September 11, 2008

Google Chrome 'keylogger' found in IE8

Internet Explorer beta has search suggest tool

By Gregg Keizer, Computerworld US

---

Microsoft's Internet Explorer 8 (IE8) browser includes a keystroke-logging search suggestion tool similar to the one that Google modified earlier this week after coming under fire from consumers.

Unlike Google's Chrome, IE8 Beta 2 does not enable the feature - which some have compared to a keylogger - by default. One privacy expert said that was a "huge difference".

According to IE8's revised privacy statement, Microsoft's beta browser contains a new feature, dubbed ‘Suggested Sites', that sends the addresses of visited sites and other information to the company's servers.

Suggested Sites is similar to the ‘Google Suggest' tool in Google's Chrome browser, and is designed to recommend the most likely destination sites based on what the user types, the popularity of sites and Microsoft's own algorithm.

On Monday, Google reacted to criticism of the feature by promising it would render the data it collects anonymous within 24 hours.

By comparison, Microsoft's privacy statement does not spell out how long the Suggest Sites data is kept, and when, if at all, the company ‘anonymises' that data.

The company does, however, go into some detail about what it collects. "When Suggested Sites is turned on, the addresses of websites you visit are sent to Microsoft, together with some standard information from your computer such as IP address, browser type, regional and language settings," the privacy statement reads.

Other data that Search Sites collects includes the time that sites were visited, which site referred the user to the destination site and how long the user was at the destination site.

"This information, along with the website addresses and past history, will be used to personalise your experience, as well as improve the quality of our products and services," the statement continued. "Microsoft will not use any information collected to identify, contact or target advertising to you."

Alissa Cooper, the chief computer scientist at the Center for Democracy and Technology , expressed concerns about the IE8 suggestion tool, as she did yesterday about Google's Chrome.

"The things you type when you search for something are going back to the provider and can be quite revealing," she said, noting that most users understand that. "But [Chrome's] OmniBox and IE8's Suggested Search capture everything in one space, not only searches but all the Web sites that you would be typing into the box. So they'll know even more about you."

Microsoft does not enable the keystroke capture and logging tool by default - as does Google with Chrome. "That makes a huge difference," said Cooper. "Not many people go around tweaking their browser."

However, Microsoft does pitch the tool during IE8 Beta 2 setup. After installing the beta, users are shown a screen that asks "Do you want to discover websites you might like based on websites you've visited?"

The default response is ‘Yes, turn on Suggested Sites', but users can also select ‘No, don't turn on', before continuing the configuration process.

Users can also later disable Suggested Sites by clicking the Tools button in IE8 and clearing the check beside "Suggested Sites" in the drop-down menu.

"You can also delete individual entries from your history at any time," Microsoft's privacy statement reads. "Deleted entries will not be used to provide you suggestions for other websites, although they will be retained by Microsoft for a period of time to help improve our products and services."

"The thing that popped to mind is that, in terms of search logs, Microsoft deletes cross-session data, such as cookies and IP addresses, after 18 months," said Cooper. "I'd be curious if that's the same policy for IE."

Newsletters

Our Daily & Weekly Newsletters highlight breaking news, vital issues, expert analysis and solutions to help you stay ahead of developments in the industry.