[tor-bugs] #17577 [Tor Browser]: Disconnect Search started hijacking search results

[Tor Bug Tracker & Wiki]

#17577: Disconnect Search started hijacking search results
-------------------------+--------------------------
 Reporter:  cypherpunks  |          Owner:  tbb-team
     Type:  defect       |         Status:  closed
 Priority:  Medium       |      Milestone:
Component:  Tor Browser  |        Version:
 Severity:  Normal       |     Resolution:  fixed
 Keywords:               |  Actual Points:
Parent ID:               |         Points:
  Sponsor:               |
-------------------------+--------------------------
Changes (by gk):

 * status:  new => closed
 * resolution:   => fixed


Comment:

 We spoke with Disconnect and they killed this affiliate implementation
 immediately. No searches were hijacked. And no tracking took place unless
 a user clicked through to the domain (e.g., Samsung) from the
 interstitial. Upon click, the affiliate partner redirected to the site for
 attribution only. The affiliate agreement was only meant to include
 affiliates that used first-party tracking (e.g. Amazon and Ebay), but
 unfortunately a few sites (e.g., Samsung) contracted with third-parties to
 handle their tracking, but third-party tracking would have taken place had
 a user simply visited the website (e.g., Samsung.com
 <http://samsung.com/>) directly.

 This was run as a test and coded so as not to be shown to Tor users.
 Unfortunately, a small number of Tor users who (1) manually visited the
 URL search.disconnect.me <http://search.disconnect.me/> and then (2)
 searched for a small group of affiliate companies or misspelled an
 affiliate company’s name were presented with the interstitial screen, and
 the option to go directly to the affiliate.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17577#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online