Update re Google (prefetch) vs. user privacy

[David Farber <dave () farber net>]

Begin forwarded message:

From: Lauren Weinstein <lauren () vortex com>
Date: June 14, 2005 10:47:19 AM EDT
To: dave () farber net
Cc: lauren () vortex com, tim () oreilly com
Subject: Update re Google (prefetch) vs. user privacy



Dave,

I've gotten a lot of queries about this Google issue (relating
to prefetch behavior with Mozilla-based browsers) and have some
additional information that I'd like to pass along, including
an easier "fix" for many users.

Tim O'Reilly noted a comment by Trenton Lipscomb:


> First, Google does this for only the first result, not all of them.
> So, it's not really "top search results" but "the first search
> result".

This is both correct and what I was saying in my original message.
My terms "top listings" and "top link results" referred to the top
item from each of the pages (plural) of search results returned.
I don't really see what "all of them" (from a single results page)
would even mean.  I could have worded that section differently, but
I've always considered the top listings to be the first item on each
page returned, regardless of how many total hits are found for an
individual search.

A number of people asked me if the prefetching behavior also applies
to Google Groups (Usenet) search results.  My initial testing
suggests that it does not, at least for my samples.  This will bear
watching, however.

I agree with the argument that people shouldn't be simplistically
using access log data to generate page impression statistics for ad
revenue, etc. purposes.  However, many people indeed use such
techniques, especially for informal statistics where money is not
involved.  Such users still need to know that the Google prefetch
behavior may be distorting their numbers.

I'd like to emphasize again that I am far less concerned about the
statistical problems than by the privacy issues I noted in my
original message.  These anti-privacy effects impact users whether
or not the prefetched sites are using cookies, just through the mere
fact of the prefetch access.

Finally, in my original message I noted a means to stop prefetching
in the affected Mozilla-based browers (including Firefox and others)
by editing the "prefs.js" file.  Though this is not an ideal technique
(the browser needs to be closed when this is done, and there are
overwriting risks in some situations), I chose it as a lowest
common denominator approach that should work in all affected browser
configurations, even when a better choice ("userprefs.js") did not
already exist.

An even better approach is also available that I routinely have used
to set Firefox configurations, and some additional checking verifies
that this is also available for many (if not all) of the other
affected Mozilla-based browsers, at least in typical configurations.

If you enter:

   about:config

into the location bar as if it were a URL, direct access to
configuration settings appears.  Go down to:

   network.prefetch-next

and double-click on that line to toggle the setting from "true"
to "false".  Then close the browser, just to play it safe.
Be sure not to touch any other settings if you don't know
what they do!

After this procedure is performed, prefetch commands in returned
pages will be ignored from all sites.

It's important to note that the prefetch capability, when enabled
(which is the default), can be used by *any* site, so the potential
for problems is not limited to Google by any means.  However, the
particular manner in which Google is now using this feature with
search results, combined with their enormous base of users,
represents a special, very serious case, likely to affect vast
numbers of persons around the world.

--Lauren--
Lauren Weinstein
lauren () pfir org or lauren () vortex com or lauren () eepi org
Tel: +1 (818) 225-2800
http://www.pfir.org/lauren
Co-Founder, PFIR
  - People For Internet Responsibility - http://www.pfir.org
Co-Founder, EEPI
  - Electronic Entertainment Policy Initiative - http://www.eepi.org
Moderator, PRIVACY Forum - http://www.vortex.com
Member, ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
DayThink: http://daythink.vortex.com



-------------------------------------
You are subscribed as lists-ip () insecure org
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/