EFF: Forget cookies, your browser has fingerprints – Computerworld

Even without cookies, popular browsers such as Internet Explorer and Firefox give Web sites enough information to get a unique picture of their visitors about 94 percent of the time, according to research compiled over the past few months by the Electronic Frontier Foundation.

The research puts a quantitative assessment on something that security gurus have known about for years, said Peter Eckersley, the EFF senior staff technologist who did the research. He found that configuration information — data on the type of browser, operating system, plugins, and even fonts installed can be compiled by Web sites to create a unique portrait of most visitors.

This means that most Internet users are a lot less anonymous than they believe, Eckersley said. “Even if you turn off cookies and you use a proxy to hide your IP address, you could still be tracked,” he said.

The data doesn’t actually identify the Web user, but it creates a unique browser “fingerprint,” that can be used to identify the user when he visits other Web sites.

Using JavaScript, Web sites are able to probe PCs and learn a lot. No single piece of data is enough to identify the visitor on its own, but when it’s all strung together — browser version, language, operating system, time zone details — a clearer picture emerges. Some things — what combination of plugins and fonts are installed, for example — can be a dead giveaway.

And using the private mode offered by some browser-makers does nothing to stop this analysis. “They provide you with some protection against other people who may be in your house or who have access to your computer, but they haven’t got to the point where they’ve provided protection against the companies that are profiling Web users,” Eckersley said.

In fact, there are already a handful of companies have already started offering this kind of cookie-less Web tracking to help e-commerce sites identify fraudsters. Companies such as 41st Parameter, ThreatMetrix, and Iovation are widely used in the banking, e-commerce and social Web sites.

via EFF: Forget cookies, your browser has fingerprints – Computerworld.

Microsoft Office 2010 Adds Features For Browsers, Smartphones | Information Week

Office 2010, which goes on sale to businesses this week, shows Microsoft for the first time putting serious sweat into making the suite work better on the Web and smartphones. Microsoft still pushes the feature-packed, client-based interface, but there are notable features focused on keeping Office relevant beyond the desktop screen.

For example, the browser-based versions of Word, Excel, and PowerPoint have “embed” tags to let a person embed a PowerPoint slide or Excel chart in a blog post. The PowerPoint would reside in a company’s SharePoint system (for a company blog) or Microsoft’s public SkyDrive (for a public blog), so when the content is updated, the embedded content in the blog stays up to date. The client versions don’t have that.

On the mobile app, Office’s OneNote digital notepad has a “take a photo” button to capture photos alongside notes out in the field. The client and browser versions don’t have that. This reflects Microsoft’s thinking that Office 2010 needs unique features based on the different screens a person might use. “We have taken an approach of “What does productivity mean when you’re in the browser?” as opposed to on the phone,” says Chris Capossela, Microsoft senior VP of information worker products.

So why buy the client-based Office? For one thing, Microsoft is likely to charge the same license no matter if you use Office on the PC, browser, or phone. (It hasn’t disclosed Web apps-only pricing for businesses yet.) Microsoft also touts high-end features that work only on a client, like editing rich video in PowerPoint. It expects most people will want to use all three interfaces, at different times for different purposes.

While Office 2010 brings different features to each interface, Microsoft also touts “fidelity” for Office documents. So while you need the rich-client Word to create watermarks, you don’t lose them by looking at a document on a phone or browser. “That seamlessness is critical,” says Stephen Elop, president of Microsoft business division.

via Microsoft Office 2010 Adds Features For Browsers, Smartphones — Microsoft Office 2010.

Google Building Browser Plug-In To Protect Consumer Privacy | MediaPost Publications

Google is working on a browser plug-in that allows consumers to block being counted when landing on a Web site that monitors visits with Google Analytics. The Mountain View, Calif. company’s engineers continue to test and finalize the function.

Sitting in the crossroads, Google needs to support advertisers, investors and consumers. The obligation to support advertisers and shareholders resides in the ability to develop tools that provide data and ad targeting. But to succeed, Google must become a good corporate citizen and give consumers a method to opt-out and protect their privacy.

