Become a MacRumors Supporter for $25/year with no ads, private forums, and more!

Google Under Fire for Circumvention of Cookie Settings in Safari for iOS to Track Users

MacRumors

macrumors bot
Original poster
Apr 12, 2001
50,521
11,906



The Wall Street Journal reports that Google and several other advertising agencies have been discovered to be circumventing privacy protections in Apple's Safari browser for iOS devices in order to track users through ads on numerous popular websites. Google implemented the technique in order to embed +1 buttons on its ads, tricking users' systems into allowing cookies by using an invisible form submission to make Google's third-party cookies, which are blocked by Safari, appear as first-party cookies that are allowed.
To get around Safari's default blocking, Google exploited a loophole in the browser's privacy settings. While Safari does block most tracking, it makes an exception for websites with which a person interacts in some way--for instance, by filling out a form. So Google added coding to some of its ads that made Safari think that a person was submitting an invisible form to Google. Safari would then let Google install a cookie on the phone or computer.

The cookie that Google installed on the computer was temporary; it expired in 12 to 24 hours. But it could sometimes result in extensive tracking of Safari users. This is because of a technical quirk in Safari that allows companies to easily add more cookies to a user's computer once the company has installed at least one cookie.



Google halted the practice once it was contacted by The Wall Street Journal about it, but has tried to downplay the impact of the issue.
In a statement, Google said: "The Journal mischaracterizes what happened and why. We used known Safari functionality to provide features that signed-in Google users had enabled. It's important to stress that these advertising cookies do not collect personal information."
In a companion blog post, The Wall Street Journal notes that the loophole that had permitted Google to bypass Safari's privacy protections has been closed in WebKit, the open source engine behind Safari, with the change having been made by two Google engineers. Consequently, Apple could and appears to be preparing to bring that fix to the public version of Safari.
An Apple spokesman said: "We are aware that some third parties are circumventing Safari's privacy features and we are working to put a stop to it."

An update to the software that underlies Safari has closed the loophole that allows cookies to be set after the automatic submission of invisible forms. Future public versions of Safari could incorporate that update. The people who handled the proposed change, according to software documents: two engineers at Google.
The issue was discovered by Stanford graduate student Jonathan Mayer, who has also published an extensive blog post offering additional technical details on how Google and other advertising companies circumvented Safari's default cookie settings.

Article Link: Google Under Fire for Circumvention of Cookie Settings in Safari for iOS to Track Users
 

newagemac

macrumors 68020
Mar 31, 2010
2,091
23
This is completely unacceptable. You would expect this kind of behavior from some type of shady malware outfit. Is this what Google has become? I know the "don't be evil" thing was thrown out the window a long time ago but this is stooping to a new low even for Google.
 

FloatingBones

macrumors 65816
Jul 19, 2006
1,318
397
This is evil.

This is evil. These yahoos were deliberately working around the privacy/security on a platform. There should be a massive fine and people should be fired from the company.

The really shocking thing is that very smart people within the company noted this loophole and designed the workaround. Did their ethical light-bulbs never go on? Can the government subpoena email records to see how high up the company people knew about this evil act?
 

dethmaShine

macrumors 68000
Apr 13, 2010
1,697
0
Into the lungs of Hell
I am not surprised at either of the things-

- Apple not fixing loopholes in software
- Google circumventing privacy restrictions on software

I know many people who belong to each club (Apple, Google) have adapted to both the facets referred above. Nothing can be done.
 

Menel

macrumors 603
Aug 4, 2011
6,214
1,164
Google exploits it.
Google fixes it (both on their end, and in Webkit project source)

Sounds like it really was purely unintentional. It's such a short lived behavior, they can't really get anything significant out of it.

Non-issue, only newsworthy because it's mildly interesting.
 

Rot'nApple

macrumors 65816
Dec 27, 2006
1,151
0
I DID build that!
"An Apple spokesman said: "We are aware that some third parties are circumventing Safari's privacy features and we are working to put a stop to it."

