10 ms·

AT&T Hotspots: Now with Advertising Injection

150 points by jeo1234 11y ago

ChuckMcM 11y ago
which is why, by default on my laptop, I use an ssh tunnel with a SOCKS proxy to get to the web. Truly sad, nothing you could do with your phone or tablet though. Not that I begrudge them trying to get some money out of their "free" service, and I choose not to use such services. Of course you will then get MITM routers which link to the free WiFi, offer their own free WiFi on a different channel, and then swap the 'customer id' on the ads going through to send them the money. Or something like that. I'm sure there is a RasPi build to do something like this.
- zrail 11y ago
  On phone and tablet you can set up a real VPN, potentially through the same host where you're tunneling.
  - sigjuice 11y ago
    It was relatively straightforward to set up an IPSEC VPN on my Digital Ocean VPS using these instructions https://raymii.org/s/tutorials/IPSEC_L2TP_vpn_with_Ubuntu_14.04.html https://raymii.org/s/tutorials/IPSEC_L2TP_vpn_with_Ubuntu_14... . Also, it worked with the VPN clients built into OS X and iOS.
    - blazingfrog2 11y ago
      Is that VPN setup an "always on"-able setup so that iOS just routes traffic through it without having to manually switch on the VPN client? I run the VPN server bundled with OS X Server and I haven't been able to achieve that.
      - sigjuice 11y ago
        Sorry, I am not sure if there is an "always on" knob on the client. I don't know the details, but some versions of iOS have a feature called per-App VPN, that might get you close to what you want. Look for the text "OnDemandMatchAppEnabled" on this page https://developer.apple.com/library/ios/featuredarticles/iPhoneConfigurationProfileRef/Introduction/Introduction.html https://developer.apple.com/library/ios/featuredarticles/iPh... .
- edwhitesell 11y ago
  There are Android Apps that will tunnel via SSH and/or SOCKS. I use some now and again to get around connection "issues" like filtering.
- JustSomeNobody 11y ago
  On Android, you can root and run SSHTunnel. Things like this are the reason I strongly feel we should have admin privs on our phones without having to root it.
jeo1234 11y ago
AT&T seems to really not care about their customers trusting them.
- urda 11y ago
  Don't connect to open Wifi hotspots willy nilly then. Is AT&T taking advantage of the situation? Absolutely, but this is what happens when you connect to any WiFi network you find while on the road. Today it's AT&T, tomorrow it'll be someone else.
  - Someone1234 11y ago
    And let's be frank, these networks are so insecure anyway even if you can connect you likely shouldn't be using it for anything you care about anyway (and certainly nothing that isn't HTTPS). But even websites which support HTTPS won't mark cookies secure, so the browser will happily upload it to the HTTP version for the world to see. Ultimately open WiFi hotspots are a security nightmare, it is quite incredible that nothing has been done about it. There's no reason we couldn't utilise something akin to SSL to secure the WiFi connection itself (since the scenario is identical, two previously unknown parties wanting to communicate securely, and utilising an already trusted CA to facilitate that). I guess as an industry we're just too lazy to make anything except PSK work.
  - r00fus 11y ago
    Staying off promiscuous mode is one thing, but all AT&T hotspots appear with the same SSID - if you rely on a single one you'll get all of them. Weak Wifi signal is also a killer - you're using maps and driving near a Starbucks? Data crawls to a halt as your phone tries to connect to a wifi point 30+m away. Eventually I just gave up on them.
Someone1234 11y ago
Individual websites may be able to protect yourselves by: - Using HTTPS directly, in particular with HSTS set (optimal). - Use a third party like CloudFlare to add HTTPS via their proxy. - Alternatively: HTTP with Content Security Policy set (since it will reject their scripts and CSS running as it isn't in the whitelist). This is only a short term solution since they can alter the CSP header, but it will work if you're stuck on HTTP for now. We bounce a lot of advertisers and malware off of our site this way. Ultimately this is yet another "Use HTTPS!" broken record. But the CSP solution works until they get wise to it.
- r1ch 11y ago
  Unfortunately the first two options aren't really viable if you're an ad supported website. HTTPS will kill your ad revenue since most ad scripts don't work properly over HTTPS.
  - dogma1138 11y ago
    That's a problem for site operators not users if more people force sites to switch to HTTP's more AdNetworks will start serving content via HTTPS. The good thing is that at least most browsers these days are good at blocking mixed content so you won't have HTTP adds growing tumors due to injections anyhow. What i don't understand is why AT&T has to do injection in the 1st place they can easily setup their own AdNetwork and partner with the large AdNetworks to route through AT&T's own internal servers.
    - rsanders 11y ago
      Without injection, their own ad network is irrelevant. Nobody (more or less) is getting on Free AT&T Wi-Fi to visit AT&T's websites. Without injection, any ad revenue goes to the actual site operators.
      - dogma1138 11y ago
        Well that was a given in my statement... hence partner with the large AdNetworks, use the already existing scripts which are integrated much better into the existing sites, AT&T can simply server all requests to www.big.ad.network/ads.js from it's own servers in it's own internal network serving ads from their internal campaigns sharing revenue.... Heck considering that the ads AT&T can serve can be much more relevant to a specific location such as a mall, a large venue, or an airport heck even stores within say half a mile of the hotspot they might actually be "useful". Adnetworks are saving bandwidth, AT&T doesn't have to fight with HTML injection which can break on many sites, AdNetworks get better targeted advertisement win for everyone...
ejdyksen 11y ago
I have just stopped connecting to most wifi hotspots altogether unless I'm going to be somewhere for a few days (hotel, conference, etc). LTE is just faster and more reliable, and tethering is dead simple these days.
- enraged_camel 11y ago
  The problem is that most people's mobile data plans have caps, so if they do any kind of non-trivial web browsing, they need to connect via wifi.
  - _delirium 11y ago
    The prevalence of stuff that likes to auto-update without asking you makes this even more dicey. I ran through 50% of my monthly mobile-data quota once when OSX decided to download a big OS update over tethering (my monthly quota is 1GB). It'd be nice if there were an OS-level service letting me mark certain SSIDs as not suitable for unnecessary data use, the way Android knows not to download app updates over the data connection. Nowadays I mostly avoid tethering unless I really have to use it, since it's always rolling the dice whether it's going to eat hundreds of megabytes of my data quota without asking. Fortunately, there are so many wifi hotspots around that I'm finding tethering at all increasingly unnecessary. And a VPN takes care of the security issues well enough.
    - sliverstorm 11y ago
      Windows 8.1 & 10 let you mark WiFi networks as "metered". Can't do it with USB or Bluetooth tethering, but anyway it does exactly what you are hoping for- the OS will suppress most background network activity. It even tracks "metered network usage" in a separate bucket from regular network usage. I would expect OSX has a similar setting somewhere, with the increase in metered networks.
      - dogma1138 11y ago
        Hmm yes you as long as the tethering shows as a network interface (which all of them do) you can manage the metered settings individually, and every device will have it's own virtual network interface even if you sync 2 different phones via bluetooth. The only time you "can't" do it is if you are using a Wifi Hotspot method in which case you'll have to set the Wireless connection to a metered one so it will keep track of the cap no matter to which HotSpot you connect too. That said Windows doesn't block applications from accessing metered connections it moderates it self(Windows Update, Windows Mail etc...), has a separate setting for what ever MSFT calls "Metro" apps these days (so "Store" apps can be toggled individually with metered access policies), and for windows services so if Spotify decides to download a playlist you might get a surprise bill in the mail.
0x0 11y ago
I've seen this on the "xfinitywifi" SSID even when logged in with a valid comcast subscriber ID... :( Wonder how it handles apps that expect json, or jquery/ajax calls that works with html fragments. Or even someone authoring a wordpress blog post?
- eli 11y ago
  You would hope it would be checking Content-Type headers or similar... but yeah, I'm sure it must subtly break a lot of stuff.
edwhitesell 11y ago
It's easy to get drawn into doing this kind of intrusive advertising when you have a captive audience on a WiFi network. It's an idea I've discussed or been involved in "testing" a number of times. (background: I've been building/operating wireless/WiFi/Hotspot networks since 2001) The reality is AT&T probably has no idea how bad this is, and likely would not care. Somewhere, someone sees the potential dollars on the upside and that's the only factor that matters. There are better ways to monetize free WiFi today. Advertising is a piece of that puzzle, but there are others too.
- edwhitesell 11y ago
  (replying to myself is probably bad form, but I had another thought to note here) Most likely, the WiFi provided by carriers like AT&T is meant for offloading. The phones will do EAP-SIM or some other authentication the customer has no idea of. That will get the voice and SMS traffic passing via WiFi and associated backhaul to the Mobile Core, instead of the mobile network. Assuming that scenario, where WiFi is really a low-cost extension of the mobile network, the carrier has very little incentive to do the "right thing" when it comes to injecting ads and/or content filtering. They are already improving the services their customers pay for. Offsetting that (relatively low cost) with some "bad form" advertising probably won't get a second thought.
- JoBrad 11y ago
  They would likely care if they see how bad the user experience can be.
droopybuns 11y ago
It is 2015. If you're not running your own VPN on aws or if you're not using solutions like Cloak, you get what you get. https://www.getcloak.com/ https://www.getcloak.com/ I would prefer that carriers didn't do this kind of nonsense, but I'd also prefer that companies like Facebook & Google didn't have the core of their business built around the same function. We live in a world where people expect miraculous technology for "free." It's trivial to get around this.
- intopieces 11y ago
  Cloak is pretty, but my goodness their site is light on technical detail. I can't tell where their servers are located, what protocols they support, who owns the servers. It's so vague and hand-wavy that I'm not sure why I'm supposed to trust them.
- falcolas 11y ago
  With DPI, it's also rather trivial for WiFi providers to block normal VPN traffic - and they do. There are ways around the DPI with SSL wrapping and such, but it's not always "trivial". Point in case, I'm living in a town with a population under 40k, and I know of at least 3 places so far which block OpenVPN traffic over both UDP and TCP.
  - droopybuns 11y ago
    That is novel to me. Thanks for sharing. Are they really doing flow inspection & identifying protocols? Or is it just that they're watching for standard ports?
    - intopieces 11y ago
      The comments on this post: https://news.ycombinator.com/item?id=10101469 https://news.ycombinator.com/item?id=10101469 feature technical information about the technology used to block VPNs.
  - blacksmith_tb 11y ago
    I have seen a fair number of public APs blocking VPN traffic, but my instinct is it's due to incompetence, not malice. It appears they are blocking everything but traffic to 80 and 443, likely due to some sort of turnkey wifi-in-a-box which makes bad assumptions. It is frustrating, as I won't use a public AP if I can't VPN (but I have unlimited data, so it's not a huge problem for me, at least).
mp3geek 11y ago
Now blocked in easylist. https://hg.adblockplus.org/easylist/rev/881423eab157 https://hg.adblockplus.org/easylist/rev/881423eab157
Animats 11y ago
Does this violate the "exceeds authorized access" provision of the Computer Fraud and Abuse Act? AT&T is not acting as a regulated carrier in this instance, and does not have the immunities of a carrier. Also, their terms of service[1] do not permit them to modify the web pages of others. They can block URLs, ask for a payment, or show an ad at connection time as an alternative to a payment. But they did not disclose that they would modify existing pages. The requirement for arbitration in the AT&T terms does not apply, because the Computer Fraud and Abuse Act is a criminal law. [2] [1] http://www.att.com/legal/terms.wiFiServices.html http://www.att.com/legal/terms.wiFiServices.html [2] http://apps.americanbar.org/litigation/committees/criminal/articles/summer2013-1013-glitches-within-cfaas-exceeds-authorized-access-language.html http://apps.americanbar.org/litigation/committees/criminal/a...
- georgemcbay 11y ago