Google engineers have been working on the plug-in during the past year and plans to make it globally available in the coming weeks, according to Amy Chang, group product manager at Google Analytics. She says the search engine takes privacy very seriously and will continue to provide people with more choices.

“Though Google Analytics does not track personally identifiable information, the plug-in will give users the choice to fully opt-out of sending any information back to Analytics,” Chang says. “We’re constantly working to enhance the balance between privacy options for users, while providing advertisers with valuable and actionable data to improve their Web sites.”

via MediaPost Publications Google Building Browser Plug-In To Protect Consumer Privacy 03/22/2010.

A brabhsálaí gréasáin ilteangach (or, a multilingual web browser) | Official Google Blog

Since announcing the latest Google Chrome beta earlier this month, we’ve been excited to receive feedback from our beta users on the browser’s new translation and privacy features. Today, we’re introducing these features in the stable channel, so that they’re widely available to everyone who uses Google Chrome on Windows.

Google Chrome’s translation feature is the latest step in the evolution of translation tools across Google. Just a few years ago, Google’s translation tools consisted of a site where you had to copy and paste text into a box — and it only worked for a handful of languages. Today, our translation technology works across 52 languages and can automatically detect and translate entire websites in less than a second. Chrome’s translation feature automatically detects if the language of the webpage you’re on is different from your preferred language setting, The browser will then display a prompt asking if you’d like the page to be translated using Google Translate. With one click, you can instantly translate the page, and all of its text will appear in your preferred language.

via Official Google Blog: A brabhsálaí gréasáin ilteangach (or, a multilingual web browser).

What your browser says about you

Online privacy is a hot topic and the accuracy and detail with which you can be tracked as you bounce from Web site to Web site should be an issue of great concern to both consumers and corporate IT.

Many people say they don’t really care about being tracked, arguing that they have nothing to hide about where they browse and with whom they communicate, so nothing needs to be kept private.

But here’s the problem: The tracking that can now be done by paying attention to details of your Web browser is akin to the staff of a department store following you around and noting every mole and wrinkle on your body, what you’re wearing and everything you pay attention to. Then they attach flags to you so they can identify you on subsequent visits to their stores or any of their affiliates. I think everyone would care about that.

Because mostly we aren’t aware of this in-depth examination and cataloging of our browsing, we hardly think about it. Perhaps we tend to operate under the old adage, “what you don’t know won't hurt you” or “ignorance is bliss.”

As corporations become ever more skilled at following our digital tracks they acquire knowledge that enables them to maximize their messaging and selling abilities by customizing how they present themselves to us. The result? It becomes easier to sell goods, services and information to consumers.

And from the viewpoint of a corporation dealing with other corporations online, how much do you really want your competitors, suppliers and customers to have deep insight into what your staff is paying attention to online?

If you want to learn just how identifiable you are through your browser configuration, go to the Electronic Frontier Foundation’s Panopticlick. Click on the big red “Test me” button and prepare to be amazed.

via What your browser says about you.

Experts fret over iPad security risks • The Register

Apple’s much hyped iPad tablet may come tightly locked down but the device is still likely to be affected by many of the security issues that affect the iPhone, as well as some of its own.

Security experts polled by El Reg were concerned about a variety of risks, in particular phishing attacks and browser exploits.

Graham Cluley, senior technology consultant at Sophos, commented: “The iPad, from the sound of things, will be as locked down as the iPhone. Hackers will no doubt try to jailbreak it. But the main threat would be phishing and browser exploits.”

Malware related risks may also trouble the iPad. The only risks to affect the iPhone to date have relied on a very small but well publicised number of worms (e.g. ikee) that exploited default passwords and open SSH shells on jailbroken iPhones.

However, while the iPad uses the same OS as the iPhone, it is more powerful; that means attacks based on doctored PDF files may potentially become a risk, explained Luis Corrons, technical director of PandaLabs.

“The device is really close to an iPhone, so we should expect a similar security. However, unlike the iPhone, it would be able to open PDF documents by default.

via Experts fret over iPad security risks • The Register.