8 ms·
Verizon shouldn't be allowed to own any web properties. They inject a unique subscriber identifier into your HTTP requests unless you turn it off. http://www.v
by tehwebguy 10y ago
Verizon shouldn't be allowed to own any web properties. They inject a unique subscriber identifier into your HTTP requests unless you turn it off.
http://www.verizonwireless.com/support/unique-identifier-header-faqs/ http://www.verizonwireless.com/support/unique-identifier-hea...
- otoburb 10y agoAdoption of HTTPS helps somewhat to counter this, but note that advertisers and content sites are also complicit. Carriers wouldn't have injected such headers without demand from content partners and other run-of-the-mill sites. Vilifying carriers only attacks half the problem.
- themartorana 10y ago"...run-of-the-mill sites." Highly doubtful. Someone running ads on their site doesn't make them suddenly complicit and knowledgeable about the creepiest corners of ad-tech. This is _exactly_ why knowledgeable regulators should make this illegal - this is a situation where the people on both ends are unaware of an explicit MITM attack happening between them.
- unexistance 10y agoI wonder what's Mozilla's reaction to this, if they haven't done so before
- allendoerfer 10y agoLet's Encrypt is Mozilla's reaction.
- unexistance 10y agoI'm not the most versed in encryption & stuff, so does Let's Encrypt prevents / subvert Verizon's HTTP modification? EDIT: ah it's supercookie[1] and apparently a full protection is "Only a VPN or Tor" [1] https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh
- cpeterso 10y agoHTTPS is adequate to protect you against X-UIDH injection, but many sites still don't support HTTPS.
- allendoerfer 10y agoWith HTTPS you are protected against this, the EFF is saying, that a "full protection is only a VPN or Tor", because you have no control over whether the website offers HTTPS or not. In each of these cases the traffic is encrypted, Verizon can read only gibberish and cannot know where to insert its tracking code, while with HTTP it sees exactly where the HTTP headers end and can add another to them.
- kevincox 10y agoNot only does it not no where to put them but TLS also provides verification so that the traffic can't be tampered with.
- ajmurmann 10y agoNo company that sells Internet access should be allowed to also be in the content business.
- tinalumfoil 10y agoHaving a web content business incentivizes ISPs to provide faster internet. Case in point: Google Fiber
- shmerl 10y agoOr it incentivizes them to hinder competitors who are routed through their network. It's a clear conflict of interests. Case in point, Comcast is capping their Internet in order to hinder competing video services, but their own video is not capped.
- deleted 10y ago[deleted]
- droopybuns 10y agoShould Google be allowed to sell fiber? I think the suggestion that carriers shouldn't do this is wrong and naive and here is why: User count should not ever be exponential of customer counts. It inescapably results in fundamentally unethical business practices where users are exploited. That is google's business model and they stand uncontested today. Carriers that end up doing any amount of content monetization will never disrupt Google, but they can create pressure that drives the cost of ads down, making google's life harder. I think this is so important that I am happily willing to endure the judgement of everyone here. I know this is downvote bait, but I keep thinking at some point everyone here will see the net positive on all possible angles.
- deleted 10y ago[deleted]
- dredmorbius 10y agoI can't parse this. Especially "User count should not ever be exponential of customer counts". Wat. I'm not seeing the connection between content monetisation and Google's ads business either.
- intopieces 10y agoI'm a Verizon Wireless customer. I remember reading about this, but forgot to take action on it. Thank you for reminding me to opt-out of it.
- throwaway76543 10y agoA bit more than a decade ago Yahoo powered Site Finder, the much hated DNS wildcard implemented by VeriSign. Sounds like a good match to me. https://en.wikipedia.org/wiki/Site_Finder https://en.wikipedia.org/wiki/Site_Finder http://www.wsj.com/articles/SB106383944220437900 http://www.wsj.com/articles/SB106383944220437900
- themartorana 10y agoI find this to be the height of outrageous. It makes my blood boil every time I hear about it. Messing with my data in-flight should be a crime.
- tootie 10y agoThey own AOL and now Yahoo, so no place any users actually visit.
- phaedrix 10y agoDirect URL to opt-out: https://wbillpay.verizonwireless.com/vzw/secure/setPrivacy.action https://wbillpay.verizonwireless.com/vzw/secure/setPrivacy.a...
- mysterydip 10y agoIronically, it makes me log in with my "username or mobile number" even though they know exactly who I am from the unique ID I'm trying to opt out of having :)
- notyourwork 10y agoWithout logging in, someone could enumerate all of these IDs and opt out everyone. This at least protects some of their spying.
- MertsA 10y agoAnyone could send that header and claim to be anyone they want to be. They couldn't use that header to authenticate you even if they wanted to.
- peteretep 10y agoI use a VPN (Freedome) by default on the basis that people I'm paying for connectivity should only be providing that, and not any other "interesting" features like DNS catching, invisible proxies, or fucking with my HTTP.
- Agustus 10y agoCould you detail how you chose Freedome for your VPN?
- peteretep 10y agoIt's run by F-Secure. I've known the F-Secure guys for a long time, and I trust them and I trust the brand. I think they'll use time and resources to fight what they consider to be over-broad surveillance orders, and I think they're competent from a security perspective.
- gcb0 10y agomy guess is that aol and yahoo are just fronts to continue to do this, since every now and then VZ get slaped and told to stop it. it is buying legal condoms to continue to abuse its subscribers.