  IANAL, but I don't see how this sort of thing doesn't count as copyright violation on a massive scale. The users probably agree to it in a terms of service, but the served websites do not, and AT&T is creating what logically seems like a highly derivative (but altered) copy of their content with their own content inserted without permission of the original copyright owners. While some amount of data rewriting is inherent in the nature of how the Internet works, modifying the content of web page bodies to insert advertisements just feels like it steps way, way over the lines of that, especially when it can easily present situations where you have ads selling products that would be vehemently opposed by the people whose site it seems to be appearing on to the average user.
  - threatofrain 11y ago
    I also think this could affect the image or experience of a company or entity, since people might not know this is ATT's doing. In the examples provided, one might think this was an action of Stanford.
    - JustSomeNobody 11y ago
      Exactly. Looking at the video linked in the article, RaGaPa shows what ads on Google's home page might look like. Surely Google doesn't want to be associated with certain products that way?
pavel_lishin 11y ago
I've seen this happen on a commercial ISP. I used to work for a web dev firm, and our ISP decided to start injecting ads. Ads that immediately broke all of our javascript that we were testing on QA sites. It took us an hour to realize what was going on, and that it wasn't our code that was breaking, and another 30 minutes of angry phone yelling before they backed down and turned that shit off.
r00fus 11y ago
I wonder how AT&T's ad injection will fare with iOS9's content blocking capabilities...
dmitrygr 11y ago
Holy shit! They log pretty much ALL of the traffic too. Not just CAN LOG. They DO LOG. - See http://www.ragapa.com http://www.ragapa.com "analytics" tab: Here are some of the analytics RaGaPa device collect: Geographical Location Mac Address/Cookie Tracking User Agent User Browser Destination URL Ad/Message Impressions Ad/Message Clicks User Activity with Time
- edwhitesell 11y ago
  That's not really "logging", but analytics based on the ads. Any ad software/network worth using is going to do at least the items listed here.
hinkley 11y ago
There are a bunch of contract renewals coming up in a couple months (including mine, which I've been on the fence about, and now I have an excuse to switch carriers). I wonder whose bright idea it was to roll this out now.
bsder 11y ago
So, basically https and NoScript will block this. Well, I guess if websites don't want ads crapping all over their stuff, they'd better get on the stick.
jtokoph 11y ago
I'm pretty sure all AT&T iPhones pull carrier configurations that set attwifi hotspots as a trusted auto-joined wifi network. I reset my iPhone the other day without restoring any backup. Later that day I found my phone connected to attwifi without any instructions from me.
JoshM33k 11y ago
A smaller ISP near me (Bright House) does a similar thing with their hotspots. There are no ad injections, but they inject a little popup with their logo, that says something along the lines of "hotspot provided by Bright House networks". The funny thing is, this network requires you to log in with your Bright House username and password, so anyone seeing that little "provided by" intrusion is already a paying customer.
JustSomeNobody 11y ago
"Next, it injects a backup advertisement, in case a browser doesn’t support JavaScript." Ha! They do a better job of degradation than most web sites!
laurentoget 11y ago
What I do not get is why the airport would allow that sort of things. I can understand that providing wifi is a cost that should be mitigated for someone like McDonalds who is running razor thin margins, but considering the cost of operating an airport trying to monetize wifi will probably never make an impact on your bottom line while annoying your users certainly will. It just seem like a foolish move to me. What am I missing?
makecheck 11y ago
You know, I could stomach inserted ads a lot more if they were honest about doing them; something like "the contents of this box were placed by the owners of the free Wifi network you are using". The infuriating part is that these ads are typically folded into original content as if the original page had the extra garbage in it. When you see an obnoxious ad, you're not thinking "well I guess I won't use this wifi again"; you think "well I guess I'm not going to this site ever again". We desperately need a way to strongly sign each part of a page so that it is impossible to display a web site with any third-party content that wasn't explicitly added by the site owner (e.g. such as an authorized "Like" button). This naturally means removing i-frames and all other similar mechanisms from browsers, or at least making them a hell of a lot more obvious.

