Browser Privacy Gets Renewed Attention from Google, Microsoft

An Incognito mode in Google Chrome lets users create a special tab in which no activities are recorded in the browser. “It’s a read-only mode,” says a page from a lengthy Web comic created by Google to explain Chrome. “You can still access your bookmarks. But none of your history is saved in the browser -- and when you close the window, the cookies from that session are wiped out.” The comic recalls Facebook’s Beacon ad platform and a highly-publicized episode in which a user’s wedding-ring purchase on a third-party site appeared in that user’s Facebook news feed, spoiling the surprise for the fiancee-to-be (WID Dec 6 p3). “Want to keep a surprise gift a secret?” the comic says, showing a wedding band on a site. “Just continue to browse normally in any other window.”

Google executives dashed hopes that Incognito might be more protective of privacy. Asked in a webcast demonstration Tuesday from the Googleplex if Incognito would keep Google from showing ads based on user searches, Sundar Pichai, vice president of product management, said the company is aiming only to keep people from clearing their browsing histories to keep their activities private on shared computers: “The Web still works the way it does,” he said. Chrome’s innovations largely rely on Web history, Pichai said. Google isn’t working on anything analogous to the Tor anonymous-browsing software, Pichai told another questioner. “We welcome innovations in user privacy” but Google doesn’t want to harm “user experience,” he said. “We will think about this carefully.”

A Google “privacy paper” on Chrome emphasizes the need to collect user browsing data to increase usefulness and safety. To fight malware, Google regularly downloads compressed lists of dangerous URLs to Chrome and, when a user visits a match, the browser sends a “distorted version of the URL” so Google can send the right warning without knowing exactly what URL it is. The “suggest” feature, disabled in Incognito, uses the default search provider -- not necessarily Google -- on a user’s computer to suggest Web addresses the user may intend to visit, the paper says. Incognito “can’t control what happens outside of your browser -- at your ISP, and on the Web sites that you visit,” the paper says, sidestepping the issue of Google’s 18-month retention of search data on its servers.

The Center for Democracy & Technology raised the matter of Chrome’s treatment of cookies with Google, Deputy Director Ari Schwartz told us. The group was told that existing cookies won’t be recognized when a user is in Incognito, and that the mode will erase all cookies set during the session when it ends, he said. Incognito largely mimics a similar privacy feature in Apple’s Safari browser -- but it’s only a half-measure compared with Microsoft’s Internet Explorer 8, which also allows users to block tracking of their browsing, Schwartz said. Mozilla’s Firefox browser, long supported by Google and for which Google pays for home-page placement, also has an extension that allows users to block tracking, he said.

The Electronic Privacy Information Center and the Center for Digital Democracy, both critics of Ask.com’s AskEraser, couldn’t be reached for comment. Nor could we reach House Telecom Subcommittee Chairman Ed Markey, D-Mass., sponsor of legislation that would require search engines to delete search queries with “obsolete data containing personal information” (WID Feb 10/06 p8).

Chrome distinguishes itself mainly via a “multi-process architecture” that keeps application processes “sandboxed” in their own tabs so they don’t slow or harm other processes in the browser, the company said. As a result, executed code that gets stuck on a page in one tab won’t cause the entire browser to freeze. It prevents malicious code in one tab from infecting the whole computer. A Google-built Javascript engine better handles resource-intense applications. Users can track which applications, including third-party plugins, are running in the browser and using the most resources, letting users shut them down to free up resources. Rumors of a Google browser, dating to 2005, led Google to consider the idea in 2006, co-founder Sergey Brin said at the demonstration. Chrome doesn’t signal the end of Google’s support, financial and otherwise, for Firefox, co-founder Larry Page said: Google wants a “healthy ecosystem of choices” for browsers that load pages quickly so Internet use keeps growing. Users largely are ignorant of browsers other than their default, Pichai said, so Google is adding its “voice” to get users to try more browsers.

IE 8: Subscribing to Block Lists

Microsoft goes a step beyond Google in letting Web users keep their browsing private in IE 8. InPrivate Browsing works like Incognito except that it can read existing cookies. InPrivate Blocking, though, automatically blocks tracking by third-party sites that have “seen” or tracked a user across more than 10 sites, Program Manager Andy Zeigler said on the Microsoft IEBlog. Users also can manually block sites from tracking them. InPrivate Subscriptions let users subscribe to lists of sites to block from tracking, maintained by others, for users who don’t want to make “granular” decisions on what to block, Zeigler said.

A Microsoft spokeswoman declined to tell us how concerns in Congress may have shaped IE 8’s new privacy features. Google similarly declined to explain who influenced its privacy settings. “Privacy advocates briefed to date have been supportive of providing users with choice and control,” the Microsoft spokeswoman said. “We are working with a limited number of stakeholders, including privacy advocates, ad syndicators, advertisers, publishers and others to preview the [InPrivate] feature and get their feedback as well.”

A spokesman for Ask.com said the company had made a “post-launch tweak” to AskEraser in early 2008 “to strengthen it and amplify its applications,” but otherwise hadn’t changed it. AskEraser remains the “first and only online privacy application in the industry that deletes searches from servers,” he said. “We believe strides to protect privacy in a browser setting is a good step forward, but we'd like to see the search marketplace make more strides to protect users’ privacy” for search engines as well.