TCS - DoubleClick

DoubleClick

by Don Singleton
Tulsa Computer Society
From the April 2000 issue of the I/O Port Newsletter

Normally "cookies" are not a problem since only the site that wrote them can read them, and they can be very useful, because they can be used to let your own computer remember a logon id/password to a site you signed up for, or record the fact that you have already filled out a questionaire the site requires before it will grant you access to its services (like for example the Microsoft Knowledge Base and other Tech Support Services). But a company called DoubleClick has figured out a way to abuse cookies.

DoubleClick plants "cookies" on the computers of many Internet users. It has repeatedly stated that it couldn't link its "cookies" to your personal identity and didn't want to do so. But recently DoubleClick quietly entered into an arrangement to collect your name, address, and other personal information from Web sites where you knowingly register. So far at least ten Web sites are participating -- and are making a profit by providing DoubleClick your identity. Once in DoubleClick's hands, your personal identity can be linked to your "cookie" whenever you visit any of the 1,500 Web sites in the DoubleClick network, which includes such prominent online companies as Altavista and Mindspring.

Thus, DoubleClick, to whom you have never revealed your identity, now has access to your name, home address, online habits, purchases, even search terms. What they do with it, nobody knows.

http://www.cdt.org/action/doubleclick.shtml has information on this problem, and a link which will supposedly protect you from being tracked by DoubleClick cookies. It adds the following cookie ".doubleclick.net TRUE / FALSE 1920499222 id OPT_OUT" which is supposed to let you "opt out" of DoubleClick's tracing. I don't know for sure whether it works or not. According to this page, the following companies are among DoubleClick's users: A&E, AltaVista, AT&TAnyWho, CBS, CBS MarketWatch.com, Comics.com, Compuserve, Egghead.com, EssenceOnline, Freeserve, GTEInternet, infoUSA.com, Kozmo.com, McAfee, Multex.com, NBC, Network Solutions, PIIQ.com, Shockwave.com, Space.com, ThomsonInvestorsNetwork, Trip.com, and Virtualcountries.com who have not yet responded to messages about their use of DoubleClick.

Ask Jeeves, AuctionWatch, Billboard, Blue Mountain Arts, CarSmart, CBS SportsLine, Comedy Central, Food Network's, FoodTV, HealthCentral, Internet Movie Database, Intuit, Kelley Blue Book, MacNN, MindSpring, Enterprises, New York Times, Princeton Review, Smithsonian, Magazine, TechRepublic, Travelocity, Wall Street Journal, WebMD.com, and Yellowpages.com have responded, and their responses are on the site.

I sent messages to some of them. For example Blue Mountain Arts responded telling me "Thank you for your message. In our arrangement with Doubleclick they are specifically prohibited from setting cookies on our users computers." I wrote them back and asked "If what you say is true, that your "arrangement with Doubleclick they are specifically prohibited from setting cookies on our users computers" then what do they do for you other than read the cookies set when they are on other sites, and provide you information about other sites your users have visited? I must admire your being willing to admit it, but it appears that you have just said that you are one of the primary customers for their illicitly gathered information." They did not respond to that question.

For more information, see http://www.langa.com/newsletters/2000/feb-21-00.htm#2

Here is a list of opt-out links for DoubleClick and many other ad-tracking companies as well, printed in another issue of the LangaList. The URLs apparently came from an issue of PC Computing.

One example of how DoubleClick's efforts can create privacy concerns a design quirk in Intuit's mortgage calculator and credit-assessment feature was sending customer information regarding income, assets and debts, etc from one page to another on their site, but because they used DoubleClick, that information was sent to DoubleClick as well. They responded quickly to take care of the situation (http://www.zdnet.com/zdnn/stories/news/0,4586,2454429,00.html), to Intuit's credit, but it shows what could happen inadvertently. DoubleClick has said that it will delay its plans for adding people's names and addresses to its ad-tracking program until the government and industry agree on privacy standards (http://www.zdnet.com/zdnn/stories/news/0,4586,2454748,00.html?chkpt=zdnntop) but we definitely need to keep our eyes on them.

While we are talking about privacy concerns, I thought I should mention Aureate Media, who makes tracking software that's embedded inside many popular downloads and applications--- about 300 in all. I believe that this is the system that I reported reading about at an earlier Internet meeting, where some writer installed ZoneAlarm and discovered some ad program he did not realize was on his system was trying to send information about his system out to someone on the net.

Aureat Media claims (http://www.aureate.com/devs-n-pubs/how_we_target.html) that they don't send any information you don't authorize them to have.

LangaList reports on this topic (http://www.langa.com/newsletters/2000/mar-02-00.htm#4), including a reference to a web page (http://www.hardocp.com/news_images/2000/february_2000/aureatespying.html) which would tend to say this is a very dangerous thing.

It also references an article (http://news.cnet.com/news/0-1005-200-1558696.html?tag=st.ne.1002) discusses this and indicates it may not be quite as bad as some think, but as the LangaList article indicated, the software *does* seem to be either poorly designed or implemented, and since it is a part of a number of different software packages, it would seem possible that the authors of some products might be a little more agressive than Aureat Media planned in identifying information it wanted to know about your system.

I personally don't care for even the overt thing Aureat Media's product does. In the latest beta for Cool FTP, for example, the product is used to flash advertising in your face all of the time you are using their shareware product. I don't know whether that stops if you send them the registration fee, but I will never find out, because the amount of screen space taken by those ads makes the product so much harder for me to use than WS-FTP/LE that I just dumped CoolFtp and will use the light edition of WS-FTP.

To Aureat Media's credit, when installing CoolFTP I was told "This application is supported through the use of advertising. Advertising allows us to bring it to you at a reduced fee. By filling out the user profile, advertising you see is better suited to you as an individual. We do not collect any personally identifiable information (email, name, address, and phone) from you unless you provide it to us voluntarily. Please answer only those questions you feel comfortable answering. For more information about our Internet privacy policies, please visit: http://www.adsoftware.com. Feel free to distribute this software. We hope you enjoy it."

Some of the products that are reported to use Aureat Media, that I have either heard of, or which have names which I think might attract some of our members, are: 123Search, 3D-FTP, Add/Remove Plus!, Aureate SpamKiller, buddyPhone 2, CuteFTP 3.0, DigiCams - The WebCam Viewer, EasySeeker, Go!Zilla, MP3 Album Finder, MP3 Fiend, MP3 Grouppie, MP3 Mag-Net, MP3 Renamer, Mp3 Stream Recorder, MP3INFO-Editor, NotePads+, Personal Search Agent, QuoteWatch, WebCamVCR, WinEdit 2000, Word+, Wordwright, and Zip Express 2000

I do not know that these programs are dangerous, but I would be leary of installing them, especially if I did not have ZoneAlarm installed and operational on the computer.



For more information on the Tulsa Computer Society click here



This page has been accessed times.
Tulsa Computer Society 3/10/2000
Don Singleton, President
djs@ionet.net