Google Exploited Loophole To Track Safari Users’ Browsing Habits

Exploit allows advertisers to set third party cookies despite Safari’s privacy settings.

By Shaylin Clark · February 18, 2012 · 43 Comments

Google Exploited Loophole To Track Safari Users’ Browsing Habits

Google has made plenty of news lately over concerns with how they handle user privacy. Now it looks like they may have been circumventing privacy settings in Apple’s Safari browser – on computers and iOS devices alike – in order to track users’ web browsing habits for the purposes of advertising.

Is real privacy even possible on the internet anymore? What do you do to protect yourself from online snooping from advertisers and marketers? Let us know in the comments.

According to a report by the Wall Street Journal Friday morning, Stanford researcher Jonathan Mayer discovered that Google and other advertising companies were employing a workaround that allowed third party cookies to be installed by tricking Safari into thinking that the user had submitted a form which allowed the advertisers to set a tracking cooking on the user’s browser. According to the Journal’s researchers, this behavior occurred in Safari both on iOS devices, and on computers (presumably both Windows and Mac versions of Safari). Here’s the Journal’s explanation of how the exploit works:

Here are the full results of Jonathan Mayer’s investigation.

Google, however, insists that the Wall Street Journal is blowing the situation out of proportion. They say that the code in question was designed to allow certain features such as “Like” and “+1” buttons to function in Safari the way they do in other browsers (which allow third party cookies by default, unlike Safari). The workaround was only meant to apply to Google users who were signed in and allowed Google to show them personalized content. That the code allowed other advertisers to set their own cookies as well. Google says that once the Journal brought this to their attention, they disabled the code and began deleting the cookies.

In response to a request for comment, Google sent us the following statement from Rachel Whetstone, Senior Vice President, Communications and Public Policy:

The Journal mischaracterizes what happened and why. We used known Safari functionality to provide features that signed-in Google users had enabled. It’s important to stress that these advertising cookies do not collect personal information.

Unlike other major browsers, Apple’s Safari browser blocks third-party cookies by default. However, Safari enables many web features for its users that rely on third parties and third-party cookies, such as “Like” buttons. Last year, we began using this functionality to enable features for signed-in Google users on Safari who had opted to see personalized ads and other content–such as the ability to “+1” things that interest them.

To enable these features, we created a temporary communication link between Safari browsers and Google’s servers, so that we could ascertain whether Safari users were also signed into Google, and had opted for this type of personalization. But we designed this so that the information passing between the user’s Safari browser and Google’s servers was anonymous–effectively creating a barrier between their personal information and the web content they browse.

However, the Safari browser contained functionality that then enabled other Google advertising cookies to be set on the browser. We didn’t anticipate that this would happen, and we have now started removing these advertising cookies from Safari browsers. It’s important to stress that, just as on other browsers, these advertising cookies do not collect personal information.

A request for comment was also sent to Apple, but they have not yet responded. Business Insider, citing “an industry source who we believe understands Google’s perspective” suggests that Google’s intent was not malicious. Rather, they set out to solve a specific problem concerning their advertising business: Safari behaves differently than every other web browser, and that behavior impacts how Google’s ads work. The problem, this source suggests, is that the workaround was likely developed and implemented without thought toward how it would look from a public relations perspective.

Is it possible that Apple is partly to blame for making Safari function differently than other browsers? Should Apple bear any of the blame for the loophole that made Google’s workaround possible? Let us know in the comments.

In sum, it seems likely that Google is not actually out to spy on their users. Nevertheless, the situation is intensely problematic for Google. The company has already caught significant flack for planned updates to their privacy policy. Moreover, Google (as well as other internet giants like Facebook) has long been fighting an uphill PR battle to convince people that they are not engaged in Big Brother-esque monitoring of people’s internet habits.

The backlash against Google has been swift. In addition to the general public outcry, Consumer Watchdog has filed a complaint (PDF) with the Federal Trade Commission. Their letter calls Google’s actions unfair and deceptive, accuses Google of violating the 2011 consent order concerning Google Buzz, and calls on the FTC to “take immediate action against Google.” Consumer Watchdog has long had a beef with Google (e.g., a series of anti-Google videos that can be found here, here, and here). The consent order mentioned in Consumer Watchdog’s letter has also been the subject of a suit filed against the FTC by the Electronic Privacy Information Center. That suit seeks the to force the FTC to block the rollout of Google’s new unified privacy policy, which is currently scheduled for March 1.

