4 ms·
P3P is a load of garbage as it is implemented/written. There is no real enforcement behind it and it just causes lots of confusion. Seriously I have to go look
by jtchang 15y ago
P3P is a load of garbage as it is implemented/written.
There is no real enforcement behind it and it just causes lots of confusion. Seriously I have to go lookup what each of these acronyms are in order to figure out how my privacy is being violated? What guarantees do I even have that you are obeying P3P and not simply sending it to make me feel good.
Hell while we are at it we should implement P3P for phone apps. I'm sure Path (and others) will stop uploading your address book if the P3P says "ADDRBKNOUP"
- mikemaccana 15y ago>Seriously I have to go lookup what each of these acronyms are in order to figure out how my privacy is being violated? No, you don't. This is mentioned in the article.
- driverdan 15y agoI came to the comments to say pretty much the same thing. While it's a good idea in theory, P3P is a terrible standard. It's hard to implement because there are so many acronyms and no easy reference for them. As mentioned in the article, IE has had the basic implementation of blocking 3rd party cookies if you don't use P3P for a while. I've always wanted to use honest P3P headers but it's such a PITA to generate them correctly site-by-site. Many frameworks include a generic P3P header by default with little or no mention in documentation so that's what I end up using. I spent many hours read specs, tutorials, and trying out P3P generators to no avail. Finally I decided it's not worth my time and just used default framework P3P headers.
- powertower 15y ago> There is no real enforcement behind it You could say the same thing about robots.txt.
- sequoia 15y ago...and you would be correct.
- im3w1l 15y ago"What guarantees do I even have that you are obeying P3P and not simply sending it to make me feel good." This sounds like the perfect job for a legion of lawyers.