Personal Website of Yakov Shafranovich

« When “Photography Forbidden” Really Isn’t         SiteMeter Responds »

SiteMeter and Spyware (Sort of)

Tonight word comes from multiple blogs (here, here, here and here) that a popular free stats called SiteMeter made a deal with a third party marketing company called Specific Media to place tracking cookies on ALL sites that use SiteMeter. Sitemeter’s privacy policy makes no mention of this fact. Needless to say people are leaving the service in droves. I do not use this service on this site, but do use it on at least two other sites that I operate (TorahTexts.org and SocialPeople). I will be waiting a little bit before removing it in case they change their mind.

I took a look tonight at the Javascript that SiteMeter sends out and was able to confirm what others have been saying. Here is the relevant snippet:

var newIFrame = document.createElement("iframe");
newIFrame.frameBorder=0;
newIFrame.width = 0;
newIFrame.height = 0;
newIFrame.src="http://dg.specificclick.net/?u=" mce_src="http://dg.specificclick.net/?u=" +
escape(document.location) + "&r=" + SiteMeter.getReferral();
...
parentOfScript.insertBefore(newIFrame,scriptRef);


As you can see, this piece of code creates a hidden IFRAME that is sent over to the Specific Media servers. The server returns a set of tracking cookies back from the IFRAME request:

p3p: policyref=”http://www.specificmedia.com/w3c/p3p.xml”, CP=”NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA”

Set-Cookie: dmc=0tI-5mV2XP.-UizyToBLTyoWE.-UiyyToBLTyoWE.-UhaoNkzkkIskM.-UhYjpL9Z7uCCD.-UhY———-.-UhYjpL9Z7uCCD.-Ufoqnj95tRCzm.-Sa_eZYVjhqc3-; Domain=.specificclick.net; Expires=Mon, 31-Mar-2008 05:18:00 GMT; Path=/
dmk=0tI-5mV2XP.-Sa_blm17MIsM6Gh; Domain=.specificclick.net; Expires=Mon, 31-Mar-2008 05:18:00 GMT; Path=/
smc=0tI-5mV2XP.-UizyToBLTyoWE.-UiyyToBLTyoWE.-UhaoNkzkkIskM.-UhYjpL9Z7uCCD.-UhY———-.-UhYjpL9Z7uCCD.-Ufoqnj95tRCzm.-Sa_eZYVjhqc3-; Domain=.specificclick.net; Expires=Mon, 31-Mar-2008 05:18:00 GMT; Path=/
smk=0tI-5mV2XP.-Sa_blm17MIsM6Gh; Domain=.specificclick.net; Expires=Mon, 31-Mar-2008 05:18:00 GMT; Path=/

Content-Length: 0
Date: Sun, 01 Apr 2007 05:17:59 GMT
Server: Apache-Coyote/1.1

200 OK

Here is some information on what this specific cookie does: here, here and here. While this is not true spyware per se - there is not physical software installed, nevertheless it is a tracking cookie which is being installed without permission.

Additionally, what is glaring is lack of mention of this in the privacy policy. The FTC has been known to go after companies what violate their own privacy policies, so if I were SiteMeter, I would rectify this issue really fast.

Tags: privacy, security, sitemeter, spyware

Permalink | Trackback URL | This post has 3,748 Views