Adobe and Omniture caught spying on customers
Dec 31st, 2007 | By Leslie Poston | Category: Products - software, Technology news
One fake URL and some detective work later, Adobe and Omniture’s run at customer privacy is at an end. Until the next time they get caught, that is. That’s right, Adobe was busted over the holidays for using a fake URL relay in its CS3 series of applications to gather data on its users.
The site who broke the story is called UNEASYsilence. Adobe applications offer an option to “check for updates”, and one of the URLs the Adobe CS3 apps were checking in with was a fake IP that actually went to an URL owned by Omniture, a consumer research firm. According to the article on the subject in ARSTechnica:
As it turns out, the IP in question—192.168.112.2O7.net (note the capital O instead of a zero)—is not an IP at all, but rather a domain owned by statistics-tracking firm Omniture.
When the news broke over the holidays, it was swept up like wildfire across the Internet. No one expected Adobe to have a response to the spying accusations since it happened over the holidays, but one Adobe employee was one the ball: Photoshop Product Manager John Nack.
Nack decided to do a little research on the issue on his own time, posting his findings on his blog. what he found out was that the call goes out to Omniture’s services to track three things:
“…the news items presented in some apps’ welcome screens, Adobe-hosted content loaded in Bridge’s implementations of Opera and Flash Player (Bridge is the asset management component of Creative Suite), and Adobe online help systems like forums and the Exchange service, but only upon a user’s request.”
While that is still invasive, it isn’t nearly as invasive as the Internet first feared. On the other hand, Nack was as concerned about the deceptive nature of the fake URL as the rest of the Internet was, but Omniture, a separate company from Adobe, wasn’t returning his calls over the holiday week either.
If you want to prevent Omniture and Adobe from scamming your data while the fiasco is still being sorted out, you can add the specific domain and all of its wild card variations to your firewall or IP access blocker software. You can also use a solution like ArsTechnica’s recommended Little Snitch. Regardless, the fact that you, the user, who has paid a huge premium to use Adobe software, have to go to the extreme of banning an IP to opt out is telling. It will be interesting to see how Adobe addresses the problem in the new year.
Related:
I think this issue is overblown. I have posted my views on http://webanalysis.blogspot.com/2007/12/unnecessary-outcry-over-adobe-cs3-and.html