San francisco, Sept 20: If you rely on Microsoft’s Internet Explorer’s privacy settings to control cookies on your computer, you may want to rethink that strategy.
Large numbers of Web sites, including giants like Facebook, appear to be using a loophole that circumvents IE’s ability to block cookies, according to researchers at CyLab at the Carnegie Mellon University School of Engineering.
A technical paper published by the researchers says that a third of the more than 33,000 sites they studied have technical errors that cause IE to allow cookies to install, even if the browser has been set to reject them. Of the 100 most visited destinations on the Internet, 21 sites had the errors, including Facebook, several of Microsoft’s own sites, Amazon, IMDB, AOL, Mapquest, GoDaddy and Hulu.Cookies are used to store information about a user or computer’s Web use so sites can customize that user’s experience, including what ads they see. So-called persistent or tracking cookies are data placed not by the site visited, but by other third-party Web sites that have placed content or advertising on the visited Web page. These types of cookies can stay on computers for long periods of time and gather data about surfing habits, and have long raised hackles among those concerned about privacy online.
The loophole resides deep in an exchange of data between browser and site. Normally, Internet Explorer checks the privacy policy of a site to see if it complements the browser’s own security settings.
This checking is done through “compact policies”: lines of computer code (in this case, three- or four-letter codes) that reflect the content of the tomelike privacy policies that sites have written out in English. For illustrative purposes, imagine an interaction between browser and site that goes something like this:
Browser: I don’t allow cookies that store personally identifiable information that could be used to contact me without permission.
Site: I do have some cookies to place here, but none do that.
Browser: That sounds fine. Come on in.
Microsoft’s IE browser uses compact policies to block and control certain cookies by default with its “medium” privacy setting. Browsers like Chrome, Firefox and Safari have simpler security settings. Instead of checking a site’s compact policy, these browsers simply let people choose to block all cookies, block only third-party cookies or allow all cookies.
The loophole sites are using to evade IE’s cookie blocker shows up in the process the browser uses to check compact policies. Internet Explorer checks only for codes that indicate a site doesn’t have the right privacy protections. If it finds a compact policy with bad inputs — say, the codes are wrong or there aren’t enough of the codes to complete a proper policy (at least five) — it simply lets the cookies install.