21 ms·
Verizon fined $1.3M for supercookie header injection [pdf]
- jcr 11y agoVerizonWireless does all sorts of ahem questionable things to the network traffic passing through it, particularly unencrypted traffic like plain HTTP. If you're concerned about image quality, one of their more insidious but unnoticed intrusions is their on-the-fly recompression and/or resizing of images. Always using a VPN (or SSH tunnel) solves most of the problems. $ ssh me@example.com -4ND 127.0.0.1:1080 But you'll need to make sure ppp(8) ignores the HLDC errors they inject into long standing sessions. It will work if your settings and chat script are correct. Lastly, check your contract; you might be one of the lucky ones who have the clause stating VPN traffic is not counted towards your bandwidth cap and/or rate limit.
- chejazi 11y agoT-Mobile got called out pretty hard when it was discovered they were downscaling videos [0] under the guise of their "Binge On" program. But hidden tracking cookies are far more disturbing that (noticeably) downscaled images/videos. Ultimately, the people are the consumers of images/videos. Who knows who the consumers of that tracking data might be... Obviously advertisers, but who else? The NSA? [0] https://www.eff.org/deeplinks/2016/01/eff-confirms-t-mobiles-bingeon-optimization-just-throttling-applies https://www.eff.org/deeplinks/2016/01/eff-confirms-t-mobiles...
- spacemanmatt 11y agomy tmo network service is often a crude joke. 10gb/mo of basically trash service. at least i get 4 bars!
- pc86 11y agoI switched about 6 months ago and haven't had any problems at all. Anecdotes!
- sethhochberg 11y agoAre you in an area where T-Mobile offers band 12 LTE, and does your device's radio support it? http://www.spectrumgateway.com/t-mobile-700a-spectrum http://www.spectrumgateway.com/t-mobile-700a-spectrum Band 12 is rolling out pretty quickly and is spectrum that allegedly helps with a lot of issues caused by buildings / dense urban environments / long range / etc. I can't confirm personally since I don't own a device that supports LTE band 12 (purchased before TMo bought this spectrum....) but reports seem to be very positive.
- deleted 11y ago[deleted]
- r00fus 11y agoAnecdotally, my TMO LTE service is better than my coworkers ATT or VZ in quite a few places.
- ikeboy 11y agoThat link says they reduced the download speed, but the actual files remained unchanged.
- criddell 11y agoI think they were relying on video services being able to detect available bandwidth and alter the stream to fit. Netflix does this, for example. If you have a narrow connection, you're probably going to get 240p video. If the streaming service doesn't do this, you just get a terrible experience (buffering... buffering... buffering...).
- mirimir 11y agoThat's why streaming on bad (narrow, high latency and/or jitter) connections is a bad idea, no? Download in the background, then view, makes much more sense.
- criddell 11y agoI don't think there's one right answer for that. Buffering is a terrible experience everywhere. On my desktop, I'd rather wait to get the best quality video that I can get. On mobile though, I probably prefer for video to start NOW at a lower bitrate if need be. It will save bandwidth, and battery, and time and the quality is probably good enough.
- mirimir 11y agoI'm not a mobile user, so this is probably unworkable. But anyway, why not download to desktop, and then transfer to mobile device? Destroys spontaneity, I know.
- criddell 11y ago> Destroys spontaneity It's exactly that. I'm sitting in a waiting room or the departure gate at the airport flipping through Twitter or Instagram and a click on a video. I don't need that 6 second video to play in 4K. That it runs instantly is the most important quality, IMHO.
- acdha 11y agoThat's a very different situation: they didn't downscale anything — the service used traffic shaping which caused most services to fall down to lower bitrates but they weren't altering content, which is why it still applied to HTTPS – and that wasn't a “discovery” as much as “reading the announcement”. The emails and SMS sent to all of their customers first and those messages included the opt-out link. In contrast, the super-cookies were only discovered by people noticing unexpected headers in the requests their servers were receiving. There was no pre-announcement and it took publicity to get opt-out instructions.
