Feeds

Fresh privacy fears over IE 8 Suggested Sites

Promiscuous URL sharing not a great idea, warns top Cambridge researcher

Protecting against web application threats using SSL

A top security researcher has called for Microsoft to rethink aspects of its Suggested Sites feature in IE8. The optional feature in the next version of Microsoft's browser allows users to "discover websites you might like based on sites you've visited", as Microsoft explains it.

When the feature is activated, the addresses of sites visited are sent to Microsoft, alongside informations such as IP address, browser type, regional and language settings, in an encrypted form. Microsoft draft IE8 privacy policy explains that "information associated with the web address, such as search terms or data you entered in forms might be included".

Microsoft was able to allay concerns that data from secure sites might be sampled or that the feature might be used to serve up targeted advertising in response to our earlier queries on the technology, prompted in response to posts by privacy activists on the No Deep Packet Inspection campaign website. However, concerns about the privacy implications of the technology remain.

Cambridge University security researcher Richard Clayton, who carried out an analysis of Phorm for the Foundation for Information Policy Research (FIPR), said full URL sharing via Suggested Sites poses a privacy and security risk. In particular he warns Microsoft should avoid sharing data submitted by surfers with other users of the service.

Microsoft should be clearer about explaining the risks as well as the benefits of the service, he adds.

In order for Microsoft to suggest other websites that you might like to look at, they need to know where you've been visiting lately. If you're embarrassed about saying where that is, then you leave the new feature turned off and no harm is done.

However, if you turn it on, then it appears that you hand over the entire URL of where you've visited. On some sites that's essential: if you've been on blogger.com, then knowing which of the eight million blogs you visited will matter. However, on other sites, that full URL may hold clues to your identity, give permissions to others to access the site, or compromise your privacy or security in some other manner.

The risk that someone at Microsoft decides to use that URL for wickedness are rather small - but what if they hand off the URL to someone else with similar tastes, for them to try visiting the places that you go to. Suddenly all that "security through obscurity", the pious hope that no one could possibly guess that URL, goes up in smoke.

Microsoft could do better, by minimising the data transfer, and only obtaining longer URLs for the sites, like blogger.com, where it actually matters. In the meantime, they should spell out the risks up front, along with the benefits... or did they genuinely think that there weren't any risks?

Clayton's response, which came in response to a request by El Reg for his opinion on the privacy implications of the technology, moves on the debate about whether Suggested Sites allows users a richer surfing experience or creates more problems than it solves.

Microsoft told us that when InPrivate (aka pron surfing) mode is applied within IE8, then Suggested Sites is temporarily turned off. "Data about secure HTTPS sites visited, intranet sites or local files on the PC" is excluded at all times, it added.

Microsoft went on to say that IE8 does "not send back any elements of data in the body of a rendered page" a statement that sits oddly alongside an explanation in the draft privacy policy) from IE 8 that "information associated with the web address, such as search terms or data you entered in forms might be included" in data submitted when Suggested Sites is turned on. We're still waiting for a clarification from Microsoft on this point. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.