IE8 Beta 2 contains Google-style keystroke logger

Computerworld - Microsoft Corp.'s Internet Explorer 8 (IE8) browser includes a keystroke-logging search suggestion tool similar to the one that Google Inc. modified Monday after coming under fire from consumers.

Unlike Chrome, IE8 Beta 2 does not enable the feature -- which some have compared to a keylogger -- by default. One privacy expert said that was a "huge difference."

According to IE8's revised privacy statement, Microsoft's beta browser contains a new feature, dubbed "Suggested Sites," that sends the addresses of sites visited and other information to the company's servers.

Suggested Sites is similar to the "Google Suggest" tool in Google's Chrome browser and is designed to recommend the most likely destination sites based on what the user types, the popularity of sites and Microsoft's own algorithm.

On Monday, Google reacted to criticism of the feature by promising it would render the data it collects anonymous within 24 hours.

By comparison, Microsoft's privacy statement does not spell out how long the Suggest Sites data is kept, and when, if at all, the company "anonymizes" that data.

The company does, however, go into some detail about what it collects. "When Suggested Sites is turned on, the addresses of Web sites you visit are sent to Microsoft, together with some standard information from your computer such as IP address, browser type, regional and language settings," the privacy statement reads. Other data that Search Sites collects includes the time that sites were visited, which site referred the user to the destination site and how long the user was at the destination site.

"This information, along with the Web site addresses and past history, will be used to personalize your experience, as well as improve the quality of our products and services," the statement continued. "Microsoft will not use any information collected to identify, contact or target advertising to you."

Alissa Cooper, the chief computer scientist at the Center for Democracy and Technology, expressed concerns about the IE8 suggestion tool, as she did yesterday about Google's Chrome. "The things you type when you search for something are going back to the provider and can be quite revealing," she said, noting that most users understand that. "But [Chrome's] OmniBox and IE8's Suggested Search capture everything in one space, not only searches but all the Web sites that you would be typing into the box. So they'll know even more about you."

Microsoft does not enable the keystroke capture and logging tool by default -- as does Google with Chrome. "That makes a huge difference," said Cooper. "Not many people go around tweaking their browser."

However, Microsoft does pitch the tool during IE8 Beta 2 setup. After installing the beta, users are shown a screen that asks "Do you want to discover Web sites you might like based on Web sites you've visited?" The default response is "Yes, turn on Suggested Sites," but users can also select "No, don't turn on," before continuing the configuration process.