51–60 of 63 posts
Microsoft is in a bind, now. If they fix their security hole, the Like and +1 buttons will stop working on IE9, and only IE9. The solution to fixing them will be 'use another browser'. The only solution. So faced with losing market share, they instead chose to turn it around and say that other companies are doing unethical things. When those companies stop doing them, IE9 will stop working, but now it looks like thos…
What is the preferred way to handle P3P for a young startup or a small (possibly academic) project? As I see it, there are seven relevant facts: 1. The intent of P3P is to make it so that you are personally, legally bound to enforce particular privacy guarantees. 2. The attempt to make a P3P standard has been abandoned for half a decade, and only one browser maker supports it, largely for historical reasons. Document…
Earlier quoted context omitted.
If it's broken to begin with, it's not really "breaking the users security settings". Specifically if it can be broken just by saying "break it", then it's broken from the start.
In that sense NO ENTRY signs are also broken. And so is the robots.txt protocol.
What is the preferred way to handle P3P for a young startup or a small (possibly academic) project? As I see it, there are seven relevant facts: 1. The intent of P3P is to make it so that you are personally, legally bound to enforce particular privacy guarantees. 2. The attempt to make a P3P standard has been abandoned for half a decade, and only one browser maker supports it, largely for historical reasons. Document…
If I read correctly, the article says that of the top 10000 sites 95% do have a valid P3P header. Does that make a decision any simpler for an aspiring startup?
In the case of A, I utilize the Facebook SDK which relies on the Third-Party Facebook cookie passed into my application when it is loaded in a Facebook.com iframe. Could I build my application a little different to not need this? Yes, but this way is a little more reliable and secure. B.) Google Analytics breaks for IE users when your application lives within any iframe. It relies on Third-Party cookies to correctly track the users actions, and browser information.
I am a big user advocate when it comes to protection of personal information, but I really believe that unless users stop using IE (which is not going to happen any time soon), or P3P is depreciated by Microsoft then for now it is a useful hack to get around yet another IE pitfall.
What is the preferred way to handle P3P for a young startup or a small (possibly academic) project? As I see it, there are seven relevant facts: 1. The intent of P3P is to make it so that you are personally, legally bound to enforce particular privacy guarantees. 2. The attempt to make a P3P standard has been abandoned for half a decade, and only one browser maker supports it, largely for historical reasons. Document…
If I read correctly, the article says that of the top 10000 sites 95% do have a valid P3P header. Does that make a decision any simpler for an aspiring startup?
Specifically, these are the headline stats:
1. 34% of websites have errors in their P3P compact header in that they contain invalid, missing, or conflicting tokens.
2. 79% of websites with P3P compact headers are missing full policy files, which is required to be compliant.
3. Among the top 100 websites, only 48 have P3P compact policies, and of those, 41 have no full policy file, and 21 have errors making the header invalid.
4. 97% of invalid compact policies bypass Internet Explorer's default filters.
5. Vast numbers (thousands) of the valid compact policies are duplicates. In fact, a little under 5000 of the approximately 20,000 compact policies that are valid are the same policy (NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM) which coincidentally is listed all over the web as a bug fix for IE's cookie handling.
Reading between the lines, the norm here seems to be to either (a) not include P3P (52% of top websites) or (b) include it as a bug fix in an invalid, non-compliant way (21--41% of top websites). Is an invalid P3P header likely to be legally binding if the overwhelming majority of websites of all sizes implement it incorrectly, both intentionally and unintentionally? Is it worth the time, expense, and potential legal risk for a small startup to try to use it correctly?
Earlier quoted context omitted.
I think live.com does (or did) do it. See page 8, second column of the CMU paper in this reddit comment: http://www.reddit.com/r/technology/comments/py9h5/now_google...
It's really unbelievable how this paper keeps getting cited as proof Microsoft is doing this too. Page 7 was cited on the other thread; you can read my response here: http://news.ycombinator.com/item?id=3615267 Re: Live doing it too. No, that is not what the paper says. From page 8: "Only one of these websites, microsoft.com, displayed a full P3P policy." "Websites under the msn:com domain exhibited a CP that include…
It's not really that unbelievable: Microsoft is berating Google for sending invalid P3P headers and this paper describes that Microsoft is sending invalid P3P headers.
Microsoft does not always fully comply with the letter of the law...
In this case what constitutes the letter of the law isn't really clear. As far as I can tell this is the latest specification for the P3P header:
http://tools.ietf.org/html/draft-marchiori-w3c-p3p-header-01
I'm going to quote a small portion:
This Internet-Draft will expire on August 6, 2002.
So it's at least arguable that there isn't a standard for the P3P header, and whatever anyone wants to put in it is just whatever they put in it, nothing is invalid and everyone is fine.
Only IE supports it anyway, and it's not like it prevents websites from doing things they've said in their P3P headers that they're not going to do. And the header is required to make IE accept 3rd party cookies (which are needed for lots of quite normal stuff on the web) you need to send it one of these headers.
RFC 6462 also has some interesting comments: