Two years ago I surveyed the websites of 20 of the top research journals and found that 16 of the top 20 journals placed trackers from ad networks on their web sites. Only the journals from the American Physical Society (2 of the 20) supported secure (HTTPS) connections, and even now APS does not default to being secure.
So that's the good news. The bad news is that reader privacy at most of the journals I looked at got worse. Science, which could be loaded securely 2 years ago, has reverted to insecure connections. The two Annual Reviews journals I looked at, which were among the few that did not expose users to advertising network tracking, now have trackers for AddThis and Doubleclick. The New England Journal of Medicine, which deployed the most intense reader tracking of the 20, is now even more intense, with 19 trackers on a web page that had "only" 14 trackers two years ago. A page from Elsevier's Cell went from 9 to 16 trackers.
Despite the backwardness of most journal websites, there are a few signs of hope. Some of the big journal platforms have begun to implement HTTPS. Springer Link defaults to HTTPS, and Elsevier's Science Direct is delivering some of its content with secure connections. Both of them place trackers for advertising networks, so if you want to read a journal article securely and privately, your best bet is still to use Tor.
Posts
One reasons publishers have been so slow implementing https is because libraries (the customers) can't handle it. Our proxy servers for giving access to users not on campus haven't always been able to cope with https (and it's still a bit of a fudge). I know at least one publisher, I think it was OUP, moved to https and had to go back again because of the outcry from customers. So blame the library management systems companies...
ReplyDeleteThe most popular proxy server fro remote access, EZProxy, fully supports proxying HTTPS. I would love to hear why you think it's "still a bit of a fudge".
DeleteMy uni doesn't use EZProxy, so I can't comment - our proxy is WAM, and support for https involves rewriting urls to replace the dots with hyphens - I call that a fudge!
DeleteMaybe I need to have a chat with the folks at Innovative. But replacing dots with hyphens isn't a problem. Rewriting proxy servers have been a fudge all along (Ask Chris Zagar!) but they aren't a good excuse to reject privacy and security for journal users.
DeleteI've confirmed that WAM fully supports HTTPS.
DeleteSo worthy of note. thank you for sharing this. I use https everywhere on my browser which does close off certain functions of pages - in addition to privacy badger. But as the default for journal publishing goes to some form of web-publishing, the chances for tracking increase. Tor is a great tool to access material that might otherwise be logged, using a VPN is another. But to keep it simple: STOP USING GOOGLE SCHOLAR because for all intents and purposes, we should expect that to be tracked. Again, thank you for sharing.
ReplyDeletePartly as a result of an inquiry from Eric last year, but mostly for other unrelated reasons, we at the American Physical Society have made our journal platform forcibly redirect to https for all connections as of yesterday. We are in the process of updating our Crossref registered URLs in the DOI handle system to use https (those link.aps.org URLs have been using https since last week). We will also be updating any absolute URLs within our CMS system. During the past week when we started redirecting all incoming link.aps.org to https, we have had no end user questions, complaints, or comments. So it looks like the barrier to moving to https for scholarly journals is lower than expected. Kudos to Eric for drawing attention to this issue.
ReplyDeleteMark Doyle
Chief Information Officer
American Physical Society