2 ms·

Some additional research that came out today, with more details of the various things Verizon is doing / plans to do with UIDH: https://freedom-to-tinker.com/bl

Some additional research that came out today, with more details of the various things Verizon is doing / plans to do with UIDH: https://freedom-to-tinker.com/blog/englehardt/verizons-tracking-header-can-they-do-better/ https://freedom-to-tinker.com/blog/englehardt/verizons-track... (We collaborated with Mayer on this research.) Code and data that you can play with to verify these results / do other similar experiments, using our web privacy measurement tool OpenWPM: https://github.com/englehardt/verizon-uidh https://github.com/englehardt/verizon-uidh / https://github.com/citp/OpenWPM https://github.com/citp/OpenWPM

x0x0 12y ago
quantcast was sued for resuscitating browser cookies when flash LSOs persisted [1], ie taking the cookie value from the LSO and recookie-ing the browser. quantcast and clearspring settled for $2.5m [2]. The crux of the matter seemed to be that users didn't know such data was in flash cookies or associated with quantcast, making it hard to opt-out, though I'm not sure if this is illegal; and violated quantcast and the 3rd party sites' privacy agreements, which appears to be illegal. A lawsuit outline for one plaintiff is here [3] and the full text of the initial filing here [4]. I naively assume there is a clear parallel to this case, though perhaps verizon and turn have thoroughly privacy policied their way out, somewhere in 30 pages of legalese. According to Jonathan Mayer, Commercial supercookies, fingerprinting, and zombie cookies are tolerated (if not permitted) under current United States law. [...] Any associated consumer deception, however, is a violation of the Federal Trade Commission Act and parallel state statutes. [5] [1] http://www.wired.com/2010/07/zombie-cookies-lawsuit/ http://www.wired.com/2010/07/zombie-cookies-lawsuit/ [2] http://www.lexology.com/library/detail.aspx?g=bc3a4358-6692-4c82-94b5-6a1a160bbaaf http://www.lexology.com/library/detail.aspx?g=bc3a4358-6692-... [3] https://www.privaworks.com/Details/AlertReference/PrintPreview.aspx?guid=%7Bb7a1afcf-7795-4138-9401-27272896f095%7D&p=1 https://www.privaworks.com/Details/AlertReference/PrintPrevi... [4] http://www.wired.com/images_blogs/threatlevel/2010/07/CV10-5484-GW-JCGx-Complaint-Summons-Civil-Case-Cover-Sheet1.pdf http://www.wired.com/images_blogs/threatlevel/2010/07/CV10-5... [5] http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/ http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/

x0x0 12y ago

quantcast was sued for resuscitating browser cookies when flash LSOs persisted [1], ie taking the cookie value from the LSO and recookie-ing the browser. quantcast and clearspring settled for $2.5m [2]. The crux of the matter seemed to be that users didn't know such data was in flash cookies or associated with quantcast, making it hard to opt-out, though I'm not sure if this is illegal; and violated quantcast and the 3rd party sites' privacy agreements, which appears to be illegal. A lawsuit outline for one plaintiff is here [3] and the full text of the initial filing here [4]. I naively assume there is a clear parallel to this case, though perhaps verizon and turn have thoroughly privacy policied their way out, somewhere in 30 pages of legalese. According to Jonathan Mayer, Commercial supercookies, fingerprinting, and zombie cookies are tolerated (if not permitted) under current United States law. [...] Any associated consumer deception, however, is a violation of the Federal Trade Commission Act and parallel state statutes. [5] [1] http://www.wired.com/2010/07/zombie-cookies-lawsuit/ http://www.wired.com/2010/07/zombie-cookies-lawsuit/ [2] http://www.lexology.com/library/detail.aspx?g=bc3a4358-6692-4c82-94b5-6a1a160bbaaf http://www.lexology.com/library/detail.aspx?g=bc3a4358-6692-... [3] https://www.privaworks.com/Details/AlertReference/PrintPreview.aspx?guid=%7Bb7a1afcf-7795-4138-9401-27272896f095%7D&p=1 https://www.privaworks.com/Details/AlertReference/PrintPrevi... [4] http://www.wired.com/images_blogs/threatlevel/2010/07/CV10-5484-GW-JCGx-Complaint-Summons-Civil-Case-Cover-Sheet1.pdf http://www.wired.com/images_blogs/threatlevel/2010/07/CV10-5... [5] http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/ http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/