Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web :: Specific Sites :: bt1192.txt

Privacy leak in VeriSign's SiteFinder service


I just discovered that VeriSign's SiteFinder Web site is leaking data
submitted in Web forms to its marketing analysis partner, Omniture.
Forms can easily contain personal information such as an email address.
For the problem to occur, a Web form must use the GET method.  

This data spill problem occurs if a Web page anywhere on the Internet
submits a Web form to an action URL with a misspelled or expired domain
name.  Because of VeriSign's recent controversial changes to the DNS
system, this form data is submitted to the SiteFinder Web site. 

SiteFinder in turn passes the form data along to Omniture in the URL of
a Web bug.  The Web bug is constructed on the fly by about 50 lines of
JavaScript code embedded in the SiteFinder home page.

This data spill problem raises legal questions because of possible
violations of the VeriSign privacy policy and of the Electronic
Communications Privacy Act (ECPA).

As a point of comparison, it appears that Microsoft went out of their
way to not receive form data with their Smart Search feature.  In my
experiments, Smart Search is not enabled for Web form action URLs with
misspelled or expired domain names.  Instead, Internet Explorer gives a
generic 404 error page.

Here's an example form that illustrates the problem: 

   <form action="
   /cgi-bin/" method=get>
   <input type=hidden name=list value=horsebreeding>
   <input type=text name=email> 
   <input type=submit value="Subscribe">

And here's what the URL of Omniture Web bug looks like with an email
address from the form in it:

Some relevant links are:

   Data spills in banner ads

   SiteFinder privacy policy

   Omniture privacy policy

   Omniture company overview

   Electronic Communications Privacy Act

   Court draws a line for online privacy 

Richard M. Smith


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH