4 ms·

So, if I recall correctly, that "tracking supercookie" they're mentining in that account has to be injected in the headers of any request / response, right? Doe

So, if I recall correctly, that "tracking supercookie" they're mentining in that account has to be injected in the headers of any request / response, right? Doesn't this mean it's easily defeated by HTTPS? Or am I misunderstanding how that works?

johncolanduoni 10y ago
Since tracking would be done in cooperation with the website you are connecting to, they could transmit something OOB to associate your current IP with their advertising identifier, even if you use HTTPS.
- guelo 10y ago
  This. The network itself becomes the inescapable tracking supercookie. They would provide web publishers a JavaScript snippet that took the user's IP address and returned the targeted ad. And Verizon can tie each IP adress not only to its previous browsing history but also their name, address, credit reports, even contacts that they slurp up using their bloatware phone apps.
yeukhon 10y ago
Correct, only encrypted traffic. See https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh. Verizon was fined ~1.35M by FCC on this violation. But one can still infer actual page a user is visiting by means of looking at some leakage of data. See https://security.stackexchange.com/questions/4388/are-urls-viewed-during-https-transactions-to-one-or-more-websites-from-a-single-i/4418#4418 https://security.stackexchange.com/questions/4388/are-urls-v.... It isn't easy but I am sure some people have done it. One thing ISP has been doing for years is with DNS. If you are at home and you entered some wrong domain name, your ISP will likely present you with its custom search page. This is enough to understand what you are looking for. Furthermore, Google & Facebook aren't relying on cookies as the only way to mine your interest anymore, instead they focus on building profile for you when you use single sign on. For example, when you sign up for Stackoverflow and chooses to login with your Google account, Google may be able to learn you are using Stackoverflow. Verizon in particular has been in the ads business for years, especially with their acquisition of AOL and on-going acuqisiton of Yahoo, Verizon has a big plan to make use of all the data they have, likely to provide a Google search or new portal for their users, much like AOL back in the days in the 90s and early 2000s.
- x0x0 10y ago
  They also will use your dns data. There's existing companies that already do this.
  - devnullmonkey 10y ago
    You can always use CryptDNS, which prevents this. CryptDNS plus OpenDNS and you're pretty good. Add a VPN and you're doing better than 99% of people online. Add uBlock Origin, Decentraleyes, Privacy Badger, and block http/s referrer, disable mediaconnect (prevents RPC from seeing your RFC 1918s--private address scheme) and you're largely unidentifiable in the true sense. You can do this for $5 a month by renting a droplet virtual server on Digital Ocean and setting up Streisand. Don't log anything. You will control the VPS/VPN. Use it for your mobile phone and household router (if your router supports this). If not, individual machines, but having a router that does this is key. Use Opera and it's free VPN until you can get something sorted for yourself.
username223 10y ago
You're right, but the article may be confusing two things: First, ISPs tried injecting a header ("supercookie") into HTTP requests, which won't work over HTTPS unless they MITM certificates (not easy). Second, because they provide the last-mile connection, they know your MAC address, connecting location, and billing information, and can see every host you contact. That's a whole lot of surveillance capital.

johncolanduoni 10y ago

Since tracking would be done in cooperation with the website you are connecting to, they could transmit something OOB to associate your current IP with their advertising identifier, even if you use HTTPS.

guelo 10y ago
This. The network itself becomes the inescapable tracking supercookie. They would provide web publishers a JavaScript snippet that took the user's IP address and returned the targeted ad. And Verizon can tie each IP adress not only to its previous browsing history but also their name, address, credit reports, even contacts that they slurp up using their bloatware phone apps.

yeukhon 10y ago

Correct, only encrypted traffic. See https://www.eff.org/deeplinks/2014/11/verizon-x-uidh https://www.eff.org/deeplinks/2014/11/verizon-x-uidh. Verizon was fined ~1.35M by FCC on this violation. But one can still infer actual page a user is visiting by means of looking at some leakage of data. See https://security.stackexchange.com/questions/4388/are-urls-viewed-during-https-transactions-to-one-or-more-websites-from-a-single-i/4418#4418 https://security.stackexchange.com/questions/4388/are-urls-v.... It isn't easy but I am sure some people have done it. One thing ISP has been doing for years is with DNS. If you are at home and you entered some wrong domain name, your ISP will likely present you with its custom search page. This is enough to understand what you are looking for. Furthermore, Google & Facebook aren't relying on cookies as the only way to mine your interest anymore, instead they focus on building profile for you when you use single sign on. For example, when you sign up for Stackoverflow and chooses to login with your Google account, Google may be able to learn you are using Stackoverflow. Verizon in particular has been in the ads business for years, especially with their acquisition of AOL and on-going acuqisiton of Yahoo, Verizon has a big plan to make use of all the data they have, likely to provide a Google search or new portal for their users, much like AOL back in the days in the 90s and early 2000s.

x0x0 10y ago
They also will use your dns data. There's existing companies that already do this.
- devnullmonkey 10y ago
  You can always use CryptDNS, which prevents this. CryptDNS plus OpenDNS and you're pretty good. Add a VPN and you're doing better than 99% of people online. Add uBlock Origin, Decentraleyes, Privacy Badger, and block http/s referrer, disable mediaconnect (prevents RPC from seeing your RFC 1918s--private address scheme) and you're largely unidentifiable in the true sense. You can do this for $5 a month by renting a droplet virtual server on Digital Ocean and setting up Streisand. Don't log anything. You will control the VPS/VPN. Use it for your mobile phone and household router (if your router supports this). If not, individual machines, but having a router that does this is key. Use Opera and it's free VPN until you can get something sorted for yourself.

username223 10y ago

You're right, but the article may be confusing two things: First, ISPs tried injecting a header ("supercookie") into HTTP requests, which won't work over HTTPS unless they MITM certificates (not easy). Second, because they provide the last-mile connection, they know your MAC address, connecting location, and billing information, and can see every host you contact. That's a whole lot of surveillance capital.