- hammock 11y agoThat's pretty bad if you're trying to use your phone for image editing or something.
- 0x0 11y agoI wonder what would happen if you repeatedly downloaded and uploaded an image to imgur or something. Maybe something like this? http://gizmodo.com/5555359/the-weirdness-of-a-youtube-video-re-uploaded-1000-times http://gizmodo.com/5555359/the-weirdness-of-a-youtube-video-...
- matt-attack 11y agoI'm confused. How did you go from an SSH SOCKS proxy to ppp?
- jcr 11y agoI left out plenty of details, so sorry if the transition wasn't clear and seamless. VerizonWireless, whether via a "smart" phone or a dongle (i.e. 3G EVDO or 4G LTE via USB usually, or PCMCIA historically) operates as a plain old modem connected to a serial port. To connect with a UNIX system, you need ppp, either in kernel or in userland. You also need a "chat script" which is the AT Commands needed to set up the connection. Once the connection is up, create a SOCKS proxy bound to localhost with ssh(1) by using the '-D host:port' flag. You could use another type of secured connection like OpenVPN or IPSec tunnels, but ssh(1) is by far the easiest. The one thing I've never figured out is the exact AT Commands necessary to update the PRL (Preferred Roaming List), but that only needs to be done every few years if you don't move around the globe too much. The cell tower leases are usually 20 to 30 years, so they stick around for a long time. Unfortunately, if your PRL gets too far out of date, VerizonWireless can prevent connections, so occasionally you need the verizon software to update it.
- snuxoll 11y agoTo update the PRL you just need to dial 22898, that's all the VZW software does (228 is interactive and requires you actually answer a voice prompt, while *22898 forcibly pushes a new PRL to your device).
- jerf 11y agoIf you edit to replace your asterisks with [STAR], your post will make more sense. To the best of my knowledge the only reliably way to get an asterisk to display in an HN post is to use only one. (Maybe sometimes stick it in the middle of the word.) Backslash does nothing useful.
- maxerickson 11y ago
- DKQKFE 11y agoIt took about 10 days for the opt out to work for me. "Overall, Verizon reported a profit of $4.22 billion" reported by forbes for the 2015 operating year. That is profit, not revenue. So, 1,300,000 / 4,220,000,000 = .000308 ouch..
- hallman76 11y agoI just found opt-out instructions[1]. How did you validate that the opt-out worked? [1] http://www.clarkhoward.com/how-opt-out-verizons-super-cookie-tracking http://www.clarkhoward.com/how-opt-out-verizons-super-cookie...
- Animats 11y agoVerizon was fined for not disclosing supercookie injection. They can still do it, but have to allow for opt-out. Amusingly, they don't do it for "government or enterprise" accounts.
- spacemanmatt 11y agoI'd like to benefit from collective bargaining with mobile carriers, too.
- IMTDb 11y agoELI5 what is/was the super cookie ? What is/was the purpose, and how does/did it work ?
- icebraining 11y agoWhen you did an request for a web page on their network, Verizon would silently add an header to your request with an ID tied to your data plan contract. The point was to enable them to sell analytics services that tracked users from their network across the sites of their clients.
- wnevets 11y agoso even if the service isn't free you're still the product.
- Relys 11y agoWe've learned that with Cable TV/Hulu
- justinjlynn 11y agoIf they can sell you and get paid by you for the privilege, why wouldn't they? Capitalism, as a good and effective market philosophy, is built on all parties being aware of all aspects of the transaction and ideally of all transactions... a perfect market. If such a thing doesn't exist, which it does not, then it's selective fuckery. However, it tends to exhibit less fuckery than most other systems... except when it doesn't.
- wnevets 11y agosounds like "If you're not paying for the product, you are the product. needs to be updated to just "you are the product"
- justinjlynn 11y agowell, it's more like, "You may be the product even if you're paying. Who knows because nobody will tell you because they're not required to tell you." But yeah, 'you are the product' is probably the most accurate.
