[Florence]

This quote below comes from the forums I moderate i thought it relevante to copy over here.

Originally Posted by Mel

I've read lightbluetouchpaper's analysis and came away beleiving the design of the whole Phorm system is as flawed as the opt-out was.

It would seem what they've done using a fair amount of slight of hand and redirection is create a global tracking cookie that anyone can exploit. Sure they've made a school boy effort to strip their UID so that webservers on port 80 don't see it directly, but just by using a web bug on a port other than 80, or by using a client side javascript, or https, it will be possible for any webserver to read the Phorm UID that has been stored in the websites own domain.

The post can be seen here