150 points by jeo1234 11y ago

which is why, by default on my laptop, I use an ssh tunnel with a SOCKS proxy to get to the web. Truly sad, nothing you could do with your phone or tablet though. Not that I begrudge them trying to get some money out of their "free" service, and I choose not to use such services. Of course you will then get MITM routers which link to the free WiFi, offer their own free WiFi on a different channel, and then swap the 'customer id' on the ads going through to send them the money. Or something like that. I'm sure there is a RasPi build to do something like this.

zrail 11y ago
On phone and tablet you can set up a real VPN, potentially through the same host where you're tunneling.
- sigjuice 11y ago
  It was relatively straightforward to set up an IPSEC VPN on my Digital Ocean VPS using these instructions https://raymii.org/s/tutorials/IPSEC_L2TP_vpn_with_Ubuntu_14.04.html https://raymii.org/s/tutorials/IPSEC_L2TP_vpn_with_Ubuntu_14... . Also, it worked with the VPN clients built into OS X and iOS.
  - blazingfrog2 11y ago
    Is that VPN setup an "always on"-able setup so that iOS just routes traffic through it without having to manually switch on the VPN client? I run the VPN server bundled with OS X Server and I haven't been able to achieve that.
    - sigjuice 11y ago
      Sorry, I am not sure if there is an "always on" knob on the client. I don't know the details, but some versions of iOS have a feature called per-App VPN, that might get you close to what you want. Look for the text "OnDemandMatchAppEnabled" on this page https://developer.apple.com/library/ios/featuredarticles/iPhoneConfigurationProfileRef/Introduction/Introduction.html https://developer.apple.com/library/ios/featuredarticles/iPh... .
edwhitesell 11y ago
There are Android Apps that will tunnel via SSH and/or SOCKS. I use some now and again to get around connection "issues" like filtering.
JustSomeNobody 11y ago
On Android, you can root and run SSHTunnel. Things like this are the reason I strongly feel we should have admin privs on our phones without having to root it.

jeo1234 11y ago

AT&T seems to really not care about their customers trusting them.

urda 11y ago
Don't connect to open Wifi hotspots willy nilly then. Is AT&T taking advantage of the situation? Absolutely, but this is what happens when you connect to any WiFi network you find while on the road. Today it's AT&T, tomorrow it'll be someone else.
- Someone1234 11y ago
  And let's be frank, these networks are so insecure anyway even if you can connect you likely shouldn't be using it for anything you care about anyway (and certainly nothing that isn't HTTPS). But even websites which support HTTPS won't mark cookies secure, so the browser will happily upload it to the HTTP version for the world to see. Ultimately open WiFi hotspots are a security nightmare, it is quite incredible that nothing has been done about it. There's no reason we couldn't utilise something akin to SSL to secure the WiFi connection itself (since the scenario is identical, two previously unknown parties wanting to communicate securely, and utilising an already trusted CA to facilitate that). I guess as an industry we're just too lazy to make anything except PSK work.
- r00fus 11y ago
  Staying off promiscuous mode is one thing, but all AT&T hotspots appear with the same SSID - if you rely on a single one you'll get all of them. Weak Wifi signal is also a killer - you're using maps and driving near a Starbucks? Data crawls to a halt as your phone tries to connect to a wifi point 30+m away. Eventually I just gave up on them.

