<?xml version="1.0" encoding="UTF-8"?>

<rss version="2.0" xmlns:blogChannel="http://backend.userland.com/blogChannelModule">

<channel>
<title>Re: How &#x27;bad&#x27; are spyware cookies?? in Security</title>
<link>http://www.dslreports.com/forum/r11682689</link>
<description></description>
<language>en</language>
<pubDate>Sat, 28 Nov 2009 07:50:45 EDT</pubDate>
<lastBuildDate>Sat, 28 Nov 2009 07:50:45 EDT</lastBuildDate>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11771891</link>
<description><![CDATA[<A HREF="/useremail/u/851210"><b>VirtualLarry</b></A> :  <div class="bquote"><SMALL>said by  IGGY <A HREF="/useremail/u/357201"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>If someone has a better way of doing things. Please present it.</DIV>Ted Nelson's concept of "transcopyright", and micropayments, come to mind.<br> <div class="bquote"><SMALL>said by  IGGY <A HREF="/useremail/u/357201"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>If someone has a better way to make sure websites get paid for sales from ads shown.</DIV>What if they got paid for the content itself, directly? In such a way that the annoying advertisements weren't even necessary? Not a pre-paid subscription, but a tiny "pay-as-you-go" thing, almost just like pre-paid phone cards, which were/are all the rage.<br> <div class="bquote"><SMALL>said by  IGGY <A HREF="/useremail/u/357201"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>Then definitely present it and help get it into place. Many would say just do away with the commercialization of the web. I honestly don't see this happening.</DIV>Well, if you remember the state of the internet/web around '94-95, and the state of it now... what do you think? I think that the commercial interests have almost totally destroyed what it used to be, on the order of carpet-bombing Iraq, in order to "save it".<br><br>I also blame the speculators and "the bubble" for doing a lot of damage too, over and above those that sought to commercialize the medium. If they had never shown up, things like hosting/bandwidth costs would never have shot up either. Kind of like the Gold Rush, those selling sevices to those that hoped to "strike it rich", often overcharged, simply because those customers would be willing to pay the price, in a manner that the "locals" were not able to afford any more.<br><br>Some of the biggest obstacles preventing something like I outlined from happening, are simultanously the biggest, existing transaction merchant companies, although Paypal is making significant inroads, and ISPs, whom want to "stay out of the loop" as much as possible, and yet, are really the "key" to the whole thing. Local leaf-node caching of content, using a protocol that can differentiate between "wholesale" and "retail" information, and have a capability for direct local billing, with a certain cut going "upstream", and eventually reaching the actual root content-provider/content-creator, would going a long way towards the creation of this sort of infrastructure.<br><br>I know that a lot of people believe that everyone on the internet should be free, and that feeling is probably never going to go away, but realistically, would paying pennies per day, for you favorite websites, be too high of a cost?<br><br>It also greatly reduces the risk that prevents many people from pre-paying for a subscription for content, because they could visit the site once, at a tiny nominal cost (under a quarter or dime, perhaps, for the average site), and if they don't like the content, simply never go back.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11771891</guid>
<pubDate>Thu, 04 Nov 2004 03:16:08 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11771860</link>
<description><![CDATA[<A HREF="/useremail/u/851210"><b>VirtualLarry</b></A> :  <div class="bquote"><SMALL>said by  hpguru <A HREF="/useremail/u/615773"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>I don't know but she may be thinking in terms of local or hard disk referers. It used to be the case that when a link in a local html file was clicked a referer was transmitted revealing the DOS path to the html file containing the link. Netscape Navigator, IE and Opera all did this. Anyway somewhere along the line this was fixed.</DIV>Ahh! Good catch. I had actually forgotten about that. To Mele20's credit, that was at one point true. I use WebWasher and filter referrer information heavily anyways, so it wouldn't have affected me, but that <I>did</I> use to be an important security precaution.<br><br>Even now, due to various javascript and tabbed-browsing "exploit" issues ... most suggest completely closing/re-opening the browser, or at least a new window, before/after visiting a "secure" site, to prevent other sites/windows/tabs from maliciously interacting.<br><br>Me? Bah, I'm kind of a luddite. I would never conduct financial transactions over the internet, period. It's not just the client-server security issues, but far too many high-profile sites have had far too many security breaches on the back-end for me to feel comfortable, especially knowing the current state of technology of most system WRT security. Call me paranoid if you like, I don't mind. :)]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11771860</guid>
<pubDate>Thu, 04 Nov 2004 03:01:05 EDT</pubDate>
</item>

<item>
<title>Re: OT:  Tin Foil</title>
<link>http://www.dslreports.com/forum/remark,11771851</link>
<description><![CDATA[<A HREF="/useremail/u/851210"><b>VirtualLarry</b></A> :  <div class="bquote"><SMALL>said by  avd706 <A HREF="/useremail/u/766601"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>No no no! Ordinary aluminium doesn't work! You need real tin!</DIV>I'm surprised that no-one has suggested Copper Hats - aren't they supposed to work much better for EM shielding? Or is everyone afraid that they might end up with green hair, like Marsha Brady did that one time... :P<br><br>Would tipping a metal spittoon over, and placing that over your head work?<br><br>PS. No wonder Oscar the Grouch lives in a metal trash can, and always closes the lid when he goes inside. He's the only sane one on Sesame Street - you know that, because everyone else is strangely... happy... like they are under some sort of alien mind-control... Hmm. Must think doubleplusgood thoughts. Yes... Smile! :)]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11771851</guid>
<pubDate>Thu, 04 Nov 2004 02:53:46 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11771016</link>
<description><![CDATA[<A HREF="/useremail/u/357201"><b>IGGY</b></A> : I like Dvorak. But my question in regards to the statements quoted above would be this. If he truly feels this way. Why does he use the advertising that many of us do to make a living on his blog. Many of the advertisements you see on his blog will in fact drop a cookie on your machine. Some of these companies are even frowned upon by some in this forum. Even though the companies are legitimate and as far as I've seen. Never have obtained unnecessary data or shared any data from cookies with others.<br><br>My opinion is simple. If someone has a better way of doing things. Please present it. If someone has a better way to make sure websites get paid for sales from ads shown. Then definitely present it and help get it into place. Many would say just do away with the commercialization of the web. I honestly don't see this happening. So lets offer options you feel would better handle the issue. Many in this forum also run websites with various content. Many of those same users depend on those cookies to put food on the table and pay the bills. For anyone who has ever read an affiliate contract / terms of service. You know that one slight error and you don't get paid. No cookie - no recorded sale. Even if the buyer came from your site. Many here would say oh well tough luck. Your not going to invade my privacy. Even though the cookie placed isn't spying on you. <br><br>I personally feel the whole cookie thing has become way blown out of proportion. With that said. I do block cookies - except for session cookies - for sites I don't know all that well. Just in case the evil cookie monster does reveal itself. But when I make purchases online. I make sure I'm accepting the needed cookies for that site not to get hosed out of a payment.<br><SMALL>--<br><A HREF="http://test.iggyz.com/">Test Your Security</A>   <A HREF="http://cog.iggyz.com">Benefit for Children's Cancer </A>   <A HREF="http://www.iggyz.com/AdvDiag.html">Cable Diagnostics</A><A HREF="http://iggy.iggyz.com/"> My Blog</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11771016</guid>
<pubDate>Wed, 03 Nov 2004 23:56:38 EDT</pubDate>
</item>

<item>
<title>Re: OT:  Tin Foil</title>
<link>http://www.dslreports.com/forum/remark,11756547</link>
<description><![CDATA[<A HREF="/useremail/u/658856"><b>javaMan</b></A> :  <BLOCKQUOTE><SMALL>said by  avd706 <A HREF="/useremail/u/766601"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><HR>  <div class="bquote"><SMALL>said by  dave <A HREF="/useremail/u/156437"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br><BR> I'm still going to refer to tin-foil hats, by the way. Even if tin foil is really aluminium.<br><br>Edited: fix typo.<br> <HR></BLOCKQUOTE>No no no! Ordinary aluminium doesn't work! You need real tin!<br><br>&raquo;<A HREF="http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=13597&item=7110189444&rd=1" >cgi.ebay.com/ws/eBayISAPI.dll?Vi&middot;&middot;&middot;444&rd=1</A><br> <HR></BLOCKQUOTE><br>All you ever wanted to know about the tin foil hat.  Be sure to read the History Of Aluminum & Psychotronics.<br><br>The euphemism of the tin foil hat indicates someone who, while not necessarily mentally ill, is certainly someone who's pictures don't hang level on the wall.<br><br>&raquo;<A HREF="http://zapatopi.net/afdb.html" >zapatopi.net/afdb.html</A><br><SMALL>--<br>Woe unto them that call evil good, and good evil; that put darkness for light, and light for darkness. . . Isa. 5:20</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11756547</guid>
<pubDate>Tue, 02 Nov 2004 15:27:46 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11755997</link>
<description><![CDATA[<A HREF="/useremail/u/874811"><b>sivran</b></A> :  <BLOCKQUOTE><SMALL>quote:</SMALL><HR>there have been exploits that could foil a user who clicked on a banking bookmark in favorites/bookmarks. <HR></BLOCKQUOTE><br><br>Prove it. Short of a pre-existing infection, what is there to make it dangerous? Find me a vuln, preferably with proof of concept, by which a pre-existing bookmark can be compromised to point to a phishing site. Note that I use Mozilla 1.7.3 and thus any vuln you find must affect that version. Yes, I am calling on YOU to find it. It's your allegation, you prove it.<br><br> <BLOCKQUOTE><SMALL>quote:</SMALL><HR>You must use some banks that have terrible security and don't give a hoot about the possible consequences of poor security for the individual user.<HR></BLOCKQUOTE><br><br>My bank's security is fine, thank you.<br><br>Also, silly me, in my previous post the recent GMail vuln had <I>completely</I> slipped my mind. Perhaps because it couldn't affect me. It's also been fixed, according to SecurityFocus.<br><SMALL>--<br><A HREF="http://www.againsttcpa.com/">TCPA </A>- Treacherous Computing<BR><A HREF="http://download.kerio.com/dwn/kpf/kerio-pf-2.1.5-en-win.exe">Kerio 2.1.5</A> - Best damn firewall<BR><B>Licenses should be per user, Ditch Norton! Get F-Prot!</B></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11755997</guid>
<pubDate>Tue, 02 Nov 2004 14:32:58 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11755620</link>
<description><![CDATA[<A HREF="/useremail/u/615773"><b>hpguru</b></A> :  <div class="bquote"><SMALL>said by  BM Fan <A HREF="/useremail/u/1061336"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>I'm totally lost as to how typing the address is any different then clicking your bookmark<br>and Mele20<br> </DIV>I don't know but she may be thinking in terms of local or hard disk referers. It used to be the case that when a link in a local html file was clicked a referer was transmitted revealing the DOS path to the html file containing the link. Netscape Navigator, IE and Opera all did this. Anyway somewhere along the line this was fixed. What I see now is that no referer is sent when clicking a link in a local file (although old browsers may still do it). There is simply no difference whatsoever in clicking a link in a local file, clicking a favorite or bookmark entry or typing in the address. So she is wrong but her idea may have basis in outdated fact. I don't know, I'm just guessing.<br><SMALL>--<br><B>FOUR MORE YEARS!!</B> - of fear.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11755620</guid>
<pubDate>Tue, 02 Nov 2004 13:50:55 EDT</pubDate>
</item>

<item>
<title>OT:  Tin Foil</title>
<link>http://www.dslreports.com/forum/remark,11753215</link>
<description><![CDATA[<A HREF="/useremail/u/766601"><b>avd706</b></A> :  <div class="bquote"><SMALL>said by  dave <A HREF="/useremail/u/156437"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR> I'm still going to refer to tin-foil hats, by the way. Even if tin foil is really aluminium.<br><br><I><SMALL>Edited: fix typo.<br> </DIV>No no no! Ordinary aluminium doesn't work! You need real tin!<br><br>&raquo;<A HREF="http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=13597&item=7110189444&rd=1" >cgi.ebay.com/ws/eBayISAPI.dll?Vi&middot;&middot;&middot;444&rd=1</A>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11753215</guid>
<pubDate>Tue, 02 Nov 2004 09:04:56 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11753041</link>
<description><![CDATA[<A HREF="/useremail/u/156437"><b>dave</b></A> : OK, I wasn't going to join in the discussion about 'paranoia', because it's obviously an emotional issue.<br><br>But I think the insistence on taking 'paranoid' as a literal accusation of mental illness is getting silly. The word is used, in America, in a colloquial sense.<br><br>See <A HREF="http://www.dslreports.com/forum/remark,11736144~mode=flat?hilite=paranoia#11736144">here</A> for an example of someone using the word 'paranoia' thus. I'm assuming that the writer does not literally expect that someone will develop a clinical condition from seeing a sticky note about anti-virus updates. In other words, the author is aware of the colloquialism, and expects the reader to be likewise aware.<br><br>Myself, I don't much like to see clinical terms such as paranoia used in this manner, but nevertheless I can tell a colloquial use when I see one.  I'm still going to refer to tin-foil hats, by the way. Even if tin foil is really aluminium.<br><br><I><SMALL>Edited: fix typo.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11753041</guid>
<pubDate>Tue, 02 Nov 2004 08:29:52 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11751263</link>
<description><![CDATA[<A HREF="/useremail/u/766601"><b>avd706</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>  Anyone who is "too paranoid" is by medical definition suffering from a physical disease called paranoid schizophrenia. <br> </DIV>I disagree [personal flame deleted]]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11751263</guid>
<pubDate>Mon, 01 Nov 2004 23:34:53 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11750923</link>
<description><![CDATA[<A HREF="/useremail/u/851210"><b>VirtualLarry</b></A> :  <div class="bquote"><SMALL>said by  Khaine <A HREF="/useremail/u/779741"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>I think we all need to chill and put this in perspective</DIV>Agreed. For example, while I do think cookies present a privacy risk, and that privacy and security from the perspective of an individual attempting to live their life in in a modern computerized society are both very intertwined and to a point inseperable concerns, I also think that cookies are quite low on the totem-pole of risks overall - with a specific exception made for those containing authentication information that could potentially be used for "serious" (real-world) things if exploited. Banking site cookies would fall under that rule. Forum login cookies would most likely not.<br><br>I used to have my browser set to prompt me for every single cookie, even when I had third-party cookies disabled, but after a reasoned analysis I figured that the "denial of sevice" to my browsing habits was effectively just as bad as pop-up advertising windows were. I realized that "tracking cookies" are probably the most trivial of security/privacy concerns, and because of that I have recently configured my browser to allow 1st-party cookies by default. It makes browsing much smoother. I also still run WebWasher, which can act as a front-end cookie filter, and I can set specific exceptions to allow sites. (I do have Google set to 'deny' cookies though.) One annoying "feature" of some web sites that I noticed, is that they use IFRAMEs and other methods to access HTTPS sites, and those are used to set 3rd-party tracking cookies, in a way that bypass most local HTTP proxy servers, including WebWasher. So I have my firewall prompt on outbound TCP 443 connects from my browser, or I disable them entirely, and then add whitelisted IPs instead. (SourceForge, BugZilla, others.)<br><br>As for accessing said banking site's URLs, I think that the point was to never click on a link from <I>inside another web page or e-mail document</I>, as it could be a "phishing" attempt. I don't see anything inherently insecure about using local bookmarks, unless some malware were able to access and modify them in such a way to re-direct your access to a "rogue" site instead. The same could be accomplished by highjacking the 'hosts' file, or inserting an LSP into the network stack.<br><br>I <I>do</I> agree about concerns of the act of bookmarking any sort of "deep link" into said banking site, as many sites often use URL parameters, sometimes instead of cookies or whatnot to hold session-id data, or worse (much worse) actual authentication or other private material. (If you were accessing through a proxy, it would be logged. That shouldn't be an issue over HTTPS connections though, although it might be again with the advent of the "Google Desktop search" tool.)<br><br>But a simple bookmark to the front page of the site shouldn't be a concern.<br><br>Getting back somwhat on topic here, shouldn't a bigger concern should probably be with persistant identifiers being used for tracking purposes, that are not as up-front and as easy to control as cookies are? That's why those non-standard IE features intrigued me so. There are also a number of other ways for online sites to identify you, notably by IP address, and also by GUIDs that are accessable by common ActiveX controls, if you use IE and have at least those common ones enabled.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11750923</guid>
<pubDate>Mon, 01 Nov 2004 22:55:57 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11750219</link>
<description><![CDATA[<A HREF="/useremail/u/779741"><b>Khaine</b></A> : I think we all need to chill and put this in perspective]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11750219</guid>
<pubDate>Mon, 01 Nov 2004 21:50:23 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11750157</link>
<description><![CDATA[<A HREF="/useremail/u/1061336"><b>BM Fan</b></A> : I'm totally lost as to how typing the address is any different then clicking your bookmark<br>and Mele20 Ive seen enough of your posts since ive been here I  feel confident in saying you are overly paranoid ( no offence  meant) one thing you have to realise the internet is a huge place, and the odds that anyone is going to give a rats ass about your data or go through the effort to get it are very slim indeed. I don't sugest you ignore taking basic security precautions. but within reason<br><SMALL>--<br>"Well, I lost my virginity in a car. But it wasn't a very nice one."" -Brittany Murphy</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11750157</guid>
<pubDate>Mon, 01 Nov 2004 21:44:42 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11749039</link>
<description><![CDATA[<A HREF="/useremail/u/340145"><b>Steve</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>I totally discount anyone who uses that phrase as it indicates they feel they are qualified physicians capable of diagnosing a very serious physical disease.</DIV>If you think we are diagnosing a medical illness, you're out of your mind.<br><br>This forum would be better to have less of your "advice", not more of it.<br><br>Steve<br><br><SMALL>P.S. - shiny side out</SMALL><br><SMALL>--<br>Stephen J. Friedl &#149; Unix Wizard &#149; Microsoft MVP &#149; Tustin, California USA &#149; <A HREF="http://www.unixwiz.net">my web site</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11749039</guid>
<pubDate>Mon, 01 Nov 2004 19:58:22 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11749026</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : I totally discount anyone who uses that phrase as it indicates they feel they are qualified physicians capable of diagnosing a very serious physical disease. So, go ahead with your ranting. You have suceeded in my finally deciding that all your comments are tainted by your obvious prejudice against those who suffer from diseases that you seem to think are legitimate targets for your derision. <br><br>You have proven yourself not worthy of any reasoned comments from me nor my time to read your rants.<br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11749026</guid>
<pubDate>Mon, 01 Nov 2004 19:56:44 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11748848</link>
<description><![CDATA[<A HREF="/useremail/u/615773"><b>hpguru</b></A> :  <div class="bquote"><SMALL>said by  VirtualLarry <A HREF="/useremail/u/851210"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br> Ok, emphassis mine - which is it? Does the "userdata persistance" (I assume if enabled?) persist across sessions, or just across pages in the same session (like session cookies), or what? </DIV>Yes it can persist across sessions.<br><br> <div class="bquote"><SMALL>said by  VirtualLarry <A HREF="/useremail/u/851210"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>And what kind of security measures are implemented, to prevent site B from accessing site A's persistent DOM property additions? At least cookies are limited by the browser to be readable only by the server/URL path that set them. It would seem at least from your limited description that they would be accessable if one simply knew the name, which could probably be obtained from enumerating DOM elements/properties, couldn't it? (Not sure, I'm a C++ guy, not a JS guy.) If nothing else, one could potentially use an IFRAME to include the source page's HTML itself and then scrape the frame's data that way to obtain the name, couldn't they? </DIV>Before I answer I would just like to stress that Userdata Persistence and the arbitrary navigator prop thingy I mentioned are entirely seperate methods. I wouldn't even call the latter a method. I regard it as a bug since I have yet to find it officially documented anywhere.<br><br>Unless IE6 SP2 has beefed up security in this area it seems the only security mechanism present is MSDN warning developers to be careful when coding behaviors to persist data across sessions. This might answer your question a little better.<br><br><A HREF="http://msdn.microsoft.com/library/default.asp?url=/workshop/author/behaviors/sec_behaviors.asp">Security Considerations: DHTML and Default Behaviors</A><br><br>Yes navigator object properties may be obtained by enumeration but data retrieved thereby would be difficult if not impossible for a dumb script to interpret correctly. The malicious webmaster would almost have to have foreknowledge of the property and its value in order to exploit it. It wouldn't be necessary to load the page in a frame if the frameset is still in the same window session.<br><br> <div class="bquote"><SMALL>said by  VirtualLarry <A HREF="/useremail/u/851210"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>Also, considering this discussion is about cookies, couldn't some "banking sites" that require the use of IE, actually use this mechanism instead of cookies, believing (seemingly wrongly) that using a non-standard persistance method would have greater security? (Security through obscurity, the favorite security mechanism of PHBs.)<br>  </DIV>IMHO that is inadvisable. Unless the bank overwrites the data they stored to an arbitrary navigator prop, the only other way to expire the data would be to close the window. Users might not want to do that and might be highly offended if the bank tried to close it from a script or other active content. IMHO the only utility in this "method" is it makes a nifty DHTML trick.<br><SMALL>--<br><B>FOUR MORE YEARS!!</B> - of fear.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11748848</guid>
<pubDate>Mon, 01 Nov 2004 19:39:43 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11748686</link>
<description><![CDATA[<A HREF="/useremail/u/340145"><b>Steve</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>You should also NEVER allow your browser to save any passwords.</DIV> This is the kind of blanket statement that earns "tinfoil hat" epithets.<br><br>I have dozens and dozens of passwords saved in my browser, and it's been a wonderful timesaver. But, unlike those who are too freaked out about security to think clearly, I am able to decide which passwords are entirely unimportant (and saved by my browser) and which ones are too dangerous for that (which are not saved).<br><br>I sign up for all kinds of sites that requires a registration - the most recent was the LA Times - and there are simply no consequences that I care about if this saved password were somehow compromised. I really, really do not care (aside from the fact that the computer itself has been well secured).<br><br>You are providing a disservice to the security community by making everything a big hairy deal: if everything is important, then nothing is. Teaching newbies that it's a vice to have a sense of perspective is not helping anybody.<br><br>Steve<br><SMALL>--<br>Stephen J. Friedl • Unix Wizard • Microsoft MVP • Tustin, California USA • <A HREF="http://www.unixwiz.net">my web site</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11748686</guid>
<pubDate>Mon, 01 Nov 2004 19:22:22 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11748619</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> :  <div class="bquote"><SMALL>said by  sivran <A HREF="/useremail/u/874811"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br> <BLOCKQUOTE><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><HR>Only a crass,  unfeeling person jokes about schizophrenia. Stop the jokes about mental illness please. <HR></BLOCKQUOTE><br><br>Tin-foil hat has nothing to do with schizophrenia, and everything to do with being overly and unnecessarily paranoid. If someone says you wear a tin-foil hat, that person thinks you are too paranoid. That's all there is to it. <br><br> <BLOCKQUOTE><SMALL>quote:</SMALL><HR>never go to your bank from a favorites link. Always type in the address.<HR></BLOCKQUOTE><br><br>And why not? What is the difference between typing it in, and clicking the bookmark which I've had forever? <B>None,</B> other than the bookmark being faster.<br><br>  </DIV>Tinfoil hat is a nasty expression used on the internet by nasty people who wish to flame someone but don't want the mod to make them suffer the consequences of such so they use this phrase. Anyone who is "too paranoid" is by medical definition suffering from a physical disease called paranoid schizophrenia. That is what you say I am suffering from but you are not willing to actually say it because that would be clear flaming (aside from the fact that as I far as I am aware you are not a licensed medical professional capable of properly diagnosing when a person is "too paranoid"). <br><br>As for always typing in the address of the bank, I don't know where you have been the last several years but even SANS and other reputable security sites recommend this because there have been exploits that could foil a user who clicked on a banking bookmark in favorites/bookmarks. Most security sites and banking sites (all of mine) warn to never place a bank's address in favorites. You must use some banks that have terrible security and don't give a hoot about the possible consequences of poor security for the individual user. Additionally, a smart user would not wish anyone who uses their computer to see what banks they use. Even if no one else uses your computer, it takes only a few seconds if you leave the room and someone else is there and your computer is on to check for this sort of information. <br><br>You should also NEVER allow your browser to save any passwords. The safest place for your passwords is locked in a safe in your home or better yet in a safety deposit box at your local bank. Or you can get programs that will allow you to encrypt them, etc on your computer but that still is less safe from physical disaster, etc. than placing them in a wall safe, etc.<br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11748619</guid>
<pubDate>Mon, 01 Nov 2004 19:14:05 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11747899</link>
<description><![CDATA[<A HREF="/useremail/u/851210"><b>VirtualLarry</b></A> :  <div class="bquote"><SMALL>said by  hpguru <A HREF="/useremail/u/615773"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>Like any other technology, it is neither good nor bad. Its primary use is to cause the state of web pages or objects in DOM to persist <B>across sessions</B> without cookies. I have it enabled in my Trusted Sites Zone so that for example most pages at MSDN persist exactly the way I last viewed them.<br><br>No it isn't anything like that. This method is pretty much useless unless site B can anticipate that site A has used this method and that you visited site A earlier in the <B>current session</B>.</DIV>Ok, emphassis mine - which is it? Does the "userdata persistance" (I assume if enabled?) persist across sessions, or just across pages in the same session (like session cookies), or what?<br><br>And what kind of security measures are implemented, to prevent site B from accessing site A's persistent DOM property additions? At least cookies are limited by the browser to be readable only by the server/URL path that set them. It would seem at least from your limited description that they would be accessable if one simply knew the name, which could probably be obtained from enumerating DOM elements/properties, couldn't it? (Not sure, I'm a C++ guy, not a JS guy.) If nothing else, one could potentially use an IFRAME to include the source page's HTML itself and then scrape the frame's data that way to obtain the name, couldn't they?<br><br>Also, considering this discussion is about cookies, couldn't some "banking sites" that require the use of IE, actually use this mechanism instead of cookies, believing (seemingly wrongly) that using a non-standard persistance method would have greater security? (Security through obscurity, the favorite security mechanism of PHBs.)<br> <div class="bquote"><SMALL>said by  hpguru <A HREF="/useremail/u/615773"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>I've not heard of this method being used for nefarious purposes. I have heard of developers using it to persist or cache data accross their own pages. Access to data cached in this manner is a little faster than access to the same data stored in a cookie and much faster than Userdata Persistance.</DIV>I thought you said that this <I>was</I> Userdata Persistance? Hmm. I will scour MSDN for more info.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11747899</guid>
<pubDate>Mon, 01 Nov 2004 17:58:46 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11747748</link>
<description><![CDATA[<A HREF="/useremail/u/851210"><b>VirtualLarry</b></A> :     <div class="bquote"><SMALL>said by  Steve <A HREF="/useremail/u/340145"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR><div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br>As for banking cookies, only an idiot would keep those. Even your bank will tell you to get rid of them.</DIV>Huh? My bank has never mentioned this to me, but even a rudimentary understanding of how cookies work - at least those by clueful banks - suggests that you're demonstrating that you <B>don't</B> know how they work.</DIV>Considering that many online sites use "magic cookies" as an authentication token, then they are essentially equivalent to a username/password authentication. Most people recommend never 'storing' your username/password combos in your browser for important sites (like banking), because of the risk of a potential browser exploit revealing them and allowing them to be stolen. Since "magic cookies" are logically equivalent to usernames and passwords, it would seem prudent to follow the same security precautions regarding them as well.<br><br>Considering how some recent privacy-violating browser exploits have worked, such as Download.Ject and most recently the GMail one, which did indeed work by stealing cookie-based authentication, I believe, although I didn't look at the nitty-gritty technical details, then this risk is very real. To pretend that it isn't, is being a bit dis-ingenious and and pretentiously dismissive towards Mele20, isn't it?<br><br>    <div class="bquote"><SMALL>said by  Steve <A HREF="/useremail/u/340145"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR><SMALL>When you login to a secure site, the login page sends your username and password (presumably over SSL), and after validating that you're who you claim to be, a new "session" is created. This session data includes thinks like your username, time you started, IP address, etc. and is stored on the server, and a unique and random session ID is assigned. The ID itself has no inherent meaning, nothing is "encoded" in it (it's "opaque"), and this is what is sent to you in your cookie. When you submit following pages (transfer money, check balance, etc.), the ID passed in your cookie is looked up in the session database, and it checks to see if you're still allowed, who you are, has it been too long since you did anything (to allow "idle sessions" to timeout), coming from the same IP address, etc. When you click the Logout button, this not only deletes the cookie from your browser, but it invalidates the session in the database, so even if you hung onto or intercepted that cookie, it would not work. Yes, the cookie value would be sent to the server, but it would look it up and find that either (a) the session had been deleted entirely, or (b) the session had been marked explicitly "expired". Expired sessions cannot be revived by anything on the browser side without going through a new login process.</SMALL></DIV>That whole secenario assumes that the site in question was designed with a 'clueful' approach to security. Unless you can guarantee that <I><B>every</B></I> site on the internet, in which you conduct "secure" transactions with, is as clueful, then it would seem prudent to follow some personal security practices to protect yourself, rather than trusting every other big company to do it for you. Personal responsibility, you see.<br><br>(Interestingly enough, I just got done reading this thread &raquo;<A HREF="http://www.blacksheepnetworks.com/security/security/vulndev/0331.html" >www.blacksheepnetworks.com/secur&middot;&middot;&middot;331.html</A> from 2002, discussing major retailers passing customer CC and other sensitive financial data "in the clear" over WiFi. Very disturbing. It tends to discount the idea that companies are always interested in proper security, because they aren't. They're only interested in implementing IT technology as cheaply as possible, to maximize profits of course. Not all banks are interested in paying for properly-secure web-development. Indeed, look at the number that still require IE for access.)<br><br>    <div class="bquote"><SMALL>said by  Steve <A HREF="/useremail/u/340145"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>Any site that has a clue about security has designed the site to mitigate the effect of "cookie theft"</DIV>Funny, I thought that the tech/development guys at Google were the "smartest of the smart", and yet they fell prey to a "cookie exploit". The risks are real, don't downplay or deny them, it does a disservice to security-concious people everywhere.<br><br>Btw, I do always try to "logout" from my webmail, but there are occasions when that doesn't happen. Thankfully, webmail sessions time-out after about 10 minutes of inactivity.<br><br>There are other sites that do not operate using session cookies, but instead use permanent "magic" cookies for authentication. Verizon is one of them, and they <I>do not</I> "time-out". If you stole those cookies, you could intercept someone's e-mail, create a sub-account, give the username/password for the sub-account to your buddy, and they could run up huge charges on your VZ ISP account.<br><br>All because of a stolen authentication cookie.<br><br>    <div class="bquote"><SMALL>said by  Steve <A HREF="/useremail/u/340145"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>If you feel better deleting your cookies, that's fine, but saying "only an idiot doesn't" puts you squarly in tinfoil hat territory and shows that you have only a limited grasp of how cookies are actually used.</DIV>I think that perhaps it would have been better phrased as "only an idiot doesn't know that they are a risk" - because they are. If you, or your bank's site (for example) take steps to mitigate that risk, then they are less of a risk, but they are a risk. Security is all about deciding what is an acceptable level of risk... for yourself.<br><br>Also, regarding the issue of session vs. persistant cookies - I think that you fail to consider the behavior of "persistent browsers" like myself. My browser uptime is over eight days now, and I've visited countless sites. "Session" cookies to me, are just as persistant as permanent ones, effectively, because of my browsing behavior. I always manually delete my session cookies after I'm done visiting a site that uses cookies for secure authentication.<br><br>PS. In case you were curious Steve, I only stumbled upon that other thread while investigating some Kerio firewall weaknesses, which led me to your post on that list regarding "BACKSTEALTH". I've decided to re-evaluate my own approach to security, having realized that I've become far too complacent and trivializing some risks that perhaps I should not.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11747748</guid>
<pubDate>Mon, 01 Nov 2004 17:44:36 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11745640</link>
<description><![CDATA[<A HREF="/useremail/u/874811"><b>sivran</b></A> :  <BLOCKQUOTE><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><HR>Only a crass,  unfeeling person jokes about schizophrenia. Stop the jokes about mental illness please. <HR></BLOCKQUOTE><br><br>Tin-foil hat has nothing to do with schizophrenia, and everything to do with being overly and unnecessarily paranoid. If someone says you wear a tin-foil hat, that person thinks you are too paranoid. That's all there is to it. <br><br> <BLOCKQUOTE><SMALL>quote:</SMALL><HR>never go to your bank from a favorites link. Always type in the address.<HR></BLOCKQUOTE><br><br>And why not? What is the difference between typing it in, and clicking the bookmark which I've had forever? <B>None,</B> other than the bookmark being faster.<br><br> <BLOCKQUOTE><SMALL>quote:</SMALL><HR>Are cookies secure, meaning that can site1 read site2's cookies?<HR></BLOCKQUOTE><br><br>As far as I know and in general, yes. Heck, I've tried. ;) There may exist a few exploits which may allow cookies to be read by a hostile webserver, but I don't recall any off the top of my head, and they probably have a) long been patched and b) only work in IE, if they do exist. Some may rely on a previously compromised system. They're just text files, after all. Only the browser really stands in the way.<br><br> <BLOCKQUOTE><SMALL>quote:</SMALL><HR>What kind of information can a cookie contain?<HR></BLOCKQUOTE> Anything. Whatever data the webserver wants to put in it, it can.<br><br> <BLOCKQUOTE><SMALL>quote:</SMALL><HR>What kind of information should a cookie contain and why?<HR></BLOCKQUOTE> This is a thorny one. Personally I think cookies should only contain information pertinent to the functionality of a site, for example, "color=blue" on a site you can customize. They could also be used to skip scripts which may slow the site down. Reading "Resolution=1024x768" when a user returns could save the webserver the processing cycles it takes to run a script that determines a returning user's resolution.<br><br>That cookies are used for advertising purposes is an unfortunate side-effect of the need for advertisers to support and defray the costs of maintaining a web presence. To that end you could say that keeping cookies around, letting the advertisers track you, is in some small way supporting the usefulness of the www. The more information the advertisers have about you, the more money they can potentially make, leading to potentially buying space on more websites, thereby supporting more websites. Perhaps this is an overly optimistic view, but it's better than "evil advertisers tracking you" and certainly less worrisome.<br><SMALL>--<br><A HREF="http://www.againsttcpa.com/">TCPA </A>- Treacherous Computing<BR><A HREF="http://download.kerio.com/dwn/kpf/kerio-pf-2.1.5-en-win.exe">Kerio 2.1.5</A> - Best damn firewall<BR><B>Licenses should be per user, Ditch Norton! Get F-Prot!</B></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11745640</guid>
<pubDate>Mon, 01 Nov 2004 13:44:17 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11743625</link>
<description><![CDATA[<A HREF="/useremail/u/340145"><b>Steve</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>Sigh. I am fully aware of all that you have thought necessary to "teach" me. </DIV>OK, so you actually do understand that there aren't any technical reasons to worry about banking cookies, but you do anyway? Is this like throwing spilled salt over your shoulder? Do you read your horoscope too?<br><br>Steve<br><SMALL>--<br>Stephen J. Friedl • Unix Wizard • Microsoft MVP • Tustin, California USA • <A HREF="http://www.unixwiz.net">my web site</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11743625</guid>
<pubDate>Mon, 01 Nov 2004 08:49:57 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11743382</link>
<description><![CDATA[<A HREF="/useremail/u/615773"><b>hpguru</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>...since when is PRIVACY not a SECURITY issue??? That is the main security issue!<br><br> </DIV>Privacy and security are linked only in our interests. The perceived linkage may in fact be a result of the use of multifunction security apps such as firewalls which perform other tasks including cookie and active content management. Fact is, one can have good rock solid security with no particular interest in privacy protection and it will not impact his security. The obverse isn't necessarily true. Privacy only becomes a security issue once security has already been breached. So for example ID theft is a privacy issue which began with a breach in security. <br><br>That's not to say privacy isn't a legitimate concern. It is but there is only so much one can do to protect it. <br><SMALL>--<br><B>FOUR MORE YEARS!!</B> - of fear.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11743382</guid>
<pubDate>Mon, 01 Nov 2004 07:40:58 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11743203</link>
<description><![CDATA[<A HREF="/useremail/u/615773"><b>hpguru</b></A> :  <div class="bquote"><SMALL>said by  VirtualLarry <A HREF="/useremail/u/851210"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>Does that have anything to do with the "Userdata Persistance" setting in IE?<br> </DIV>Yes.<br><br> <div class="bquote"><SMALL>said by  VirtualLarry <A HREF="/useremail/u/851210"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>I've always assumed that was "bad", like some sort of user-profiling/tracking feature, but I never quite knew what the technical specifics were. I always disable it regardless.<br> </DIV>Like any other technology, it is neither good nor bad. Its primary use is to cause the state of web pages or objects in DOM to persist across sessions without cookies. I have it enabled in my Trusted Sites Zone so that for example most pages at MSDN persist exactly the way I last viewed them. <br><br> <div class="bquote"><SMALL>said by  VirtualLarry <A HREF="/useremail/u/851210"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>That sounds very similar in concept to the "tabbed browser javascript exploit", where one tab can access the data of another tab, or put up a dialog and use javascript (with a delay) to focus on it, to steal user input.<br> </DIV>No it isn't anything like that. This method is pretty much useless unless site B can anticipate that site A has used this method and that you visited site A earlier in the current session.<br><br>I've not heard of this method being used for nefarious purposes. I have heard of developers using it to persist or cache data accross their own pages. Access to data cached in this manner is a little faster than access to the same data stored in a cookie and much faster than Userdata Persistance.<br><SMALL>--<br><B>FOUR MORE YEARS!!</B> - of fear.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11743203</guid>
<pubDate>Mon, 01 Nov 2004 06:25:03 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11743016</link>
<description><![CDATA[<A HREF="/useremail/u/779741"><b>Khaine</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>Edited to ask since when is PRIVACY not a SECURITY issue??? That is the main security issue!<br> </DIV>Well generally I lump privacy and annomity together, and since security relies heavily on trust I tend to keep it seperate.<br><br>I didn't mean to trivialise this issue.  It is an important issue, and with governments pushing more and more draconian laws reducing our privacy it is becoming very important to keep our rights.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11743016</guid>
<pubDate>Mon, 01 Nov 2004 04:14:54 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11742850</link>
<description><![CDATA[<A HREF="/useremail/u/827318"><b>Bobby_Peru</b></A> :  <div class="bquote"><SMALL>said by  Khaine <A HREF="/useremail/u/779741"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>tracking cookies are at worst a privacy issue, they have little if any security concerns with their use. </DIV>Not to pick on  Khaine <A HREF="/useremail/u/779741"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>, but perhaps he has hit on the key to the polarization in past and present attempts here to discuss cookies.<br><br>Tracking cookies have been, are, and will continue to absolutely, and most certainly be, a huge "privacy issue". This is self-evident from even a glance at www.abacus-direct.com (as linked and quoted in my post above). Of course there are other Ad-Servers and other deep 'consumer' (NewSpeak for humans/citizens) dBases, along with the Googles, Amazons, Pay-Pals, MSN/Passports, various "site-meters"....<br><br>If some self-appointed guardians of membership in the "Security (Professional?) Community" wish to completely exclude the realm of hundreds of millions of user's Privacy from their bailiwick, it is important that those who may be relying on these folks understand this serious self-imposed limitation, so as to know not to place <B>any</B> reliance on them for anything in this area. It would be nice to have them along for this effort, but, oh well...<br><br>If they, or others feel no concern in this area, that is one thing, but to dismiss other people's very reasonable and legitimate concerns over such growing intrusions into their lives with derogatory childish epitaphs, which also serve to stifle discussion, is more of a reflection on themselves than they are probably willing and/or able to admit, and should be viewed for exactly what they are - cheap rhetorical discussion killers.<br><br>Once they have provided the world with this notice, they could then safely sit out any discussions related to this pesky little Privacy thing.... Dismissing such petty concerns to the non-letter-wearing masses.....  <br><br>Thanks to those who have helped clear up this misunderstanding. ;)<br><br>Discussion of Blake's three most recent questions would get this back towards his OP for those users who <B>do</B> find this area to be important.<br><br>Expanding on his list: when are cookies really absolutely essential on a single site, what info would be required there, and is there really no other mechanism to accomplish this?<br><br>-------------------<br>For the commoners, non-letters-on-sleeve wearing masses - who may be relying on a wider definition of Security than that of a strict Security Professional Community construction -<br><br>"WordNet (r) 2.0"<br><br><B>security</B> n<br>1: the state of being free from danger or injury; "we support the armed services in the name of national security" [ant: insecurity]<br>2: a formal declaration that documents a fact of relevance to<br>finance and investment; the holder has a right to receive interest or dividends; "he held several valuable securities" [syn: certificate]<br>3: a department responsible for the security of the<br>institution's property and workers; "the head of security was a former policeman" [syn: security department]<br><B> 4: measures taken as a precaution against theft or espionage ,</B> or sabotage etc.; "military security has been stepped up since the recent uprising" [syn: security measures], ...<br><SMALL>--<br>**~~<A HREF="/faq/8428">Infected/Hijacked? FAQ</A>~~~<A HREF="/faq/8463">Protect/Secure Your Box/Data FAQ</A>~~~<A HREF="/faq/security">Security Forum FAQs</A>~~**</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11742850</guid>
<pubDate>Mon, 01 Nov 2004 02:33:03 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11742835</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : I end up with a bunch of banking cookies from just ONE bank after I close the browser. All my banks set permanent cookies. I don't know what bank you are using. I use major national banks. Even my two local banks set permanent cookies but they don't set as many as some of the national banks. They are almost as bad as Dell which sets about 15 cookies each time you visit. FF complains about Dell and the banks setting too many cookies both session and permanent.<br><br>Edited to ask since when is PRIVACY not a SECURITY issue??? That is the main security issue!<br><br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11742835</guid>
<pubDate>Mon, 01 Nov 2004 02:28:53 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11742699</link>
<description><![CDATA[<A HREF="/useremail/u/779741"><b>Khaine</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>Sigh. I am fully aware of all that you have thought necessary to "teach" me. My banks still recommend deleting the cookies after the visit. They are NOT deleted on exit. If you want someone to use your computer sometime and see what bank you use from your banking cookies you didn't delete fine. I prefer to guard against that. I always close the browser after visiting one of my banks also for the same reason. I do this even though it is unlikely anyone else would use this computer.<br> </DIV>Banking cookies are generally session only, and hence are deleted when the session ends {when you close the web browser}<br><br>tracking cookies are at worst a privacy issue, they have little if any security concerns with their use.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11742699</guid>
<pubDate>Mon, 01 Nov 2004 01:49:48 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11742669</link>
<description><![CDATA[<A HREF="/useremail/u/356416"><b>Link Logger</b></A> : Quick example of why tracking a session by IP address doesn't work, proxy servers.  A proxy server means a couple of things, first that multiple individual clients could be connecting from the same IP address (ie the proxy server), and second a single client might use more then one proxy server for sequential requests and hence would have a different source IP address (AOL clients for example).<br><br>Three questions which might help the discussion and understanding of cookies.<br><br>Are cookies secure, meaning that can site1 read site2's cookies?<br><br>What kind of information can a cookie contain?<br><br>What kind of information should a cookie contain and why?<br><br>Blake<br><SMALL>--<br>Vendor: Firewall Logging Software &raquo;<A HREF="http://www.SonicLogger.com" >www.SonicLogger.com</A> - SonicWall and 3Com &raquo;<A HREF="http://www.LinkLogger.com" >www.LinkLogger.com</A> - Linksys, Netgear and Zyxel</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11742669</guid>
<pubDate>Mon, 01 Nov 2004 01:41:07 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11742657</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : Sigh. I am fully aware of all that you have thought necessary to "teach" me. My banks still recommend deleting the cookies after the visit. They are NOT deleted on exit. If you want someone to use your computer sometime and see what bank you use from your banking cookies you didn't delete fine. I prefer to guard against that. I always close the browser after visiting one of my banks also for the same reason. I do this even though it is unlikely anyone else would use this computer.<br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11742657</guid>
<pubDate>Mon, 01 Nov 2004 01:39:09 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11742572</link>
<description><![CDATA[<A HREF="/useremail/u/340145"><b>Steve</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>As for banking cookies, only an idiot would keep those. Even your bank will tell you to get rid of them.</DIV>Huh? My bank has never mentioned this to me, but even a rudimentary understanding of how cookies work - at least those by clueful banks - suggests that you're demonstrating that you <B>don't</B> know how they work.<br><br>When you login to a secure site, the login page sends your username and password (presumably over SSL), and after validating that you're who you claim to be, a new "session" is created. This session data includes thinks like your username, time you started, IP address, etc. and is stored on the server, and a unique and random <B>session ID</B> is assigned.<br><br>The ID itself has no inherent meaning, nothing is "encoded" in it (it's "opaque"), and this is what is sent to you in your cookie. My last Wells Fargo cookie contained <B>B-200409191637071418511140</B>.<br><br>When you submit following pages (transfer money, check balance, etc.), the ID passed in your cookie is looked up in the session database, and it checks to see if you're still allowed, who you are, has it been too long since you did anything (to allow "idle sessions" to timeout), coming from the same IP address, etc. <SMALL>the IP test is not that simple, to allow for changes, but there are provisions to see that a cookie is not being shared</SMALL>.<br><br>When you click the Logout button, this not only deletes the cookie from your browser, but it invalidates the session in the database, so even if you hung onto or intercepted that cookie, it would not work. Yes, the cookie value would be sent to the server, but it would look it up and find that either (a) the session had been deleted entirely, or (b) the session had been marked explicitly "expired". Expired sessions cannot be revived by anything on the browser side without going through a new login process.<br><br>Any site that has a clue about security has designed the site to mitigate the effect of "cookie theft", so even aside of the fact that I run a secure network that prevents people from stealing my cookies, aside from the fact that banking cookies travel over unsniffable connections, there is nothing anybody could do with my banking cookies even if they got them.<br><br>If you feel better deleting your cookies, that's fine, but saying "only an idiot doesn't" puts you squarly in tinfoil hat territory and shows that you have only a limited grasp of how cookies are actually used.<br><br>Steve<br><SMALL>--<br>Stephen J. Friedl • Unix Wizard • Microsoft MVP • Tustin, California USA • <A HREF="http://www.unixwiz.net">my web site</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11742572</guid>
<pubDate>Mon, 01 Nov 2004 01:15:46 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11742404</link>
<description><![CDATA[<A HREF="/useremail/u/851210"><b>VirtualLarry</b></A> :  <div class="bquote"><SMALL>said by  hpguru <A HREF="/useremail/u/615773"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>Another form of session-wise persistence can be achieved by assigning a pseudo-attribute to the navigator object.<br><B>window.navigator.myattribute='foobar';</B><br>This was once supported by every browser I had tested a couple years ago (IE, Moz, Opera, etc.) but it may no longer be the case. Anyway when this is used the stored data will persist in the window in which it was created until the window is closed. Any website aware of the attribute can access it.</DIV>Very interesting information, I didn't know that.<br><br>Does that have anything to do with the "Userdata Persistance" setting in IE? I've always assumed that was "bad", like some sort of user-profiling/tracking feature, but I never quite knew what the technical specifics were. I always disable it regardless.<br><br> <div class="bquote"><SMALL>said by  hpguru <A HREF="/useremail/u/615773"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>Here is how you can test your browser. Create two html pages, one to be accessed locally and the other from your web server on the net. The first page has a script which defines the attribute as above. The page on your server has a script with the line<br><br><B>window.alert(window.navigator.myattribute);</B><br><br>which will display the stored data via an alert box when you navigate to that page in the original window.<br>If you have two servers you can use one for the first html file. It doesn't have to be opened locally. Also, the attribute name is arbitrary so long as it's not reserved.</DIV>That sounds very similar in concept to the "tabbed browser javascript exploit", where one tab can access the data of another tab, or put up a dialog and use javascript (with a delay) to focus on it, to steal user input.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11742404</guid>
<pubDate>Mon, 01 Nov 2004 00:40:55 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11740462</link>
<description><![CDATA[<A HREF="/useremail/u/896076"><b>BrettStarr</b></A> :   <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR><BR>Gee, I just noticed you leave banking cookies on your computer. You should never do that! Always clear those as soon as you have finished with the site. <br> </DIV>I think you misunderstand.  The managed list of sites are those you will ALLOW cookies for.  It doesn't mean I keep them. You most certainly can delete them at any time, but  must always have the entry in the managed sites list to allow site to set the cookie in the first place.<br>-<br>edit: Regardless of how you handle cookies, you should at least block THIRD PARTY cookies.  Those are the "bad" spyware, tracking cookies 95% of the time (Doubleclick, etc).   ]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11740462</guid>
<pubDate>Sun, 31 Oct 2004 20:07:37 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11740387</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : Only a crass,  unfeeling person jokes about schizophrenia. Stop the jokes about mental illness please. <br><br>As for banking cookies, only an idiot would keep those. Even your bank will tell you to get rid of them. Also, never go to your bank from a favorites link. Always type in the address. These are just ordinary, standard safety measures.<br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11740387</guid>
<pubDate>Sun, 31 Oct 2004 19:57:22 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11740290</link>
<description><![CDATA[<A HREF="/useremail/u/766601"><b>avd706</b></A> : time for a tin-foil suit.....<br><br>let me know when cosco has a sale on Reynolds wrap...]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11740290</guid>
<pubDate>Sun, 31 Oct 2004 19:44:36 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11739926</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : Gee, I just noticed you leave banking cookies on your computer. You should never do that! Always clear those as soon as you have finished with the site. ]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11739926</guid>
<pubDate>Sun, 31 Oct 2004 18:53:32 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11738518</link>
<description><![CDATA[<A HREF="/useremail/u/0"><b>anon</b></A> : Wow, thank goodness for this post!! I just noticed I had about 100 spyware website entries in my "per site privacy cactions" dialog in IE.  Enlightening :=0<br><br>(incl. lop.com, various porn/xx sites....)]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11738518</guid>
