Talk:Summit 2011 Working Sessions/Session073
Thank you for attending! This page is for the session participants to add their ideas and comments.
Please also take a look at the FTC response http://www.owasp.org/index.php/Industry:FTC_Protecting_Consumer_Privacy completed with your help.
- 1 Accomplishments
- 2 Ideas...
- 2.1 Government legislation & policies
- 2.2 Issues
- 2.3 Privacy vulnerabilities
- 2.4 Technical approaches
- 2.5 Tools, Add-ons, Projects to Detect & Protect Privacy
- 2.6 Micro survey
- 3 External Links
I was asked to provide the top 3 accomplishments from our session to the summit team. I have suggested:
1) A recognition that OWASP MUST (not should) be active in this space
2) Direct input into OWASP's response to the FTC staff report on consumer privacy
3) A consensus to try to document the drivers, issues, resources and relevant technical approaches
Some suggested headings, but please feel free to add more:
Government legislation & policies
- EU Directives
- Netherlands Wet bescherming persoonsgegevens (Wbp)
Primary data protection authorities:
- Fair processing
- Acceptable use/specified purpose
- Avoid collecting excessive information
- Data accuracy
- Data retention period enforcement (& disposal)
- Protection of data
- Transfers (inter department, company, country)
- Tracking consent and withdrawal of consent
- Provision of consent
- Collection and storage of PII (personally identifiable information)
- User tracking
- User profiling
- Build up user profiles used e.g. for retargetted / behavioral advertising
- Identify users based on e.g. IP address, browser type and version, add-ons,... based on fingerprinting
- Privacy vulnerability detection on server side
- Privacy vulnerability detection on client side
- Client side patterns implying privacy vulnerability e.g.
- 3rd party links (typically trackers)
- 3rd party cookies
- invisible images / web bugs
- behavioral tracking patterns
- Client side patterns implying privacy vulnerability e.g.
Tools, Add-ons, Projects to Detect & Protect Privacy
Please note OWASP Foundation does not endorse or recommend commercial products or services. The tools, add-ons, etc here are simply listed to help identify technical approaches.
Data privacy is not only a client-side issue, but may also be a server-side issue. For example storing data in cloud services, where the data needs to be protected somehow. So we distinguish protection and detection tools in four areas for now:
1. Client-side Tools
On the client we have three categories of tools:
- Add-ons in the browser
- Standalone tools based on the underlaying OS
Add-ons in the browser
|Chromeblock||Protect your privacy by stopping secret tracking of your web browsing.
ChromeBlock automatically blocks 100's of web beacons, bugs, and other tracking technologies that advertisers and others use to track your browsing.
|Disconnect||Stop third parties and search engines from tracking the webpages you go to and searches you do.|||
|Forget Me||Delete everything about a website. Cookies, History, localStorage, sessionStorage...everything!|||
|Abine TACO||Abine TACO sets all the NAI opt-out cookies to stop advertisers from delivering content based on their attempts to profile you and your online behavior. At each website you visit TACO can show you how many and which advertising networks you've opted-out of.|||
|Keep More Opt-Outs||Permanently opts your browser out of online ad personalization via cookies for over 150 tracking companie.
This extension is based on Google's "Keep My Opt Outs" extension.
This extension provides more complete coverage by including opt-out cookies from over 150 tracking companies, based on the PrivacyChoice Tracker Index.
|Keep My Opt-Outs||Permanently opts your browser out of online ad personalization via cookies.|||
|SelectOut Cookie Monitor||Introducing the new Google Chrome extension for SelectOut. This extension allows you to control your online tracking cookie by Opting-Out and In to the companies you choose, Opt-Out of all if you don't want to have to research them all, and even gives you the option of viewing profiles on each of the companies.|||
|Vanilla||A Cookie Whitelist Manager that helps protect your privacy. Automatically removes unwanted cookies.|||
|Window Name Eraser||An extension preventing user-tracking methods (e.g. evercookie) from transmitting data through the window.name property.|||
|Template:List needs attributes for: usablity, funtionality, active/passive protection, ...|
|AddBlock Plus popup|
|Cookie Whitelist With Buttons|
|HTTP Request String Editor||Control of the HTTP Request the browser sents to the servers. Set up rules for a page with Regular expression to modify headers.|||
|TACO - Targeted Advertisong Cookie Opt-Out|
- Ghostery plug-in
- Available for Firefox, Chrome, Safari, Internet Explorer
Scans the page for scripts, pixels, and other elements and notifies the user of the companies whose code is present on the page. These page elements aren't otherwise visible to the user, and often not detailed in the page source code. Ghostery allows users to learn more about these companies and their practices, and block the page elements from loading if the user chooses.
