[LINK] Redirects, User counters and Advertising

[Craig Sanders]

On Mon, Feb 26, 2007 at 07:41:48AM +0800, Adrian Chadd wrote:
> On Mon, Feb 26, 2007, Marghanita da Cruz wrote:
> > One of the easiest ways of counting pageviews is the use of a graphic.
> > The owner of the graphic/image/logo, the owner of the website can source
> > the use which may or may not be legitimate. Ofcourse the "evil" will
> > just copy the graphic.
> 
> Pageviews is only part of it. People also would like to correlate
> individual users with page accesses, and a simple image won't cut it.

right...and jut counting pageviews doesn't actually matter as a privacy
issue.

javascript and web bugs do matter - they're the things that can be used
to build up a profile of an individual's interests and browsing habits
AND link that profile back to that individual's real world identity.


paypal makes a good example. lots of sites on the net have a "donation"
image-button which links to paypal. that image, served by paypal's
web servers, wants to get/set a cookie. if you already have a paypal
account, then you have a paypal cookie which paypal can use to identify
you. now paypal is able to track every site that you visit that has a
paypal donation button on it - regardless of whether you click on the
"donate" button or not.

i.e. the paypal button is acting as a web bug....and a very common one.

some web browsers (e.g. firefox) have cookie options that you can set
so that cookie requests are only honoured for the page's domain and
subdomains. so, if you visit paypal.com directly all the cookie stuff
will work normally (useful for quick logons etc)...but if you visit
another site which just has a paypal button on it, then the browser will
ignore any cookie requests associated with that paypal button.

craig

-- 
craig sanders <cas at taz.net.au>

BOFH excuse #74: You're out of memory