Do you believe Google’s story? Could this be a relatively innocent workaround that got out of hand, or is there something more sinister? What should happen to Google after this? Does this make you less likely to trust Google’s new privacy policy? Let us know in the comments.

RELATED ARTICLES:

There are 43 Comments. Add Yours.

parvesh
February 24, 2012 at 8:46 am
Reply

We are Noida Packers Movers engaged in providing the packing and moving services for each and every type of commodity. We offer all kinds of moving services such as Packing Moving Services, Residential Relocation Service, Office Relocation Service, Car Transport Service, Insurance Coverage Service, Car Carrier Services. We apply the most modern techniques and devices to offer quality oriented services.
Norman
February 21, 2012 at 8:50 am
Reply

I never stay logged in to any Google service unless I am using it. So I log into youtube to post a movie I took, then log out of it.
Same with gmail, which I never use anyway.

Does this work? Expert please answer

I have my own domain and can create multiple email addresses “on the fly” so I create a different one for everyone I deal with.

Thus my email address for this service is:

webpro@norman******.com

My email address for Delta Airlines is:

delta@norman******.com

etc.
If I get sent spam I know who sold my address and can delete it.
seo linkz
February 20, 2012 at 5:19 am
Reply

who here really believes anything coming from either of these CEO’s mouths?

they BOTH steal your information and sell it/use it in a million different ways
seo linkz
February 20, 2012 at 5:18 am
Reply

who here really believes anything coming from either of these CEO’s mouths?

they BOTH steal your information and sell it/use it in a million different ways
John
February 20, 2012 at 2:09 am
Reply

How you my Name is John Damas Assey I m your tour operator in
Arusha the company is kibotrekking adventures ltd.
The best mister l is the you friends to me Poland in Arusha and the
office is near to me the office please don’t forget don your friend
your rill you can trey so that you teller me that you have clients to
climbing Kilimanjaro
This letter me which date and rout their clients to climbing to
confirm all cancellations confirmation when the clients you lake
the routs let me then four booking hotel in Arusha our Moshi hotel
I will confirmation the booking to you and me well blameworthiness oral
the clients to pick up whey to come is Esther to pick up to droop The
hotel you booking there please come to us to see they services to us
my company and your food is fresh and precession cook your Kilimanjaro
Our safari budget camping and precession driver guide safari and
precession mountain guide Kilimanjaro our routs and Meru mountain Lake
Oldonyolengai
please for more information I have Recommendation tell phone the
friend to is Travel whist us so that better Cole them +4795774333 Mona
Norway +48603136176Tom from Poland +48600660702 peter from Poland is
friend to me let me when your give me this clients that you can cheek
the menu the food you clients you lake clients you will be in
climbing our safari camping I m professional cook dot for get help
friend and me thanks very munch to come us
Mountain Trekking-All routes
MT Meru Momela via route 4days 3nights all prices include all park
fees, salaries of guides/porters/cook, and all meals on the
mountain, equipment and transfer to/from Arusha or Moshi. Discounts
can also be arranged for larger groups. Not included: tips and items
of a personal nature

Kilimanjaro via machame route 6days 5nights

Kilimanjaro via Marangu route 5days 4nights

Kilimanjaro via Rongai route 6days 5nights

Kilimanjaro via umbwe route 6days 5nights

Kilimanjaro via shira route 8days 7nights

Kilimanjaro via lemosho route 8days 7nights

MT Meru Momela via route 4days 3nights

All prices include all park fees, salaries of guides/porters/cook, and
all meals on the mountain, equipment and transfer to/from Arusha or
Moshi. Discounts can also be arranged for larger groups. Not
included: tips and items of a personal nature.

