable Bing suggestions by default.
evmar 15y ago
After Microsoft introduced cookie-blocking features in IE they've been dancing around how to get users to block ads without telling users to install the blockers directly. Here's the blacklist they suggest in their post, which they recommend "as a protection": http://ie.microsoft.com/testdrive/browser/p3p/google.txt http://ie.microsoft.com/testdrive/browser/p3p/google.txt The "-d" lines block domains entirely, which I believe means this has the consequence of blocking Google ads entirely.
- recoiledsnake 15y ago
  >The "-d" lines block domains entirely, which I believe means this has the accidental consequence of blocking Google ads entirely. Err what? Why would disabling cookies disable displaying ads? You seem to be overly concerned about Google being unable to track the browsing habits of some people.
  - evmar 15y ago
    At least as best as I can gather from the TPL docs, they block "all third party content", which includes iframes (the mechanism used for ads). http://ie.microsoft.com/testdrive/Browser/TrackingProtectionLists/faq.html http://ie.microsoft.com/testdrive/Browser/TrackingProtection...
lawnchair_larry 15y ago
Privacy violations should be opt-in. That's what is wrong with privacy on the web.
gyardley 15y ago
Google really should have the cojones to stand up and state their actual position plainly, which as far as I can tell is this: "If you haven't taken an active, positive step to block our +1 buttons, we're going to assume you don't really care and we'll do whatever we can to show them to you, no matter what your browser's default settings are. Why? Well, because we think the default settings are bullshit, and 99 times out of 100 they're only that way because they're the default. They don't reflect actual user preferences, they reflect other browsers messing with our business plans." Not only is that an intellectually honest position, it's a lot more accurate than assuming all IE users who haven't changed their settings don't want +1 buttons.
- nikcub 15y ago
  then how would you actually block third-party cookies as a Safari user?
  - powertower 15y ago
    According to the sentiment here, that's your problem, not Google's!
    - nikcub 15y ago
      so safari needs to add a fourth option: really block all third-party cookies, and not make it default
      - pak 15y ago
        And once Google and Facebook find a workaround for that setting, they can add a fifth option: really really block all third-party cookies. Seriously, the answer here is that if a browser wants to block third-party cookies by default, it should go all the way and do so, no exceptions. If social networks want to plaster the entire web with their buttons they can try asking browser users to change the setting back.
      - Tyrannosaurs 15y ago
oakgrove 15y ago
Episode 32432432 in the pissing match between MS and anybody who dares make a dollar in the computing industry. Yawn
jdavid 15y ago
I flagged this because it's just Microsoft trying to flame war with Google. These headers have been an annoyance every time I have had to consider them. This is a clear example of Microsoft's 'extend' and 'embrace' strategy that destroyed so many platforms. The MS series of browsers were the only ones to adopt this before being recommended as a spec. The spec was never adopted.
jsz0 15y ago
Spitting in the face of user intent like this is really crossing the line of what is acceptable in my opinion. I'm not really concerned about my privacy but I do need to have some faith that the settings I am choosing are being respected. If I allow Google+ to use my webcam should I expect Google to turn it on and watch me all the time? That's not too far removed from what they are doing here.
deleted 15y ago
[deleted]
- raganwald 15y ago
  The fact that: 1. This is not new, 2. It’s not just Google, 3. Microsoft did it (or even still does it), 4. A bunch of web experts don’t take it seriously because a bunch of web sites don’t take it seriously. Does not in any way invalidate or make absurd the proposition that: 5. Google’s actions are noxious. Points 1 through 4 are, however, informative and provide valuable context for Google’s noxious actions.
nitrogen 15y ago
I can't say I would side with either party in this case. P3P sounds about as robust a protocol as RFC 3514 (the evil bit), and Google could just as easily display a warning to any user whose browser rejects third-party cookies. https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt
shtylman 15y ago
Can someone explain to me why it isn't the browsers responsibility to enforce this instead of relying on websites to "do the right thing"?
justinlau 15y ago
It's a new low for Microsoft to use MSDN as a corporate mudslinging soapbox.
joshfraser 15y ago
Having battled with P3P in the past, I sympathize with Google. I don't have a problem breaking dumb rules. And P3P is dumb on multiple levels.
Volpe 15y ago
Googles explanation (set inside the P3P cookie): http://support.google.com/accounts/bin/answer.py?hl=en&answer=151657 http://support.google.com/accounts/bin/answer.py?hl=en&a...
Stormbringer 15y ago
Is "Google does evil shit and violates users privacy" even news-worthy anymore? Isn't that the default? Yeah you heard me Google-tards. Down-vote me like you always do, I got karma to burn baby burn.
- andersh 15y ago
  From your user page, I see that your IT company likes/dislikes conform to one of the approved off-the-shelf opinionsets. [ticks box] Carry on.
prtamil 15y ago
It reminds me of a quote from Dark Knight "You either die a hero or you live long enough to see yourself become the villain" .
dudus 15y ago
I was going to post a comment with details of what the microsoft's P3P CP policy means. But it got so damn long that I had to write a blog post. http://news.ycombinator.com/item?id=3615381 http://news.ycombinator.com/item?id=3615381
kontinuation 15y ago
Hiybbprqag!
mrinterweb 15y ago
For some reason, it feels too soon for the IE team to be calling foul on web standards implementation.
meow 15y ago
Keeping Google's blunders aside, the P3P policy as described seem to be a joke. Do they really expect third party sites to be honest with a browser ? At least they had to do some magic on Safari.. this seems too straight forward and begging to be abused...
tete 15y ago
Easy fix: use DuckDuckGo https://duckduckgo.com/ https://duckduckgo.com/ Don't let them track and bubble you: http://donttrack.us/ http://donttrack.us/ http://dontbubble.us/ http://dontbubble.us/