By buying Google and shutting it down and screw the shareholders, keeping the money! :D PLEASE!, PLEASE!, PLLLLLLLEEEEEEEEASE! :rolleyes:
/
/
/
 

trainwrecka

macrumors 6502
Apr 24, 2007
467
455
Earth
Google exploits it.
Google fixes it (both on their end, and in Webkit project source)

Sounds like it really was purely unintentional. It's such a short lived behavior, they can't really get anything significant out of it.

Non-issue, only newsworthy because it's mildly interesting.

Yup, I "unintentionally" write lines of code all the time that exploit loopholes that benefit me.
 

Marcus-k

macrumors regular
Nov 17, 2011
111
0
It's like Google is trying to become nothing more than adware or something.

:rolleyes:

This is completely unacceptable. You would expect this kind of behavior from some type of shady malware outfit. Is this what Google has become? I know the "don't be evil" thing was thrown out the window a long time ago but this is stooping to a new low even for Google.

Well F you Google. :mad:

"Don't be evil."

Why am I not surprised.

And who said Google is "not evil"?

Absolutely disgraceful.

This is evil. These yahoos were deliberately working around the privacy/security on a platform. There should be a massive fine and people should be fired from the company.

The really shocking thing is that very smart people within the company noted this loophole and designed the workaround. Did their ethical light-bulbs never go on? Can the government subpoena email records to see how high up the company people knew about this evil act?


Google only does it when you have it enabled on your account:

"provide features that signed-in Google users had enabled."
 

jon1987

macrumors regular
Jan 27, 2011
151
10
If they behave in this way with someone else's browser, makes you wander what shady activities they get up to on their own.
 

Big-TDI-Guy

macrumors 68030
Jan 11, 2007
2,606
13
It's obvious what a farce their slogan was from the beginning. Time to ditch your slogan, it's not helping you anymore.
 

ugahairydawgs

macrumors 68030
Jun 10, 2010
2,774
1,809
Google is just one of the offenders here, and should be drug through the PR wringer for it, but at the end of the day a large chunk of the blame for this needs to be laid at Apple's feet for loading up Macs with software that has such a massive freaking hole.

This is very Internet Explorer-esque.
 

jpmcnown

macrumors member
Aug 4, 2011
35
0
Gimme a break. If Apple did this same thing, fanboys would unite in support of a new "feature" of Safari. If you think that Apple is any less nefarious than Google, you are sorely mistaken.
 

dethmaShine

macrumors 68000
Apr 13, 2010
1,697
0
Into the lungs of Hell
There's been an update to this story on AppleInsider, which Macrumors should also update accordingly.

http://www.appleinsider.com/article...privacy_settings_to_better_track_its_ads.html

Extract:
Update: Google reached out to AppleInsider to share the following comment from the company's senior vice president of Communications and Public Policy, Rachel Whetstone:
The Journal mischaracterizes what happened and why. We used known Safari functionality to provide features that signed-in Google users had enabled. It’s important to stress that these advertising cookies do not collect personal information.

Understandable. But they should have put it this way:

The Journal caught us circumventing privacy settings. We used a known Safari bug/exploit to extract more information and more information and provide features that signed-in Google users had enabled. It’s important to stress that these advertising cookies do not collect personal information. I mean, believe us for what we say.

:)
 

dethmaShine

macrumors 68000
Apr 13, 2010
1,697
0
Into the lungs of Hell
This is evil. These yahoos were deliberately working around the privacy/security on a platform. There should be a massive fine and people should be fired from the company.

The really shocking thing is that very smart people within the company noted this loophole and designed the workaround. Did their ethical light-bulbs never go on? Can the government subpoena email records to see how high up the company people knew about this evil act?

I know Apple is to blame; they should have fixed the loophole but such a big company using an already known exploit to do something so unethical is beyond me.

The company being Google, is less surprising though. I always knew they would do anything to get whatever data beneficial to them.
 

mdriftmeyer

macrumors 68040
Feb 2, 2004
3,281
1,015
Pacific Northwest
This is evil. These yahoos were deliberately working around the privacy/security on a platform. There should be a massive fine and people should be fired from the company.

The really shocking thing is that very smart people within the company noted this loophole and designed the workaround. Did their ethical light-bulbs never go on? Can the government subpoena email records to see how high up the company people knew about this evil act?

Authorization for this comes from the top.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.