We use the GeoLite2 data created by MaxMind, available from. We look up the IP addresses within a local copy of a GeoIP database. Furthermore, if the site uses content delivery networks or anycasting the set of addresses we observe may differ from the set for other users. Due to DNS round robin configurations, we may not see all IP addresses that are actually used by a site. We perform a single DNS lookup for the A records of the domain name of the respective site. We plan to offer more flexible geo-location tests in the future.Ĭonditions for passing: The test passes if all IP addresses (A records) are found to be in countries that implement the GDPR. It is believed that personal data is protected better, if a website is hosted in a country that implements the European General Data Protection Directive (GDPR). We obtain the IP addresses of the domain and look up its country in a GeoIP database.
On the other hand, however, it is also possible that a website has serious security holes, although it achieves a good result on this page. Therefore, one cannot conclude from the failure of individual checks that a provider does not handle personal data with sufficient care.
However, such variations are not taken into account in the analysis. Furthermore, it is possible that additional security mechanisms are used on individual pages (e.g., for the transmission of passwords). It is quite possible that an operator uses additional internal protection mechanisms and therefore has decided to leave out some externally visible mechanisms. The results cover only security mechanisms that can be observed from outside when visiting the specified internet addresses. Some security mechanisms are only necessary to protect against strong attacks (e.g., by governments). The fact that a web page fails at a specific does not automatically mean that sensitive pieces data are at risk. What can be concluded from the results, what not? Among other things, this raises the question of whether website operators have an additional incentive to improve their websites. As scientists, we are interested in how users and operators deal with this form of transparency.
What is the purpose of PrivacyScore? With PrivacyScore we make websites publicly comparable in terms of selected properties. What exactly is checked and what do the results mean? We check the internet addresses with several techniques, which we have described in detail in a research paper. How are the results presented? Our analysis focuses on the following aspects: whether tracking services are used ("NoTrack" category), whether selected attacks are prevented, the quality of encryption during data transmission to the website (EncWeb), and the quality when sending e-mails to an existing e-mail server (EncMail).
0 kommentar(er)