- jmsdnns 11y ago$1.3m? They won't even notice.
- mtgx 11y agoThey probably paid their lobbyists more to fight against the FCC over this.
- yclept 11y agoHere is a discussion from a year or two ago that explains the header: https://news.ycombinator.com/item?id=8500131 https://news.ycombinator.com/item?id=8500131
- incongruity 11y agoThe punishment should fit the crime. If penalties were tied to some sort of assessment of economic gains from the violations, it might start to make companies weigh their actions a bit more...
- vonklaus 11y agoThis is a big victory: > 16. Termination of Investigation. In express reliance on the covenants and representations in this Consent Decree and to avoid further expenditure of public resources, the Bureau agrees to terminate the Investigation. In consideration for the termination of the Investigation, Verizon Wireless agrees to the terms, conditions, and procedures contained herein. Verizon has agreed to pay $1.35M and will likely notify the FTC by mail if it makes a change. It has agreed to abide by the law. If you put this in perspective, this is way more than a slap on the wrist. If we assume a gb costs ~$10 and an average user uses ~6gb then: ($1,350,000 fine / $10/gb) / (6gb/user * 12months) = 1875 This is almost very nearly 1900 people! A huge number. Obviously this is back of a napkin, and the actual size of headers is pretty negligible so there isn't any sense in backing that out of the calculation, because the users already paid for the bandwith. Plus, verizon is literally the only company out of hundreds of providers doing this. Surely between the weight of this fine and the competition the company will go bankrupt soon. Big win! Say what you want about the FTC but they closed down the investigation saving an untold number to the US tax payer, Verizon is forced to break the bank, and the response time was rapid, 4 years open shut. The FTC has been super sharp on policing the industry, by allowing the Governement to subsidize huge swathes of infrastructure costs and selling a finite amount of bandwith, they have been able to keep companies on their toes, not allowing any one company to own telephone, wireless, and internet capabilities. I hope they can keep this up because Verizon is the only bad actor in the entire space, so it is pretty much all taken care of now.
- Ensorceled 11y agoCan I pre-evoke Poe's Law?
- jessaustin 11y agoIf you've even asked the question, the answer is no. b^) We must leave some space for wit and ambiguity in our discourse.
- vonklaus 11y agoVerizon took a pretty big gamble in 2015[0] and bought spectrum covering more than half of America. So even though taxpayers pay for a lot of the infrastructure so they can be a common carrier and deliver services without manipulation, it was pretty risky to assume most of the populated regions in America will use cellphones in 2016. Since they broke that agreement, they had to pay. 10b is a big risk to take, and 1.3M is likely to panic the market. So while I am happy to see them go bankrupt, I could only imageine the chaos that would ensue if taxpayers had to try and resell that to someone. If you asked those 190million people whether they would rather have $60 to sell the bandwith or have the country pay to build them an entire wireless network, legislate on their behalf, and limit most of their future profits tax burden, while allowing them to make a profit, and then inject and sell adverts, no brainer, $60 up front. They are just a Unicorn company anyway, lets see if selling a core service you got for free into an impenatrable market is a good business. Can't wait to see these guys on http://ourincrediblejourney.tumblr.com http://ourincrediblejourney.tumblr.com [0]http://www.fiercewireless.com/story/verizon-aws-3-we-have-least-40-mhz-aws-spectrum-92-top-100-markets/2015-02-17 http://www.fiercewireless.com/story/verizon-aws-3-we-have-le...
