Microsoft: IE9's web privacy hole? A feature, not a bug

When do-not-track lists clash


A hole has been spotted in Internet Explorer 9's do-not-track technology, and Microsoft says it's a feature not a bug.

In response to a US government call for greater protection of consumers' privacy online, Microsoft added a Tracking Protection Lists (TPLs) feature to IE9. Netizens can use one or more lists to prevent certain ad networks and websites from tracking their behavior online. But when an IE9 user downloads multiple TPLs and a site's blocked on one list but allowed on another, IE9 will allow the site, letting it to track the user's activities.

The hole was flagged up by UK consumer watchdog Which?. Tracking Protection Lists are available from four Microsoft IE9 partners: Abine, EasyList, PrivacyChoice, and Truste.

An existing Microsoft TPL Q&A here at the foot of the IE9 test drive site mentions briefly what happens if there's a conflict. It's also illustrated as part of a video on Microsoft's IE blog that announces TPLs. While that might count as forewarning, this is not a capability that Microsoft has explicitly called out or explained in any great detail when it has talked about TPLs.

The company is instead placing the onus on IE9's users to "review carefully" the TPLs that they chose to ensure IE9 continues to block the sites they want blocked.

Microsoft is also shifting the responsibility to the creators of TPLs to maintain compatible lists. A company spokesperson told The Reg: "We'd hope the list creators are providing an overview of what's in the lists and what it'll mean if a consumer subscribers."

But it's Microsoft's underling platform, IE9, that the list providers are all relying. IE9 is enabling the "allow" list to override the "block" list when there's a conflict. The spokesperson told us: "It was designed like it. We are comfortable with it at this stage."

Washington lobbyist the Center for Democracy and Technology told The Reg that Microsoft could have been clear in explaining the process of what happens when there's a conflict in TPLs. The CDT has been advising parties on do-not-track.

Director of consumer privacy Justin Brookman said Microsoft could have been clearer explaining what happens when there's a conflict between lists, and he is "concerned" about the level of involvement needed by the end-user on managing TPLs. "The point of do not track is you shouldn't have to be terribly involved," he said.

He added he doubted Microsoft is trying to be malicious and called the policy behind it - of building white lists of approved sites - sound. "They still have their work cut out," he said.

TPLs have been added to IE9 on top of existing privacy and cookie-blocking features. It's an approach that's been criticized by an associate professor for Carnegie Mellon University's School of Computer Science, Department of Engineering and Public Policy (EPP).

TPL's are designed to stop third-party sites using techniques such as cookie tracking, Flash LSO tracking and browser finger printing to follow IE9 users and serve up ads and content on the sites that they visit. The idea with TPLs is you build up a list of sites you've either visited or allowing to track you.

Carnegie Lorrie Faith Cranor, also director of Carnegie CyLab Usable Privacy and Security Laboratory (CUPS), has highlighted that you don't just get TPLs in IE9, but also the ability to block cookies in the Internet Options panel. The default setting is to block third-party cookies that lack a "satisfactory" Platform for Privacy Preferences (P3P) compact privacy policy.

Cranor also co-authored a report last year that found that Microsoft's implementation of P3P, a W3C standard, is now being widely sidestepped by web sites that are deliberately mis-representing their privacy policies to prevent cookie blocking.

In her blog on TPL's Cranor wrote: "IE9 now has a confusing array of poorly-implemented privacy features that interact with each other in strange ways. If I don't turn on a TPL or change any privacy settings, then third-party cookies might be blocked depending on their P3P compact policies. If I turn on a TPL that allows a particular site, does it unblock third-party cookies that would otherwise be blocked?"®


Other stories you might like

  • SpaceX Starlink sat streaks now present in nearly a fifth of all astronomical images snapped by Caltech telescope

    Annoying, maybe – but totally ruining this science, maybe not

    SpaceX’s Starlink satellites appear in about a fifth of all images snapped by the Zwicky Transient Facility (ZTF), a camera attached to the Samuel Oschin Telescope in California, which is used by astronomers to study supernovae, gamma ray bursts, asteroids, and suchlike.

    A study led by Przemek Mróz, a former postdoctoral scholar at the California Institute of Technology (Caltech) and now a researcher at the University of Warsaw in Poland, analysed the current and future effects of Starlink satellites on the ZTF. The telescope and camera are housed at the Palomar Observatory, which is operated by Caltech.

    The team of astronomers found 5,301 streaks leftover from the moving satellites in images taken by the instrument between November 2019 and September 2021, according to their paper on the subject, published in the Astrophysical Journal Letters this week.

    Continue reading
  • AI tool finds hundreds of genes related to human motor neuron disease

    Breakthrough could lead to development of drugs to target illness

    A machine-learning algorithm has helped scientists find 690 human genes associated with a higher risk of developing motor neuron disease, according to research published in Cell this week.

    Neuronal cells in the central nervous system and brain break down and die in people with motor neuron disease, like amyotrophic lateral sclerosis (ALS) more commonly known as Lou Gehrig's disease, named after the baseball player who developed it. They lose control over their bodies, and as the disease progresses patients become completely paralyzed. There is currently no verified cure for ALS.

    Motor neuron disease typically affects people in old age and its causes are unknown. Johnathan Cooper-Knock, a clinical lecturer at the University of Sheffield in England and leader of Project MinE, an ambitious effort to perform whole genome sequencing of ALS, believes that understanding how genes affect cellular function could help scientists develop new drugs to treat the disease.

    Continue reading
  • Need to prioritize security bug patches? Don't forget to scan Twitter as well as use CVSS scores

    Exploit, vulnerability discussion online can offer useful signals

    Organizations looking to minimize exposure to exploitable software should scan Twitter for mentions of security bugs as well as use the Common Vulnerability Scoring System or CVSS, Kenna Security argues.

    Better still is prioritizing the repair of vulnerabilities for which exploit code is available, if that information is known.

    CVSS is a framework for rating the severity of software vulnerabilities (identified using CVE, or Common Vulnerability Enumeration, numbers), on a scale from 1 (least severe) to 10 (most severe). It's overseen by First.org, a US-based, non-profit computer security organization.

    Continue reading

Biting the hand that feeds IT © 1998–2022