Someone1234 11y ago

Individual websites may be able to protect yourselves by: - Using HTTPS directly, in particular with HSTS set (optimal). - Use a third party like CloudFlare to add HTTPS via their proxy. - Alternatively: HTTP with Content Security Policy set (since it will reject their scripts and CSS running as it isn't in the whitelist). This is only a short term solution since they can alter the CSP header, but it will work if you're stuck on HTTP for now. We bounce a lot of advertisers and malware off of our site this way. Ultimately this is yet another "Use HTTPS!" broken record. But the CSP solution works until they get wise to it.

r1ch 11y ago
Unfortunately the first two options aren't really viable if you're an ad supported website. HTTPS will kill your ad revenue since most ad scripts don't work properly over HTTPS.
- dogma1138 11y ago
  That's a problem for site operators not users if more people force sites to switch to HTTP's more AdNetworks will start serving content via HTTPS. The good thing is that at least most browsers these days are good at blocking mixed content so you won't have HTTP adds growing tumors due to injections anyhow. What i don't understand is why AT&T has to do injection in the 1st place they can easily setup their own AdNetwork and partner with the large AdNetworks to route through AT&T's own internal servers.
  - rsanders 11y ago
    Without injection, their own ad network is irrelevant. Nobody (more or less) is getting on Free AT&T Wi-Fi to visit AT&T's websites. Without injection, any ad revenue goes to the actual site operators.
    - dogma1138 11y ago
      Well that was a given in my statement... hence partner with the large AdNetworks, use the already existing scripts which are integrated much better into the existing sites, AT&T can simply server all requests to www.big.ad.network/ads.js from it's own servers in it's own internal network serving ads from their internal campaigns sharing revenue.... Heck considering that the ads AT&T can serve can be much more relevant to a specific location such as a mall, a large venue, or an airport heck even stores within say half a mile of the hotspot they might actually be "useful". Adnetworks are saving bandwidth, AT&T doesn't have to fight with HTML injection which can break on many sites, AdNetworks get better targeted advertisement win for everyone...

ejdyksen 11y ago

I have just stopped connecting to most wifi hotspots altogether unless I'm going to be somewhere for a few days (hotel, conference, etc). LTE is just faster and more reliable, and tethering is dead simple these days.

enraged_camel 11y ago
The problem is that most people's mobile data plans have caps, so if they do any kind of non-trivial web browsing, they need to connect via wifi.
- _delirium 11y ago
  The prevalence of stuff that likes to auto-update without asking you makes this even more dicey. I ran through 50% of my monthly mobile-data quota once when OSX decided to download a big OS update over tethering (my monthly quota is 1GB). It'd be nice if there were an OS-level service letting me mark certain SSIDs as not suitable for unnecessary data use, the way Android knows not to download app updates over the data connection. Nowadays I mostly avoid tethering unless I really have to use it, since it's always rolling the dice whether it's going to eat hundreds of megabytes of my data quota without asking. Fortunately, there are so many wifi hotspots around that I'm finding tethering at all increasingly unnecessary. And a VPN takes care of the security issues well enough.
  - sliverstorm 11y ago
    Windows 8.1 & 10 let you mark WiFi networks as "metered". Can't do it with USB or Bluetooth tethering, but anyway it does exactly what you are hoping for- the OS will suppress most background network activity. It even tracks "metered network usage" in a separate bucket from regular network usage. I would expect OSX has a similar setting somewhere, with the increase in metered networks.
    - dogma1138 11y ago
      Hmm yes you as long as the tethering shows as a network interface (which all of them do) you can manage the metered settings individually, and every device will have it's own virtual network interface even if you sync 2 different phones via bluetooth. The only time you "can't" do it is if you are using a Wifi Hotspot method in which case you'll have to set the Wireless connection to a metered one so it will keep track of the cap no matter to which HotSpot you connect too. That said Windows doesn't block applications from accessing metered connections it moderates it self(Windows Update, Windows Mail etc...), has a separate setting for what ever MSFT calls "Metro" apps these days (so "Store" apps can be toggled individually with metered access policies), and for windows services so if Spotify decides to download a playlist you might get a surprise bill in the mail.

