[LINK] Redirects, User counters and Advertising

[Irene Graham]

On Sun, 25 Feb 2007 08:50:11 +1100, rchirgwin at ozemail.com.au wrote:

> Linkers (esp. Howard and Irene!),
[...]
> sessions of the kind we're interested in. For example: secure-
> au.imrworldwide.com:443 https://secure-uk.imrworldwide.com:443 secure-
> za.imrworldwide.com:443 secure-jp.imrworldwide.com:443

Interesting, but I don't have any info on that.

> I suspect Telstra is still using the "443 technique" on visitors to sub-
> sites.
>
> I can't find what setting in Firefox makes it pop up "entering /
> leaving a secure site" warnings, but I use IE so rarely that I've never
> switched that popup off. So when I go from the Telstra home page to
> BigPond I get two popups while the page loads: "You are about to enter
> a secure site", and "You are leaving a secure site". But this was just
> clicking on the BP link on the Telstra home: no attempt at a
> transaction.

Very interesting. I practically never use IE either, but just visited 
Telstra with it and I certainly see what you mean. However, in the Telstra 
case I don't think it's advert/tracking etc related (but could be wrong). 
Viewing the source code of the Telstra home page, near the top of the page 
it runs javascript which includes this:

var telstra_global_login_url = 
"https://telstra.com/myaccount/index.jsp?tR=1";

That appears to me to be probably what causes the "entering a secure site" 
popup.

When the home page has loaded, I notice the address bar shows:
http://www.telstra.com/index.jsp?SMIDENTITY=NO

which suggests to me that maybe if you have e.g. a Telstra cookie on your 
computer relevant to your Telstra account, going to the home page URL might 
load the "my account" part of the site instead of the homepage (because 
that is where the above URL goes).

A bit further down the home page, it runs this script:

http://www.telstra.com.au/global/javascript/switchprotocol.js

which, if you have a browser that will let you view the source of the 
script (my Opera does), appears to be checking whether the browser state is 
currently HTTP or HTTPS and switching protocols under whatever 
circumstances.

So, that seems likely to be what's causing the "leaving secure site". 
Probably reverting to HTTP before loading the rest of the homepage if it 
didn't find whatever it was looking for e.g. perhaps cookie to go to the 
"my account" page (?).

All of the above could be completely wrong. It's complete speculation on my 
part, based on a quick look at source code. If that is what it's doing it 
strikes me as a quite peculiar way of doing things given there's no obvious 
reason to an ordinary visitor as to why it appears to enter/leave an SSL 
site. If my speculation is right it's probably not really doing that - just 
switching protocols as the homepage loads. 

Re advert tracking etc, Telstra's using Omniture - masses of Omniture 
related javascript in the source code of home page and on visiting Telstra 
home page my firewall logged visits to "cnetaustralia.122.2o7.net" and 
2o7.net is Omniture. 

http://www.2o7.net redirects to: 
http://www.omniture.com/privacy/2o7?f=2o7

which tells you that you can "opt-out" of Omniture tracking etc (they don't 
call it that of course). How can you opt out? Allow Omniture to put a 
cookie on your computer.

One more domain is about to become permanently blocked by my firewall!

Irene