Flash cookies are a threat to privacy

13th November 2008 by David North

I’m not an overly paranoid person and think some of the people who feel the need to delete their cookies regularly are probably taking things just a little too far. If people are tracking me around the web and serving adverts I might actually be interested in - fair play to them! I have nothing to hide and nothing to worry about.

However I didn’t realise that Flash provides a much more dangerous type of cookie that really needs to be addressed.

This Local Shared Object can:

  • Stay on your computer for an unlimited amount of time
  • Store 100 kb of data by default, with an unlimited max
  • Couldn’t be deleted by your browser
  • Send previous visit information and history, by default, without your permission

The big thing I take exception to here are the last two points. Firstly I believe every technology should give the user the ability to opt out, for cookies the option to delete should be readily available even if for the most part it’s only used by a minority. But the second point is truly wrong - this kind of data should be limited as it is in other technologies such as JavaScript.

Come on Adobe just give an opt out button on the next version of Flash player or perhaps just make security settings a little easier to find for your average user?

Social media sites turning up ten a penny

12th August 2008 by David North

Wait for a bus and then two come along at once? Well same thing today but with social media websites.

Firstly Smarta.com is billing itself as a information resource for business. Essentially providing social support for your business or future business projects. With the official launch in November 2008 you can check out the blog and register for updates as they come. I’m going to keep an eye on this one as it seems to be backed by some big names like Vodafone and various UK Government agencies.

The next one is called GetCloser.com which is social media site built on your music and film tastes. It’s produced by HMV and isn’t getting the best of press. I’ve had a discussion with Scott Boyd at Fused Nation and he’s got some valid points about how this service is basically a cynical customer profiling system. While I agree about HMV’s motivation for this website I have to say I actually think it’s a very clever way of getting excellent quality data from your customers - you’ve got to respect that.

Are people willing to trade a window into their World for a few nice features on a website? On the whole the answer is yes - people are far too free and easy with their information in my opinion. The law can cover data protection but if people want to hand their personal information over to every Tom, Dick and Harry then they should learn not to be so naive. In the same way that regulation of social networks for children should take the lead from parents protection of your data should start at home.

However other aspects of GetCloser’s marketing of this site are darn right stupid with their marketing agency spamming forums with beta test invitations. Yeah I’ll sign up! Not!

EU now asks about Phorm

6th August 2008 by David North

The EU has requested a response from the UK government to clarify if Phorm breaches European data laws.

Of course the answer in Phorm’s current opt-out structure is yes. I certainly don’t understand why this seems to be so difficult to sort out. An opt-in system would work fine and actually if marketed correctly could be quite popular but the current system is tantamount to spying on web users. I’ve even said myself I’d be happy to opt-in but take exception to ISPs just making the decision for me - where will they draw the line in the future?

I’ve posted several times about this just because I think a system with a lot of potential has just been greedy and followed a route that is only going to antagonise people.

I encourage everyone to sign the online petition to stop ISPs breaching customers’ privacy on the Downing Street website.

I’ve never been entirely happy with some of the data protection laws floating about - some just don’t seem to contain any common sense at all. However if this system is allowed to slip through the net then clearly the whole issue of data protection is a farce.

The balancing act of online privacy

3rd August 2008 by David North

Google has been under fire for stating “complete privacy doesn’t exist” but as always saying they “take privacy very seriously”.

Unfortunately they are toeing the line between providing useful services and protecting everyone’s privacy.

It seems a lot of online providers experience growing pains of user privacy including high profile reporting of websites like Facebook providing personal details that could be used by the unscrupulous.

It’s not a simple solution. I do believe that new services should expand our horizons but they must take a forward thinking attitude to privacy from the offset. In many cases providing the controls for users to be able to protect their own data as they see fit seems to be the best route to take.