313 points by ecaron 15y ago

deleted 15y ago

[deleted]

I saw this header a few days ago in curl, and I wondered why Google would send something like this. Now I know. P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

capocani 15y ago

http://support.google.com/accounts/bin/answer.py?hl=en&answer=151657 http://support.google.com/accounts/bin/answer.py?hl=en&a... In some situations, the cookies we use to secure and authenticate your Google Account and store your preferences may be served from a different domain than the website you're visiting. This may happen, for example, if you visit websites with Google +1 buttons, or if you sign into a Google gadget on iGoogle. Some browsers require third party cookies to use the P3P protocol to state their privacy practices. However, the P3P protocol was not designed with situations like these in mind. As a result, we've inserted a link into our cookies that directs users to a page where they can learn more about the privacy practices associated with these cookies. Information that Google collects in association with these cookies is subject to our Privacy Policy. Doesn't seem nefarious.

mbetter 15y ago
Someone instructs their browser to not accept third party cookies, full stop. Google then does something, mumbles a bit, and then sets a third party cookie. How isn't this nefarious?
- capocani 15y ago
  It's not as if the users set IE to read P3P headers so technically they didn't override any user settings. P3P is lacking: http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enough-for-a-cookie-to-fit-through/ http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enou...
  - huxley 15y ago
    So P3P is flawed and IE implements a flawed standard. Granted. Google is still using this flaw to override the user setting "Do not allow 3rd party cookies" to allow themselves to track users. There is no "technically" about this, they've misused the standard to override user settings.
    - mattmcknight 15y ago
      Not exactly. The user setting is inaccurate, as it actually should have said "Do not allow 3rd party cookies, except for those from sites which have a code that indicates they aren't tracking cookies or a code we don't understand." Instead it says "Third Party Cookies" with choices of Accept, Block, or Prompt.
      - recoiledsnake 15y ago
        >Not exactly. The user setting is inaccurate, as it actually should have said "Do not allow 3rd party cookies, except for those from sites which have a code that indicates they aren't tracking cookies or a code we don't understand." That's exactly what they do. >Instead it says "Third Party Cookies" with choices of Accept, Block, or Prompt. No, it doesn't. You sound as if you have researched it, but you seem to be trying to mislead folks by spreading nonsense.
        mattmcknight 15y ago
        Hmm....you act as if you have looked at it, but you haven't. You simply lie.
  - ugh 15y ago
    Is that really so hard to understand? Google is intentionally using the loophole. They are intentionally circumventing users’ wishes. That’s nefarious. It’s first and foremost a moral failing. That’s exactly the problem. Just because it’s possible doesn’t mean it’s right. That the loophole exists is a separate issue that also has to be remedied – but it doesn’t make Google’s behavior any less evil.
- freehunter 15y ago
  If by "mumbles a bit" you mean not supporting an unsupported and defunct proposed "standard" that doesn't work in practice and is only implemented in IE, then yeah.
  - kevingadd 15y ago
    It's a W3C recommendation. Scare quotes around the word standard are unnecessary, since a vast number of current web standards came out of W3C processes. Or is it not 'standards-compliant' when WebKit implements features that only WebKit has, even if they're from W3C standards?
    - eli 15y ago
      It's not really much of a standard if no one references it in the real world. And the W3C standards are most successful when they document how technology is already being used in the wild. Proscriptive web standards handed down from on high have historically not fared well. Plenty of W3C standards are duds.
    - freehunter 15y ago
      Why does everyone always assume quotes are used as scare quotes? I quoted "standard" because it's not a standard. If the standards body no longer exists and no one follows the standard, it's not a standard.
      - pessimizer 15y ago
        That's the definition of scare quotes. "Scare quotes are quotation marks placed around a word or phrase to indicate that it does not signify its literal or conventional meaning." "If scare quotes are enclosing a word or phrase that does not represent a quotation from another source they may simply serve to alert the reader that the word or phrase is used in an unusual, special, or non-standard way or should be understood to include caveats to the conventional meaning." http://en.wikipedia.org/wiki/Scare_quotes http://en.wikipedia.org/wiki/Scare_quotes
- mattmcknight 15y ago
  The nefarious bit is in IE- which, although it pretends to allow you to "instruct the browser not to accept 3rd party cookies, full stop," actually accepts third party cookies from any site with a P3P code it doesn't understand.
  - dos1 15y ago
    So do you work at Google or are you just a fanboy? IE is not being nefarious in this case. IE is following a standard that Google is actively abusing. Not sure why you have such an infatuation with Google, but I dare say: Everything in moderation.
    - tikhonj 15y ago
      Could you please avoid personal attacks? They add nothing to your argument while making the discussion less pleasant and civil. I don't mean to single you out, but I've just been seeing too many of them lately.
  - recoiledsnake 15y ago
    >The nefarious bit is in IE- which, although it pretends to allow you to "instruct the browser not to accept 3rd party cookies, full stop," actually accepts third party cookies from any site with a P3P code it doesn't understand. No, if you select that option, it actually blocks all third party cookies.
    - mattmcknight 15y ago
      No, it actually doesn't (or this discussion wouldn't be happening).
aaronsw 15y ago
The dishonesty of this statement is stunning. IE is designed to only accept the cookie if Google promises not to use it for tracking. Google wants to use the cookie for tracking so they provide a dishonesty promise and then explain they're lying because IE didn't have them in mind -- when this is exactly what IE had in mind.
- narrator 15y ago
  99% of people leave their settings at the default and don't give a damn and just want it to work. When it doesn't work it's broken. Period, end of story. They will say: "Shut up with your geeky explanation" when you explain to them your options. There may be a really long complicated answer as to why it doesn't work but 99% of users don't gives a crap. If you are a smart guy you can just use ad block. There, done. Microsoft is very well aware of the fact that users never change the default settings and IMHO would love to use this to break Google by default and destroy their business model. This fits in well with the usual MS tactics of spreading paranoia, incompatibility, legal threats, obfuscation and confusion. IMHO, Microsoft would love to exploit privacy fears to remove features from the web and break it so everyone just goes back to the desktop. In my opinion, if they could get away with breaking an ajax call, because hey they might be tracking you, they would in order to kill usability of web software in favor of the desktop software model. They will try anything they possibly can to win. Did you ever see the list of IE6 features that got canned (e.g "Smart Tags") because of the antitrust investigation? It makes me shudder what the web would be like with these jerks in control.
gojomo 15y ago
Doesn't seem nefarious. That's why it's a brilliant piece of passive-aggressive engineering! It undermines both the letter and intent of P3P, while ostensibly informing the user. The exact same string is a lie to the protocol, but the truth when read by a person outside of the protocol-context! It's kind of like a file that's both a legal and harmless GIF and a malicious executable Java JAR. (Look up [GIFAR vulnerability] for more details.)
huxley 15y ago
According to the article, Google has done it in a way that indicates (according to the P3P protocol) "that the cookie will not be used for any tracking purpose or any purpose at all." Basically they are abusing the standard to force P3P browsers to override the user's choice to block 3rd party cookies, by telling the browser that the cookie isn't intended for tracking, but Google is using it to track users. That's kinda of appalling privacy-wise. Maybe it isn't maliciously intended, which is what you mean, but it is an intentional misuse of a browser feature to force user tracking.
recoiledsnake 15y ago
Interesting, but are they using the cookies for ad tracking too, eg. adding pages with +1 buttons to your ad tracking profile? > However, the P3P protocol was not designed with situations like these in mind. In that case, the P3P protocol was EXACTLY designed with this in mind.
kstenerud 15y ago
So does this mean that things such as "like" and "+1" buttons don't work unless you subvert the P3P protocol?
- spullara 15y ago
  It means that they don't work unless the user enables tracking by third parties on first party websites.
  - kstenerud 15y ago
    So if someone goes to Mashable and clicks a "like" button, it won't work unless they specifically allow 3rd party tracking on Mashable? And then again on the WSJ, and again on Youtube? Or is it that they need to allow Facebook tracking once and then it works on all sites that have a "like" button? If it's the former, then I'd say P3P is horribly broken and bypassing it for "like" buttons would be the only way to make things work. And even if it's the latter, giving a site carte blanche tracking rights seems too coarse for comfort (unless you could grant permission ONLY for "like" buttons and nothing else).

arebop 15y ago

Oh look, Google fails to fully support features only MSIE has [http://en.wikipedia.org/wiki/P3P#Criticisms http://en.wikipedia.org/wiki/P3P#Criticisms]! Shame on them. P3P was standardized but it never got traction due to various practical problems. For example, privacy policies vary in many, sometimes-subtle, ways and nobody could figure out how to build simple software to decide automatically how to respond to these policies on behalf of users. Don't take Google's word for it, see what facebook says: http://www.facebook.com/help/?page=219494461411349 http://www.facebook.com/help/?page=219494461411349. epic.org doesn't use it either. There are some appealing ideas in P3P but in real life it doesn't actually help users protect their privacy, even on sites that actually implement it (such as Bing). The P3P working group shut down long go (http://www.w3.org/P3P/ http://www.w3.org/P3P/). This is article is just cheap shot at a competitor.

kevingadd 15y ago
So the fact that P3P doesn't solve all the problems it set out to solve justifies Google intentionally using it to compromise visitors' privacy in a way that directly contradicts the purpose of the header? And this is okay because it's an MSIE feature they're circumventing?
- eli 15y ago
  Well, you have a choice: send a bogus P3P header, or break some functionality for IE users.
  - kevingadd 15y ago
    The functionality being "broken" is functionality that users DO NOT WANT and have EXPLICITLY OPTED OUT OF by configuring their browser to reject tracking cookies. If they weren't tracking cookies, you could send a VALID P3P header and your app would work.
    - eli 15y ago
      Actually it's the default in IE, not a feature people opted into. I'd be a lot less sympathetic to Google if it was a feature people opted into rather than one that IE users were unaware of.

emu 15y ago

It's a little disingenuous for the IE team to "discover" this just now. I'm pretty sure Google has been doing this for years, and it's well-known. (I certainly talked about it as part of a wider discussion about P3P policies with colleagues a year or so ago, and this isn't even my area of expertise.) I also don't much mind what companies do with tracking cookies --- I recommend using the Vanilla Cookie extension to Chrome to create a whitelist of persistent cookies. It rather nicely avoids the problem.

kylemaxwell 15y ago

I've been a Google fanboi for years and defended them in the public square when they've been accused of nefariousness. But these revelations of intentionally ignoring users' privacy settings have shaken me. Maybe it's time to put them into the Facebook category, where I removed my account years ago.

tensor 15y ago
It's not so much that they are intentionally ignoring users privacy as they preferring the privacy settings their users have directly given them rather than those set in the browser. I've long been opted out from all of Google's ad tracking, on their site and elsewhere: http://www.google.com/privacy/ads/ http://www.google.com/privacy/ads/ http://www.google.com/ads/preferences http://www.google.com/ads/preferences Privacy is something that few of these companies truly respects. Does Google really respect it? Probably not as much as they'd like you to believe, but at least they are willing to discuss it and provide opt out solutions.
- recoiledsnake 15y ago
  Why not actually follow the P3P standard and then have a flag in the Ad preferences page to enable 3rd party cookies? >...as they preferring the privacy settings their users have directly given them rather than those set in the browser. That's extremely misleading. That's a default as well and not something that the user have "directly given them". I seriously doubt more than 0.1% of Google users have ever visited that page.
- kylemaxwell 15y ago
  I'm not really happy with preferring their opt-out setting when I've already made an opt-out setting in my browser. I don't believe for a moment that Apple or Microsoft care about my privacy any more than Google does, but if I've made a choice and communicated that via browser settings, I expect information providers to respect that choice and not try to exploit the browser in an attempt to bypass my choice.
  - 15y ago