Ghostery is owned by Evidon (formerly "Better Advertising": http://www.evidon.com/solutions/overview.php
"Selected by the Digital Advertising Alliance (DAA) to power its online behavioral advertising Self-Regulatory Program"
- Dashboard Firefox extension
- Developed by the research project !PrimeLife funded by the European Commission’s 7th Framework Programme.
- Download: http://www.primelife.eu/results/opensource/76-dashboard
- Alpha release: tracks what information is collected by the visited websites. Allows to set preferences on a site by site basis.
- Note: Currently maintained by W3.org, full description expected by March 2011.
- observe HTTP Requests ans Responses while loading the web page
- log collected HTTP traffic in a SQLite database"dashboard.sqlite" in the browser's profile folder
- access additional databases maintained by the browser and the folders containing the LSOs
- cancel HTTP requests e.g. for third party content based on user's preference for a given web site
- user settable site preferences, e.g. to block 3rd party cookies or content, to disable scripting,...
- Detected privacy patterns e.g.
- internal third party content
- external third party content
- invisible images (based on the image dimension / hidden by CSS)
- User Interface
- adds smiley icon to the browser's navigation toolbar to reflect a measure of the privacy friendliness of the current web page
- click on the face to view privacy details
A proxy can either be one on a intermediate server such as a company gateway, or a proxy installed on the client system itself. In both cases the browser needs to be configured to use that proxy. As it is no difference from the browser's view, we do not destingush these proxy types.
- The drawback when using a proxy is that SSL/TLS (https) is either not supported (i.e. privoxy, 2011), or the trust chain is broken and the browser indicates that with a proper message and a broken "lock" icon.
2. Server-side Tools
- appexchange2 
- Mozilla Firefox 4 Beta
- "Do Not Track" Option - Privacy Feature
- You can check a “Do Not Track” box in the “Advanced” screen of Firefox’s Options. When this option is selected, a header will be sent signaling to websites that you wish to opt-out of online behavioral tracking. You will not notice any difference in your browsing experience until sites and advertisers start responding to the header.
Note: Also available for Google Chrome: http://google-chrome-browser.com/tags/do-not-track
CW created a micro survey on paper called A Few Questions, to try to gather a few  views from other quarters in OWASP [2 participants from the working session, and 8 other leaders], as to the relevance of "personal data protection" within OWASP's mission. The questions (and anonymous answers) were:
Q1: Can OWASP contribute to PCI-DSS compliance initiatives?
Yes of course - we already have by reference to the Top 10.
Yes, we have done so, but to my knowledge we have allowed our relationship with PCI to languish.
Unsure, as I'm not fully used to PCI-DSS, but guess 'yes'.
Yes in terms of providing knowledge, training and resources to QSAs. We [OWASP] could also provide info focused on companies who are going to be assessed.
Q2: Can OWASP contribute to fraud detection and prevention?
Yes it would be included in our mission/purpose.
Yes, ***, *** and I were discussing some potential solutions to this.
Yes, it should at least 'list' possible threats.
AppSensor seems to be quite useful here.
Q3: Are there application vulnerabilities that can contribute to successful fraud?
Yes of course.
At the risk of being glib, most successful exploitations of vulnerabilities lead to some sort of fraud.
Injection flaws, possibly XSS if client credentials can be compromised, session weaknesses, SSL issues.
Q4: Can OWASP contribute to the protection of personal data?
A4: (if 'no', skip Q5 and Q6 to end)
Yes, anytime our efforts close a vulnerability, we contribute.
If OWASP wants to start talking at that issue, yes.
Q5: Are there application security vulnerabilities that can contribute to attacks against personal data?
A5: (if 'no', skip to end)
Yes, I'm hard pressed to think of one that doesn't have the potential.
Yes (for example inclusion of 3rd party code/scripts).
Injection, XSS, session flows, SSL issues.
Q6: Are there vulnerabilities in the realms of personal data protection - consent, accuracy, fair use & retention (ie not just protection of data in use/at rest) - that OWASP can help with?
Yes, at least OWASP should in the future.
Possibly to a lesser degree - seems more like the legal realm than technical.
Certainly, but I'm not in a position to identify any that aren't already a focus of the organization [OWASP].
Accuracy and use seem to be in the relam of privacy. If OWASP works in this area, we could rewach end users much more significantly.
End: Please supply any other comments here, or overleaf
[For] all questions, I answered yes, but it would need details how to achieve it.
I am working to enable ASVS as a government recommendation to verify the implementation of adequate protection of PII.