YouGov's voluntary stalkware unpicked
YouGov recently confronted survey participants with an odd offer to download software that would track users' surfing habits. The unusual request came to our attention via a reader. YouGov told us the tracking software was a project idea from its US office and nothing much was likely to come of it. A YouGov spokeswoman …
I too was asked to participate. I declined as it was unclear what exactly would be sent to whom and what control (or not) I might have.
It looks like my doubts have not been removed by this analysis. Indeed I would have thought the answer to this question was good pointer to the gullibility of the user. I am a long term Yougov participant but recent changes make me suspect that the original principles are not that deeply embedded on the IT side.
A little more transparency may be necessary to maintain a loyal cross section of society.
Having chosen to register with them, I get regular requests to participate in YouGov surveys. If it's a topic I'm interested in or wish to express my views on, I may choose to participate.
I haven't been offered the option to download this survey software, but (as described) it seems to make it fairly obvious what it is and what it does. For suitable recompense, I might choose to allow my Internet browsing to be tracked (though I'm not sure how interesting anyone might find it).
But the story seems to be: software explicitly designed to track Internet usage, tracks Internet usage (shock, horror). I'm assuming it doesn't record unnecessarily detailed info, such as emails submitted on web forms - more likely just the number of times I visit ElReg.
I await elucidation from fellow commentards.
1. It's unclear who receives the browsing information
2. It's unclear what information is sent, e.g. does it include POST data which could have passwords/email etc in it.
3. Why is it 'difficult' to remove (not having an Add/Remove programs entry)
Users might accept the software because they trust YouGov without realising that it's not really from them, instead the software belongs to some shady behind the scenes client with sinister tracking agendas (probably Google).
From the article: "It does add an entry to add/remove programs."
However, the first 2 reasons you give would be enough for me to decline this spyware.
"I'm *assuming* it doesn't record unnecessarily detailed info, such as emails submitted on web forms"
(my emphasis)
quote
I'm assuming it doesn't record unnecessarily detailed info, such as emails submitted on web forms
unquote
and if your assumption is wrong ?
Don't install it. Simples.
...as I had no intention of installing such software when it was offered. As Stuart said: there was no clear indication of what was being sent to whom & how much control one had over it.
Of course it should be marked as Potentially Unwanted for business customers - in fact I'd go further & say Definitely Unwanted - on a business machine. On a home machine, as long as the transparency requirements are satisfied (and the reality independently verified), then maybe.
surfboardhi.com is registered to "Harris Interactive" (harrisinteractive.com) another seemingly legit survey company.
rankey.com appears to be South Korean (Mediachannel Inc, Soekyo-Dong, Mapo-Ku)
search-cn.aipsurveys.com (Search-CN? China?) resolves to an IP address [43.253.216.49] in Japan
panelapp.rankey.com [121.78.241.233] is a Korean IP address.
No it will not be easy to uninstall either, not without the help of trained medical professionals!
One minute the "da-Gub" is all full of "DOWN WITH WEB THREATS!", next they are punting dicky malware like some script-kiddie gang from the Russian back-of-beyond!
"Duh, yes please sign me up! I can't wait for you have even more of my personal info you can collect and ultimately loose on a USB stick/laptop in the back of some cab!"
Are we sure that this isn't, in fact, the survey... the research is to find out how many people would be daft enough to install some unknown tracking software for the sake of a few survey points?
as the person who tipped of El Reg in the first place, I did suggest this could be some sort of uber-subtle survey to see what %age of people would happily install spyware for a few beans.
However, El Reg did the journalistic bit, and confirmed the spyware was real .....
You are aware that "YouGov" is a UK based market research company, and has nothing to do with the actual government*?
Also, it's spelt 'lose'.
* well, OK, their former Chief Exec is now MP for Stratford upon Avon..
Sign up, sign up for The Register's weekly IT security newsletter - click here
