Social networking sites leaking personal information to third parties, study warns
Data allows tracking companies to attach unique identities to browsing behavior
Computerworld - Many major social networking sites are leaking information that allows third party advertising and tracking companies to associate the Web browsing habits of users with a specific person, researchers warn.
That's the conclusion of a study on the leakage of personally identifiable information on social networks done at AT&T Labs and the Worcester Polytechnic Institute.
The findings (PDF document), which appear to have received scant public attention so far, were presented by the study's two researchers at a conference in Barcelona over a month ago. Earlier this week, civil liberties group Electronic Frontier Foundation (EFF) referred to the study in a blog post.
The research, by Craig Wills of Worcester Polytechnic and Balachander Krishnamurthy of ATT, presents "some interesting technical details" on how social networking sites are leaking personal data, the EFF blog post said.
"In some cases, the leakage may be unintentional, but in others, there is clever and surreptitious anti-privacy engineering at work," the EFF said.
Wills told Computerworld that he and Krishnamurthy surveyed 12 of the largest social networks for the study. They discovered that 11 of these networks were leaking personal identity information to third-parties including data aggregators, which track and aggregate user viewing habits for targeted ad-serving purposes.
The study shows that most users on social networking sites are vulnerable to having their identity information from their profiles associated with tracking cookies used by data aggregators, he said.
The information allows aggregators to scoop up personal data relatively easily from a user's social network page and to track that user's movement's across multiple Web sites.
While aggregators have typically claimed that a person's movement on the Internet is tracked just as an anonymous IP address, the information from social networking sites allows them to attach a unique identity to each profile, Wills said.
What remains unknown, however, is whether or not data aggregators are actually recording any of the personal identity information being relayed to them from social media sites, Wills said.
He explained that personal identity data or unique identifiers that point to a person's real identity are often relayed by social networking sites to third parties via so-called HTTP referrer headers. HTTP headers basically identify the URLs of any resources that link to a Web page.
In the case of the social networks surveyed, all of the URLs being relayed via such HTTP headers included the user's unique identifier, he said.
When a user's page is being loaded on such sites, third-party tracking and advertising services that have a relationship with the site get not only the data from their tracking cookies but also the data containing the users unique identifier from the HTTP header, he said.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Is Your Big Data Solution Production-Ready? Read "Is Your Big Data Solution Production-Ready?" now, and discover best practices and actionable steps to implementing a production-ready big data solution.
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- Data Protection and Disaster Recovery with iSCSI and VMware Get this on demand webcast now
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have. All Privacy White Papers | Webcasts