<pubDate>Sun, 31 Oct 2004 15:24:03 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11737700</link>
<description><![CDATA[<A HREF="/useremail/u/658856"><b>javaMan</b></A> :  <BLOCKQUOTE><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><HR>What I don't understand is why anyone would want a web based email account when you get 5 or more accounts free with your ISP. . . <HR></BLOCKQUOTE><br>I use one as my Post Office box.  It's one of the reasons I don't get any spam; well, that's not true, I get one or two a month.  If a site wants an email address it gets my web based mail address.  So if they want to share it with someone it's fine with me.  I'd rather have the spam on the Lycos servers than on my computer.<br><SMALL>--<br>Woe unto them that call evil good, and good evil; that put darkness for light, and light for darkness. . . Isa. 5:20</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11737700</guid>
<pubDate>Sun, 31 Oct 2004 13:13:22 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11737332</link>
<description><![CDATA[<A HREF="/useremail/u/800286"><b>rstrandb</b></A> : Not bad at all if you don't mind your privacy being invaded.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11737332</guid>
<pubDate>Sun, 31 Oct 2004 12:03:50 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11736871</link>
<description><![CDATA[<A HREF="/useremail/u/615773"><b>hpguru</b></A> :  <div class="bquote"><SMALL>said by wati:</SMALL><br><br>My cousin had a bad problem with these cookies. She was diagnosed with breast cancer and started reading up on it  and lo and behold before she knew it, she had emails not just of medical things but also of porn..and no amount of cleaning her tif files/cookie folder , running ad-aware, spyware etc helped ! she has now started getting bombarded by emails offering viagra and other presciption medicines. So what do people like her do ?<br> </DIV>Sounds like ordinary run-of-the-mill spam to me.<br><SMALL>--<br><B>FOUR MORE YEARS!!</B> - of fear.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11736871</guid>
<pubDate>Sun, 31 Oct 2004 10:49:50 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11736837</link>
<description><![CDATA[<A HREF="/useremail/u/0"><b>anon</b></A> : My cousin had a bad problem with these cookies. She was diagnosed with breast cancer and started reading up on it  and lo and behold before she knew it, she had emails not just of medical things but also of porn..and no amount of cleaning her tif files/cookie folder , running ad-aware, spyware etc helped ! she has now started getting bombarded by emails offering viagra and other presciption medicines. So what do people like her do ?]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11736837</guid>
<pubDate>Sun, 31 Oct 2004 10:45:13 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11736123</link>
<description><![CDATA[<A HREF="/useremail/u/615773"><b>hpguru</b></A> :  <div class="bquote"><SMALL>said by  keith2468 <A HREF="/useremail/u/304237"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br> If they can find another persistant thing, then they don't need cookies.<br> </DIV>Speaking of which...<br><br><A HREF="http://msdn.microsoft.com/library/default.asp?url=/workshop/author/persistence/overview.asp?frame=true">Introduction to Persistence</A><br><br>It is easily disabled though.<br><br>Another form of session-wise persistence can be achieved by assigning a pseudo-attribute to the navigator object.<br><br><B>window.navigator.myattribute='foobar';</B><br><br>This was once supported by every browser I had tested a couple years ago (IE, Moz, Opera, etc.) but it may no longer be the case. Anyway when this is used the stored data will persist in the window in which it was created until the window is closed. Any website aware of the attribute can access it.<br><br>Here is how you can test your browser. Create two html pages, one to be accessed locally and the other from your web server on the net. The first page has a script which defines the attribute as above. The page on your server has a script with the line<br><br><B>window.alert(window.navigator.myattribute);</B><br><br>which will display the stored data via an alert box when you navigate to that page in the original window.<br><br>If you have two servers you can use one for the first html file. It doesn't have to be opened locally. Also, the attribute name is arbitrary so long as it's not reserved.<br><SMALL>--<br><B>FOUR MORE YEARS!!</B> - of fear.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11736123</guid>
<pubDate>Sun, 31 Oct 2004 08:23:44 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11735985</link>
<description><![CDATA[<A HREF="/useremail/u/795407"><b>SnowyOne</b></A> : A PCWorld look at privacy on the net. This older article is still as accurate as it was on the day it was written.<br>&raquo;<A HREF="http://pcworld.about.com/magazine/1806p102id16444.htm" >pcworld.about.com/magazine/1806p&middot;&middot;&middot;6444.htm</A><br><SMALL>--<br>Dave said "By the way, 4294967295 is just another way to write -1".</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11735985</guid>
<pubDate>Sun, 31 Oct 2004 07:42:08 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11735746</link>
<description><![CDATA[<A HREF="/useremail/u/851210"><b>VirtualLarry</b></A> :  <div class="bquote"><SMALL>said by  avd706 <A HREF="/useremail/u/766601"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>But if an outfit is clever, all they have to do is find somthing persistant in you online activity, to link old numbers to new numbers and to each other.<br> <br>And if they are really clever, they can figure out your credit card number, and connect your online life to your real world activities.<br><br>The junk mail you get at home, the telemarketers that used to call, may be due to what you are doing online.<br><br>So, i dont think that cleaning cookies is enough.</DIV>Which is, if you recall, <B>exactly</B> what DoubleClick planned to do in the past, when they purchased several marketing databases containing private information, with the intent to combine them with their collected (but "non-personally identifiable", supposedly) tracking ID numbers, in order to do what they originally said that they would not - associate real-world marketing profiles with online ones.<br><br>That's the thing that currently bothers me most about some other major online sites, like Amazon.com. I ordered something once from them, because someone sent me a credit voucher. Thankfully the address that they had is no longer valid, and I never gave them any CC information, but between what I've read of their marketing practices and ethics, along with exploits and potential privacy breaches from the past, it gives me the 'willies'.<br><br>Don't even get me started with the "Google knows all" aspect of things. I think that Mele20 is basically exactly right, in terms of a cautious, long-term approach to protecting privacy.<br><br>In fact, something that I recently discovered, leads me to believe that during several sales/mergers of some ISPs in the past, that my signup information from an old account that was closed a long time ago, was sold to marketers, or otherwise disclosed in a manner in which I consider to be severely un-ethical. These things <B>do</B> happen, and the only way to protect against them, is to be smart in the first place. I think that's what Mele20 was talking about in terms of "smarter than 90% of the people", in terms of thinking long-term, about the possibly disclosure of information.<br><br>Also, just like DoubleClick, Google collects "non-personally-identifying information". Considering that one of their specialities is keyword-based indexing, and applying clever heuristics to the data - along with their disclosure that your e-mail data will never be deleted, it seems quite likely that they will index and mine it for all that it's worth, too. (Since it is now a public company, they are apparently beholden to their shareholders to do just that - if they can make money selling out your privacy, they will do so.)  Any other appraisal of the situation seems to me to be hopelessly naive, especially regarding a company who's sole reason for existance is to collect and cross-reference information. Mark my words.<br><br>Remember, even a con man appears honest and harmless at first, too.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11735746</guid>
<pubDate>Sun, 31 Oct 2004 05:31:18 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11735712</link>
<description><![CDATA[<A HREF="/useremail/u/851210"><b>VirtualLarry</b></A> :  <div class="bquote"><SMALL>said by  avd706 <A HREF="/useremail/u/766601"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>HQ references aside, I thought to tin-foil was for the paranoid to keep the deep-space gamma-rays from penetrating their brain. </DIV>Nah, nowadays it's used for much more benign things, like protecting your brainstem while you crank up the output power of your 802.11 AP to be able to watch streaming video on your laptop while lounging out in the middle of your lawn. Plus, on really sunny days, you can cook hotdogs on it, if you angle the corners just right. Your neighbors might think you were a little weird though.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11735712</guid>
<pubDate>Sun, 31 Oct 2004 05:04:50 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11718913</link>
<description><![CDATA[<A HREF="/useremail/u/1061336"><b>BM Fan</b></A> :  I think cookies are Ok they offer a convenience, as far as being tracked online, cookies don't really track me they track my browser or ip . and they way i look t it let them track away i could care less<br><SMALL>--<br>"Well, I lost my virginity in a car. But it wasn't a very nice one."" -Brittany Murphy</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11718913</guid>
<pubDate>Fri, 29 Oct 2004 03:45:57 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11718663</link>
<description><![CDATA[<A HREF="/useremail/u/755055"><b>OZO</b></A> :  <div class="bquote"><SMALL>said by  hpguru <A HREF="/useremail/u/615773"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>Tin Hat = Unthinking Cap ;)<br><br>Persons who wear such caps have a tendency to accuse others of wearing them when their universal scheme of things gets disturbed.</DIV>Coudn't agree with you more. Person who accuses another one - you're wearing tin hat - actually wears it him/herself. Just simple like that, isn't it? ;) <br>Unfortunately on this Forum there is a limited set of unbalanced and overly emotional people who try to insult others this way.<br><br>My IE handles cookies exactly the same way as  BrettStarr <A HREF="/useremail/u/896076"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A> has described in <A HREF="http://www.dslreports.com/forum/remark,11682094~mode=flat#11684413">the post</A> and I've found this way as the best one. No problem at all for a long, long while. I do not need to remove cookies on a regular basis, they simply are deleted by IE when I close it. I do keep very small controlled set of cookies from sites that I need (this site is one example).<br><br>One should remember what cookies by definition are created for tracking purposes. It's Ok and if you keep it in mind - you'll not fall into an easy trap. One example from my experience. I'm actively using Google as search engine. I don't like if Google would track all my search requests and keep them in one place. Therefore I do not accept cookies from this site. But when I applied to GMail (with my name in mail account) it asked me - do you want to keep your login info in cookies? It was attractive (speeds up login into account) for a second, but I have to choose between convenience of quick loging and searching the Internet without tracking my area of interests. The last one is more important to me. Just my personal preference and usual caution.<br><SMALL>--<br>Keep it simple, it'll become complex by itself...</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11718663</guid>
<pubDate>Fri, 29 Oct 2004 02:28:17 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11718340</link>
<description><![CDATA[<A HREF="/useremail/u/766601"><b>avd706</b></A> : I mean like a login, or an ip address, or your internet shell, or the DRM key for your MP3 player, or some trojan/spyware/worm on your system.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11718340</guid>
<pubDate>Fri, 29 Oct 2004 01:12:48 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11718006</link>
<description><![CDATA[<A HREF="/useremail/u/304237"><b>keith2468</b></A> :  <BLOCKQUOTE><SMALL>quote:</SMALL><HR>all they have to do is find somthing persistant in you online activity, to link old numbers to new numbers and to each other.<HR></BLOCKQUOTE><br><br>A cookie is supposed to be that persistant thing.<br><br>If they can find another persistant thing, then they don't need cookies.<br><SMALL>--<br>(<A HREF="/faq/8428">Virus&Hijacking FAQ</A> + <A HREF="/faq/security/edit/8428#submit">Submit suspected malware</A> + <A HREF="/faq/10194">Backups FAQ</A> + <A HREF="/faq/security">Security FAQ TOC</A>)</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11718006</guid>
<pubDate>Fri, 29 Oct 2004 00:26:16 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11717177</link>
<description><![CDATA[<A HREF="/useremail/u/766601"><b>avd706</b></A> :  <div class="bquote"><SMALL>said by  keith2468 <A HREF="/useremail/u/304237"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>I <br>My personal remedy is to run Ad-aware once every week or two and let it delete all the "tracking cookies".  That cleans out the old id numbers.  The ad companies can start tracking me again, but the numbers in the new cookies will be disconnected from my name. </DIV> <br><br>But if an outfit is clever, all they have to do is find somthing persistant in you online activity, to link old numbers to new numbers and to each other.<br> <br>And if they are really clever, they can figure out your credit card number, and connect your online life to your real world activities.<br><br>The junk mail you get at home, the telemarketers that used to call, may be due to what you are doing online.<br><br>So, i dont think that cleaning cookies is enough.<br><br> <br><br></DIV>The government isn't after me, so for me this is adequate security. <br> </DIV>Exactly, now if my last name was gotti, it would be a different story.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11717177</guid>
<pubDate>Thu, 28 Oct 2004 22:43:02 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11715706</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : LOL It is not likely that Time Warner Cable will get bought by someone else...I mean AOL did buy them but then TW took over and kicked AOL's ass and pushed Hawaii's son Steve Case completely out of the picture!. :D  As for moving, I have rented the same condo for 30 years. Some day I may have to move, but it would never be my choice to move. <br><br>I think we are talking apples and oranges here. You are now doing what you have done in previous posts on other subjects...<B> qualifying </B> what you originally said. Now you appear to be talking about business email. That is different. I thought we were discussing personal email. It is hard to have a conversation with you when you change the subject so frequently. ;)<br><br>But as  Keith9 <A HREF="/useremail/u/637919"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A> has pointed out email is off topic so I suppose we should get back to the original topic.<br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11715706</guid>
<pubDate>Thu, 28 Oct 2004 20:10:05 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11715579</link>
<description><![CDATA[<A HREF="/useremail/u/304237"><b>keith2468</b></A> : Webmail is another issue.  Let's get back on topic.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11715579</guid>
<pubDate>Thu, 28 Oct 2004 19:55:08 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11715545</link>
<description><![CDATA[<A HREF="/useremail/u/304237"><b>keith2468</b></A> : I buy things off the web.  And *sometimes* I give my real name when I register with a site.  So a marketing organization could link my name to the id number in their cookie.<br><br>My personal remedy is to run Ad-aware once every week or two and let it delete all the "tracking cookies".  That cleans out the old id numbers.  The ad companies can start tracking me again, but the numbers in the new cookies will be disconnected from my name.  <br><br>The government isn't after me, so for me this is adequate security.  <br><br>Is it really that big of an "invasion of privacy" that I get advertising for computer stuff, and my sister gets advertising for clothing?<br><SMALL>--<br>(<A HREF="/faq/8428">Virus&Hijacking FAQ</A> + <A HREF="/faq/security/edit/8428#submit">Submit suspected malware</A> + <A HREF="/faq/10194">Backups FAQ</A> + <A HREF="/faq/security">Security FAQ TOC</A>)</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11715545</guid>
<pubDate>Thu, 28 Oct 2004 19:52:02 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11715515</link>
<description><![CDATA[<A HREF="/useremail/u/304237"><b>keith2468</b></A> : A cookie is not required to track you by your IP address (referring back to the earlier posts on IP addresses appearing in cookies.)<br><br>The other end has to know your IP address in order to send you back the information you've requested (the web page).<br>By the way, you can often force an IP address change by using a router the allows MAC address cloning.  (Caution, if  you happen to choose a MAC address that someone else on your ISP is using, you may find your IP address changing too frequently.)<br><SMALL>--<br>(<A HREF="/faq/8428">Virus&Hijacking FAQ</A> + <A HREF="/faq/security/edit/8428#submit">Submit suspected malware</A> + <A HREF="/faq/10194">Backups FAQ</A> + <A HREF="/faq/security">Security FAQ TOC</A>)</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11715515</guid>
<pubDate>Thu, 28 Oct 2004 19:49:09 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11715504</link>
<description><![CDATA[<A HREF="/useremail/u/340145"><b>Steve</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>I believe I think more than 5 minutes into the future. :D I venture to say that I think much further into the future than 90% of the people I know. As for not being associated with the same ISP for a long time...well, I have no choices. There is ONE broadband ISP here. That is it. I don't see myself going back to dial up!</DIV>So you're sure you're never going to move? You're sure they won't get bought by somebody else? You're sure that technology won't ever change?<br><br>That's not thinking very far into the future.<div class="bquote"> Further, I change my ISP email addresses on a regular basis. As soon as one becomes compromised with more than a little spam, I get rid of it and create a new account.</DIV>OK, then it's clear you couldn't really use email that much, because about the third or fourth time I got "my address has changed" from you, I'd decide you weren't worth the trouble to communicate with.<br><br>I have had to change my email address once in the last 10 years, and it's been painful. Even <B>a year later</B> I still get bits and pices of mail mail to the old address, and I'm not willing to lose track of old customers that might need something in the future. I expect to have <B>unixwiz.net</B> pretty much for the rest of my life.<br><br>Steve<br><SMALL>--<br>Stephen J. Friedl • Unix Wizard • Microsoft MVP • Tustin, California USA • <A HREF="http://www.unixwiz.net">my web site</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11715504</guid>
<pubDate>Thu, 28 Oct 2004 19:47:15 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11715471</link>
<description><![CDATA[<A HREF="/useremail/u/304237"><b>keith2468</b></A> : I totally agree that the popular press and some security outfits are irresponsible in getting the public alarmed over cookies and tracking cookies.<br><br>I don't care if people want to be super concerned over their own computers, that is their decision based on what their individual circumstances are.  <br><br>But when addressing the general public, mis-leading terminology and alarmist statements should be avoided.  <br><br>We really need a better terminology.  One that differentiates between:<br>- remote access trojans, <br>- spyware that targets confidential information, like keystroke loggers,<br>- adware that resists removal, <br>- adware that sneaks onto machines but that can be removed in a standard method, <br>- tracking cookies, <br>- site settings and navigation cookies,<br>- adware from established companies that only installs with informed permission, that only advertises, and that doesn't report on browsing habits.<br><br><B>There is a big difference in how people should react to these different products.  </B><br>- In some cases people must re-format and re-install their software, to clean their machines; and change their credit card numbers, change all their passwords, and put an alert on their credit rating, to prevent identify theft.<br>- And at the other end of the spectrum, there isn't even really an infection to cure.<br><SMALL>--<br>(<A HREF="/faq/8428">Virus&Hijacking FAQ</A> + <A HREF="/faq/security/edit/8428#submit">Submit suspected malware</A> + <A HREF="/faq/10194">Backups FAQ</A> + <A HREF="/faq/security">Security FAQ TOC</A>)</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11715471</guid>
<pubDate>Thu, 28 Oct 2004 19:44:18 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11715385</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : I believe I think more than 5 minutes into the future. :D I venture to say that I think much further into the future than 90% of the people I know. As for not being associated with the same ISP for a long time...well, I have no choices. There is ONE broadband ISP here. That is it. I don't see myself going back to dial up! Further, I change my ISP email addresses on a regular basis. As soon as one becomes compromised with more than a little spam, I get rid of it and create a new account. I can't do that with the master account so that account, of course, is never used and is wasted but I still have four accounts from my ISP and the dslr account. Do you have a web based account where all your bills are sent because you might some day move or just might change banks because your bank got bought by some larger institution you don't want to do business with? Your arguments make little sense. People move, people change bank accounts, people get a P.O. box, etc. and they don't go through convulsions because they have to let friends and businesses know they have a new address. I think if one has a broadband ISP that the email address is much more "stable" than if one has Google or Hotmail or Yahoo or Myrealbox, etc. I have had a bunch of different web based email addresses and those have all changed many times. What has not changed is my ISP addresses unless I decide to ditch one because it has become compromised and is getting too much spam. I prefer to ditch it than to use spam filters.<br><br>I'm not "hysterical" about ads. That is a very insulting comment, but then you have been insulting me on a regular basis here recently so I guess I cannot expect more courteous behavior.  No, I don't live off a trust fund. I live on a fixed income for 29 years. Don't I wish I had a trust fund. Maybe I don't like ads because I don't have any money to spare to spend on all the things the ads try to entice me to buy. Perhaps, I don't like wishing I could have those things when I cannot. Perhaps, I prefer to try and ignore, as best I can, that most others have lots of things that I will never have. Or maybe I just find the animation and the silly drivel obnoxious. I got rid of my tv for much the same reason...I don't want to be subjected to all those ads which began to take more and more of the tv hour and became more and more obnoxious. No ad will get me to buy something. In fact, ads just put me off. If I decide that I want and can afford to spend money on a particular something, then I research to find what is the best brand and model for the amount of money I can spend and then and only then do I look for places where I can buy it. I seldom look on the internet because the shipping costs to Hawaii for even a tiny item are usually prohibitive. So, I am stuck with Walmart, Office Max, Sears and Longs Drugs to buy things at. I don't need ads that promote items and models of items that are not available on this island and that is the majority of things in ads. We are very limited in what we can purchase here even if we have reasonable incomes.  <br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11715385</guid>
<pubDate>Thu, 28 Oct 2004 19:35:50 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11715171</link>
<description><![CDATA[<A HREF="/useremail/u/974615"><b>mers2</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>What I don't understand is why anyone would want a web based email account when you get 5 or more accounts free with your ISP. Plus, we all get a dslr account. Why does anyone put up with ads in general when there is Proxomitron to filter all of them out?<br> </DIV>I have a webmail account that serves as a backup for those rare occasions when my ISP server is down. Family and friends have that address and know to use it if their email to my ISP address bounces. I also have another webmail address that I use for any online registration so I get no spam on either my ISP or other webmail acct.<br><SMALL>--<br>Kerry/Edwards 2004</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11715171</guid>
<pubDate>Thu, 28 Oct 2004 19:11:58 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11715143</link>
<description><![CDATA[<A HREF="/useremail/u/340145"><b>Steve</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>What I don't understand is why anyone would want a web based email account when you get 5 or more accounts free with your ISP.</DIV>Because some people think more than five minutes into the future by realizing that they may not be associated with their ISP for the rest of their lives.<br><br>And I bet you could find some unhappy people who had ISP accounts who were faced with forced migrations from <B>@mediaone.net</B> to <B>@attbi.net</B> to <B>@comcast.net</B> email address.<br><br>I suppose if one has no friends (e.g., "barely uses email") it's not big deal to change your address, but many of us like having one stable thing in our lives. An ISP-provied email address is not.<br><br>And I don't get the hysterical reaction to ads: Google does a pretty good job of making them (a) relevant, and (b) relatively inobtrusive. Yah, somebody is trying to make money, but so what? Are you living off of a trust fund and don't have to worry about the mundane activities of "making a living"?<br><br>I understand that people would prefer not to get ads, but hysterical opposition just baffles me.<br><br>You don't work for free, why should everybody else?<br><br>Steve<br><SMALL>--<br>Stephen J. Friedl • Unix Wizard • Microsoft MVP • Tustin, California USA • <A HREF="http://www.unixwiz.net">my web site</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11715143</guid>
<pubDate>Thu, 28 Oct 2004 19:06:22 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11715069</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : What I don't understand is why anyone would want a web based email account when you get 5 or more accounts free with your ISP. Plus, we all get a dslr account. Why does anyone put up with ads in general when there is Proxomitron to filter all of them out?<br><br>Yes, of course, one places a certain degree of trust in the provider when using their email. And of course, Microsoft or Yahoo or whoever provides email COULD decide at some future date to archive all emails. The point though is that they have not done this. Only Google has stated that they are archiving all email. We had long discussions here when Google first announced their email scheme which I am sure you can find by doing a search. I don't believe for one second that Google is archiving all this mail for any reason other than to sell the information at some future date. What other plausible reason would they have to archive? None. They know that most users are idiots and will jump at the "free" aspect and then ten years down the road when they decide to sell the information there will be no going back. The deed is done and there will be tons of victims who listened to people like you who said it couldn't and wouldn't happen. They listened because they were getting something free. Of course, nothing is ever free but people conveniently ignore that until it is time to pay the piper.<br><br>The fact that an email which is unencrypted is like a postcard is the reason I have about stopped using email. I no longer want to communicate by email with anyone who refuses to use encryption.  I will do so reluctantly currently but there will come the day when I will insist on encryption. (I don't send postcards and haven't for at least a quarter of a century. When I did the comments were always innocuous ("having fun in the sun ...wish you were here!") unlike specific personal comments in email which tends to be looked at as an electronic form of personal snail mail. If we look at email as an electronic postcard then I venture to say that few will continue to use it as postcards have never been intended to have any personal information other than some vague generality. If this is what email is supposed to be then what is the point in email? No, the answer here is to require all personal email (not newsletters, etc) to be encrypted and to pass strong legislation that will protect users from companies like Google ever attempting to sell their personal information. Until then, email should be sparingly used.<br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11715069</guid>
<pubDate>Thu, 28 Oct 2004 18:58:15 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11711651</link>
<description><![CDATA[<A HREF="/useremail/u/429566"><b>Jason Levine</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>I was not aware that Microsoft has a repository of all Hotmail and intends at some time in the future to sell the information.</DIV>Microsoft controls Hotmail's servers and can thus decide to archive all e-mails pretty much whenever they want.  I'm not saying they have been or have any plans to do so, just that they have the physical capability.<br><br>Any time you use any e-mail provider, you place some degree of trust in them that they won't spy on your e-mails.  It's just the nature of the beast.  (Just like you trust that your ISP won't listen in on your unencrypted e-mails.)<br> <br> <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>That is what Google intends to do.</DIV>Where did you get your information that Google has any plans on using e-mail text for marketing purposes (beyond an on-the-fly display of text ads)?  I certainly haven't heard anything about that beyond vague claims (without any evidence) that they could do this (any e-mail provider could) and might/will/already are (depending on the vague claim) in the future.<br><br> <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>Aside from the privacy thing, what in the world would anyone want with email that serves them ads? GEEEZ!</DIV>If you are using a free, web-mail provider then ads are part of the package.  Otherwise, how is the provider going to financially support giving you access to their servers and bandwidth?  (If you upgraded to a paid web-mail account then you'd likely not see any ads.)  Personally, I'd prefer Google's targeted ads to the untargeted junk that Yahoo mail puts up.  If I'm going to see ads, it might as well be something that I'm actually interested in.<br><br> <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>I have just about stopped using email for this reason and because of the spam. I don't need the invasion of my privacy or the spam in my life.</DIV>I'll agree with you about the spam.  It definitely reduces the effectiveness of e-mail as a communications medium.  If you use a good spam filter (I use POPFile), you won't see as much spam, but it can still cause headaches.<br><br>As for privacy implications, just think of e-mail as the digital equivalent to sending someone a postcard.  Your mailman (ISP, web-mail provider) can read it, everyone in the postal processing centers (servers) can read it, and the recipient's mailman (ISP, web-mail provider) can read it.  Anyone along the way can make a photocopy of it and send the copy to someone else.  The recipient can even slap a label over his address and send it on to someone else (forward the e-mail) exposing your personal information to a complete stranger.<br><SMALL>--<br>-Jason Levine<BR><A HREF="http://www.jasons-toolbox.com/">http://www.jasons-toolbox.com/</A><BR><A HREF="http://www.PCQandA.com/">http://www.PCQandA.com/</A><BR><A HREF="http://www.urateit.com/">http://www.urateit.com/</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11711651</guid>
<pubDate>Thu, 28 Oct 2004 12:32:55 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11711052</link>
<description><![CDATA[<A HREF="/useremail/u/340145"><b>Steve</b></A> :  <div class="bquote"><SMALL>said by  salzan <A HREF="/useremail/u/928459"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>1. If the knowledgeable people who populate this forum have such differing views on the use/danger of cookies, its no wonder the average user is confused.</DIV><SMALL>It's not so clear that all of the opinions you're seeing are "knowledgeable"</SMALL> :-)]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11711052</guid>
<pubDate>Thu, 28 Oct 2004 11:14:57 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11711026</link>
<description><![CDATA[<A HREF="/useremail/u/928459"><b>salzan</b></A> : Before this thread is locked, I'd like to share a couple of observations.<br><br>1. If the knowledgeable people who populate this forum have such differing views on the use/danger of cookies, its no wonder the average user is confused.<br><br>2. If you send email, post on forums, surf the internet or, god  help you, build a personal website, you have no idea of how the information may be used in the future. <br><br>3. If you are really, really, really concerned about your complete and utter privacy, the absolutely safest thing to do is pull the plug on your internet connection.<br><br>Personally, I like the internet and will continue to use it and take my chances based on educated guesses.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11711026</guid>
<pubDate>Thu, 28 Oct 2004 11:11:46 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11710525</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : Uh huh. And I suppose you still believe in the tooth fairy. How naive can you get??? <br><br>I have no respect for those who use Gmail. As for Hotmail, no I don't communicate with anyone using Hotmail although I was not aware that Microsoft has a repository of all Hotmail and intends at some time in the future to sell the information. <br>That is what Google intends to do. As for Yahoo, I have nothing to do with Yahoo and haven't for a long time. Never visit Yahoo and would never have a mail account there. I tune out almost all sites that require cookies to visit and use them. There is only a small handful of sites that I give cookies to and some site insists I have to register there and accept cookies to read their newspaper or whatever... I just go elsewhere.<br><br>Aside from the privacy thing, what in the world would anyone want with email that serves them ads? GEEEZ! <br><br>I have just about stopped using email for this reason and because of the spam. I don't need the invasion of my privacy or the spam in my life.  I get a few newsletters and I do use email for support issues if that is what the vendor insists on and that is about it.<br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11710525</guid>
<pubDate>Thu, 28 Oct 2004 09:53:28 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11710224</link>
<description><![CDATA[<A HREF="/useremail/u/429566"><b>Jason Levine</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>It's Google's repository and what they may do with it in the future that scares me and worries me. </DIV>I really see no reason to not use GMail just because they might, possibly, one day in the future, decide to do something bad with the text of your e-mails.  If you think so then you had better not send e-mail to people who use Hotmail either.  Or do you trust Microsoft to not use your personal information in the future?  How about Yahoo?  Better exclude those users.  AOL too?  Comcast?  Time Warner/Roadrunner?<br><br>For that matter, how do you know that e-mails you send to a user running his own mail server aren't being forwarded completely intact (with all personal data still in there) to another e-mail account on a completely different server?  (GMail, Hotmail, etc.)<br><br>The main fears that people seemed to have with GMail were that:<br><br>1.  Their e-mails would be "read" to display ads.<br>2.  It seemed that deleting a GMail message wouldn't really delete the message entirely.<br><br>The reality is that:<br><br>1.  The e-mail's text is scanned by Google's ad server when it is being displayed.  Keywords are pulled out, matched with appropriate ads (as appropriate as the ad server can determine) and then those ads are displayed alongside the server.  This is all done on the fly with no likely record being kept on keywords.  (There would be no purpose to keep a keyword record since they have the complete text of the e-mail.)  No human (other than the GMail account owner) is reading the e-mail.<br><br>2.  Google's statement that a deleted e-mail isn't completely gone was referring to the fact that they have redundant systems and backups.  This is (hopefully) true for most organizations' e-mail systems.  If you delete a GMail message, it might take awhile to propagate that deletion over all of their servers.  Then, it'll take a bit longer until it's been overwritten on all of the backup tapes.  They were just being honest about that fact.<br><SMALL>--<br>-Jason Levine<BR><A HREF="http://www.jasons-toolbox.com/">http://www.jasons-toolbox.com/</A><BR><A HREF="http://www.PCQandA.com/">http://www.PCQandA.com/</A><BR><A HREF="http://www.urateit.com/">http://www.urateit.com/</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11710224</guid>
<pubDate>Thu, 28 Oct 2004 08:58:25 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11710203</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : But my "stuff" is not out there. My real name and other identifying characteristics are not out there. My handle and the characteristics that go with it are out there. There is a HUGE difference. <br><br>With Google's mail repository consisting of every piece of email that comes through Google in it, that has made it very easy for Google to possess not just information about your persona's handle on the internet but about you yourself because we tend to trust, rightly so or not, email to friends, family, attorneys, doctors, etc. with very, very personal information that, I for one, would never want Google to have in a repository. <br><br>Perhaps the fight for personal privacy is a loosing battle, but as long as I live I will fight that battle with everything ounce of strength and passion I have as I consider personal privacy fundamental to the foundation upon which this nation is built and we are seeing a slow erosion of that foundation now and I will do whatever I can to help  stop it. Big Brother is watching just didn't arrive in the 80's as Orwell predicted but he has arrived now.<br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11710203</guid>
<pubDate>Thu, 28 Oct 2004 08:55:37 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11710070</link>
<description><![CDATA[<A HREF="/useremail/u/795407"><b>SnowyOne</b></A> : It's not a Google issue. It's a net issue. Your 'stuff' is already out there. Reminds me of this sig "You can catch the devil but can't hold him long". Same difference with Google, you can slow down their collection of your stuff, but your not gonna stop it.<br><SMALL>--<br>Dave said "By the way, 4294967295 is just another way to write -1".</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11710070</guid>
<pubDate>Thu, 28 Oct 2004 08:31:20 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11710007</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : OK, so I was correct. "Tinfoil hat" refers to someone who is very sick and needs help not derision. It should be beneath posters here to use a phrase like that. I had a good friend in high school who was diagnosed with paranoid schizophrenia. It was very, very, very sad. She died under suspicious circumstances a few years later in a state institution. A wonderful girl, intelligent, kind, fun to be with until this cruelty befell her. Another friend after I moved to Hawaii was diagnosed with the same disease. Another tragedy. Poking fun at sick persons is immature and should be beneath all of us here. Implying that someone like myself is that mentally sick is an insult and is an attempt to start a flame war. I think the mods should delete any posts with these insults.<br><br>Further, I think it most interesting that everyone jumped on this question of mine but no one has addressed the important issue of Google's repository and what they will do with it in the future and how they can possibly stay uncorrupted by the power that holding this repository will give them.<br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11710007</guid>
<pubDate>Thu, 28 Oct 2004 08:18:53 EDT</pubDate>
</item>

<item>
<title>??</title>
<link>http://www.dslreports.com/forum/remark,11709885</link>
<description><![CDATA[<A HREF="/useremail/u/198601"><b>jack b</b></A> : The Tinfoil hat supposedly will block the incoming radio waves from collecting your thoughts, and therefore protects the wearer from being scanned. Or something like that...:p<br>Mildly derogatory, depending on the wearer...<br><SMALL>--<br>~Help find a cure for cancer~<br><br><I>Proud Member  <br><A HREF="http://www.dslreports.com/forum/disco"><br><I><B>Team Discovery</B></A></I></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11709885</guid>
<pubDate>Thu, 28 Oct 2004 07:41:31 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11709875</link>
<description><![CDATA[<A HREF="/useremail/u/766601"><b>avd706</b></A> : HQ references aside, I thought to tin-foil was for the paranoid to keep the deep-space gamma-rays from penetrating their brain.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11709875</guid>
<pubDate>Thu, 28 Oct 2004 07:40:17 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11709850</link>
<description><![CDATA[<A HREF="/useremail/u/615773"><b>hpguru</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>What is this reference to a tinfoil hat? I have never understood that although I occasionally see some users attempting to  belittle others with that strange reference. I assume it means the user of the phrase believes the wearer is insane ( in the sense of paranoid schizophrenia)? But why the reference to "tinfoil" as meaning something derogatory?<br> </DIV>Tin Hat = Unthinking Cap ;)<br><br>Persons who wear such caps have a tendency to accuse others of wearing them when their universal scheme of things gets disturbed. So for example they may accuse liberals of being conspiracy theorists when all the while they still believe Al Qaeda really exists and is out to get us, WMDs in Iraq, etc.<br><SMALL>--<br><B>FOUR MORE YEARS!!</B> - of fear.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11709850</guid>
<pubDate>Thu, 28 Oct 2004 07:33:55 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11709570</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : It's Google's repository and what they may do with it in the future that scares me and worries me. If it doesn't concern you then perhaps you figure you'll be dead by the time something bad is done with the information so what does it matter? No need to protect the future of this nation if you will not be alive to see how destructively this is used. Is that it?<br><br>How long do you think Google's owners will continue to be responsible people?  "All power corrupts and absolute power corrupts absolutely". Lord Acton<br><br>What is this reference to a tinfoil hat? I have never understood that although I occasionally see some users attempting to  belittle others with that strange reference. I assume it means the user of the phrase believes the wearer is insane ( in the sense of paranoid schizophrenia)? But why the reference to "tinfoil" as meaning something derogatory?<br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11709570</guid>
<pubDate>Thu, 28 Oct 2004 04:51:37 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11709408</link>
<description><![CDATA[<A HREF="/useremail/u/874811"><b>sivran</b></A> : The same could be said of ANY unencrypted email, so I don't really see the point of singling out gmail. Google text ads? Irrelevant, read by a computer, big deal. <br><br>The only way to be sure your email is not read by others is:<br><br>1) Encrypt it. You've got assurance until CPU power reaches the point where it can break the encryption the mail was sent with<br><br>2) Use only servers and clients you can control, so that you can make sure delete really deletes all trace of a message. Obviously this severely limits who you can email.<br><br>Didn't know your tinfoil hat was so thick. ;)<br><br>We're getting off-topic..<br><SMALL>--<br><A HREF="http://www.againsttcpa.com/">TCPA </A>- Treacherous Computing<BR><A HREF="http://download.kerio.com/dwn/kpf/kerio-pf-2.1.5-en-win.exe">Kerio 2.1.5</A> - Best damn firewall<BR><B>Licenses should be per user, Ditch Norton! Get F-Prot!</B></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11709408</guid>
<pubDate>Thu, 28 Oct 2004 03:20:59 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11709227</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : LOL But that is information about Mele20 which is my handle on the internet. There may or may not be information connected to Mele20 (such as my interests, age, etc.) that really is true about the "real" me. When I search the internet for information about myself, not my handle, I find none. That is the information that is important and private and is also the sort of information that until GMail one might put in a personal email to a friend or relative or mentor, etc. and have reasonable expectation that the information would remain between the two of them. (I say "reasonable" because without using encryption that is as much as could be expected and most users won't use encryption). <br><br>Now, with GMail, one can find private information that was given in an email to a friend in Google's hands if the friend forwarded the email to their son or daughter, etc. who then was unconcerned about anyone's privacy and forwarded it to someone with Gmail because there was one part of the email that had relevance to the son or daughter it was forwarded to who then forwarded it because of that reference never thinking about the consequences to the original sender of the email to their friend. There are other scenarios for how private information will now be ending up in Google's hands ...real information ...not the sort of information found about someone's handle. <br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11709227</guid>
<pubDate>Thu, 28 Oct 2004 02:20:08 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11708870</link>
<description><![CDATA[<A HREF="/useremail/u/548172"><b>foxsteve</b></A> : I have read each post in this thread carefully and paid attention on the strange focus this discussion. The participants as  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A> consider that cookies are potential spyware and explains why and in what case. The participants as  Steve <A HREF="/useremail/u/340145"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A> consider that<br> <BLOCKQUOTE><SMALL>said by  Steve <A HREF="/useremail/u/340145"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><HR>People who rail against cookies do not belong in the security community.<br><HR></BLOCKQUOTE><br>i.e. try to suppress discussion.<br>I think the cookie defender should explain why cookie can be html file, why this file can contain scripts and tags meta, OBJECT, link...<br>BTW, on my professional WEB Site I do not use cookie - all statistics about my client's interest I get with Webalizer.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11708870</guid>
<pubDate>Thu, 28 Oct 2004 01:08:04 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11708161</link>
<description><![CDATA[<A HREF="/useremail/u/928459"><b>salzan</b></A> :   <div class="bquote"><SMALL>said by  dave <A HREF="/useremail/u/156437"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR><BR>   <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR><BR><BR>Information about me could end up in Google's hands no matter what I do </DIV><A HREF="http://www.google.com/search?hl=en&q=mele20">Too late...?</A><br> </DIV>Every breath you take<br>Every move you make<br>Every bond you break<br>Every step you take<br><br>I'll be watching you<br><br><SMALL><STRONG>Sting</SMALL></STRONG>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11708161</guid>
<pubDate>Wed, 27 Oct 2004 23:36:40 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11707716</link>
<description><![CDATA[<A HREF="/useremail/u/156437"><b>dave</b></A> :  <div class="bquote"><SMALL>said by  Mele20 <A HREF="/useremail/u/403861"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>Information about me could end up in Google's hands no matter what I do </DIV><A HREF="http://www.google.com/search?hl=en&q=mele20">Too late...?</A>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11707716</guid>
<pubDate>Wed, 27 Oct 2004 22:49:36 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11707547</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : I don't have Gmail and never will and never will communicate with anyone having such an account. I value my privacy. I don't ever give Google (of all sites!) a cookie!! Besides the fact that all mail is read by Google and kept by them and used for advertising purposes. It think it awful that anyone would get Gmail. My opnion of those who do drops drastically as soon as I learn that. Information about me could end up in Google's hands no matter what I do if I email someone who then forwards the email without my permission to someone who has Gmail. That is awful. So, I am extremely careful now about email. I hardly use it anymore.  <br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11707547</guid>
<pubDate>Wed, 27 Oct 2004 22:32:08 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11706461</link>
<description><![CDATA[<A HREF="/useremail/u/766601"><b>avd706</b></A> : A lot of software uses 'unique identifiers' besides web vrowsers. And the credit card in your wallet is a cookie too.<br><br>The trick is to link all this stuff together. Log into GMail? Don't bother deleting the Google cookie.<br><br>Heck you log into this website too right?]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11706461</guid>
<pubDate>Wed, 27 Oct 2004 20:44:02 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11700237</link>
<description><![CDATA[<A HREF="/useremail/u/429566"><b>Jason Levine</b></A> :  <div class="bquote"><SMALL>said by  steveknj <A HREF="/useremail/u/386919"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>My rule with cookies, which is something I read on a website like CNET or ZDNET years ago (or maybe in a magazine), is I NEVER accept a cookie from a website that doesn't match the website's domain.</DIV>You can set IE up to automatically block those.  So if you are at yahoo.com, you'll still accept/get prompted for yahoo.com's cookies (depending on your other cookie settings) but that cookie for joeswebsite.com will be auto-rejected.<br><SMALL>--<br>-Jason Levine<BR><A HREF="http://www.jasons-toolbox.com/">http://www.jasons-toolbox.com/</A><BR><A HREF="http://www.PCQandA.com/">http://www.PCQandA.com/</A><BR><A HREF="http://www.urateit.com/">http://www.urateit.com/</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11700237</guid>
<pubDate>Wed, 27 Oct 2004 08:45:17 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11694893</link>
<description><![CDATA[<A HREF="/useremail/u/615773"><b>hpguru</b></A> :  <div class="bquote"><SMALL>said by  steveknj <A HREF="/useremail/u/386919"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>...if I'm at Yahoo and I am prompted to accept a cookie from yahoo.com, then I will usually accept it.  But if I'm at Yahoo, and am prompted to accept a cookie from joeswebsite.com, then I WON'T accpet.</DIV>I don't want to be botherered with it. I block all cookies till a site *I really want or need to use* indicates that cookies must be enabled for the site to be functional. That just isn't the case for the vast majority of sites I encounter in casual browsing. Of course I block scripts as well so that plays a part. Sometimes a script which has little or nothing to do with site functionality will block your access because cookies are disabled. Disable scripting and access is restored. That is a little too harsh for most folks which is why I like The Proxomitron. I can disable scripting using Proxo filters while leaving it enabled in my browsers for sites where I want or need the functionality.<br><SMALL>--<br><B>FOUR MORE YEARS!!</B> - of fear.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11694893</guid>
<pubDate>Tue, 26 Oct 2004 17:42:13 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11694713</link>
<description><![CDATA[<A HREF="/useremail/u/156437"><b>dave</b></A> :  <div class="bquote"><SMALL>said by  Goldengamego <A HREF="/useremail/u/957735"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>Who came up with "cookie" anyway? Why not just log or state file?<br> </DIV>1) Because nothing about the semantics of a cookie requires it to be implemented as a 'file'.<br><br>2) Because programmers have to talk about this sort of stuff, and 'cookie' has a pretty precise meaning, but 'log file' can mean many different things.<br><br> ]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11694713</guid>
<pubDate>Tue, 26 Oct 2004 17:19:14 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11694670</link>
<description><![CDATA[<A HREF="/useremail/u/168087"><b>Daniel</b></A> :  <div class="bquote"><SMALL>said by  Steve <A HREF="/useremail/u/340145"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>People who rail against cookies do not belong in the security community.</DIV>I agree.  This is almost like the pursuit of "stealth" in the TCP/IP world. The more you know about TCP/IP the less concerned with stealth you become.<br><br>This applies to cookies as well, just insert "cookies" and "Internet Security" in place of "stealth" and "TCP/IP".<br><SMALL>--<br>cat knowledge | grep understanding</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11694670</guid>
<pubDate>Tue, 26 Oct 2004 17:11:37 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11693873</link>
<description><![CDATA[<A HREF="/useremail/u/386919"><b>steveknj</b></A> : My rule with cookies, which is something I read on a website like CNET or ZDNET years ago (or maybe in a magazine), is I NEVER accept a cookie from a website that doesn't match the website's domain.  For example, if I'm at Yahoo and I am prompted to accept a cookie from yahoo.com, then I will usually accept it.  But if I'm at Yahoo, and am prompted to accept a cookie from joeswebsite.com, then I WON'T accpet.  With that and running spybot, I have managed to stay generally clean.  I have also played around a bit with IE6's cookie settings and they seem to help in websites that require certain odd named cookies in order to load (Excite seems to work in this fashion).  All in all, if a website doesn't require a cookie to load, I err on the side of caution and don't load.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11693873</guid>
<pubDate>Tue, 26 Oct 2004 15:39:38 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11690254</link>
<description><![CDATA[<A HREF="/useremail/u/964038"><b>alien8</b></A> : "Where did the term cookies come from?":<br>&raquo;<A HREF="http://www.cookiecentral.com/faq/#1.2" >www.cookiecentral.com/faq/#1.2</A><br><SMALL>--<br>Tired of spam? Grab www.spampal.org</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11690254</guid>
<pubDate>Tue, 26 Oct 2004 06:10:46 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11690239</link>
<description><![CDATA[<A HREF="/useremail/u/957735"><b>Goldengamego</b></A> : Again and again and again. <br><br>They are just text files; the websites 'setting' them are not really ever touching your computer in any way. It is simply telling your browser to "help remember this for me" and your browser jots whatever it was down (or a ref ID to it on the server) in a text file aka. the cookie.<br><br>They only get what you give them. So don't, or give them BS (I have my Google toolbar preprogrammed with mounds of bogus info for just such occasions).<br><br>Who came up with "cookie" anyway? Why not just log or state file?<br><SMALL>--<br>Because Goldengamegod won't fit:p</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11690239</guid>
<pubDate>Tue, 26 Oct 2004 06:01:45 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11689902</link>
<description><![CDATA[<A HREF="/useremail/u/537492"><b>antiserious</b></A> :  <div class="bquote"><SMALL>said by  Steve <A HREF="/useremail/u/340145"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br> <div class="bquote">I pretty much completely agree with this: cookies are very nearly "nothing to think about", Steve </DIV> <br>... then it shouldn't matter that I toss 'em almost immediately ... <br> <br>... my take is simple - the site didn't ask me (directly) if they could plant a cookie, they didn't explain what data they were 'harvesting' or what they planned to use it for, and often the site will work adequately without the cookie - so they (or you) shouldn't mind if I decline the cookie or delete it immediately after leaving the site ... it's no bother to me to clean 'em out, or log in again when I need to ...<br> <br>... <I>"People who rail against cookies do not belong in the security community."</I> ... that seems a bit harsh, if not absurd ...<br> <br>... f w i w ...<br> <br><SMALL>--<br>... "everybody's somebody to somebody, and nobody to everybody else" ... y.t. ...</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11689902</guid>
<pubDate>Tue, 26 Oct 2004 03:05:43 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11689661</link>
<description><![CDATA[<A HREF="/useremail/u/795407"><b>SnowyOne</b></A> :  <div class="bquote"><SMALL>said by  Link Logger <A HREF="/useremail/u/356416"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>...  I would agree that when a cookie is cross linked with personal data then that would be bad.  The easy way to deal with that is don't give out your personal information to any site which sells or otherwise cross link your personal data (generally its not a good idea to give out personal data unless you absolutely have to and then only to a highly responsible site)....<br> </DIV>That's it again. How do you separate the responsible sites from the irresponsible ones? You use cookies.<br>If a site is setting tracking cookies, that's not a site I'm likely to share anything with. Tracking cookies cut both ways.<br><SMALL>--<br>Dave said "By the way, 4294967295 is just another way to write -1".</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11689661</guid>
<pubDate>Tue, 26 Oct 2004 02:04:09 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11689551</link>
<description><![CDATA[<A HREF="/useremail/u/356416"><b>Link Logger</b></A> : Excellent discussion thus far.  I would agree that when a cookie is cross linked with personal data then that would be bad.  The easy way to deal with that is don't give out your personal information to any site which sells or otherwise cross link your personal data (generally its not a good idea to give out personal data unless you absolutely have to and then only to a highly responsible site).  If you have to give out personal data and you suspect the site is bogus, give bogus information as the only thing worse then no information is bogus information.  So in short for myself unless some very trusted sites have cough up the pill then its unlikely that my personal information exists in any adware/spyware site.  If they did have my email address then any email they send me will be consumed by my ever so hungry spam filters.  As for popping up ad-banners based on sites I have previously visited, who cares as I can choose to ignore them as I wish, or I can block that traffic at the firewall for example (and likely pay a performance penalty as its seems that some sites want to persuade you not to block banners or ads).<br><br>I think that any company that sells or is otherwise cross linking personal data with adware/spyware cookie companies should be exposed and shot, twice.<br><br>Anyone who thinks that cookies should be tossed altogether has no idea as to how the internet works and why cookies are required and I'd like to see PCMag under the artful guidance of Mr. Dvorak eliminate cookies from their site first, good luck.<br><br>It would also appear that it is possible to configure just about any browser to reject or otherwise manage cookies, so in my ever so humble opinion anyone who mentions spyware cookies in the same statistic as spyware/malware infections like CWS or keyloggers is likely trying to sell you something based on FUD.<br><br>Blake<br><SMALL>--<br>Vendor: Firewall Logging Software &raquo;<A HREF="http://www.SonicLogger.com" >www.SonicLogger.com</A> - SonicWall and 3Com &raquo;<A HREF="http://www.LinkLogger.com" >www.LinkLogger.com</A> - Linksys, Netgear and Zyxel</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11689551</guid>
