Monday, February 16, 2009

Hiding ToS behind JavaScript

Recently I got a reply from Microsoft support to a spam report I'd sent in. It said that they "have taken appropriate action on the account," which I assume means they terminated it, and that's good. But then it went on, "To view our Terms of Use, visit the following Web site:
http://help.live.com/help.aspx?project=tou

Naturally, I checked that page. Unlike most such pages, it didn't present me with a mass of intimidating information, but rather with effectively no information. There was just a search box and two links called "FAQ" and "Table of Contents." Clicking on any of them does nothing.

I use Firefox with NoScript, a plugin which lets me disable JavaScript by default and enable it selectively just for sites of my choosing. This is a useful security measure, not to mention that it keeps a lot of distracting flashy graphics from appearing on pages I view. Microsoft's Terms of Use page was designed so that people who don't have JavaScript enabled will get no information. Microsoft isn't alone in this; it's practically a standard practice. I can imagine Dilbert getting a performance review and hearing the Pointy-Haired Boss complain that he wrote a couple of pages that people could use without JavaScript. But there is no excuse for the practice in pages which deliver plain text, and doubly so for any page that notifies users of the terms under which they may use the site.

If you do enable JavaScript and read the terms, you learn among other things that Microsoft may automatically download software upgrades to your machine and that you aren't allowed to reverse engineer them to find out what they're doing to you.

No comments: