Author Topic: Google Bypassed Apple Browser Settings for Guarding Privacy  (Read 764 times)

Offline Johnnie F.

  • Administrator
  • Korat forum specialist
  • *****
  • Posts: 6440
    • Korat-Info
Google Bypassed Apple Browser Settings for Guarding Privacy
« on: February 17, 2012, 06:32:34 PM »
Google's iPhone Tracking

Web Giant, Others Bypassed Apple Browser Settings for Guarding Privacy

Google Inc. and other advertising companies have been bypassing the privacy settings of millions of people using Apple Inc.'s Web browser on their iPhones and computers—tracking the Web-browsing habits of people who intended for that kind of monitoring to be blocked.

The companies used special computer code that tricks Apple's Safari Web-browsing software into letting them monitor many users. Safari, the most widely used browser on mobile devices, is designed to block such tracking by default.

Google disabled its code after being contacted by The Wall Street Journal.

The Google code was spotted by Stanford researcher Jonathan Mayer and independently confirmed by a technical adviser to the Journal, Ashkan Soltani, who found that ads on 22 of the top 100 websites installed the Google tracking code on a test computer, and ads on 23 sites installed it on an iPhone browser.

The technique reaches far beyond those websites, however, because once the coding was activated, it could enable Google tracking across the vast majority of websites. Three other online-ad companies were found using similar techniques: Vibrant Media Inc., WPP PLC's Media Innovation Group LLC and Gannett Co.'s PointRoll Inc.

In Google's case, the findings appeared to contradict some of Google's own instructions to Safari users on how to avoid tracking. Until recently, one Google site told Safari users they could rely on Safari's privacy settings to prevent tracking by Google. Google removed that language from the site Tuesday night.

In a statement, Google said: "The Journal mischaracterizes what happened and why. We used known Safari functionality to provide features that signed-in Google users had enabled. It's important to stress that these advertising cookies do not collect personal information."

Google's privacy practices are under intense scrutiny. Last year, as part of a far-reaching legal settlement with the U.S. Federal Trade Commission the company pledged not to "misrepresent" its privacy practices to consumers. The fine for violating the agreement is $16,000 per violation, per day. The FTC declined to comment on the findings.

An Apple official said: "We are working to put a stop" to the circumvention of Safari privacy settings.

Of the ad companies found to be using the technique, Google has by far the largest reach. It delivers Internet ads that were viewed at least once by 93% of U.S. Web users in December, according to comScore Media Metrix.

A Vibrant Media spokesman called its use of the technique a "workaround" to "make Safari work like all the other browsers." Other major Web browsers don't block tracking by default. Vibrant, a top 25 ad network in the U.S. according to comScore Media Metrix, uses the technique "for unique user identification," the spokesman said, but doesn't collect personally identifiable information such as name or financial-account numbers.

WPP declined to comment. A spokeswoman for Gannett described its use of the code as part of a "limited test" to see how many Safari users visited advertisers' sites after seeing an ad.

PointRoll's coding was found in some ads on "We were unaware this was happening on and are looking into it further," a Journal spokeswoman said.

To test the prevalence of Google's code, the Journal's technology adviser, Mr. Soltani, surveyed the top 100 most popular websites as ranked by Quantcast earlier this month. He found Google placed the code within ads displayed on major sites including movie site, dating site,, and, among others. These companies either declined to comment or didn't respond. There is no indication that they or any other sites knew of the code.

"We were not aware of this behavior," said Michael Balmoris, AT&T Inc. spokesman. Google's code was found on AT&T's "We would never condone it," he said.

Google has already been facing broader questions about privacy. Last month, Google—which offers many services including YouTube, Gmail and of course, Google search—said it would revise its privacy policy to combine nearly all the information it possesses about its users.

The move prompted an international outcry. European Union privacy officials asked Google to "pause" its changes until it can ensure the privacy of EU citizens. Google said it briefed European officials in the weeks before its announcement and plans to roll out the new privacy policy March 1.

Across the digital landscape, the issue of online privacy is taking center stage. In recent months, large institutions and tiny app-makers alike have been accused of mishandling personal data. Trying to reassure a worried public, lawmakers have introduced more than a dozen privacy bills in Congress. The Obama administration has called for a Privacy Bill of Rights to encourage companies to adopt better privacy practices.

Trade in personal data has emerged as a driver of the digital economy. Many tech companies offer products for free and get income from online ads that are customized using data about customers. These companies compete for ads, in part, based on the quality of the information they possess about users.

Google's tracking of Safari users traces its roots to Google's competition with social-network giant Facebook Inc. After Facebook launched its "Like" button—which gives people an easy way to indicate they like various things online—Google followed with a "+1" button offering similar functionality on its rival social network, known as Google+.

Last year, Google added a feature to put the +1 button in ads placed across the Web using Google's DoubleClick ad technology. The idea: If people like the ad, they could click "+1" and post their approval to their Google social-networking profile.

But Google faced a problem: Safari blocks most tracking by default. So Google couldn't use the most common technique—installation of a small file known as a "cookie"—to check if Safari users were logged in to Google.

