Token attempt: the misrepresentation of website privacy policies through the misuse of p3p compact policy tokens
Token attempt: the misrepresentation of website privacy policies through the misuse of p3p compact policy tokens
复制标题
令牌尝试：通过滥用 p3p 紧凑策略令牌来歪曲网站隐私政策
DOI：
--
复制
发表时间：
2010
期刊：
影响因子：
--
通讯作者：
R. McGuire
中科院分区：
文献类型：
--
作者：
P. Leon;L. Cranor;Aleecia M. McDonald;R. McGuire
P3P紧凑型策略（CP）是一组三字符和四字符标记，总结了网站与Cookie有关的隐私政策。用户代理，包括微软的Internet Explorer（IE）网络浏览器，使用CP来评估网站的数据收集实践，并根据网站的隐私实践允许、拒绝或修改Cookie。如果CP准确地反映网站的做法，CP可以提供一种技术手段来强制执行用户的隐私偏好。确认CP的准确性将需要每个站点实践的第一手知识。然而，通过自动分析，我们可以识别由于语法错误或语义冲突而导致错误的CP。我们从33，139个网站收集了CP，并在其中11，176个网站中检测到错误。我们发现大量网站使用相同的无效CP，这些CP被推荐作为IE cookie阻止的解决方案。其他网站的CP在令牌中有拼写错误或其他错误。大多数无效的CP导致Cookie在默认Cookie设置下未被IE阻止。大量使用CP的网站似乎在歪曲他们的隐私做法，从而误导用户，使隐私保护工具无效。
P3P compact policies (CPs) are a collection of three-character and four-character tokens that summarize a website's privacy policy pertaining to cookies. User agents, including Microsoft's Internet Explorer (IE) web browser, use CPs to evaluate websites' data collection practices and allow, reject, or modify cookies based on sites' privacy practices. CPs can provide a technical means to enforce users' privacy preferences if CPs accurately reflect websites' practices. Confirming the accuracy of CPs would require first-hand knowledge of each site's practices. However, through automated analysis we can identify CPs that are erroneous due to syntax errors or semantic conflicts. We collected CPs from 33,139 websites and detected errors in 11,176 of them. We found large numbers of sites using identical invalid CPs that had been recommended as workarounds for IE cookie blocking. Other sites had CPs with typos in their tokens, or other errors. Most invalid CPs resulted in cookies remaining unblocked by IE under it's default cookie settings. It appears that large numbers of websites that use CPs are misrepresenting their privacy practices, thus misleading users and rendering privacy protection tools ineffective.