nostromo 15y ago

This seems to be a problem with the design of P3P more than anything. Browsers: "3rd-party cookies are blocked unless you add a P3P header..." Websites: "Ok. What should be in the header?" Browsers: "Anything... it doesn't matter. Just add the header then 3rd-party cookies are fine" Websites: "Ok, we'll just add a P3P header saying 'Ceci n'est pas une P3P header' then. Problem solved."

masklinn 15y ago
> This seems to be a problem with the design of P3P more than anything. Granted, the standard is written to be abused. On the other hand, Google's behavior is basically "well if you don't say no it's not rape. What, you were bound and gagged at the time? Well nothing I can do about that".
- DanBC 15y ago
  Please don't use a violent real world crime as an analogy to things like setting cookies.
gwillen 15y ago
If you read more closely, it's not enough to _have_ a header; the header must also indicate that cookies are not used for tracking. The problem is, that indication is made with _lack_ of a particular token; and google includes a fake P3P header with no tokens in it. Thus, according to the protocol, google's header indicates that it does not use cookies for anything at all.
- dudus 15y ago
  It's just plain wrong. The cookies can be used for tracking. You just need to tell what kind of tracking and what you do with that information. http://news.ycombinator.com/item?id=3615381 http://news.ycombinator.com/item?id=3615381
cooldeal 15y ago
I would expect shady sites from the dark parts of the internet to actively lie but Google? What do you think about robots.txt then? Isn't that a standard that isn't enforced as well?

Tichy 15y ago

So I take it the MS ad network doesn't track users?

cooldeal 15y ago
Of course it does. The question is, does it still do that even if the browser explicitly told it not to. If you have some evidence that it does, I am looking forward to seeing it. But more likely, I think you just read the headline and jumped in to comment.
- Tichy 15y ago
  There are countless tracking mechanisms besides cookies, for example flash cookies and so on. They have been used for years. I would be surprised if any ad network would opt to not use them (I don't like it, but still).

slig 15y ago

It's been a while. And fb does it too. http://security.stackexchange.com/questions/8489/should-anyone-support-implement-p3p-policies-do-they-matter-are-they-legally http://security.stackexchange.com/questions/8489/should-anyo...

barista 15y ago
And that is a perfectly valid reason for Google to do it as well and bash Facebook while they are at it.
mjs 15y ago
There's an "IT Security" stackexchange?! WTF?! How many almost identical communities does stackexchange need?
- smackfu 15y ago
  One for each question that is moved out of StackOverflow, of course.
- tylerritchie 15y ago
  There aren't very many almost identical, but there are a lot of communities that have significant overlap. - Superuser - Serverfault - Database Administrators - 8.9 questions/day - IT Security - 6.9 questions/day - Healthcare IT - 1.1 questions/day The stackexchange community is all about forking. Clearly Healthcare IT, IT Security, and Database Administrators could all be tagged questions in serverfault. But apparently serverfault.com/questions/tagged/heathcare didn't sit well with the 298 people who committed to the beta. Separating power-users from IT professionals (superuser vs serverfault)is certainly reasonable even though there is a large overlap of knowledge there. Of course, without the forks, as an IT person there might be a question if your cryptography related question should go in cryptography.SE or serverfault. With a dedicated site the "correct" location for those questions is easier to determine. But if we're going to talk about overlapping stackexchanges we have to look at those populated predominantly by programmers, because... well, they are the master forkers. - stackoverflow - Programmers - Code review - Theoretical Computer Science - Code Golf - Signal Processing - Computational Science I left out the language specific ones like Mathematica and TeX. I also omitted Software QA and Cryptography. Apparently theoretical physicists and applied? physicists are unable to co-exist on one stackexchange. Anyway, clearly the stackexchange community thinks that forking is the answer. I think tagging is superior and I think fragmenting the community gets fewer able eyes focused on questions. Forking doesn't really hurt google users trying to find answers to questions that have already been answered. Even while not being a professional developer I would stick Code golf, code review, and Programmers into one stack exchange. I'd also put Signal Processing, Mathematica, Tex, and Compuational Science back in Stack Overflow and let the theoretical CS folks stay separate.

jtchang 15y ago

P3P is a load of garbage as it is implemented/written. There is no real enforcement behind it and it just causes lots of confusion. Seriously I have to go lookup what each of these acronyms are in order to figure out how my privacy is being violated? What guarantees do I even have that you are obeying P3P and not simply sending it to make me feel good. Hell while we are at it we should implement P3P for phone apps. I'm sure Path (and others) will stop uploading your address book if the P3P says "ADDRBKNOUP"

mikemaccana 15y ago
>Seriously I have to go lookup what each of these acronyms are in order to figure out how my privacy is being violated? No, you don't. This is mentioned in the article.
driverdan 15y ago
I came to the comments to say pretty much the same thing. While it's a good idea in theory, P3P is a terrible standard. It's hard to implement because there are so many acronyms and no easy reference for them. As mentioned in the article, IE has had the basic implementation of blocking 3rd party cookies if you don't use P3P for a while. I've always wanted to use honest P3P headers but it's such a PITA to generate them correctly site-by-site. Many frameworks include a generic P3P header by default with little or no mention in documentation so that's what I end up using. I spent many hours read specs, tutorials, and trying out P3P generators to no avail. Finally I decided it's not worth my time and just used default framework P3P headers.
powertower 15y ago
> There is no real enforcement behind it You could say the same thing about robots.txt.
- sequoia 15y ago
  ...and you would be correct.
im3w1l 15y ago
"What guarantees do I even have that you are obeying P3P and not simply sending it to make me feel good." This sounds like the perfect job for a legion of lawyers.

devindotcom 15y ago

Yeah, this isn't quite the same level as the Safari one, which was a bit of a tempest in a teacup to begin with. In both cases you can partially blame the browser, though more so in this case.

yanw 15y ago

So the WSJ publishes another one of it’s alarmist articles about Google and Safari during the weekend and Microsoft wants to capitalize by pretending it just now discovered that P3P (a defunct and shitty protocol) is useless and no one uses it. NYT September 17, 2010: http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enough-for-a-cookie-to-fit-through/ http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enou... If you rely on Microsoft’s Internet Explorer’s privacy settings to control cookies on your computer, you may want to rethink that strategy. Large numbers of Web sites, including giants like Facebook, appear to be using a loophole that circumvents I.E.’s ability to block cookies, according to researchers at CyLab at the Carnegie Mellon University School of Engineering. A technical paper published by the researchers says that a third of the more than 33,000 sites they studied have technical errors that cause I.E. to allow cookies to install, even if the browser has been set to reject them. Of the 100 most visited destinations on the Internet, 21 sites had the errors, including Facebook, several of Microsoft’s own sites, Amazon, IMDB, AOL, Mapquest, GoDaddy and Hulu. Google doesn’t support a broken feature that is exclusive to IE somehow it’s their fault. If anyone ever doubted Microsoft's PR sleaziness and propaganda tactics that blog post is proof.

recoiledsnake 15y ago
>So Google doesn’t support an IE exclusive broken feature I am tired of this constant meme in the comments. It's one thing not to support a standard, it's another to actually go to the effort of actively subverting it. They are supporting it by sending out (fake) P3P headers. If they didn't support it, they wouldn't send P3P headers. As simple as that.
- ootachi 15y ago
  Yeah, this is not an excuse at all. You can't argue in defense of Google from an "it's nonstandard" angle, because Google is all about nonstandard Web extensions these days -- to a much larger extent than Microsoft. You can't argue in defense of Google from a "they didn't know enough about how IE works" angle. They're Google. They created Chrome Frame, people. They know enough to solve this engineering problem. The pro-Google bias on HN is astounding.

jackalope 15y ago

This is like teams of foxes selling chicken coops and accusing the other teams of the improper placement of "No Foxes Allowed" signs. If third party cookies are bad, disallowing them should be the default, regardless of some policy header no user ever heard of or can decipher. If they really cared, they'd include a way to disallow any third party resource without having to install a plugin like RequestPolicy. That would go a long way towards fighting tracking (and multiple exploits).