1. Short trip to Lake Manyara National Park and Ngorongoro Crater 2
days 1 night. Price is 180 SUD per person per day 3 to 5 people.
Budget safari camping
2. Trip of 3 days Tarangire, Lake Manyara and Ngorongoro Crater with 2
nights price 170 USD per Person per day. Camping safari
3. Trip of 4 days 3 nights to Lake Manyara, Ngorongoro Crater
Tarangire National Park the price 130camping USD per person per
day.
4. Trip of 5 to 7 days Tarangire, Lake Manyara, Ngorongoro Crater,
Lake Norton, Lake Eyasi and
Serengeti price is 210 USD.camping safari
5. Trip of 8 days 7 nights (Cross Country Trip) to Rift Valley
Engaruka – Lake Norton, Serengeti and
Ngorongoro Crater price 210 SUD per person per day. Camping safari
6. Trekking Kilimanjaro via Marangu Rout 6 days 5 nights price is
1110 SUD per person per the
Whole climb
7. Trekking Kilimanjaro via Machame Rout for 6 days 5 nights the
price is 1150per person per the Whole climb.
8. Trekking Kilimanjaro via Rongai Rout for 6 days 5 nights the
price is 1350 SUD per person per the Whole climb.
9. Trekking Kilimanjaro via Umbwe Route for 6days 5 nights the
price is 1250 SUD
10. Trekking Kilimanjaro via Shira rout for 8 days 7 nights the
price is 1300 SUD per person per the Whole climb.
11. Trekking Kilimanjaro also via Lemosho Route for 8 days 7 nights
the price is 1350 SUD.
12. Trekking Mount Meru 4 days 3 nights with game drive the price is
640 SUD per person per whole
Climb.
13. Trekking Mount Meru for 3 days and 2 nights without game drive
the price is 510 SUD per Person
per the whole climb.
NB: The above Safari to the National Park prices are for budget
camping and they are package includes:
Transport with land rover or land cruiser 4 x 4 with pop – up root
Food 3 meals a day
All the government fees
A professional Driver Guide
A cook (Chef)
Camping gears, Tent, mattress chairs & table
All transfers to pick-up on arrival and drop off to the air port
is includes with 1 night accommodation.
The above prices for Mountain climbing include the following:-
- Transport to the starting point
- Food 3 meals a day
- Professional Guide
- A professional cook (Chef)
- Porters
- All the government fees
- Camping gears, tent.

Not included on all above prices are:-
Tips and personal items
checking sticks, mattress, and sleeping bag is also not included on
the prices but they are available for hire basis
Hope that you will understand well and write to me soon as possible.
May regards to your family and friends.
Yours, partner
LUNCH
SALADS:
• Tomato and cucumber salad
• Avocado, green pepper and onions
• Potato salad with mayonnaise
• Coleslaw
MAIN:
• Spaghetti bolognaise
• Cheese
DESSERT:
• Fresh fruit salad. Tea and coffee
SOUP:
• Tomato soup
MAIN CSE:
• Pain fried fish fillet + tartar sauce
• Parsley potatoes
• Carrots and peas
• Green salad
DESSERT
• Mango compote
• Tea and coffee
BREAKFAST
• Fresh fruits
• Fresh bread + Toast
• Butter
• Jam + Honey
• Eggs + sausage on order
• Tea and coffee
LUNCH BOX
SALADS:
• Ham + cheese sandwich
• Tomato + carrots
• Fried chicken with ginger and garlic
• Bread + butter
• Banana
DINNER
SOUP:
• Leeks and potato cream soup
MAIN CSE:
• Spicy grilled pork escalope
• Ratatouille
• French beans + vegetables
• Mixed salad
DESSERT
• Banana fritters
• Tea and coffee

LUNCH BOX TO BE PROVIDED IN ARUSHA
DINNER
SOUP:
• Cream of pumpkin soup
MAIN:
• Fish with potato and pepper sauce
• Vegetables
• Coconut rice
• Salad
DESSERT;
• Pineapple
• Tea and coffee