0x0 11y ago

I've seen this on the "xfinitywifi" SSID even when logged in with a valid comcast subscriber ID... :( Wonder how it handles apps that expect json, or jquery/ajax calls that works with html fragments. Or even someone authoring a wordpress blog post?

eli 11y ago
You would hope it would be checking Content-Type headers or similar... but yeah, I'm sure it must subtly break a lot of stuff.

edwhitesell 11y ago

It's easy to get drawn into doing this kind of intrusive advertising when you have a captive audience on a WiFi network. It's an idea I've discussed or been involved in "testing" a number of times. (background: I've been building/operating wireless/WiFi/Hotspot networks since 2001) The reality is AT&T probably has no idea how bad this is, and likely would not care. Somewhere, someone sees the potential dollars on the upside and that's the only factor that matters. There are better ways to monetize free WiFi today. Advertising is a piece of that puzzle, but there are others too.

edwhitesell 11y ago
(replying to myself is probably bad form, but I had another thought to note here) Most likely, the WiFi provided by carriers like AT&T is meant for offloading. The phones will do EAP-SIM or some other authentication the customer has no idea of. That will get the voice and SMS traffic passing via WiFi and associated backhaul to the Mobile Core, instead of the mobile network. Assuming that scenario, where WiFi is really a low-cost extension of the mobile network, the carrier has very little incentive to do the "right thing" when it comes to injecting ads and/or content filtering. They are already improving the services their customers pay for. Offsetting that (relatively low cost) with some "bad form" advertising probably won't get a second thought.
JoBrad 11y ago
They would likely care if they see how bad the user experience can be.

droopybuns 11y ago

It is 2015. If you're not running your own VPN on aws or if you're not using solutions like Cloak, you get what you get. https://www.getcloak.com/ https://www.getcloak.com/ I would prefer that carriers didn't do this kind of nonsense, but I'd also prefer that companies like Facebook & Google didn't have the core of their business built around the same function. We live in a world where people expect miraculous technology for "free." It's trivial to get around this.

intopieces 11y ago
Cloak is pretty, but my goodness their site is light on technical detail. I can't tell where their servers are located, what protocols they support, who owns the servers. It's so vague and hand-wavy that I'm not sure why I'm supposed to trust them.
falcolas 11y ago
With DPI, it's also rather trivial for WiFi providers to block normal VPN traffic - and they do. There are ways around the DPI with SSL wrapping and such, but it's not always "trivial". Point in case, I'm living in a town with a population under 40k, and I know of at least 3 places so far which block OpenVPN traffic over both UDP and TCP.
- droopybuns 11y ago
  That is novel to me. Thanks for sharing. Are they really doing flow inspection & identifying protocols? Or is it just that they're watching for standard ports?
  - intopieces 11y ago
    The comments on this post: https://news.ycombinator.com/item?id=10101469 https://news.ycombinator.com/item?id=10101469 feature technical information about the technology used to block VPNs.
- blacksmith_tb 11y ago
  I have seen a fair number of public APs blocking VPN traffic, but my instinct is it's due to incompetence, not malice. It appears they are blocking everything but traffic to 80 and 443, likely due to some sort of turnkey wifi-in-a-box which makes bad assumptions. It is frustrating, as I won't use a public AP if I can't VPN (but I have unlimited data, so it's not a huge problem for me, at least).

mp3geek 11y ago

Now blocked in easylist. https://hg.adblockplus.org/easylist/rev/881423eab157 https://hg.adblockplus.org/easylist/rev/881423eab157

Animats 11y ago

Does this violate the "exceeds authorized access" provision of the Computer Fraud and Abuse Act? AT&T is not acting as a regulated carrier in this instance, and does not have the immunities of a carrier. Also, their terms of service[1] do not permit them to modify the web pages of others. They can block URLs, ask for a payment, or show an ad at connection time as an alternative to a payment. But they did not disclose that they would modify existing pages. The requirement for arbitration in the AT&T terms does not apply, because the Computer Fraud and Abuse Act is a criminal law. [2] [1] http://www.att.com/legal/terms.wiFiServices.html http://www.att.com/legal/terms.wiFiServices.html [2] http://apps.americanbar.org/litigation/committees/criminal/articles/summer2013-1013-glitches-within-cfaas-exceeds-authorized-access-language.html http://apps.americanbar.org/litigation/committees/criminal/a...