mike-cardwell 15y ago
It is not in Googles or Microsofts interest to do that with their browsers. They both have a very large commercial interest in people using browsers that make it easy to track them. This is the main reason I stick with Firefox. I don't want to use a browser built by an advertising company.
- ceejayoz 15y ago
  The vast majority of Mozilla's revenue comes from a search deal with Google.
  - mike-cardwell 15y ago
    Yes. And I have already heard the conspiracy theories.

scotty79 15y ago

How can you bypass something that is not a barrier? P3P is useless. P3P means "we would never..." in computer speech which is unenforceable therefore useless. Google just make no promises via P3P and places link there explaining that it doesn't and why it doesn't. Fortunately implementations of the P3P do the right thing and fold.

recoiledsnake 15y ago
>How can you bypass something that is not a barrier? So if tomorrow Chrome uploads all your keystrokes to Google, will that be a valid defense? >P3P means "we would never..." in computer speech which is unenforceable therefore useless. Stopping Chrome from uploading your bank passwords with today's update is unenforceable as well and hence thereby useless.
- scotty79 15y ago
  Right. So if you are afraid of that then don't use Chrome. And if you are afraid that cookies can be used for tracking then disable them in your browser. P3P imho is useless because people whom I don't want to be tracked by will serve all the reassuring tokens in P3P and do whatever they want anyway. I want my +1 buttons to work and if that means pulling curtain on some security theater then so be it.
  - ugh 15y ago
    I see this as a predominantly moral issue. Google seems to expose itself as the people whom I don’t want to be tracked by by engaging in shady behavior. That is exactly the problem. Yes, anyone who wants to can circumvent it anyway, but that doesn’t stop us from judging those who do so negatively†. Google can be held accountable in this case (by, for example, complaining loudly about what they do) and there is nothing wrong with doing so. Just because it’s possible doesn’t mean it’s right. That the protocol sucks is in that context a separate and unrelated issue. It may be security theater, but that doesn’t make Google’s behavior any more moral†. — † Insert clever analogy here. I’m too lazy to think about one, though.

tlogan 15y ago

There are some comments here that say: P3P is garbage as implemented, so it is ok for Google to invest some time and engineering effort to trick P3P and track users via cookies. Not sure if that the valid answer but it has some merits if everybody is doing that (like downloading adress book from iPhone). Now, I have the following question: if a random website is catch doing this, is it going to marked as un-safe by security scanners?

voidr 15y ago

What about IE tracking what users are searching for? Microsoft should admit that they only care about privacy when it's convenient for them.

ceejayoz 15y ago
> What about IE tracking what users are searching for? What about it? A browser isn't a website, so P3P doesn't apply. Its written privacy policy applies, and likely allows such behaviour. > Microsoft should admit that they only care about privacy when it's convenient for them. I think the point being made is: so should Google.
CurtHagenlocher 15y ago
Microsoft, Google and Apple all agree that your privacy should not be sacrificed for the sake of their competitors making a buck.
recoiledsnake 15y ago
>What about IE tracking what users are searching for? What about it? Tell me more. They don't even enable Bing suggestions by default.

evmar 15y ago

After Microsoft introduced cookie-blocking features in IE they've been dancing around how to get users to block ads without telling users to install the blockers directly. Here's the blacklist they suggest in their post, which they recommend "as a protection": http://ie.microsoft.com/testdrive/browser/p3p/google.txt http://ie.microsoft.com/testdrive/browser/p3p/google.txt The "-d" lines block domains entirely, which I believe means this has the consequence of blocking Google ads entirely.

recoiledsnake 15y ago
>The "-d" lines block domains entirely, which I believe means this has the accidental consequence of blocking Google ads entirely. Err what? Why would disabling cookies disable displaying ads? You seem to be overly concerned about Google being unable to track the browsing habits of some people.
- evmar 15y ago
  At least as best as I can gather from the TPL docs, they block "all third party content", which includes iframes (the mechanism used for ads). http://ie.microsoft.com/testdrive/Browser/TrackingProtectionLists/faq.html http://ie.microsoft.com/testdrive/Browser/TrackingProtection...

lawnchair_larry 15y ago

Privacy violations should be opt-in. That's what is wrong with privacy on the web.