To get around Safari's default blocking, Google exploited a loophole in the browser's privacy settings. While Safari does block most tracking, it makes an exception for websites with which a person interacts in some way—for instance, by filling out a form. So Google added coding to some of its ads that made Safari think that a person was submitting an invisible form to Google. Safari would then let Google install a cookie on the phone or computer.

The cookie that Google installed on the computer was temporary; it expired in 12 to 24 hours. But it could sometimes result in extensive tracking of Safari users. This is because of a technical quirk in Safari that allows companies to easily add more cookies to a user's computer once the company has installed at least one cookie.

Google said it tried to design the +1 advertising system to protect people's privacy and that the placement of further tracking cookies on Safari browsers wasn't anticipated.

Among some Web programmers, the type of maneuver used by Google appears to have been an open secret for some time. Anant Garg, a 25-year-old Web developer in Mumbai, India, blogged about the technique two years ago.

Mr. Garg said when he developed the Safari workaround he didn't consider the privacy angle. He came up with the idea simply to "ensure a consistent experience" for a group of people accessing a chat system from different Web browsers, he said.

The coding also has a role in some Facebook games and "apps"—particularly if the app wants to store a user's login information or game scores. In fact, a corporate Facebook page for app developers called "Best Practices" includes a link to Mr. Garg's blog post.

"We work to educate our developers on how to deliver a consistent user experience across all browsers," said Facebook spokesman David Swain.

Mr. Mayer, who spotted Google using the code, also noticed variations of Mr. Garg's code at work in ads placed by Vibrant Media and WPP's Media Innovation Group. Mr. Soltani verified those findings, and also found code being used by Gannett's PointRoll. In a test, Mr. Soltani found the PointRoll code present in ads on 10 of the top 100 U.S. sites.

Wall Street Journal

Offline Johnnie F.

  • Administrator
  • Korat forum specialist
  • *****
  • Posts: 6440
    • Korat-Info
How Google Tracked Safari Users
« Reply #1 on: February 17, 2012, 06:35:10 PM »
How Google Tracked Safari Users

Google and other advertising companies have been following iPhone and Apple users as they browse the Web, even though Apple’s Safari Web browser is set to block such tracking by default.

How have they been able to do it? Well, first they made Safari think the user was submitting an invisible form associated with the ad.

That technique allowed the companies to then place a “cookie” – a small text file that is stored on the user’s computer and can be used to track online activities. Google disabled its code after being contacted by The Wall Street Journal.

By default, Apple’s Safari browser accepts cookies only from sites that a user visits; these cookies can help the site retain logins or other information. Safari generally blocks cookies that come from elsewhere – such as advertising networks or other trackers. But there are exceptions to this rule, including that if you interact with an advertisement or form in certain ways, it’s allowed to set a cookie even if you aren’t technically visiting the site.

Google’s code, which was placed on certain ads that used the company’s DoubleClick ad technology and was uncovered by Stanford researcher Jonathan Mayer, took advantage of this loophole, as did the code used by the other companies.

In Google’s case, the code was part of a Google feature that allows its “+1” button to be embedded in advertisements. Wall Street Journal technologist Ashkan Soltani analyzed the code further and found that 22 of the top 100 most popular websites installed the Google code on a test computer.

Google said the company tried to design the +1 ad system to protect people’s privacy and did not anticipate that it would enable tracking cookies to be placed on user’s computers.

To put cookies onto Safari, Google’s ads used something called an “iframe,” an invisible container that allows content from one website to be embedded within another site, such as an ad on a blog.

Through this “iframe” window, Google received data from the user’s browser and was able to tell whether the person was using Safari. If he was, Google then inserted an invisible form into the container. The user didn’t see or fill out the form – in fact, there was nothing to “fill out” – but nevertheless, the Google code “submitted” it automatically.

Once the form was sent, Safari behaved as though the user had filled something out intentionally, and the browser allowed Google to put a cookie on the user’s machine.

The cookie Google was placing through this method was associated with the company’s Google+ social network. Last year, Google announced a system that would allow users to click the company’s “+1” buttons on advertisements to indicate that they liked the ad.

But Google faced a problem: Apple’s Web browser Safari blocks most tracking by default and is the most popular browser on mobile devices. That meant that Google wouldn’t be able to check if a user was logged into Google, using a small text file called a cookie.

So Google set up an elaborate system. If the person was logged in to Google+ and had agreed to see the +1 button on ads, the cookie would contain encoded information about that account. If the person wasn’t logged in or hadn’t agreed to see the button, the cookie would still be placed on the computer, but it would be blank.

The cookies were temporary; the blank one was set to expire in 12 hours, and the cookie for logged-in users was set to expire in 24.

Google’s Ms. Whetstone said the temporary cookie served to create a “temporary communication link between Safari browsers and Google’s servers.” She said the goal was to ensure that the information passing between the user’s Safari browser and Google’s servers was anonymous–effectively creating a barrier between a user’s personal information and the web content they browse.

But even the blank cookie could then result in extensive tracking of Safari users. This is because of a technical quirk in Safari that allows websites to easily add more cookies to a user’s computer once the site has installed at least one cookie. Safari allows this so that sites such as the Facebook and Google+ social networks can install cookies in widgets they place around the Web, as long as the user has visited the original site.

