P3P

» see w3.org/P3P as it lived, on the wayback machine

~ the last words ~

The Privacy tab inside Internet Options had a slider with six stops on it, running from accepting every cookie to blocking all of them. I had that dialog open plenty of times in the Internet Explorer years and never moved the slider once, which is close to the whole story of this standard. The default position in the middle was doing something all the same. It was reading a machine-readable privacy statement off every site that tried to set a third-party cookie, and deciding on that basis. The thing it was reading was P3P.

The Platform for Privacy Preferences started at the W3C in 1997 and became a Recommendation on 16 April 2002. A site published an XML policy at a known path saying what it collected and what it did with it. Alongside that came the compact policy, a short token of three-letter codes stuffed into an HTTP header so a browser could make a cookie decision without fetching a second file. Your browser held your preferences and the site declared its practices, and the two were compared without anybody reading a word.

Microsoft shipped the only implementation that mattered. Internet Explorer 6 arrived in 2001 and used compact policies at its default privacy setting to decide whether to accept third-party cookies at all, which meant that anybody running an ad network, an analytics script or an embedded widget had to emit a P3P header or watch their cookies get dropped on most of the web. That requirement is the reason P3P was deployed anywhere. Mozilla had written P3P support and pulled all of the code out again by 2007. Safari and Chrome never had any.

~ pretty poor privacy ~

The objections predate the standard. In June 2000, two years before the Recommendation, the Electronic Privacy Information Center published a report with Junkbusters called "Pretty Poor Privacy: An Assessment of P3P and Internet Privacy". It argued that the protocol failed baseline privacy standards outright and was complex enough to make protecting yourself harder rather than easier. An earlier design had already been withdrawn once because the negotiation it demanded was too much to ask of a user, and nothing in the surviving one checked whether a promise was true. What the report recommended instead was building on fair information practices and collecting less data at the start.

~ the record ~

~ the string that was not a policy ~

On 20 February 2012 Dean Hachamovitch, who ran Internet Explorer, posted a question on the IE blog about whether Google was circumventing the privacy preferences of IE users, and then answered it himself. Google's compact policy was not a policy. Where the codes should have been, the string said that this was not a P3P policy and gave a link to a page explaining why. The specification told browsers to ignore tokens they could not parse, so IE ignored it and took the cookie.

Google's head of policy, Rachel Whetstone, replied that it was impractical to comply with Microsoft's requirement while delivering modern web features, and pointed out that the IE behavior broke Facebook Like buttons and signing in to a site with a Google account. She was not wrong about the breakage. Facebook was running a similar workaround. Research out of Carnegie Mellon had already found thousands of sites publishing policies that misstated what they did, some of them by mistake and some of them not.

What the episode exposed was the hole in the design. P3P gathered declarations and had no step anywhere in it for verifying one. The browser was built to trust a sentence written by the party with the most to gain from writing it loosely, and the only enforcement available was a regulator reading the policy afterward and calling it a misrepresentation, which is what the US Federal Trade Commission eventually did to Google over the Safari side of the same story.

~ obsoleted ~

Microsoft removed the feature from its own browsers on Windows 10, so Internet Explorer 11 and the original Edge both shipped with P3P support stripped out. That left the standard with no implementation anywhere, while a long tail of ad servers went on emitting the headers out of habit.

On 30 August 2018 the W3C stamped a banner over the Recommendation: "This specification is obsolete and should no longer be used as a basis for implementation." The note underneath records that fewer than six percent of the ten thousand most visited sites supported it and that no current user agent interpreted a P3P policy. Three months earlier the General Data Protection Regulation had come into force across the European Union, carrying fines up to four percent of global turnover. The compliance problem P3P had tried to solve with a header got solved with a law instead.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »