Online privacy, Tracking, and IE8?s InPrivate Filtering

August 2, 2010

Online privacy and tracking have been in several news articles and public hearings lately. The recent attention has been on how visiting one site shares information with many sites, and how those sites can then share the information and effectively &lsquotrack&rsquo your activity on the web. The articles certainly show the complexity of the topic. This blog post offers some context on online safety and privacy and specific information about InPrivate Filtering, a feature in IE8 designed to help protect users from some tracking scenarios, as well as several other features IE8 offers users to help protect their privacy online.

Part of what makes online privacy tricky is that browsing the web is fundamentally an information exchange. Your web browser offers information in order to get information. That information can identify you. Often, that information is sent automatically for your convenience (like the languages you prefer to read) to tailor the content for you.

Because some of the technologies that can be used for tracking are also essential today for basic functionality, there is no &ldquoJust give me perfect privacy&rdquo feature. The way different tracking and anti-tracking technologies interact can read like a Spy vs. Spy comic strip. Distinguishing between a tracking technology (a beacon) and a useful piece of web content (a stock chart used as a beacon) is not obvious. Some people are concerned about Adobe Flash&rsquos &ldquosuper cookies&rdquo IE8&rsquos InPrivate browsing clears these as well with newer versions of Flash. As another example, InPrivate Browsing in IE8 &ldquoclears your tracks&rdquo and removes information from browser history when you close IE. During the actual browsing session, before you close it, IE still records history (so the back button continues to work) and cookies (so that logins and shopping carts continue to work). Ultimately, people want the web to work and privacy protection.

We designed InPrivate Filtering to help users control who can get information about their browsing. IE enables users to choose how privately they want to browse. Users are in control of several privacy protection features in IE, and how automatically they function. Specifically, users can keep browsing information from going to sites they don&rsquot actually visit directly. IE determines the potential tracking sites on the list based on the sites you browse to directly and how those sites were written. Different sites on the web have articles about more advanced features, like always browsing with InPrivate Filtering on, and importing and exporting InPrivate Filtering lists.

People who are concerned with tracking may be interested in how to use InPrivate Filtering in IE. (People interested in how it works can read more here and here.)

1. From the Safety menu, choose &ldquoInPrivate Filtering.&rdquo

2. Choose &ldquoBlock for me&rdquo to turn on automatic filtering.

Alternatively, you can choose &ldquoInPrivate Filtering Settings&rdquo from the Safety menu at any time to see a list of sites that are in position to track your browsing based on the sites you browse to in IE. You can find more detailed instructions in several places around the web with some basic web searches.

The sheer complexity of privacy and online safety spans many disciplines. We&rsquove posted here about different aspects of web browsing safety. Bad things can happen to good people on the web in many ways. Internet Explorer includes protections for many different kinds of threats people face on the web. People often focus on malicious sites that exploit unpatched security issues in different devices and software. (Microsoft regularly releases updates please turn on automatic updating if you haven&rsquot already.) Sites host seemingly good downloads (&ldquoFree Emoticons! Puppy screensaver!&rdquo) that are actually malicious, or attempt to lure people to visit them users often download them and run them anyway. Otherwise &ldquogood&rdquo sites unintentionally host malicious content. Phishing sites pretend to be one site (perhaps your bank) but are actually malicious in their use of information. IE&rsquos SmartScreen has protected users over a billion times by blocking these kinds of attacks. Protecting children online is another set of challenges entirely. Some kinds of trust violations that are lower in severity go unhindered. Browser add-ons can leak information across sites, even though add-on developers can prevent it. Protecting a user&rsquos online privacy is just as important to Microsoft as protecting the user from malicious sites.

The web today has lots of great innovation. Unfortunately, threats to online safety and privacy also see rapid innovation. The communities working together to combat online safety issues span the technology industry, financial and commercial institutions, academia, government, and law enforcement agencies.

Dean Hachamovitch

List of articles referenced

Adobe Flash Now Supports InPrivate Browsing - IEBlog - Site Home - MSDN Blogs

Browser Information

Even without cookies, a browser leaves a trail of crumbs

Hearings - U.S. Senate Committee on Commerce, Science, & Transportation

How a browser extension leaks Google history to Amazon | CNET to the Rescue - CNET Blogs

How to Start Internet Explorer 8 in InPrivate Browsing Mode by Default - The Winhelponline Blog

HTTP/1.1: Header Field Definitions

IE June Security Update Now Available - IEBlog - Site Home - MSDN Blogs

IE8 and Privacy - IEBlog - Site Home - MSDN Blogs

IE8 and Trustworthy Browsing - IEBlog - Site Home - MSDN Blogs