Web Site Privacy with P3P

Helena Lindskog, Stefan Lindskog9780471216773, 0471216771

As part of our continuing strategy to build a complete shelf of technical security books for IT professionals, we are publishing this first book on an important new web site privacy standard, P3P. The World Wide Web Consortium (W3C) has just approved the standard. This book will provide detailed descriptions of the P3P stan-dard and its parameters followed by guidelines, explanations, and P3P how-to examples for system architects to follow. A full XML tutorial appendix is provided as all web sites that use P3P encode their privacy policies in XML format.

---

Table of contents :
Web Site Privacy with P3P®……Page 5
Copyright……Page 6
CONTENTS……Page 9
ACKNOWLEDGMENTS……Page 15
Privacy Awareness……Page 17
The Right to Be Left Alone……Page 20
Means for Privacy……Page 21
Anonymization……Page 22
Pseudonymity……Page 23
Unlinkability……Page 24
Unobservability……Page 25
The Origin Server Perspective……Page 26
When the Origin Server Meets the Privacy- Aware User……Page 27
Platform for Privacy Preferences……Page 29
What¡¯s Ahead……Page 30
Terminology and Definitions……Page 33
Vulnerabilities……Page 34
Threats……Page 36
Protection Mechanisms……Page 37
Access Control……Page 38
Usage of Cryptographic Systems……Page 39
Firewalls……Page 42
Anti- Malware Software……Page 43
Additional Reading……Page 44
An Introduction to the Internet and the Web……Page 47
An Historic Introduction to the Internet……Page 48
An Introduction to the Web……Page 49
The Traditional Web Architecture……Page 50
Proxies and Such……Page 52
Auditing……Page 54
The Mobile Internet……Page 55
Summary……Page 56
Log Files and Customer Databases……Page 57
Cookies……Page 59
Web Bugs……Page 60
Information Distribution……Page 61
Tracking……Page 62
Data Alteration……Page 64
Cookie Filtering……Page 66
Anonymization……Page 67
Identities……Page 68
Privacy in a Mobile Internet……Page 69
Summary……Page 70
P3P and Legislation……Page 71
Retrieve the P3P Policy File……Page 73
Administration Tools……Page 75
“Remember This Decision”……Page 76
Perform the Agreement……Page 77
The P3P Agreement……Page 78
Summary……Page 83
Lawfulness and Processing……Page 85
Purpose Specification……Page 86
Necessity Principle……Page 87
Right to Correction……Page 88
Retention……Page 89
Security……Page 90
Checklist……Page 91
Summary……Page 92
Step 1 ¡ª Create a Written Privacy Policy for the Site……Page 93
Step 2 ¡ª Decide Which Policies Apply to Which Pages……Page 94
Step 3 ¡ª Create P3P Policies……Page 95
Step 4 ¡ª Create a P3P Policy Reference File……Page 98
Step 5 ¡ª Validate the Policies……Page 99
Additional Reading……Page 100
Information in an Online Privacy Policy……Page 101
What Type of Personal Data Is Collected?……Page 102
Why Is Personal Data Collected?……Page 103
Is the Collected Personal Data Redistributed or Shared with Other Organizations?……Page 104
How Is Collected Personal Data Protected?……Page 105
Summary……Page 106
Create a Reference File……Page 107
Create the Surrounding Tags……Page 110
Access Information……Page 111
Disputes……Page 113
Statements……Page 115
The DATA-GROUP……Page 116
The NONIDENTIFIABLE Tag……Page 125
The PURPOSE Tag……Page 126
The RECIPIENT Tag……Page 130
The RETENTION Tag……Page 132
P3P and Multiple- Language Support……Page 133
The Legal Perspective on Policies……Page 135
Additional Reading……Page 136
Cookies Revisited……Page 137
Cookie Filtering……Page 139
Create a Reference File……Page 140
Compact Policies……Page 142
Example of a Third-party Cookie That Uses a Compact Policy……Page 144
The Implications of the Three-Letter Combinations……Page 145
Legislation……Page 154
Cookie Alternatives……Page 155
Login sessions……Page 156
Persistent Cookies……Page 157
Cookie Policy Receipts ¡ª A Suggestion……Page 158
Additional Reading……Page 161
Policies……Page 163
Viewers……Page 165
User- Agents……Page 166
Intermediary Servers……Page 167
P3P for Data Conveyance……Page 168
User- Agents and Viewers……Page 170
The JRC User-Agent……Page 171
Additional Reading……Page 173
Mobile Internet ¡ª The Vision……Page 175
Mobile Internet Architecture……Page 176
The User Device……Page 177
The Proxy/ Gateway……Page 178
A WAP User- Agent Profile……Page 179
Creating a Reference File……Page 183
Creating a Policy File……Page 185
Profile Data Conveyance and Cookie-Policy Receipts……Page 195
Additional Reading……Page 197
Background……Page 199
Tags and Attributes……Page 200
Document Type Definition ( DTD)……Page 202
Prolog……Page 203
Namespaces……Page 204
Other Related Recommendations……Page 205
Additional Reading……Page 206
Introduction……Page 207
Privacy……Page 208
WAP 2.0……Page 210
Personal Trusted Devices……Page 211
User- Agent Profiles……Page 212
Context- Aware Services……Page 213
Risks Factors……Page 214
Exposed Data……Page 215
Spam……Page 216
P3P Agreement……Page 217
Minimal Profile Conveyance……Page 218
Overview……Page 219
Use Case……Page 221
Enhancement of P3P¡¯s Operation Environment……Page 223
References……Page 224
The Driving Force behind the P3P Implementation……Page 227
What Happened?……Page 228
About the Web Site……Page 229
The Human- Readable Policy……Page 230
www.comhem.se/w3c/policy.xml……Page 234
The P3P Files of the Login Domain……Page 235
https://zone.tewss.telia.se/w3c/policy.xml……Page 236
Acknowledgment……Page 238
Location- Based Services……Page 239
The GEOPRIV Working Group……Page 241
Setting Up Policies around Location……Page 242
User- Agent Response……Page 243
Additional Reading……Page 244
INDEX……Page 245