- rektide 11y ago131b revenue in 2015. So, at 1.3m, a 0.001% fine, aka half a minute of revenue. Interestingly it doesn't directly fix the problem either (although it wrecks the current free-profit model, yay!), "To settle this matter, Verizon Wireless will pay a fine of $1,350,000 and implement a compliance plan that requires it to obtain customer opt-in consent prior to sharing a customer’s UIDH with a third party to deliver targeted advertising" But lest anyone think this is a UIDH prohibition, the next line goes on to say customers must at least have the ability to opt-out from internal Verizon usage, meaning the UIDH will be there (unless the customer opts out) and that a persistent, unique identifier that follows the user wherever they go is permitted. This ruling is primarily about Verizon sharing the targeting information: Verizon is still permitted a persistent attack on their users, but they are now only permitted to sell customer data on an opt-in basis. Ad-networks will have to do their own tracking themselves for everyone else. Hopefully Verizon's profits from this schtick are shorn from this shift, to a degree where they give up this disgraceful corpoate panopticon they've been going to the bank on.
- __john 11y agoIs there any reason Verizon wouldn't start up an ad department? They have a nice advantage with the internal opt out...
- spennant 11y agoVerizon now owns Converto (http://www.adweek.com/news/technology/6-major-pieces-verizon-gets-aol-deal-164698 http://www.adweek.com/news/technology/6-major-pieces-verizon...)... Supercookies makes this a big deal.
- fomojola 11y agoThey don't need to start up an ad department: they have AOL.
- anfrany1 11y agoI'm not sure if their Rewards program is part of their ad department or not but part of their reward program is that you have to consent to being tracked.
- ComteDeLaFere 11y agoDespite all the outrage against Verizon, a small part of me feels sorry for them. Having consulted with large corporations in the past, I know that most (all) of them don't generally have expertise in this kind of thing, and usually outsource it to a variety of digital agencies. My guess is that they will be having a very hard conversation with one or more of their vendors.
- jakub_g 11y agoI can not believe such a huge company did not consult lawyers and that the guy who was forced to write the code didn't speak to their managers about potential implications (whether it went up the chain is another matter). Besides that, ignorantia iuris nocet. Governments don't have problems with fining individuals unaware of arcane and complex laws. Why would we feel sorry for unscrupulous corporations?
- ComteDeLaFere 11y agoAgreed on all points, however - the guy who was forced to write the code didn't speak to their managers about potential implications That isn't really the way things work in an agency/Fortune 500 relationship. What really happens is something like: -> the development manager attempts to translate the implications of said software to an account manager who is directly responsible for client communication -> the account manager has little idea of what the development manager is talking about, which does not stop them from attempting to translate in turn to the client's marketing team -> the one tech representative from the client company listens to the translation in abject horror, knowing that any questions they ask will never be adequately answered -> everyone goes out for drinks on the agency's tab This isn't a raging critique of the process, it's just what normally happens. That said, Verizon got fined for a good reason.
- pdkl95 11y agohttp://ogun.stanford.edu/~bnayfeh/plan.html http://ogun.stanford.edu/~bnayfeh/plan.html
- tomschlick 11y agoEven more reason to use HTTPS for everything... We can't even trust the providers we do pay not to sell data on us.
- godgod 11y agoDrop in the bucket for Verizon. Your data is for sale.
- PedroBatista 11y agoWith such a dent in their profits I'm sure Verizon will learn their lesson.
- joering2 11y ago0.001%. Is there any reason why Verizon would even bother to comply?? Just wait and see what happens if you get another suit that penalize you 0.01%, then comply. I'm being sarcastic of course.
- biturd 11y agoAnd there is now going to be yet another misc 8 cent charge on my bill. Where is my 50 cent rebate for going paperless and saving them the stamp?
- harryh 11y agoTo be fair, most the the surcharges on your bill are government taxes of various kinds.
- rasz_pl 11y ago$1.3M is less than their lawyer fees.
- RandomBK 11y agoA lot of threads here are focused on the miniscule fine, but the larger impact is that this is another case study that can be used in the next net neutrality debate. Verizon is giving evidence to the argument that they can't be trusted with network communications, evidence that will surely come back to bite them in the future.
- deleted 11y ago[deleted]