Yahoo To Ignore IE10 DNT Settings

Who Is Hacking U.S. Banks? 8 Facts

Memo from Yahoo to users of Microsoft Internet Explorer 10: Prepare to be tracked.

Yahoo, the company behind the eponymous search engine, announced Friday that it's the latest organization planning to ignore the "do not track" (DNT) setting, or flag, broadcast by IE10.

Yahoo's proffered reasoning is that by making the privacy control active by default, Microsoft is ignoring the wishes of its users. "Ultimately, we believe that DNT must map to user intent -- not to the intent of one browser creator, plug-in writer, or third-party software service," said a statement released by Yahoo, titled "In Support of a Personalized User Experience." "Therefore, although Yahoo will continue to offer Ad Interest Manager and other tools, we will not recognize IE10's default DNT signal on Yahoo properties at this time," it said.

[ Background: Do Not Track: 7 Key Facts. ]

Yahoo's Ad Interest Manager, introduced in 2009, is billed by the search company as "a central place where Yahoo visitors can see a concise summary of their online activity and make easy, constructive choices about their exposure to interest-based advertising served from the Yahoo Ad Network." The page allows users to curtail -- or fully opt out -- of so-called interest-based advertising. In other words, it's the type of feature that would be expressly enabled or disabled by DNT, should Yahoo wish to pay attention to that setting.

Yahoo's tortured reasoning drew criticism from Chester Wisniewski, a senior security advisor at Sophos Canada. "The argument is hollow and isn't open and honest. Yahoo wants to provide advertisers the ability to target its users to generate revenue," he said in a blog post.

But instead of making such advertising clear to users, or the benefit it provides even a selling point, Yahoo instead couches its argument in terms of user intent. "Why not be open and suggest to users that providing great financial, news, sports and entertainment content requires advertising partners?" said Wisniewski, noting that in contrast, Microsoft isn't hiding what it's doing. Notably, the "express" installation settings for IE10 explicitly state that DNT will be enabled, unless users opt to alter that setting. "If you want to talk big about privacy, put your money where your mouth is. I don't begrudge you your methods, but respect my choices," he said. "Microsoft fairly presents a choice and you need to honor it or become irrelevant."

In its public denouncement, Yahoo joins the Association of National Advertisers (ANA), which recently launched a concerted advertising effort aimed at discrediting Microsoft's DNT-active-by-default move, criticizing it for "unilaterally [imposing] choices on the consumer." ANA president and CEO Bob Liodice also warned in a statement that "Microsoft's decision undercuts the effectiveness of our brand owners' Internet advertising and undermines the industry's self-regulatory system."

Another Microsoft critic is the developer of Apache HTTP, Roy Fielding, who helped create the DNT standard. He proposed a patch for Apache, which runs nearly two-thirds of the world's websites, that would make Apache websites ignore IE10 DNT settings altogether, as a way to "deal with user agents that deliberately violate open standards" -- meaning Microsoft.

DNT was developed through the self-regulated Digital Advertising Alliance. Although some refer to it as a "standard," a more accurate description might be "negotiated truce," specifically between privacy advocates and advertising advocates. The White House has been pushing all concerned parties to implement some type of "do not track" principle, as part of the broader Consumer Privacy Bill of Rights introduced by the Obama administration earlier this year. But those proposals so far lack the force of law, and thus require advertisers to voluntarily agree to abide by them.

Time to patch your security policy to address people bringing their own mobile devices to work. Also in the new Holes In BYOD issue of Dark Reading: Metasploit creator HD Moore has five practical security tips for business travelers. (Free registration required.)