Quantcast StorefrontBacktalk » Blog Archive » Judges, Senators Deciding Web Privacy Issues. Shoot Me Now
advertisement
advertisement

Judges, Senators Deciding Web Privacy Issues.
Shoot Me Now

Written by Evan Schuman
July 10th, 2008
Like this story? Share it
To share this story with people in your social network, please click on the network icons below.

Two recent developments—one involving a New York federal judge and the other involving a group of U.S. senators—are signaling serious difficulties for E-Commerce efforts over the next two years.

The federal judge case involved U.S. District Court Judge Louis L. Stanton of the Southern District of New York and his decision to order Google to surrender YouTube customer records to Viacom. The U.S. senator matter involved a hearing on Wednesday (July 9) where senators questioned Microsoft, Google and others about data privacy and what kind of laws the government should have.

In both cases, those federal employees are wading into areas with extraordinary implications.

Consider one of the judge’s arguments in ordering YouTube to surrender the data. "Defendants argue that the data should not be disclosed because of the users’ privacy concerns, saying that
‘Plaintiffs would likely be able to determine the viewing and video uploading habits of YouTube’s users based on the user’s login ID and the user’s IP address.’" But the judge rules against YouTube because he wasn’t clear how that data alone could reveal much.

The assumption of some anonymity on E-Commerce sites can be critical. Let’s look at a scenario for Amazon.com. One of its most critical value-adds is customer comments—both good and bad—about its products.

What if a consumer—employed in the consumer appliance world—purchased a toaster that was absolutely horrible? That consumer then wanted to warn other Amazon users of the terrible toaster. He does so, using a pseudonym. A week later, an attorney for the Terrible Toaster Company sues Amazon, demanding the name of all anonymous posters, along with their IP addresses and any other information.

Their purpose? To sue those consumers and to make an example of them so that people are scared to criticize their products.

StorefrontBacktalk.com itself has people commenting on our stories anonymously. At least one of those anonymous users is a well-known IT exec with a very large retailer. The identification of that person could hurt their career. What if some vendor wanted them identified to evaluate whether a lawsuit was warranted?

As social networking sites and E-tailers try and leverage Web capabilities and build more interactive relationships with customers, those customers need to trust that their information will be protected. These kinds of court decisions threaten far more than the judge likely realizes.

But for true nightmarish sweats, no group delivers like the U.S. Senate. The Washington Post story had an exchange that would be quite funny if the potential for damage wasn’t so sobering: "Sen. Bill Nelson (D-Fla.) asked a question about Internet connections so muddled that apparently no one understood. ‘I think I’m not entirely sure of what you are suggesting, senator,’ the witness answered. ‘Nor am I,’ Nelson said."

One of the bigger legitimate fears about retail (including E-tail) data collection is not what the merchants plan on doing as much as what cyber thieves, rivals, evil ex-spouses and other villains might do. Not to worry, of course. Retailers are experts at protecting data. *gulp*


advertisement

Leave a Reply

Newsletter

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.
advertisement

Most Recent Comments

Kill All The Passwords

This article does mention, but does not give enough attention to, the fact that the attacks discussed are only feasible when the encrypted password file can be copied and subjected to an offline attack. The trick is to have authentication performed on a separate, much more strongly secured host - such as an Active Directory Domain Controller, or a Kerberos server, or a NIS+ server, or even using something as banal as an LDAP-over-SSL authentication dialog. In these environments, the odds of the "password file" being stolen and subjected to an offline attack go to near zero, and only online attacks may be carried out by the attacker. With sensible exponential backoff between failed password attempts, lockout after a modest number of failed attempts on a single account, and pattern detection, that minimum 7 character password is quite secure enough. Passwords aren't dead yet for security purposes, and they will be with us for a very long while to come for practical purposes. The trick is to employ them correctly. Read more...
The possibilities you describe are years away from being implemented at best, so for the moment passwords are an ugly reality. Luckily, password managers can easily manage hundreds of passwords of any length. The only thing a user needs to remember is the master password. It seems like an easier task to educate users on how to use password managers rather than implement complex security technology on a global basis. Read more...