Quote:
Originally Posted by pseudonym
They WILL leak if a site uses https: for any of its content, they are also expected to leak if a site uses a port other than 80, because Phorm have stated that they only process traffic on port 80.
They MAY also be collectable using client side javascript.
|
And you can rewrite the cookie client side too, recoding or encrypting them, to make certain the UID leaks whatever filtering they claim.
Check the Dephormation site for sample code. Its a doddle to capture User Identifiers. SSL, non standard ports, non Phorm ISPs, cookie rewriting... all will cause User Identifiers to leak.
Its a shame the ICO didn't consult external web development expertise.. It might have saved them some avoidable and profound embarrasment.