georgemcbay 11y ago
IANAL, but I don't see how this sort of thing doesn't count as copyright violation on a massive scale. The users probably agree to it in a terms of service, but the served websites do not, and AT&T is creating what logically seems like a highly derivative (but altered) copy of their content with their own content inserted without permission of the original copyright owners. While some amount of data rewriting is inherent in the nature of how the Internet works, modifying the content of web page bodies to insert advertisements just feels like it steps way, way over the lines of that, especially when it can easily present situations where you have ads selling products that would be vehemently opposed by the people whose site it seems to be appearing on to the average user.
- threatofrain 11y ago
  I also think this could affect the image or experience of a company or entity, since people might not know this is ATT's doing. In the examples provided, one might think this was an action of Stanford.
  - JustSomeNobody 11y ago
    Exactly. Looking at the video linked in the article, RaGaPa shows what ads on Google's home page might look like. Surely Google doesn't want to be associated with certain products that way?

pavel_lishin 11y ago

I've seen this happen on a commercial ISP. I used to work for a web dev firm, and our ISP decided to start injecting ads. Ads that immediately broke all of our javascript that we were testing on QA sites. It took us an hour to realize what was going on, and that it wasn't our code that was breaking, and another 30 minutes of angry phone yelling before they backed down and turned that shit off.

r00fus 11y ago

I wonder how AT&T's ad injection will fare with iOS9's content blocking capabilities...

dmitrygr 11y ago

Holy shit! They log pretty much ALL of the traffic too. Not just CAN LOG. They DO LOG. - See http://www.ragapa.com http://www.ragapa.com "analytics" tab: Here are some of the analytics RaGaPa device collect: Geographical Location Mac Address/Cookie Tracking User Agent User Browser Destination URL Ad/Message Impressions Ad/Message Clicks User Activity with Time

edwhitesell 11y ago
That's not really "logging", but analytics based on the ads. Any ad software/network worth using is going to do at least the items listed here.

hinkley 11y ago

There are a bunch of contract renewals coming up in a couple months (including mine, which I've been on the fence about, and now I have an excuse to switch carriers). I wonder whose bright idea it was to roll this out now.

bsder 11y ago

So, basically https and NoScript will block this. Well, I guess if websites don't want ads crapping all over their stuff, they'd better get on the stick.

jtokoph 11y ago

I'm pretty sure all AT&T iPhones pull carrier configurations that set attwifi hotspots as a trusted auto-joined wifi network. I reset my iPhone the other day without restoring any backup. Later that day I found my phone connected to attwifi without any instructions from me.

JoshM33k 11y ago

A smaller ISP near me (Bright House) does a similar thing with their hotspots. There are no ad injections, but they inject a little popup with their logo, that says something along the lines of "hotspot provided by Bright House networks". The funny thing is, this network requires you to log in with your Bright House username and password, so anyone seeing that little "provided by" intrusion is already a paying customer.

JustSomeNobody 11y ago

"Next, it injects a backup advertisement, in case a browser doesn’t support JavaScript." Ha! They do a better job of degradation than most web sites!

laurentoget 11y ago

What I do not get is why the airport would allow that sort of things. I can understand that providing wifi is a cost that should be mitigated for someone like McDonalds who is running razor thin margins, but considering the cost of operating an airport trying to monetize wifi will probably never make an impact on your bottom line while annoying your users certainly will. It just seem like a foolish move to me. What am I missing?

makecheck 11y ago

You know, I could stomach inserted ads a lot more if they were honest about doing them; something like "the contents of this box were placed by the owners of the free Wifi network you are using". The infuriating part is that these ads are typically folded into original content as if the original page had the extra garbage in it. When you see an obnoxious ad, you're not thinking "well I guess I won't use this wifi again"; you think "well I guess I'm not going to this site ever again". We desperately need a way to strongly sign each part of a page so that it is impossible to display a web site with any third-party content that wasn't explicitly added by the site owner (e.g. such as an authorized "Like" button). This naturally means removing i-frames and all other similar mechanisms from browsers, or at least making them a hell of a lot more obvious.