<pubDate>Tue, 26 Oct 2004 01:42:06 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11688136</link>
<description><![CDATA[<A HREF="/useremail/u/795407"><b>SnowyOne</b></A> :  <div class="bquote"><SMALL>said by  ghost16825 <A HREF="/useremail/u/864682"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>That's exactly it. If your IP address changes frequently and you delete cookies before the IP changes over in all reality what can be done?<br> </DIV>That's it exactly. I'll take it a step further & ask even if your IP doesn't change frequently in all reality what can be done?<br><SMALL>--<br>Dave said "By the way, 4294967295 is just another way to write -1".</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11688136</guid>
<pubDate>Mon, 25 Oct 2004 22:31:54 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11688093</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : But who has a dynamic IP these days? My IP hasn't changed since the last time I shut the computer down when I went on vacation. That was Sept 2003. I bought this computer November 2003 and have had the same IP address all this time. I have Road Runner as my ISP.  I have noted for years that if you want a new IP with Road Runner you must shut down the computers for at least 96 hours and sometimes it must be even longer. Three weeks will do it.<br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11688093</guid>
<pubDate>Mon, 25 Oct 2004 22:27:21 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11687852</link>
<description><![CDATA[<A HREF="/useremail/u/864682"><b>ghost16825</b></A> :  <div class="bquote"><SMALL>said by  hpguru <A HREF="/useremail/u/615773"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR> <div class="bquote"><SMALL>said by  Jason Levine <A HREF="/useremail/u/429566"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>However, if you delete adcompany.com's cookie (or refuse it in the first place), you appear to them to be a new person every time.</DIV>Yes and no. I have detected my IP address in cookies served from various sites (not in a while though). I have also seen sites insert my IP address into the query strings and posted data from form submittal. So while deleting stored cookies will prevent most sites from tracking you it won't help if they are using your IP as a unique id unless your IP address changes frequently.<br> </DIV>That's exactly it. If your IP address changes frequently and you delete cookies before the IP changes over in all reality what can be done?]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11687852</guid>
<pubDate>Mon, 25 Oct 2004 22:02:04 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11687648</link>
<description><![CDATA[<A HREF="/useremail/u/615773"><b>hpguru</b></A> :  <div class="bquote"><SMALL>said by  Jason Levine <A HREF="/useremail/u/429566"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>However, if you delete adcompany.com's cookie (or refuse it in the first place), you appear to them to be a new person every time.</DIV>Yes and no. I have detected my IP address in cookies served from various sites (not in a while though). I have also seen sites insert my IP address into the query strings and posted data from form submittal. So while deleting stored cookies will prevent most sites from tracking you it won't help if they are using your IP as a unique id unless your IP address changes frequently.<br><SMALL>--<br><B>FOUR MORE YEARS!!</B> - of fear.</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11687648</guid>
<pubDate>Mon, 25 Oct 2004 21:41:00 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11687117</link>
<description><![CDATA[<A HREF="/useremail/u/0"><b>anon</b></A> : Oh, I guess you're talking about how IE6 no longer allowed you to set cookies in zones.  I used to block all cookies in the internet zone and allow them in trusted...sadly, a few virus scares forced me to upgrade to IE6 :(]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11687117</guid>
<pubDate>Mon, 25 Oct 2004 20:45:57 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11686769</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> : Ahh..you have now qualified your original statement to read "professional" security community instead of just "security community". Fine. I am not a member of the "professional" security community. I do consider myself a member of the "security community" as I have a strong interest in computer security and have been posting in this forum (the main forum I visit here) for over three years. I also post regularly at Wilders Security and also at Computer Cops. <br><br>I do agree that "railing hysterically" about cookies is not very smart be it from a "professional"{ security person or simply a user who tries to keep up with security issues regarding their computer. I suspect though that we might disagree somewhat on what specifically entails "railing hysterically" in regard to cookies. <br><br>The first piece of software I ever bought about 8 months after I got my first computer in 1999 was Cookie Crusher. I still consider it to have been one of the most important softwares I could get at the time. I was already using Ad/subtract beta and had just gotten Zone Alarm beta for a dial up connection. I had no idea what a cookie was when I first got that computer. When I first looked at my cookies I was appalled as I had hundreds of them and many of them were third party. I began reading about cookies and bought Cookie Crusher and still use it on that computer.  I have stated many times over the years here how I feel about cookies. I vividly recall the lengthy, classic discussions here on cookies when IE6 first came out. I refused to upgrade my 98Se box to IE6 because of its poor handling of cookies. Instead, I got Mozilla way back because it handles cookies so much better even after IE6 cookie handling was improved. On my XP Pro box, I allow only a handful of permanent cookies and one reason I don't use IE on it is because it still has poor cookie handling compared to FF and Mozilla.  <br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11686769</guid>
<pubDate>Mon, 25 Oct 2004 20:10:00 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11686514</link>
<description><![CDATA[<A HREF="/useremail/u/340145"><b>Steve</b></A> : I have no idea what your opinion is on cookies (though I take it I can guess), but those who rail hysterically against cookies are not part of the professional security community.<br><br>It's more than fine to dislike cookies, to block them, to not care for advertising in general, and to hate Doubleclick, but when I see people putting cookies in the same category as real spyware, it shows a poverty of perspective.<br><br>I have no idea if that applies to you, and in any case anybody is welcome to post here.<br><br>Steve<br><SMALL>--<br>Stephen J. Friedl • Unix Wizard • Microsoft MVP • Tustin, California USA • <A HREF="http://www.unixwiz.net">my web site</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11686514</guid>
<pubDate>Mon, 25 Oct 2004 19:42:40 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11686479</link>
<description><![CDATA[<A HREF="/useremail/u/403861"><b>Mele20</b></A> :  <div class="bquote"><SMALL>said by  Steve <A HREF="/useremail/u/340145"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br> <div class="bquote"><SMALL>said by  sivran <A HREF="/useremail/u/874811"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br>People who rail against cookies do not belong in the security community.<br><br>Steve<br> </DIV>Gee, thank you kind sir! I've been here over three years and did not realize until now that I was not welcome. :(<br><SMALL>--<br>The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11686479</guid>
<pubDate>Mon, 25 Oct 2004 19:39:01 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11686359</link>
<description><![CDATA[<A HREF="/useremail/u/827318"><b>Bobby_Peru</b></A> : Jason, if you, or anyone, has any doubts about the "possibility"  of alliances between cross-site online Ad/Cookie servers, like DoubleClick, and terrestrial targeted marketing firms with deep transactional (and more) data, like ABACUS, you might want consider that DoubleClick bought ABACUS some years ago.<br><br>While it is much more than a cookie issue, cookies are one place one can easily (no cost) exercise control to impede this.<br><br>&raquo;<A HREF="http://www.abacus-direct.com/corporate_profile.asp" >www.abacus-direct.com/corporate_profile.asp</A><br><br>&raquo;<A HREF="http://www.abacus-direct.com/doubleclick_connection.asp" >www.abacus-direct.com/doubleclic&middot;&middot;&middot;tion.asp</A><br> <div class="bquote"><SMALL>said by ABACUS:</SMALL><br><br>THE DOUBLECLICK CONNECTION<br><br>The Abacus-DoubleClick combination is more than dynamic and offers you solutions you can't find anywhere else. The Abacus-DoubleClick connection allows you to accurately identify and target your audience whether it is consumer or business to business. You can reach your customers through a multiple of channels including direct mail, Internet, e-mail, or wireless communications.<br><br>With the Abacus-DoubleClick connection you can identify where your customers and prospects are buying: web, catalog, retail or phone. This powerful pooled combination of information and technology will enable you to improve client profitability and increase your market share.</DIV>&raquo;<A HREF="http://www.abacus-direct.com/products/prod_products.asp" >www.abacus-direct.com/products/p&middot;&middot;&middot;ucts.asp</A><br><br> <div class="bquote"><SMALL>said by ABACUS:</SMALL><br><br>ABACUS, a division of DoubleClick Inc., is a world leader in targeted marketing solutions. By combining transactional data, advanced statistical modeling, and extensive media reach, we target the customers most likely to buy your products or services.<br><br>The Abacus Alliance database of buyer behavior is the largest in the United States. It contains over 3.5 billion transactions from more than 90 million U.S. households and includes geographic, demographic, lifestyle, and behavioral data from catalog, retail, business-to-business, e-commerce, and publishing markets. We span multiple channels so you can integrate the most broadly based yet highly targeted campaigns for customer acquisition or retention.</DIV>It's pretty obvious what can be done, and pretty obvious what they brag about doing.  If it doesn't matter to a user, so be it (even though such acceptance ultimately 'trickles-down' to even greater intrusive behavior against everyone), but users should be aware.<br><SMALL>--<br>**~~<A HREF="/faq/8428">Infected/Hijacked? FAQ</A>~~~<A HREF="/faq/8463">Protect/Secure Your Box/Data FAQ</A>~~~<A HREF="/faq/security">Security Forum FAQs</A>~~**</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11686359</guid>
<pubDate>Mon, 25 Oct 2004 19:21:43 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11684997</link>
<description><![CDATA[<A HREF="/useremail/u/429566"><b>Jason Levine</b></A> :  <div class="bquote"><SMALL>said by  Bobby_Peru <A HREF="/useremail/u/827318"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br> the marketing can arrive at your home or workplace (mailbox, telephone, front-door) or the data can continue to be compiled with no _present_day _noticable_ effect.<br><br>"AdCompany.com" may also obtain, keep, track and correlate much more specifically identifying information, down to your name, street address, telephone number and all that can be obtained from that (from broad demographics, down to specific personal financial (health?) data from any number of dBases.)  <br><br>If the "Adcompany" doesn't know who you are, they will, as soon as a single "partner" "shares" enough information to ID you with specificity.  This is why online Adcompanies have associated with "brick and mortar" dBases [and run "Contests" which require submission of personal data].  They can "Supplement" the online tracking data that they collect with data from other sources. </DIV>How would "Adcompany" know, via cookies, that the person at IP address 123.45.67.89 who loaded their banner ad from SomeCompany.com at a specific time is really Jason Levine and that I live at 123 Someroad Lane?  (Not my real address obviously.  ;) )<br><br>Sure, they *might* be able to have a marketing deal with a company that I've given my personal information to, but this is hardly a cookie issue.  If they can ID me every time I load up an ad banner of theirs, why even bother with cookies?<br><br>I do agree though that you should refuse any unneeded cookies.  Not so much as a security issue, but because I think that sites overuse cookies.  I have my browser configured to block 3rd party cookies, and prompt me on 1st party ones.  (Session cookies are always allowed.)<br><br>If a site tries to load a cookie, I decide whether to allow it or not.  Most times I block it.  If the site is persistent in trying to put a cookie on my computer then they get Always Block status.  (I've seen sites that require a cookie read/write to load up each image on the page!)<br><SMALL>--<br>-Jason Levine<BR><A HREF="http://www.jasons-toolbox.com/">http://www.jasons-toolbox.com/</A><BR><A HREF="http://www.PCQandA.com/">http://www.PCQandA.com/</A><BR><A HREF="http://www.urateit.com/">http://www.urateit.com/</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11684997</guid>
<pubDate>Mon, 25 Oct 2004 16:51:31 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11684976</link>
<description><![CDATA[<A HREF="/useremail/u/340145"><b>Steve</b></A> :  <div class="bquote"><SMALL>said by  sivran <A HREF="/useremail/u/874811"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>John C. Dvorak just lost any credibility he once had with me (did he ever have any..). That view is far too extreme. </DIV>I pretty much completely agree with this: cookies are very nearly "nothing to think about", and it does a disservice to <A HREF="/forum/remark,11684199~mode=flat">stupid users</A> by misleading them about "what really matters" and "what's not that important".<br><br>People who rail against cookies do not belong in the security community.<br><br>Steve<br><SMALL>--<br>Stephen J. Friedl • Unix Wizard • Microsoft MVP • Tustin, California USA • <A HREF="http://www.unixwiz.net">my web site</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11684976</guid>
<pubDate>Mon, 25 Oct 2004 16:48:54 EDT</pubDate>
</item>

<item>
<title>Re: is this too much of a stretch?</title>
<link>http://www.dslreports.com/forum/remark,11684870</link>
<description><![CDATA[<A HREF="/useremail/u/429566"><b>Jason Levine</b></A> : Perhaps.  Of course, the spyware could just "listen in" on what you type on the keyboard and send that back to it's master.  Then the "spyware master" will not only have access to credit card numbers, but also to usernames and passwords.<br><br>We're getting past spyware and into a keylogger trojan, but that's just semantics really.  Once a malicious program is running on your system you've lost the battle.  It doesn't matter if a cookie stores an ID for ABC Book company or if you log in each time.<br><SMALL>--<br>-Jason Levine<BR><A HREF="http://www.jasons-toolbox.com/">http://www.jasons-toolbox.com/</A><BR><A HREF="http://www.PCQandA.com/">http://www.PCQandA.com/</A><BR><A HREF="http://www.urateit.com/">http://www.urateit.com/</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11684870</guid>
<pubDate>Mon, 25 Oct 2004 16:38:44 EDT</pubDate>
</item>

<item>
<title>is this too much of a stretch?</title>
<link>http://www.dslreports.com/forum/remark,11684793</link>
<description><![CDATA[<A HREF="/useremail/u/0"><b>anon</b></A> : Blake said:<I><br>"<br>Two weeks later, you go back to the ABC Books site. First thing, your browser checks for an ABC cookie. It finds it, and sends it to ABC's computer.<br><br>When the ABC site opens, it says "Welcome back, Joe!" How does it know? The ABC Book Co. has the information about the sale two weeks ago in its database. It matches the ID number in the cookie to the sale information, and customizes the page for you.<br><br>When you next make a purchase, <B>you won't have to enter your credit-card number</B> or address. <B>That will already be filled in.</B> Again, that came from the database, and was <B>enabled by the cookie</B>."</I><br>----------------<br><br>Okay, assume other spyware is on the user's machine which transmits the ABC cookie from the user's machine to a third party.  The third party then sends it from another machine to the ABC site, does the third party then have access to purchase things on the user's credit card?]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11684793</guid>
<pubDate>Mon, 25 Oct 2004 16:30:42 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11684727</link>
<description><![CDATA[<A HREF="/useremail/u/874811"><b>sivran</b></A> : John C. Dvorak just lost any credibility he once had with me (did he ever have any..). That view is far too extreme. So extreme in fact, I pray that article was written sarcastically. Cookies are delicious delicacies, not malignant tumors. Cookies are the only way a website can have any assurance that a particular user has returned, and respond appropriately, without having to make the user enter some id number or login. <br><br>I take no special precautions with cookies, save for some sites in Mozilla's block list from one of those rare times I clean em up. ;)<br><br>So they can eventually identify you. So what? That's what bitbuckets and trash cans/recycle bins are for. What's one more piece of junkmail to throw away? <br><SMALL>--<br><A HREF="http://www.againsttcpa.com/">TCPA </A>- Treacherous Computing<BR><A HREF="http://download.kerio.com/dwn/kpf/kerio-pf-2.1.5-en-win.exe">Kerio 2.1.5</A> - Best damn firewall<BR><B>Licenses should be per user, Ditch Norton! Get F-Prot!</B></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11684727</guid>
<pubDate>Mon, 25 Oct 2004 16:25:57 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11684413</link>
<description><![CDATA[<A HREF="/useremail/u/896076"><b>BrettStarr</b></A> :  <div class="bquote"><SMALL>said by  Bobby_Peru <A HREF="/useremail/u/827318"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><BR><BR>...<br>1) Refuse cookies that are not absolutely needed <br>2) Force all cookie to Session status (unless Persistent status is absolutely needed<br>3) Insure the removal of all cookies that are not absolutely needed to be retained when you close a TAB, as well as close your Browser ... </DIV>I totally agree with this. And it is very easy to do with IE6...if you know how.  So here is how (I even attached pics):<br>IE > Tools > Internet Options...<br>1) GENERAL tab: Temporary Internet Files(TIF) area, <br>click Delete Cookies... to clear ALL of your cookies (if you want to start from scratch).<br>OR click Settings...> View files...> select and delete the cookies you don't absolutely need.<br>2)click PRIVACY tab:<br>click Advanced.. make settings as shown in pic. click OK.<br>click Sites... enter the domain names you always want to allow/keep cookies for (see pic for example). click OK when finished.<br>3) OK out.<br>That's it. From now on, nobody will ever be able to put a cookie on your system, EXCEPT those you have in the Managed Sites list.<br>Try it!...you'll be pleasantly surprised how great this works.<br>-<br><SMALL>NO MORE AD TRACKING, SPYWARE, WHATEVER COOKIES and YOU WILL NEVER HAVE TO DO COOKIE CLEANING AGAIN!<br>ALSO, YOU DON'T NEED ANY COOKIE BLOCK LISTS EITHER.    <div class="borderless"><TABLE WIDTH=95% align=center border=0 CELLPADDING=4"><TR><TD ALIGN=CENTER VALIGN=CENTER BGCOLOR=#000000 nwrap COLSPAN=2 WIDTH=66%><A HREF="/speak/slideshow/11684413?c=699098&ret=L2ZvcnVtL3IxMTY4MjY4OS54bWw%3D"><IMG TITLE="19429 bytes" BORDER=0 WIDTH=377 HEIGHT=295 SRC="/r0/download/699098~0f8b58ccd883e8e9de9fc11f9e8cf844/ScreenShot025.jpg"></A><br>Advanced Settings</TD><TD ALIGN=CENTER BGCOLOR=#000000 nowrap width=1%>&nbsp;</TD></TR><TR><TD ALIGN=CENTER VALIGN=CENTER BGCOLOR=#000000 nwrap COLSPAN=3 WIDTH=100%><A HREF="/speak/slideshow/11684413?c=699099&ret=L2ZvcnVtL3IxMTY4MjY4OS54bWw%3D"><IMG TITLE="33237 bytes" BORDER=0 WIDTH=439 HEIGHT=316 SRC="/r0/download/699099~0616cbe1fce385cdcd5d28bb93d8cec7/ScreenShot026.jpg"></A><br>Managed Sites</TD></TABLE></div>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11684413</guid>
<pubDate>Mon, 25 Oct 2004 15:52:27 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11683826</link>
<description><![CDATA[<A HREF="/useremail/u/827318"><b>Bobby_Peru</b></A> :  <div class="bquote"><SMALL>said by  Jason Levine <A HREF="/useremail/u/429566"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br> ... The worst thing that a cookie can do is allow an advertising network to track the sites that you've been to.  ... </DIV>Once again, no, since it doesn't stop at just setting and tracking cookies online.  Unfortunately online "advertising networks" do not exist only Virtually (sorry Mr. Larry...).<br><br>Blake's example fails to expressly make the leap that is _no_ problem for all this - the marketing can arrive at your home or workplace (mailbox, telephone, front-door) or the data can continue to be compiled with no _present_day _noticable_ effect.<br><br>"AdCompany.com" may also obtain, keep, track and correlate much more specifically identifying information, down to your name, street address, telephone number and all that can be obtained from that (from broad demographics, down to specific personal financial (health?) data from any number of dBases.)  <br><br>If the "Adcompany" doesn't know who you are, they will, as soon as a single "partner" "shares" enough information to ID you with specificity.  This is why online Adcompanies have associated with "brick and mortar" dBases [and run "Contests" which require submission of personal data].  They can "Supplement" the online tracking data that they collect with data from other sources.<br><br>The existence of greater risks is really not disputable, but that does not change the existence of this specific risk, nor really matter, since it is simple to greatly reduce this potential intrusion:<br><br>1) Refuse cookies that are not absolutely needed <br>2) Force all cookie to Session status (unless Persistent status is absolutely needed<br>3) Insure the removal of all cookies that are not absolutely needed to be retained when you close a TAB, as well as close your Browser<br>4) Prevent the AdCompanies from setting cookies and from obtaining your IP in the first place with a combination of Scrud-Filters and Cookie Controls.<br><br>[edit: forgot *Block all 3ed Party Cookies]<br><br>While you may not be able to control the compilation and spread of this personal "history" type of information in many areas (i.e. credit card usage), the cost of greatly reducing this intrusion in this particular area is extremely low (software is all free, very little time needed).<br><br>Helpful Tools:<br>-FireFox/Mozilla<br>To prevent Ad companies from the acquisition of your IP and attempting to set cookies get the AdBlock extension.<br><br>Supplement FireFox's native site-specific Cookie Control with the following extensions for ease of use and configuration: CookieCuller, CookieButton, ViewCookies.<br><br>Consider the use of a Proxy like WebWasher, or the teeny tiny mighty mighty Proxomitron to scrub and control this stuff at a lower level, for all browsers and chat clients on your machine.<br><br>[edit: typo(s), added "Contests", clarity (I hope)]<br><SMALL>--<br>**~~<A HREF="/faq/8428">Infected/Hijacked? FAQ</A>~~~<A HREF="/faq/8463">Protect/Secure Your Box/Data FAQ</A>~~~<A HREF="/faq/security">Security Forum FAQs</A>~~**</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11683826</guid>
<pubDate>Mon, 25 Oct 2004 14:36:00 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11683027</link>
<description><![CDATA[<A HREF="/useremail/u/429566"><b>Jason Levine</b></A> : The cookie may contain HTML or JavaScript code for an exploit (and thus trigger an AV notificaton), but it's benign until the website that created the cookie reads and displays the contents.  And if a website is going to do that, they'll likely skip the cookie entirely and just display the exploit code directly.<br><br>The worst thing that a cookie can do is allow an advertising network to track the sites that you've been to.  For example, you land on example1.com and see an ad banner.  The ad banner, served by adcompany.com, writes a cookie to your hard drive with a unique ID.  In their back-end database, they associate that unique ID with example1.com.<br><br>Now you continue browsing and go to example2.com.  This site also displays an ad banner from the same company.  Adcompany.com reads the unique ID from the cookie and uses it to store that second site in their database.  Now adcompany.com knows 2 sites that you've been to.<br><br>However, if you delete adcompany.com's cookie (or refuse it in the first place), you appear to them to be a new person every time.<br><br>In short, the "Cookie Threat" is overblown by some people.  There are much worse things out there to worry about.<br><SMALL>--<br>-Jason Levine<BR><A HREF="http://www.jasons-toolbox.com/">http://www.jasons-toolbox.com/</A><BR><A HREF="http://www.PCQandA.com/">http://www.PCQandA.com/</A><BR><A HREF="http://www.urateit.com/">http://www.urateit.com/</A></SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11683027</guid>
<pubDate>Mon, 25 Oct 2004 12:53:58 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11682967</link>
<description><![CDATA[<A HREF="/useremail/u/928459"><b>salzan</b></A> : My fear of cookies comes from a few years ago. I was surfing some sites I probably shouldn't have been at, (mostly *.am and *.ru) and got the "accept cookie?" pop-up (even in those days I had IE set to "always ask"). I remember thinking about it for a second and then clicking "allow". Within seconds I had the red screen from the AV alerting me that "Trojan something or other" was in my internet cache. <br><br>Looking back, it was probably just a coincidence but I've never lost the feeling that I may have actually allowed the malware to get on my system by clicking "allow". <br><br>Is it ridiculous to suspect the possibility of something other than a text file piggybacking in with the cookie?]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11682967</guid>
<pubDate>Mon, 25 Oct 2004 12:46:57 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11682693</link>
<description><![CDATA[<A HREF="/useremail/u/151802"><b>jaykaykay</b></A> : I tend to accept only certain cookies and make sure that I am cleaned of all others as I see fit.  I prefer Oreos over most of those that are dispersed from the Internet.<br><br>For those who are not quite up to snuff or as yet educated enough to really follow some of these articles, my suggesting is to give a description of what a cookie is.  The following comes from &raquo;<A HREF="http://computerproblems.com/questions/question.cfm?id=2323" >computerproblems.com/questions/q&middot;&middot;&middot;?id=2323</A>.<br><br> "Cookies" are small text files that are stored on a Web user's hard drive to serve as a unique identifier for tracking that users preferences and profile on that Web site. Most cookie files are stored in the "C:\WINDOWS\COOKIES directory or folder. <br>They take very little space (I have over 200 Cookie files on my system that take less space than a single floppy disk) so &#147;filling up your hard drive with Cookies&#148; is not a real concern. No personal information about you or your computer, is stored in these files, but rather a profile of your movements and preferences when surfing. In the beginning, Cookies were to be used within one Web site to track specific information such as usernames and passwords for membership-based sites, to track your on-line purchases via a "shopping basket" or to store your preferences for that site (i.e. show me sports news but only about hockey). These were good uses of cookies that made getting in and around our favorite Web sites easier and more enjoyable. <br>But then along came the &#147;marketing wizards&#148; that put up sites such as DoubleClick (www.doubleclick.com) and NetGravity (www.netgravity.com ) that now use cookies to silently track a user's movements between their clients sites that carry their ads. When a user visits AltaVista to use the search engine, for example, a cookie is sent along with that site's images, and the information is stored in a database on a remote server at DoubleClick. This information is supposed to be used to display &#147;banner ads&#148; that would specifically appeal to you based on your previous uses whenever you visit a member Web site, not just AltaVista. This worries some users, who feel like they are being watched. Most people that are concerned about &#147;cookie&#148; usage will either block or delete the cookie files on their hard drive. Is it a case of paranoia or just playing it safe? It depends upon what you believe is possible with the information that is being gathered. Most people that &#147;fear&#148; cookies, are more concerned about what may be done with them in the future. <br>Deleting cookies is fairly easy. Most cookie files are stored in the &#147;C:\WINDOWS\COOKIES directory or folder. If you have activated user profiles, each of your users that have accessed the Internet has their own cookie directory in the C:\WINDOWS\PROFILES folder. Double-click the &#147;username&#148; folder (where &#147;username&#148; is the name you use to log on to Windows) to locate the COOKIES folder. Simply delete the entire COOKIE folder when you finish surfing and none of the information that was gathered will be available the next time you connect to the Web. When you delete all your Cookie files, however, any personal preferences or user registration information for certain web sites will be deleted as well. You may have to go through a registration or reset of your preferences every time you go to these types of sites if you use this practice. <br>Blocking cookies is fairly easy in most current Internet browsers. Programs like Microsoft's Internet Explorer or Netscape's Communicator/Navigator give you options to either be notified before accepting a cookie or just plain block all cookies. Most current versions of Microsoft's Internet Explorer allow you to change these settings by going to the VIEW/INTERNET OPTIONS menu, then click on the Advanced tab. Look for the word cookies in the listings for the options to accept, ask before accepting or blocking all cookies. Current Netscape versions will generally allow you to change Cookie options by clicking on the EDIT/PREFERENCES menu, then click on advanced. Be aware, however, some Web sites will not allow you access without placing a cookie on your computer, so you may be limiting your surfing options."]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11682693</guid>
<pubDate>Mon, 25 Oct 2004 12:09:51 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11682689</link>
<description><![CDATA[<A HREF="/useremail/u/156437"><b>dave</b></A> :  <BLOCKQUOTE><SMALL>quote:</SMALL><HR>Any person who knowingly writes or reads files from another person's computer by personal or robotic means for whatever reason whatsoever and without the permission of the party involved, with full knowledge of the activity each and every time the action is performed, is guilty of a felony and subject to fine and imprisonment not to exceed $10,000 and one year in prison for each offense." <HR></BLOCKQUOTE>So, if I have a web site that presents content in the MIME type 'application_octet_stream/bananamatic', and this causes your browser to read its config files to see whether it can handle the bananamatic format, then I've committed a felony?<br><br>How is this, mechanically, any different from my web site causing your browser to read a cookie file?<br><br>Come to think of it, if I deliver a fairly large graphic to your memory-constrained PC, haven't I just caused your paging file to be written?<br><br>Legal codes are supposed to be unambiguous, and that wording certainly is full of ambiguity. We could start by discussing the word 'file', which I suspect is loose enough to drive a truckload of lawyers through.<br><br>The fundamental problem, as I see it, is that by you pointing your web browser at my web site, you have in fact invited my web site to alter things in your running computer. That's simply the nature of the beast. If you don't want any state changes that you did not explicitly authorize, then you'd be better off sticking to something less interactive, like ftp.<br><br>Lest you misunderstand me as having sympathy for scumbags: I don't. However, I wouldn't want to see a law that's either (a) so full of loopholes it provides no protection, or (b) so overreaching that any web site anywhere is subject to nuisance law suits from idiots.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11682689</guid>
<pubDate>Mon, 25 Oct 2004 12:08:48 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11682607</link>
<description><![CDATA[<A HREF="/useremail/u/1089183"><b>Terikan</b></A> : It's fine that people have their opinions about cookies and such, it's the misconceptions that get me riled up.]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11682607</guid>
<pubDate>Mon, 25 Oct 2004 11:56:08 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11682449</link>
<description><![CDATA[<A HREF="/useremail/u/258532"><b>dp</b></A> :  <div class="bquote"><SMALL>said by  pieter arntz <A HREF="/useremail/u/591564"><IMG SRC="http://i.dslr.net/bb/profile.gif" ALT="See Profile" BORDER=0 WIDTH=16 HEIGHT=11></A>:</SMALL><br><br>Since agreeing with you will hardly make it a discussion, here is a completely different opinion:<br>&raquo;<A HREF="http://www.pcmag.com/article2/0,1759,1674169,00.asp" >www.pcmag.com/article2/0,1759,1674169,00.asp</A><br></DIV>There is also a lenghty discussion on that article going on in their forums (PC Mag).<br>&raquo;<A HREF="http://discuss.pcmag.com/n/main.asp?webtag=pcmag&nav=messages&msg=43277.1" >discuss.pcmag.com/n/main.asp?web&middot;&middot;&middot;=43277.1</A><br><SMALL>--<br>Write your questions down on the back of a $20 dollar bill and send them to me</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11682449</guid>
<pubDate>Mon, 25 Oct 2004 11:31:39 EDT</pubDate>
</item>

<item>
<title>Re: How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11682381</link>
<description><![CDATA[<A HREF="/useremail/u/591564"><b>pieter arntz</b></A> : Since agreeing with you will hardly make it a discussion, here is a completely different opinion:<br>&raquo;<A HREF="http://www.pcmag.com/article2/0,1759,1674169,00.asp" >www.pcmag.com/article2/0,1759,1674169,00.asp</A><br><br>Quote for those that don't like the cookies from PC Magazine. ;)<br><br> <BLOCKQUOTE><SMALL>quote:</SMALL><HR>But let's go further and ban cookies too. Cookies are those small files that Web sites store on your computer for their convenience. I never even liked the idea of cookies. Why should some Web site be storing its data on my machine? While a cookie is kind of handy when you want to store a password, this can be done other ways without the alien Web site looking at my files. Whose idea was this anyway? Cookies are like those marks that hoboes used to make on picket fences during the depression in the 1930s. They were marks to tell other hoboes who the rubes were. A cookie is a marker telling Web sites that I'm a sucker.<br><br>{snipped a bit}<br><br>Back to my main complaint. One thing that comes to mind in all this debate and hand-wringing over spyware, cookies, ActiveX, Java and the like is the idea of making any use of cookie technology itself illegal. <br><br>I've thought about this before. This is all about your computer doing stuff to my computer without my permission, isn't it? Make all such action illegal. That means cookies too. So what if the browser lets you create cookies? Does that mean we cannot outlaw them? There are plenty of capabilities within browser code that shouldn't be allowed to be present. But let's start with cookies and generalize a law with cookies in mind. <br><br>Something like this would work for me: "Any person who knowingly writes or reads files from another person's computer by personal or robotic means for whatever reason whatsoever and without the permission of the party involved, with full knowledge of the activity each and every time the action is performed, is guilty of a felony and subject to fine and imprisonment not to exceed $10,000 and one year in prison for each offense." <br><br>That would cover it for me.<br><br>John C. Dvorak<br><HR></BLOCKQUOTE><br><br>Personally, I tend to agree more with SpywareGuides view as published here:<br>&raquo;<A HREF="http://www.spywareguide.com/articles/internet_cookies_spyware_or_ne_57.html" >www.spywareguide.com/articles/in&middot;&middot;&middot;_57.html</A><br>It's the thought that counts more then the doing.<br><br>Regards,<br><br>Pieter<br><SMALL>--<br>Metallica rulez</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11682381</guid>
<pubDate>Mon, 25 Oct 2004 11:22:14 EDT</pubDate>
</item>

<item>
<title>How &#x27;bad&#x27; are spyware cookies??</title>
<link>http://www.dslreports.com/forum/remark,11682094</link>
<description><![CDATA[<A HREF="/useremail/u/356416"><b>Link Logger</b></A> : It is somewhat my belief that the issue of spyware cookies is vastly overblown, but of course I could be wrong so hopefully this is the start of a thread which will educate myself and others on the evils of spyware cookies, and how much information can be collected by them and how 'dangerous' this information could be.<br><br>So using a description of cookies posted on Microsoft's site written by Kim Komando, lets start this thread.<br><br>---------------------<br>Know good cookies from bad cookies. These little text files have a bad reputation. But much of that is based on ignorance. Cookies actually perform valuable services. For instance, they can shoot you right into a site so you don't have to enter your password.<br><br>Here's how cookies work: Say you visit the ABC Book Co. You buy a book. The company downloads a text file to your computer, which includes an ID number. That's a cookie.<br><br>Two weeks later, you go back to the ABC Books site. First thing, your browser checks for an ABC cookie. It finds it, and sends it to ABC's computer.<br><br>When the ABC site opens, it says "Welcome back, Joe!" How does it know? The ABC Book Co. has the information about the sale two weeks ago in its database. It matches the ID number in the cookie to the sale information, and customizes the page for you.<br><br>When you next make a purchase, you won't have to enter your credit-card number or address. That will already be filled in. Again, that came from the database, and was enabled by the cookie.<br><br>That is all very convenient. But there are less desirable cookies, too. They're called tracking cookies. Say you visit the XYZ Brain Surgery site. There's a banner ad there. It is linked to an advertising services company. It downloads a cookie. The cookie says, "This person visited XYZ Brain Surgery."<br><br>Next, you go to a heart transplant site. The banner ad there is associated with the same advertising company. The browser sends the cookie to the banner ad. The ad adds a notation that you visited the heart transplant site.<br><br>Over time, the tracking cookie builds a profile of your interests. The advertising services company sells this information. That's why you start getting advertising for medical equipment.<br>---------------------<br><br>OK so evil spyware cookie company knows I visit sites like this, how bad is that and what other information do they have (and how do they get it which might be a more important question)?<br><br>Blake<br><SMALL>--<br>Vendor: Firewall Logging Software &raquo;<A HREF="http://www.SonicLogger.com" >www.SonicLogger.com</A> - SonicWall and 3Com &raquo;<A HREF="http://www.LinkLogger.com" >www.LinkLogger.com</A> - Linksys, Netgear and Zyxel</SMALL>]]></description>
<guid isPermaLink="true">http://www.dslreports.com/forum/remark,11682094</guid>
<pubDate>Mon, 25 Oct 2004 10:40:23 EDT</pubDate>
</item>

</channel>
</rss>
