Peter Sinclair: Software lights up dark side

By PETER SINCLAIR

Earlier this year I turned the spotlight on those who would rather remain in shadow - the secret watchers of the net who go to extraordinary lengths to find out all about you and track your footprints through cyberspace.

You will find Spyware archived on our website.

Aggregated, where each of us goes and what we do when we get there is worth millions of marketing dollars.

Even the most upright cybercitizens have been tempted over to the dark side until hauled into the light by someone like Steve Gibson.

Gibson was the man who brought into the open Aureate, [rechristened Radiate] whose sticky software, secreted in dozens of downloaders like GetRight and Net Vampire, acted more like a Trojan horse than a utility, continuously monitoring users' surfing habits and secretly phoning home.

He designed an effective free internet spyware detection and removal utility, OptOut, which I sent to a number of readers.

Now, four months later, it looks as though he has sprung an even bigger Nosy Parker - RealNetworks - and I've already heard from a number of readers alarmed about the online home surveillance ("someone ... going through my most personal possessions/thoughts," wrote Andrew J). Well, it alarms me, too.

In "The Anatomy of File-Download Spyware" Steve details how he was able to prove that the new RealDownload, derived from NetZip's Download Demon and one of Real Entertainment Centre's three flagship products, immediately transmits the file's URL (universal resource locator - aka web address), together with a GUID [globally unique identifier] assigned to your computer and its IP (internet protocol) address, back to base under a default setting.

Did RealNetworks say sorry? Hardly. They stoutly denied it and dived behind a lawyer's letter.

So Steve proved it again until Real owned up, saying they hadn't realised, anyway they certainly wouldn't use the information.

Odd, because a sentence in the original NetZip licence reads: "No unique identifier or any personally identifiable information is sent with this information."

This was not true; it must have dawned on RealNetworks, after the acquisition, that NetZip had been misleading 14 million users.

Did Real, therefore, remove the identifier? No, it simply removed the sentence.

And if Real is bad, Netscape is worse. Netscape's SmartDownload utility is also NetZip in drag, and the privacy of NetCenter members is especially threatened because [along with everything else] they also have their NetCenter logon ID and personal e-mail address sent with each file-download report.

"Download With Confidence Using SmartDownload!" Well, no.

Those of you who have downloaded only the complete text of Mother Goose have little to fear. But it's the principle of the thing.

For almost everyone these days, not just Netscape or webvertising giant DoubleClick, is keen on the kind of cookie which tags and tracks you.

"Web-bugs" are being used to alert companies when their e-mail is opened, or embedded in websites to let some outfit like Engage know where you have been and where you are headed.

Engage has sprinted for the moral high ground with a new privacy standard - TrustLabels - which recommends that cookies come with a digitally signed label outlining how the tracking information will be used. Browsers could specify the kind of cookies users will accept.

And Microsoft promises that future versions of IE5.5 will warn users when websites plant cookies on them, as Opera has always done.

Until then, you might want to check out Privacy Companion from www.idcide.com - or, at the very least, get on Steve Gibson's mailing-list.

BOOKMARKS

MOST NEWSWORTHY: Online Newspapers

10,000 newspapers, sorted by country in a drop-down menu-bank - the most comprehensive news-resource I've seen on the web.

If you've ever wanted to consult the Mongol Messenger now's your chance, though I'm bound to say servers seem somewhat sluggish in Ulan Bator. New Zealand is represented by 14 organs of opinion, including the Herald.

Advisory: All the news that's fit to print, and then some.

EERIEST: Last-Minute Search

Similar to the above, involving search-engines rather than papers.

Use the drop-down list to select local engines from over 130 countries. Includes a link to a user-friendly new dialogue-based engine, Subjex [www.subjex.com], which incorporates an unusual real-time service: WebHelp, "a hyper-portal designed to offer research assistance to web-surfers day or night with Real People, with Real Answers, in Real-Time." I got someone called Murphy - or something.

"Are you a bot?" I asked impolitely. "I am a real person," droned Murphy after long thought, during which I was bombarded with ads.

He/it was only moderately helpful finding information on epiphyllums, an obscure sort of cactus, and our relationship came to an end.

Murphy: "Thank you, Peter, for using Webhelp.com. Our engagement will now be closed. A summary of our engagement as well as the websites I have sent will be e-mailed to you after we terminate the session." Click.

Advisory: If he wasn't a bot, then he certainly wasn't someone you want to be stuck in a lift with.

LINKS

Peter Sinclair: Spyware

Steve Gibson

radiate

GetRight

NetVampire

OptOut

RealNetworks

Anatomy of File-Download Spyware

NetZip's Download Demon

RealNetworks Legal

Netscape's SmartDownload

DoubleClick

Engage

Opera

www.idcide.com

Online Newspapers

Mongol Messenger

Subjex

Last-minute Search

E-mail: petersinclair@email.com