Princeton Web Policy

Machine learning just on text message metadata can probably be surprisingly accurate on classifying relationships and situations like friend, lover, employee, breakup, drug dealer, prostitute. Compare https://www.theguardian.com/technology/2014/mar/13/phone-call-metadata… which included some manual analysis and use of telephone directories and some automated analysis. (Their data set was tiny and derived from opt-in contributions.) http://webpolicy.org/2014/03/12/metaphone-the-sensitivity-of-telephone… I'm still hoping to see, and maybe help bring about, better technical and legal protections for communications in my lifetime, or at least better technical protections.

In one of the major announcements for Chrome, 'Moving towards a more secure web' (2016-09-08) [1], the Chrome Security Team writes: "Chrome currently indicates HTTP connections with a neutral indicator. This doesn't reflect the true lack of security for HTTP connections. When you load a website over HTTP, someone else on the network can look at or modify the site before it gets to you." The word 'modify' is a hyperlink to an article titled 'AT&T Hotspots: Now with Advertising Injection' [2] (ironically, a non-HTTPS site). [1] https://security.googleblog.com/2016/09/moving-towards-more-secure-web… [2] http://webpolicy.org/2015/08/25/att-hotspots-now-with-advertising-inje…

original: http://webpolicy.org/2015/08/25/att-hotspots-now-with-advertising-inje…

Wow, this is a totally uncredited ripoff of some analysis by Stanford Law's Jonathan Mayer. The image is essentially a remake of one he put together. In favor of changing the link. http://webpolicy.org/2015/06/04/nsa-cybersecurity/

Huh, apparently it was the same Stanford grad student who busted Google for the Safari cookies and Verizon for the respawning cookies. Kinda cool. http://webpolicy.org/2012/02/17/safari-trackers/ http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/

Discussion for the original researcher's post: https://news.ycombinator.com/item?id=8889224 http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/

Glad there are people like Jonathan that take the time to do things like dump federal/state caselaw and related materials: http://webpolicy.org/2013/12/29/advancing-empirical-legal-scholarship-… http://webpolicy.org/2013/05/03/advancing-empirical-legal-scholarship-… http://webpolicy.org/2013/08/09/advancing-empirical-legal-scholarship-… Also, he had an interesting start to Coursera's security: http://webpolicy.org/2014/09/04/a-funny-thing-happened-on-the-way-to-c…

The reporting on our work has been of mixed quality. Check out our actual blog-post here: http://webpolicy.org/2013/12/23/metaphone-the-nsas-got-your-number/?ut… for more accurate details. We used data collected from voluntary users' phone logs as our phone number data set. This means that if Joe called number X a few weeks ago and then decided to participate in our study, number X was in our database. We then used a couple techniques too see how well we could identify who number X belonged to. We didn't put together actual profiles of users, though that is a possible next step. However, I think it is clear that putting together profiles of users is possible given how easy it is to identify who you are calling and receiving calls from.

Hopefully Firefox will have a way to let the user enable the few places where third party cookies are desired They do. The title of the bug is "Block cookies from sites I haven't visited" and the blog post[1] explains that any site with 1st party cookies can set 3rd party cookies on other sites. Apparently this is how Safari works too. [1]http://webpolicy.org/2013/02/22/the-new-firefox-cookie-policy/

Safari already blocks most third-party cookies, yet Google Analytics works in Safari. An explanation of how GA pulls it off can be found here: http://webpolicy.org/2012/02/17/safari-trackers/

> The proper course of action in this case is to use your 4G/5G connection and not to connect to shady networks you don't trust. Sadly, there are carriers on this planet who think it's a good idea to charge ridiculous prices for mobile data (Germany) or to block hotspot functionality unless you pay up (US, see [1] for the technical background - both Apple and Google are complicit). In a world where politicians would care about their people, there would be no need for wifi hotspots to exist in the first place. Additionally, there are certain advertising brokers such as utiq that cooperate with major phone networks to provide detailed tracking, so they and advertisers know pretty precisely who you are just because you tethered your laptop to your phone. And finally, you can't trust your phone ISP either - Verizon got caught red-handed injecting tracking "supercookies" into their customers' traffic [2], thank God at least that vector got closed with everyone and their dog going HTTPS. In general: anything involving residential ISPs is rife with scams. [1] https://news.ycombinator.com/item?id=20460438 [2] http://webpolicy.org/2014/10/24/how-verizons-advertising-header-works/

quantcast was sued for resuscitating browser cookies when flash LSOs persisted [1], ie taking the cookie value from the LSO and recookie-ing the browser. quantcast and clearspring settled for $2.5m [2]. The crux of the matter seemed to be that users didn't know such data was in flash cookies or associated with quantcast, making it hard to opt-out, though I'm not sure if this is illegal; and violated quantcast and the 3rd party sites' privacy agreements, which appears to be illegal. A lawsuit outline for one plaintiff is here [3] and the full text of the initial filing here [4]. I naively assume there is a clear parallel to this case, though perhaps verizon and turn have thoroughly privacy policied their way out, somewhere in 30 pages of legalese. According to Jonathan Mayer, Commercial supercookies, fingerprinting, and zombie cookies are tolerated (if not permitted) under current United States law. [...] Any associated consumer deception, however, is a violation of the Federal Trade Commission Act and parallel state statutes. [5] [1] http://www.wired.com/2010/07/zombie-cookies-lawsuit/ [2] http://www.lexology.com/library/detail.aspx?g=bc3a4358-6692-4c82-94b5-… [3] https://www.privaworks.com/Details/AlertReference/PrintPreview.aspx?gu… [4] http://www.wired.com/images_blogs/threatlevel/2010/07/CV10-5484-GW-JCG… [5]…

Google deserves plenty of credit for Scholar. It's the best public legal research system out there. Let's not pretend, though, that Google Scholar has "set free" court opinions or offers "open access." You're trapped in Google's ecosystem. You can't download opinions in bulk for any reason, whether it's legal practice or academic analysis. You certainly can't build your own legal research system. The best "open access" resource I've found, oddly enough, is bulk XML from a Stanford grad student. It includes over 10 million documents in a fairly standard format. http://webpolicy.org/2012/12/28/advancing-empirical-legal-scholarship/ http://webpolicy.org/2013/12/29/advancing-empirical-legal-scholarship-… http://webpolicy.org/2013/05/03/advancing-empirical-legal-scholarship-… Also, it appears to be replicated on Carl Malamud's public.resource.org. https://law.resource.org/pub/us/case/federal/ https://law.resource.org/pub/us/case/state/