Re: User Agent Header Problem

--nextPart1178001.ooNMeLtBkb
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Scott,=20

I still think you have some wrong expectations with respect to the P3P=20
Protocol. This is all described in section 2 of the P3P 1.0=20
Specification: http://www.w3.org/TR/P3P/

So your first misunderstanding is that you seem to assume that you can=20
tell yahoo how to use your information. This is not the paradigm of=20
P3P. In P3P, it is on yahoo to tell you what they will do with the data=20
and it is on you to accept that or surf elsewhere. So you can base your=20
decision (go/block) on the P3P data that you received from yahoo or=20
just continue the http GET interaction and disregard the whole P3P=20
information given in the header.=20

The P3P protocol is kind of passive (for privacy reasons). This means=20
that the service (yahoo in your example) will announce its privacy=20
practices using the P3P format. There are two formats (both implemented=20
by yahoo) one being the compact format. But if you analyze the header,=20
you'll see that there is also a link to the Policy reference file=20
indicating the policy for yahoo in full XML. In those files but also in=20
the tokens, yahoo tells you what they will do if you give them your=20
name or email-address.=20

Their policy is actually not very fine grained. They tell in this policy=20
that they collect everything and that they give it away to everybody=20
and that they identify you.=20

So next step in this exchange would be that you tell us what you want to=20
try to achieve. This way we can help you with the P3P part of it. Just=20
to fetch a page, you won't need P3P. You need P3P if you want to base=20
your decisions whether to accept cookies or continue surfing on the P3P=20
metadata given by a service. And no, you don't need to send any P3P=20
information/strings back to the yahoo server

Best,=20

Rigo Wenning
Privacy Activity Lead

Am Wednesday 30 November 2005 05:25 verlautbarte Scott Wagner :
> Ok Jeff was a help in the fact the he helped me get my problem in
> order. I  am writing a program(That will Mimic IE 6) that will be P3P
> compliant. problem Example:
>
> I go to http://www.yahoo.com/ before i get the page the yahoo server
> asks me for my Privacy Policy in Compact Policies format. ie(Server
> header: P3P=3Dpolicyref=3D"http://p3p.yahoo.com/w3c/p3p.xml", CP=3D"CAO D=
SP
> COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi
> OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL
> HEA PRE GOV") Now i need to know the header format for the return of
> my privacy policy In CP format.
>

--nextPart1178001.ooNMeLtBkb
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQBDjbFwCRlGO2Cxp/0RAuTcAJ48WamgQP/iBwP+Urqdy9Vf9tKgqQCghpwf
Ra+jFi4Nx8j9RrTbDMvf4qQ=
=25vV
-----END PGP SIGNATURE-----

--nextPart1178001.ooNMeLtBkb--