Google was caught finally week bypassing default privacy settings in the Safari browser in guild to serve up tracking cookies. The company claimed the spot was an accident and confined only to the Safari Web browser, but today Microsoft claimed Google is doing much the same thing with Internet Explorer.
In a blog position titled “Google bypassing user privacy settings” Microsoft’s IE Corporate Vice Chairperson Dean Hachamovitch states that “When the IE squad heard that Google had bypassed user privacy settings on Safari, we taken ourselves a simple question: is Google circumventing the privacy preferences of Internet Explorer users too? We’ve discovered the solution is yes: Google is applying alike methods to induce around the default privacy protections in IE and traverse IE users with cookies.”
Hachamovitch explains that IE’s default configuration blocks third-party cookies unless presented with a “P3P (Platform for Privacy Preferences Project) Compact Policy Statement” indicating that the site will not use the cookie to track the user. Microsoft accuses Google of sending a drawstring of text that tricks the browser into thinking the cookie won’t be utilized for tracking. “By sending this text, Google bypasses the cookie protection and enables its third-party cookies to exist allowed rather than blocked,” Microsoft said.
The text allegedly sent by Google really reads “This is not a P3P policy” and includes a link to a Google page which says cookies used to secure and authenticate Google users are needed to shop user preferences, and that the P3P protocol “was not designed with situations like these in mind.”
Microsoft enunciated it has contacted Google to require the fellowship to “commit to honoring P3P privacy settings for users of all browsers.” Microsoft also updated the Tracking Protection Lists in IE9 to prevent the tracking described by Hachamovitch in the blog post. Ars has contacted Google to see if the companionship has any response to the Microsoft allegations, and we’ll update this post if we see back.
UPDATE: It turns away Facebook and many other sites are employing an virtually selfsame scheme to override Internet Explorer’s privacy setting, granting to privacy researcher Lorrie Faith Cranor at Carnegie Mellon University. “Companies have disclosed that they can lie in their [P3P policies] and nobody bothers to do anything nigh it,” Cranor wrote in a late blog post.
UPDATE 2: Google has gotten back to us with a lengthy reply, arguing that Microsoft’s reliance on P3P forces outdated practices onto mod websites, and points to a analyze conducted in 2010 (the Carnegie Mellon enquiry from Cranor and her colleagues) that studied 33,000 sites and felt almost a 3rd of them were circumventing P3P in Internet Explorer.
“Microsoft uses a ‘self-declaration’ protocol (known as ‘P3P’) dating from 2002 under which Microsoft asks websites to represent their privacy practices in machine-readable form,” Google Senior VP of Communications and Policy Rachel Whetstone says in a instruction e-mailed to Ars. “It is well known including by Microsoft that it is impractical to comply with Microsoft’s request while providing modernistic web functionality.”
Facebook’s “Like” button, the ability to signal into websites using your Google story “and hundreds more modernistic Web services” would exist broken by Microsoft’s P3P policy, Google says. “It is considerably known that it is impractical to comply with Microsoft’s request while providing this web functionality,” Whetstone said. “Today the Microsoft policy is widely non-operational.”
That 2010 research even calls out Microsoft’s own msn.com and live.com for providing invalid P3P policy statements. The research newspaper farther states that “Microsoft’s tolerate website recommends the use of invalid CPs equally a work-around for a problem in IE.”
