Feeds

Hundreds of websites share usernames sans permission

Photobucket, Wall Street Journal, Home Depot take liberties with your personal info

The Power of One eBook: Top reasons to choose HP BladeSystem

Home Depot, The Wall Street Journal, Photobucket, and hundreds of other websites share visitor's names, usernames, or other personal information with advertisers or other third parties, often without disclosing the practice in privacy policies, academic researchers said.

Sixty-one percent of websites tested by researchers from Stanford Law School's Center for Internet and Society leaked the personal information, sometimes to dozens of third-party partners. Home Depot, for example, disclosed the first names and email addresses of visitors who clicked on an ad to 13 companies. The Wall Street Journal divulged to seven of its partners the email address of users who enter the wrong password. And Photobucket handed over the usernames of those who use the site to share images with their friends.

The report comes as US officials have proposed a mandatory Do Not Track option for all websites. Some operators have argued such measures are unnecessary because their systems for tracking visitors' browsing histories aren't linked to a user's specific identity.

In the report, Jonathan Mayer, a Stanford graduate student who led the study, argued against the claim that the online tracking is anonymous. A username alone, he explained, is often more than adequate to identify the owner, and when it's combined with other information, such as his geographic location or first name, even widely used usernames can be uniquely assigned to an individual.

“We believe there is now overwhelming evidence that third-party web tracking is not anonymous,” he wrote. “It is a legitimate policy question whether, on balance, Do Not Track should be enforced by law. But the difficult weighing of competing privacy risks and economics can't be short-circuited by claims of anonymity.”

The report studied websites included in the Quantcast top 250 that offered user signups, didn't require a purchase or other qualification to create a username, and didn't include so many features as to be impractical for study. Of the 185 sites that met the three criteria, 113 of them included usernames and other identifiers in the URLs they shared with advertisers and analytics partners. The five biggest recipients were ComScore, Google Analytics, Google's DoubleClick, Quantcast, and Facebook.

The report cited privacy policies of many of the websites that appeared to make no mention of the practice. The WSJ's, for example, says: “We will not sell, rent, or share your personal information with these third parties for such parties' own marketing purposes.” In its own policy, Home Depot says it “will not trade, rent or sell your personal information, without your prior consent.”

The Stanford researchers have previously documented a variety of attempts by websites and marketers to track users's browsing habits, sometimes when they've taken pains to remain anonymous.

In August, they revealed JavaScript hosted on MSN.com and three other Microsoft websites that secretly logged visitors' browsing histories across multiple web properties, even when the users deleted browser cookies to elude tracking. The researchers also exposed a marketer that helped websites deliver targeted ads by exploiting a decade-old browser flaw that leaks the history of websites that users visit. ®

Designing a Defense for Mobile Applications

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.