
I'm a graduate student in law and computer science at Stanford University. Wherever information technology, public policy, and law intersect, I'm interested.
My research homes are the Security Lab, advised by John Mitchell, and the Center for Internet and Society. In my free time I build robots.
Setting the Record Straight on Google’s Safari Tracking
By Jonathan Mayer • February 21, 2012 at 4:00 pm
Our recent research on Google’s circumvention of the Safari cookie blocking feature has led to some confusion, in part owing to the company’s statement in response (reproduced in its entiretybelow). This post is an attempt to elucidate the central issues. As with the original writeup, I aim for a neutral viewpoint in the interest of establishing a common factual understanding. Read more » about Setting the Record Straight on Google’s Safari Tracking
Safari Trackers
By Jonathan Mayer • February 17, 2012 at 4:31 pm
Apple’s Safari web browser is configured to block third-party cookies by default. We identified four advertising companies that unexpectedly place trackable cookies in Safari. Google and Vibrant Media intentionally circumvent Safari’s privacy feature. Media Innovation Group and PointRoll serve scripts that appear to be derived from circumvention example code. Read more » about Safari Trackers
A Brief Overview of the Supplementary DAA Principles
By Jonathan Mayer • November 8, 2011 at 11:51 pm
Yesterday the Digital Advertising Alliance (DAA) announced a supplementary set of self-regulatory principles for third parties on the web (pdf, press release). This post is a brief — and far from comprehensive — overview of improvements, continued deficiencies, and procedural issues. Read more » about A Brief Overview of the Supplementary DAA Principles
Tracking the Trackers: Where Everybody Knows Your Username
By Jonathan Mayer • October 11, 2011 at 8:06 am
Click the local Home Depot ad and your email address gets handed to a dozen companies monitoring you. Your web browsing, past, present, and future, is now associated with your identity. Swap photos with friends on Photobucket and clue a couple dozen more into your username. Keep tabs on your favorite teams with Bleacher Report and you pass your full name to a dozen again. This isn't a 1984-esque scaremongering hypothetical. This is what's happening today.
[Update 10/11: Since several readers have asked – this study was funded exclusively by Stanford University and research grants to the Stanford Security Lab. It was not supported by any advocacy organization.] Read more » about Tracking the Trackers: Where Everybody Knows Your Username
Tracking the Trackers: Self-Help Tools
By Jonathan Mayer • September 13, 2011 at 4:35 am
A number of technologies have been touted to offer consumers control over third-party web tracking. This post reviews the tools that are available and presents empirical evidence on their effectiveness. Here are the key takeaways:
- Most desktop browsers currently do not support effective self-help tools. Mobile users are almost completely out of luck.
- Self-help tools vary substantially in performance.
- The most effective self-help tools block third-party advertising.
Following the usage model in the FTC staff's 2010 preliminary online privacy report, this post is oriented towards the user who wants a simple, persistent, comprehensive solution such that with high confidence no third party collects her browsing history. We assume that some third-party trackers will use non-cookie tracking methods including supercookies and fingerprinting (e.g. Microsoft, KISSmetrics, Epic Marketplace, BlueCava, Interclick, Quantcast).
Thanks to Jovanni Hernandez and Akshay Jagadeesh for assisting with data collection, and to Arvind Narayanan and Peter Eckersley for input on drafts.
{C} Read more » about Tracking the Trackers: Self-Help Tools
Pages
Third-Party Web Tracking: Policy and Technology
John Mitchell and I have written a new paper that synthesizes research on policy and technology issues surrounding third-party web tracking. It will appear at the IEEE Symposium on Security and Privacy in May. Read more » about Third-Party Web Tracking: Policy and Technology
Study Finds Sites Leak User Information
CIS Student Fellow Jonathan Mayer was mentioned in the following Stanford Daily article by Sandy Huang. The article covered a report authored by Mayer on privacy leaks that occur on highly visited websites.
Privacy leaks occur on 185 of the Internet’s top visited websites, according to a recent study by Stanford Law School’s Center for Internet and Society (CIS). The report was authored by Jonathan Mayer, a graduate student in computer science and at the School of Law. The report was released last Tuesday at a conference in Washington, D.C. hosted by the National Press Club. Read more » about Study Finds Sites Leak User Information
Third-Party Web Trackers and Consumer Privacy
Jonathan Mayer outlined tracking of Internet users by third-party Web trackers, focusing on a Stanford University study on the various ways people are tracked unknowingly online. After his speech he answered questions from the audience.
This program was part of a forum on Internet privacy co-sponsored by the American Civil Liberties Union, the Center for Digital Democracy, Consumer Action, Consumer Federation of America, Consumers Union, Consumer Watchdog, Electronic Privacy Information Center, Privacy Rights Clearinghouse, U.S. PIRG, and World Privacy Forum. Read more » about Third-Party Web Trackers and Consumer Privacy
Latest in Web Tracking: Stealthy 'Supercookies'
What new privacy features in Chrome, Firefox and IE9 really do
Could A Do Not Track List Become A Reality?
Student fellow Jonathan Mayer is the featured guest on a Martketplace radio broadcast covering the Do Not Track List option now available to web users. Here is a description and link to the interview:
The idea of a Do Not Track list for web users has been kicked around for a while. After the relative success of the Do Not Call telemarketing list, it seems like an easy and practical way for people to choose not to be tracked around the Internet by online advertisers. Read more » about Could A Do Not Track List Become A Reality?
Pages
Innovation or Exploitation? (Past Event)
Have you ever borrowed a smartphone without asking? Modified a URL? Scraped a website? Called an undocumented API? Congratulations: you might have violated federal law! A 1986 statute, the Computer Fraud and Abuse Act (CFAA), provides both civil and criminal remedies for mere "unauthorized" access to a computer. Read more » about Innovation or Exploitation?
Behavioral Advertising and Privacy Law Reboot - US and International Legal Trends and Best Practices for Internet, Cloud and E-Commerce Companies (Past Event)
Hosted by the Stanford Center for E-Commerce.
5:30 pm - 6:30 pm: Registration/Reception (Manning Faculty Lounge, second floor breezeway fo Stanford Law School) Read more » about Behavioral Advertising and Privacy Law Reboot - US and International Legal Trends and Best Practices for Internet, Cloud and E-Commerce Companies
Privacy Identity Innovation - pii2012 (Past Event)
The third edition of the Privacy Identity Innovation conference will be held in downtown Seattle this Spring. Taking place May 15-16 at the Bell Harbor International Conference Center, pii2012 Seattle will explore how to protect sensitive information while enabling new technologies and business models. Read more » about Privacy Identity Innovation - pii2012
IEEE Symposium on Security and Privacy: Web Security (Past Event)
Sponsored by the IEEE Computer Society Technical Committee on Security and Privacy in cooperation with the International Association for Cryptologic Research (IACR). Read more » about IEEE Symposium on Security and Privacy: Web Security
Conference on Web Privacy Measurement (WPM) (Past Event)
Jonathan Mayer, CIS Student Fellow, is co-chairing the Conference on Web Privacy Measurement.
This event is hosted by the Berkeley Center for Law and Technology.
More info about the event. Read more » about Conference on Web Privacy Measurement (WPM)
Pages
Innovation or Exploitation (Video)
February 21, 2013
Have you ever borrowed a smartphone without asking? Modified a URL? Scraped a website? Called an undocumented API? Congratulations: you might have violated federal law! A 1986 statute, the Computer Fraud and Abuse Act (CFAA), provides both civil and criminal remedies for mere "unauthorized" access to a computer. Read more » about Innovation or Exploitation (Video)
Innovation or Exploitation? (Audio)
February 21, 2013
Have you ever borrowed a smartphone without asking? Modified a URL? Scraped a website? Called an undocumented API? Congratulations: you might have violated federal law! A 1986 statute, the Computer Fraud and Abuse Act (CFAA), provides both civil and criminal remedies for mere "unauthorized" access to a computer. Read more » about Innovation or Exploitation? (Audio)