But it also meant that if a person received any of the temporary cookies , other Google advertising cookies could be placed as soon as the user saw another Google ad.

Ms. Whetstone said Google did not anticipate that further tracking cookies would be placed. “We didn’t anticipate that this would happen, and we have now started removing these advertising cookies from Safari browsers,” she said. “It’s important to stress that, just as on other browsers, these advertising cookies do not collect personal information.”

Stanford’s Mr. Mayer, who spotted Google’s technique, said, “There are zero legitimate-use cases” for advertisers to use an invisible form to enable tracking that Safari would have otherwise blocked.

An Apple spokesman said: “We are aware that some third parties are circumventing Safari’s privacy features and we are working to put a stop to it.”

An update to the software that underlies Safari has closed the loophole that allows cookies to be set after the automatic submission of invisible forms. Future public versions of Safari could incorporate that update. The people who handled the proposed change, according to software documents: two engineers at Google.

Wall Street Journal

Offline thaiga

  • Korat forum specialist
  • *****
  • Posts: 15961
Google's split personality
« Reply #2 on: February 18, 2012, 08:14:08 PM »
                Privacy brouhaha reveals Google's split personality

Latest Google Internet controversy highlights conflict between privacy protection and advertising demands.

When it comes to privacy, is the Googleplex speaking with one voice?

A new Google privacy controversy has revealed conflicting messages and actions between two different factions within the company: those working to protect consumer privacy on the one hand, and those seeking to improve advertising and social networking on the other.

Meanwhile, the news that Google overrode default cookie settings in Apple's Safari browser has prompted two complaints to the U.S. Federal Trade Commission (FTC) and renewed calls for legislation and industry standards that would protect Web surfers from being tracked across sites if they don't want to be.

To be fair, Google isn't the only company to have taken advantage of an exemption in Safari that was designed to keep third-party cookies from tracking people as they bounce from site to site. Besides Google, The Wall Street Journal reported that three other online ad companies were taking advantage of this loophole. And separately, Google offers Ads Preferences Manager that allows people to opt out of DoubleClick cookies. But, in this case, it's hard to see what would compel the company to disable opt-out settings in Safari.

Google, for its part, says the Safari backdoor allowed Google+ users on iOS devices to see +1 buttons and use them to indicate to their network when they saw a product or service in an ad they liked. "Last year, we began using this functionality to enable features for signed-in Google users on Safari who had opted to see personalized ads and other content--such as the ability to '+1' things that interest them," the company said in a statement.

Unfortunately, the way this +1/Safari initiative was implemented allowed other Google ad cookies to be set on the browser, which was unintentional, according to Google. The Google cookie was temporary, but it opened the door for additional cookies. "We have now started removing these advertising cookies from Safari browsers," the company said, adding that the code has been disabled. "It's important to stress that, just as on other browsers, these advertising cookies do not collect personal information."

While one Google team was taking advantage of a little-known backdoor that could change the default Safari setting, the Google Chrome team was working to get Apple to close the backdoor--apparently with neither team having knowledge of the other's actions. Engineers for Chrome notified Apple about seven months ago that the loophole was there, although it remains open.

"We are aware that some third parties are circumventing Safari's privacy features and we are working to put a stop to it," an Apple representative told CNET.

Meanwhile, Google's Chrome team offers an Advertising Cookie Opt-Out Plugin that lets people do exactly what Safari's default setting provides: block third-party cookies. Oddly, the instructions for confirming the default settings in Safari on that page were removed as The Wall Street Journal was preparing its news report.

The World Privacy Forum (WPF) and Consumer Watchdog both filed complaints against Google today with the FTC accusing the company of unfair and deceptive practices and of violating a settlement it reached last year with the FTC over its former social network dubbed Buzz. Google violated the Buzz consent decree by "its misrepresentations of consumer choice and how much control users actually had," alleges the WPF complaint (PDF), which also asks the FTC to investigate the other ad firms accused of overriding Safari's default settings: Vibrant Media, Media Innovation Group, and PointRoll.

An FTC representative said the agency had received the Consumer Watchdog complaint but said he could not comment further.

"We are taking immediate steps to address concerns, and we are happy to answer any questions regulators and others may have," Google said in a statement when asked to comment.

The Electronic Frontier Foundation called on Google today to include a Do Not Track option in Chrome, an option all the other major browsers provide, and for Google sites to respect Do Not Track requests from those other browsers.

Justin Brookman, consumer privacy director at the Center for Democracy and Technology, said he was baffled by Google's latest actions.

"Why are they anathema to Do Not Track? Because advertising is more core to Gogole's business than it is to Microsoft's and Apple's, maybe," he said. "I'm not sure."

Brookman said the CDT was talking to Google about Do Not Track and there was interest in it. "The Chrome team may want to do it, but Google is pushing on ads and social right now so they're scared to do it."

They should have tested the Safari override technology more, but "there's been a big rush to get social right and they wanted to integrated with ads," he added.

Read more:
Anyone who goes to a psychiatrist should have his head examined.