Google, Microsoft butt heads over IE privacy skirting

'Plenty of blame to go around' for both companies, says privacy researcher

1 2 Page 2
Page 2 of 2

"But organizations have some responsibility for using a technical trick to circumvent the IE privacy controls," Cranor said, referring to Google, Facebook and others.

She also was suspicious of Google's claim that P3P was impractical, noting that the company's DoubleClick ad network does present valid CPs to IE. "They figured out how they worked there," she said. "I'm skeptical that they couldn't do the same elsewhere."

Others have pointed fingers at Microsoft more than at Google.

"Microsoft's posting, given what was already long known about IE and P3P deficiencies in these regards, seems disingenuous at best, and certainly is not helping to move the ball usefully forward regarding these complex issues," said Lauren Weinstein, a privacy advocate and co-founder of the People for Internet Responsibility group.

While Cranor said P3P was "unhealthy, perhaps even dead" at the moment -- echoing Whetstone's assertion -- she said the standard had been useful in advancing the Web privacy debate. And she wasn't ready to give up on P3P.

"Nothing exists that is better," she said of P3P. "There's nothing fundamentally wrong with P3P. The problems with it are not technical, but a lack of interest in using it."

Cranor chaired the P3P working group, and has written a book on the standard.

Although "Do Not Track," a browser-and-website privacy initiative that the Federal Trade Commission (FTC) backs -- and that Microsoft supports in IE9 -- has gotten much of the attention recently, P3P remains a better solution, Cranor argued.

But that's only when it's enforced.

"It's more readily enforced than Do Not Track, because it forces a website to declare its privacy policies. But it's really important for regulators to enforce the policies," Cranor said.

And that's not happened.

"Once people saw that there were bugs in P3P that could be used to circumvent privacy policies, and that when they did, nothing happened, then all bets were off," said Cranor.

Yesterday, Microsoft's Hachamovitch told users how to set IE to block all cookies from a specific website, such as Google, and offered a Tracking Protection List to IE9 users "in the event that Google continues this practice."

He also confirmed that Microsoft is re-considering its use of P3P.

"We are investigating what additional changes to make to our products," Hachamovitch said. "Privacy advocates involved in the original [P3P] specification have recently suggested that IE ignore the specification and block cookies with unrecognized tokens. We are actively investigating that course of action."

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is gkeizer@computerworld.com.

See more by Gregg Keizer on Computerworld.com.

Copyright © 2012 IDG Communications, Inc.

1 2 Page 2
Page 2 of 2
7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon