Yahoo Changes Privacy Policy, Joins Google, Microsoft

Responding to concerns from privacy advocates and the public, Yahoo Inc. said Tuesday it will make user search data anonymous after 13 months.

The news comes shortly after other Internet companies, including Google Inc. and Microsoft, have taken similar steps to limit personal data.

"One of the core tenets of this company is the relationship and trust we have with our users," said Yahoo spokesman Jim Cullinan in a statement e-mailed to Computerworld.

Cullinan said Yahoo will make all search log data anonymous after 13 months except if users request otherwise or if Yahoo is required to retain the information for legal reasons.

"We believe the 13 month policy is the appropriate timeline to meet our commitment to our users' privacy while preserving our ability to continue to defend against fraudulent activity and improve our services to advertisers, publishers and users," Cullinan said in the statement.

On Tuesday, Microsoft said it will give users a way to search anonymously on its Microsoft Windows Live Web sites by the end of the year. Microsoft also said it will make all user search data anonymous after 18 months.

Last week, search portal Ask.com said it would introduce a feature to its Web portal later this year called AskEraser that will let users perform anonymous searches. When AskEraser is turned on, the Web site will not retain the user data it normally stores during a search.

Google last week said that it had hanged it privacy policy and that its cookies would expire after two years, instead of in 2038, when they were originally set to expire. However, observers dismissed the move as hype, saying the change only makes it appear that Google is taking steps to address privacy concerns.

Earlier this year, Google said it would make the data it stores about end users anonymous in its server logs after 18 months. That was a change from March, when the company said it would make user data anonymous after 18 to 24 months. The company's decision to change its policy came in response to a letter the company received last month from a European Union data protection working group regarding Google's privacy policies.

Is Firefox ALSO affected by the Microsoft ANI vulnerability?

A report on ZDNet (UK) suggests that the animated cursor vulnerability just patched in yesterday's Microsoft Security Bulletin MS07-017 can also make Firefox browsers running in a Windows environment vulnerable to the threat.

The individual who initially reported the ANI vulnerability privately to Microsoft, Alexander Sotirov of Determina, has told ZDNet.uk.co, "Firefox uses a Windows API function, which uses the vulnerable code in USER32.DLL, so the .ani vulnerability can be exploited through Firefox."

There has been no response yet from Firefox creator Mozilla.org in its Known Vulnerabilities database.

The point of this report, of course, is that anyone who was not using Internet Explorer may have felt they didn't need to apply the .ANI update.

NOTE: One TR member has already notified me of a problem with one of the patches in MS07-017. See the Comments section of my report on the release of MS07-017 for details to offer assistance or to post your own problems.

I believe this is the same problem already noted in version 2.0 of KB925902.