gyardley 15y ago

Google really should have the cojones to stand up and state their actual position plainly, which as far as I can tell is this: "If you haven't taken an active, positive step to block our +1 buttons, we're going to assume you don't really care and we'll do whatever we can to show them to you, no matter what your browser's default settings are. Why? Well, because we think the default settings are bullshit, and 99 times out of 100 they're only that way because they're the default. They don't reflect actual user preferences, they reflect other browsers messing with our business plans." Not only is that an intellectually honest position, it's a lot more accurate than assuming all IE users who haven't changed their settings don't want +1 buttons.

nikcub 15y ago
then how would you actually block third-party cookies as a Safari user?
- powertower 15y ago
  According to the sentiment here, that's your problem, not Google's!
  - nikcub 15y ago
    so safari needs to add a fourth option: really block all third-party cookies, and not make it default
    - pak 15y ago
      And once Google and Facebook find a workaround for that setting, they can add a fifth option: really really block all third-party cookies. Seriously, the answer here is that if a browser wants to block third-party cookies by default, it should go all the way and do so, no exceptions. If social networks want to plaster the entire web with their buttons they can try asking browser users to change the setting back.
    - Tyrannosaurs 15y ago

oakgrove 15y ago

Episode 32432432 in the pissing match between MS and anybody who dares make a dollar in the computing industry. Yawn

jdavid 15y ago

I flagged this because it's just Microsoft trying to flame war with Google. These headers have been an annoyance every time I have had to consider them. This is a clear example of Microsoft's 'extend' and 'embrace' strategy that destroyed so many platforms. The MS series of browsers were the only ones to adopt this before being recommended as a spec. The spec was never adopted.

jsz0 15y ago

Spitting in the face of user intent like this is really crossing the line of what is acceptable in my opinion. I'm not really concerned about my privacy but I do need to have some faith that the settings I am choosing are being respected. If I allow Google+ to use my webcam should I expect Google to turn it on and watch me all the time? That's not too far removed from what they are doing here.

deleted 15y ago

[deleted]

raganwald 15y ago
The fact that: 1. This is not new, 2. It’s not just Google, 3. Microsoft did it (or even still does it), 4. A bunch of web experts don’t take it seriously because a bunch of web sites don’t take it seriously. Does not in any way invalidate or make absurd the proposition that: 5. Google’s actions are noxious. Points 1 through 4 are, however, informative and provide valuable context for Google’s noxious actions.

nitrogen 15y ago

I can't say I would side with either party in this case. P3P sounds about as robust a protocol as RFC 3514 (the evil bit), and Google could just as easily display a warning to any user whose browser rejects third-party cookies. https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt

shtylman 15y ago

Can someone explain to me why it isn't the browsers responsibility to enforce this instead of relying on websites to "do the right thing"?

justinlau 15y ago

It's a new low for Microsoft to use MSDN as a corporate mudslinging soapbox.

joshfraser 15y ago

Having battled with P3P in the past, I sympathize with Google. I don't have a problem breaking dumb rules. And P3P is dumb on multiple levels.

Volpe 15y ago

Googles explanation (set inside the P3P cookie): http://support.google.com/accounts/bin/answer.py?hl=en&answer=151657 http://support.google.com/accounts/bin/answer.py?hl=en&a...

Stormbringer 15y ago

Is "Google does evil shit and violates users privacy" even news-worthy anymore? Isn't that the default? Yeah you heard me Google-tards. Down-vote me like you always do, I got karma to burn baby burn.

andersh 15y ago
From your user page, I see that your IT company likes/dislikes conform to one of the approved off-the-shelf opinionsets. [ticks box] Carry on.

prtamil 15y ago

It reminds me of a quote from Dark Knight "You either die a hero or you live long enough to see yourself become the villain" .

dudus 15y ago

I was going to post a comment with details of what the microsoft's P3P CP policy means. But it got so damn long that I had to write a blog post. http://news.ycombinator.com/item?id=3615381 http://news.ycombinator.com/item?id=3615381

kontinuation 15y ago

Hiybbprqag!

mrinterweb 15y ago

For some reason, it feels too soon for the IE team to be calling foul on web standards implementation.

meow 15y ago

Keeping Google's blunders aside, the P3P policy as described seem to be a joke. Do they really expect third party sites to be honest with a browser ? At least they had to do some magic on Safari.. this seems too straight forward and begging to be abused...

tete 15y ago

Easy fix: use DuckDuckGo https://duckduckgo.com/ https://duckduckgo.com/ Don't let them track and bubble you: http://donttrack.us/ http://donttrack.us/ http://dontbubble.us/ http://dontbubble.us/