BREAK FAST
LUNCH BOX
• Beef escalope
• Fresh vegetable
• Tomatoes
• Vegetarian pizza
• Bread + butter
• Fresh fruits
• Tea and coffee
DINNER
SOUP
• Cream of zucchini soup
MAIN:
• Spaghetti carbonara
• Cucumber and pepper and tomato salad
• Vegetable: Zucchini, aborigine etc..
• Cabbage
DESSERT:
• Fruit and salad
• Tea and coffee
BREAKFAST
LUNCH
SALADS:
• Mixed salad
• Tomato and onion salad
• Carrot salad
MAIN:
• Pancakes
• Salami
• Quiche Lorraine
DESSERT:
• Papaya with orange juice
• Tea and coffee
DINNER
SOUP:
• Cream of potato soup
MAIN CSE:
• Beef fillet steak Mediterranean style
• Carrots
• Potatoes
• Cucumber and pepper salad
DESSERT;
• Chocolate mousse
• Tea and coffee
BREAKFAST
LUNCH BOX
Hamburgers
Cheese
Bread and butter
Macaroni salad
Tomatoes
Fresh fruits + biscuits
Tea and coffee
DINNER
SOUP;
Cream of tomato soul
MAIN CSE:
Meat balls in beer source
Coconut rice
Vegetables
Green salad
DESSERT:
SOUP:
• Banana fritters with honey
• Tea and coffee
BREAKFAST
LUNCH
COLD SOUP
• Zucchini cold soup
SALADS
• Carrot salad
• Red beans
• Radish and corn salad
• Green salad
MAIN:
• Tuna fish pancakes
• Chicken and ham croquettes
DESSERT;
• Orange mousses. Tea and coffee
DINNER
SOUP:
• Cream of carrots
MAIN CSE:
• African night
• Makande
• Banana stew
• Mchicha
• Ugali + maharagwe
• Kachumbari
• Pilau
DESSERT;
• Cake
• Tea and coffee
BREAKFAST
LUNCH BOX
• Hamburger
• Cheese
• Bread and butter
• Macaroni salad
• Tomatoes
• Fresh fruits + bi
+255 754 271573
+ 255 788 27 15 73
p.o.box16813 Arusha Tanzania
http://www.kibotrekking.com
Best Regard
John Damas Assey
Rickey Morris
February 19, 2012 at 5:14 pm
Reply

No I don’t believe it was an accident, they just didn’t think they would be caught, or that others would learn of the workaround, and place their Cookies on as well. Anyone who thinks they weren’t tracking, and targeting you, must be someone I want to sell a House to.
Alex
February 19, 2012 at 8:02 am
Reply

I do the only thing you can do to prevent Behavioral Advertising – I opt out here http://www.networkadvertising.org/managing/opt_out.asp
Big Aussie
February 19, 2012 at 7:25 am
Reply

Looks like the technical level of expertise of the readers of WebProNews has dropped markedly over the past 12 months.

Google is using a workaround for Safari to add tracking cookies for users of Safari. This does not mean they are able to see your name, address or anything else personally identifiable.

A cookie (from any website) is simply a random string of characters which can be stored on your browsing device (iPhone, Android, Mac, Windows PC etc) so that that website will be able to “log”:

1. what website just sent you to them.
2. Possibly what keyword you used inside a search engine
3. Which search engine
4. has this browser and device visited before

Hardly personal data; but invaluable to a marketing team so they are able to know if their campaigns are working how they hoped.

Reads more like a quiet week online; so lets beat up a story. Google and Apple — the story is nearly guaranteed to attract attention.

Cookies in various guises have been around for more than 12 years online. By default Safari blocks 3rd Party cookies. Instead of trying to ask an Apple user to dig around in their Safari settings — Google found another way of identifying the visitor “anonymously”.

Get it! Got it! Good…..
sachin
February 19, 2012 at 7:05 am
Reply

complete-seo-services – Complete SEO Service Increase your bottom line with SEO with Guaranteed Rankings 1 SEO Services Company, Web Promotion , On page and off page optimization.
sachin
February 19, 2012 at 7:04 am
Reply

Complete SEO – Complete SEO Service Increase your bottom line with SEO with Guaranteed Rankings 1 SEO Services Company, Web Promotion , On page and off page optimization.
PaulWADE
February 19, 2012 at 6:08 am
Reply

I already made my point.
You can read it at http://pulpkult.blogspot.com

Thanks