Amazon's new Silk browser, which uses the power of the cloud for an optimized "split" browsing experience, has come under fire recently from privacy advocates, but the Electronic Frontier Foundation said yesterday that after talking with Amazon, they are "generally satisfied with the privacy design of Silk."
"Our conversation with Amazon allayed many of our major concerns," the EFF said in a Tuesday blog post.
The report from the San Francisco-based organization comes several days after Rep. Edward Markey, a Massachusetts Democrat, asked Amazon for more details about how data is collected via its Silk browser. He pointed to media reports that suggested Amazon might be able to track the activities of Kindle Fire tablet users via Silk.
"Consumers may buy the new Kindle Fire to read '1984,' but they may not realize that the tablet's 'Big Browser' may watching their every keystroke when they are online," Markey said in a statement.
An Amazon spokesperson said last week that "users can completely turn off the split-browsing mode and use Amazon Silk like a conventional Web browser"—a point it also made to the EFF.
"Cloud acceleration mode is the default setting, but Amazon has assured us it will be easy to turn off on the first page of the browser settings menu," the EFF said. "When turned off, Silk operates as a normal Web browser, sending the requests directly to the web sites you are visiting."
Silk is a "split browser" that partially lives on the Fire tablet and partially lives in the cloud, producing a faster browsing experience. Basically, most of the heavy lifting is handled by Amazon's EC2 and C3 services. As PCMag's ExtremeTech described it, "Amazon sucks down the target Web site, lays it out, renders it—and then ships it off as a much smaller, condensed package to the Kindle Fire tablet."
But as the EFF found out, Amazon does not intercept encrypted traffic. "Given the prevalence of Web pages served over HTTPS, this gives Amazon good incentive to make Silk fast and usable even when cloud acceleration is off. Turning it off completely should be a viable option for users," the group said.
Indeed, Google yesterday said it will encrypt the search queries and results of signed-in users, and always provide the option for users to go directly to the encrypted https://www.google.com. Last year, Google announced that it would encrypt Gmail at all times, not just during sign-on, and make the process an opt-out feature rather than opt-in. Facebook introduced a similar option in January and Twitter did the same in March.
What is Amazon tracking? The company said the only data that is regularly logged is: URL of the resource being requested; timestamp; and token identifying a session. Amazon keeps that data for 30 days, and said there is no way to identify the information with a particular user or Amazon account.
"Individual identifiers like IP and MAC addresses are not associated with browsing history, and are only collected for technical troubleshooting," Jon Jenkins, director of Silk development, told the EFF.
Still, the EFF had a few remaining concerns. Those URLs stored by Amazon could, in fact, include identifying information. "There is always a chance that search queries—even if they are unlinkable to otherwise uniquely identifying data—can effectively identify individuals," the group said.
The EFF was also concerned that Amazon is sitting atop "a ripe source of users' collective browsing habits, which could be an attractive target for law enforcement." If you're worried, however, EFF suggested turning off cloud acceleration.
Overall, the situation "highlights the need for better online privacy protections," the EFF concluded. The group reiterated its call for an update to the Electronic Communications Privacy Act (ECPA), which is currently working its way through Congress via a bill from Sen. Patrick Leahy.
Amazon did not immediately respond to a request for comment about the EFF's assessment. A Markey spokeswoman said the congressman has not yet received an official response from Amazon, but his office has been in contact with the company. "We appreciate the company's responsiveness and are looking forward to receiving the written answers to our questions," she said.
Amazon unveiled the Kindle Fire tablet in late September; it will start shipping on November 15. The Android-based device features a 7-inch screen and costs $199. For more, see PCMag's first look at the Fire and the slideshow below.