Hulu.com, an online television viewing website collectively owned by some of the television networks, is now offering a paid movie player service for iPhones. Normally these devices cannot play anything displayed with Flash, so this is a new feature. Reading more about it on their privacy statement (under what types of information they collect), I saw their use of “Pixel-Tags.” I thought I would share with you what that is… Here’s more info about Pixel-Tags from the Hulu.com privacy statement:
“We also may use services that collect data remotely by using so-called “pixel tags,” “web beacons,” “clear GIFs,” or similar means (collectively, “Pixel Tags”), which can be embedded on the Hulu Site, in an email message, or on a third party’s website or other platform. A Pixel Tag is a small string of code that provides a way for us to deliver a small graphic image (usually invisible) on a web page or in an email. Pixel Tags can recognize certain types of information on your browser, check whether you have viewed a particular web page or email message, and determine, among other things, the time and date on which you viewed the Pixel Tag and the IP address of the computer from which it was viewed…”
I thought this was an interesting piece of technology. I read more about Pixel-Bugs (more commonly called “web bugs”), and how to automatically block them, on this forum: The Joel on Software Discussion Group. Apparently it’s just a small image file, possible a clear image, that is stored on the company’s server. If you open the e-mail, the e-mail software downloads the images. The company then knows when you read the e-mail (if ever), and might then send some of your info with it. In the CNET.com article “How HP bugged E-mail,” Hewlett-Packard bugged an e-mail sent to a reporter, in the hope that the e-mail would be forwarded on to her source, a leak within HP itself. Each time the e-mail is read, the web bug image is loaded from the company’s server, detailing who last opened the message. (Digital breadcrumbs, if you will – ) In this case, the message was not forwarded to anyone, but HP was soon talking with U.S. House of Representatives subcommittee.
Wikipedia’s page about web bugs (read here) tells us that if you set your mail software to show all messages in HTML, you won’t download the Pixel-Bug image from the companys website. The authors of the Wikipedia article are more concerned privacy issues over web bugs in e-mail, and here’s an excerpt:
“Web bugs embedded in e-mails have greater privacy implications than bugs embedded in web pages. Through the use of unique identifiers contained in the URL of the web bugs, the sender of an e-mail containing a web bug is able to record the exact time that a message was read, as well as the IP address of the computer used to read the mail or the proxy server that the user went through. In this way, the sender can gather detailed information about when and where each particular recipient reads e-mail. Every subsequent time the e-mail message is displayed can also send information back to the sender.
Web bugs are used by e-mail marketers, spammers, and phishers to verify that e-mail addresses are valid, that the content of e-mails has made it past the spam filters, and that the e-mail is actually viewed by users. When the user reads the e-mail, the e-mail client requests the image, letting the sender know that the e-mail address is valid and that e-mail was viewed. The e-mail need not contain an advertisement or anything else related to the commercial activity of the sender. This makes detection of such e-mails harder for mail filters and users.[6]” Read more from Wikipedia’s page about Web Bugs
But the article goes on to tell you how to thwart e-mail marketers and spammers, simply by not loading the e-mail’s images (something that I often do…until now, that is-). It names which e-mail programs don’t automatically load images embedded in the e-mail messages. (Wikipedia also had some great citations at the bottom for further reading)
This article about Web Bugs from Richard M. Smith (written in 1999) states that they may also be used in newsgroup forums, and on Yahoo profiles. In the latter, the Yahoo profile loads the pixel image from another server, thus tracking that web page’s visitors.
In this CNET.com article about web bugs, author Stefanie Olson explains how your web-usage from visiting several websites may be shared through cookies on the same server:
Web bugs can “talk” to existing cookies on a computer if they are both from the same Web site or advertising company, such as DoubleClick, which uses bugs and dominates the online advertising market.
That means, for example, that if a person visited Johnson & Johnson’s YourBaby Web site, which uses DoubleClick Web bugs, the bug would read the visitor’s DoubleClick cookie ID number, which shows the past online behavior for that computer. The information would then go back to DoubleClick. Read more
Another CNET.com article “FBI Spyware Used to Nab Hackers, Extortionists,” details how the FBI used simple web bugs (among other more sophisticated means) to find out the identity of people possibly involved in crimes, like anonymous bomb threats.
The Fix: If you set your e-mail to not allow 3rd party cookies, it apparently gets the image from the company’s server, but cannot send any of your information with it (cite). Don’t allow cookies, and change your e-mail message software to not load the images. Delete your existing cookies, and get an aggressive spam filter.
Now you have some understanding of what a web bug is, how to avoid it, and how to have your internet viewing habits kept to yourself.