27 ms·

Comcast is injecting 400+ lines of JavaScript into web pages

999 points by CSDude 9y ago

sccxy 9y ago
That is one reason why HTTPS is must for all sites.
- nkkollaw 9y ago
  Would HTTPS help at all in this case, though..?
  - Xylakant 9y ago
    Yes. You can’t inject code in a TLS-secured connection unless you can MITM TLS and if they can do that, all is lost anyways.
    - izacus 9y ago
      There are several corporate firewall products that can do just that. Comcast can just start demanding that their customers install their root cert and that's that. Remember they are the only venue to access the internet for a lot of people, what are they going to do? Stop using the pretty much mandatory communication and information platform? I'm always surprised just how many people here on this site think you can fight social/political fights with technology. Especially when it comes to entities that can bribe legislation and control your communication.
      - mseebach 9y ago
        They could, but they don't. Until they do, or imply in any way that they might, let's stick to the facts and leave wild, flailing speculation to reddit. Regardless of what an ISP might do, HTTPS everywhere is excellent advice.
        izacus 9y ago
        After all the horrible consumer practices Comcast does regularly you'll still give them the benefit of the doubt? How many times do they have to prove themselves as untrustworthy and consumer hostile that you'll stop sitting there and just hoping that next magical tech will make them stop trying to extract maximum money and inject ads into your stream? Yes, HTTPS is great and should be deployed everywhere. But thinking that they'll just give up on injecting ads into your stream when a large chunk of people use it is hopelessly naive - especially when off-the-shelf enterprise solutions that MITM HTTPS traffic already exist.
        Xylakant 9y ago
        The technical capability to MiTM TLS exists since the very moment TLS was designed. It all hinges on the ability to get a trusted certificate for the domain you want to MiTM. You can do TLS MiTM with Apache if you choose to. Acquiring the Cert has always been the problem and nothing changed in that regard. Strictly speaking, things on that front have become harder since browsers are becoming more and more strict about enforcing TLS security. If Comcast moved to distributing a CA cert to their customers I could quite well imagine that all Browser vendors block that root, as they’ve done with CA that fell out of trust.
        izacus 9y ago
        Comcast and their telco friends just managed to lobby legislation away while completely ignoring complaints and good business. It doesn't look like Americans have any power to fight against these companies so trust into other for-profit companies which are reliant to Comcast & Co. for their profits seems a bit optimistic to me :/
        lostcolony 9y ago
        That post wasn't about legislation. It was about the fact that if Comcast started trying to install root certs on the machines of customers using them for their ISP (which itself is unlikely because of the extra cost both to install, and to troublehsoot, i.e., "why can't I browse anything when I am on my new phone"), Google, Apple, and Microsoft could, and likely would, decide to reject them in their respective browsers as being untrusted. Because they have seen fit to do that in other instances where user security was compromised, and an ISP MITM every bit of your traffic is no less alarming.
      - Crosseye_Jack 9y ago
        > Comcast can just start demanding that their customers install their root cert and that's that. Comcast can demand all they want but they are going to have to hand hold a lot of people though the process. Sure Windows/Mac could offer a nice executable to install it for you but you still have to get people to install it and that’s not something there while customer base will be able to do. The process of installing CA’s on iOS devices involves even more steps. And this is a process that will have to be completed every time an new device is put on their network. What about even more “locked down” systems? Your IoT doorbell? Your networked cctv camera? Your Smart TV? Is it possible? Sure. Is it practical? If kazakhstan couldn’t do it I’m going to struggle to see Comcast pull it off (though if anyone can, it’s prob them). See in a Corp environment where they own all the devices it’s fairly easy to do as most of your deployed hardware if going to be able to remote install what IT asks of them, your mobile devices are going to be enrolled into MDM’s and you will have IT staff on hand to help staff enroll their devices. None of which Comcast have. We are not talking about your avg hacker news reader configuring their devices to get online, we are talking about people like my mother who can just about browse the web and play games on her iPad and struggles to set the alarm on it. How you going to get her to install the rootca without having some do it for her? Sure get the installer to do it? But what about all your existing customers? You going to schedule a call out for each of them? And what about when she gets a new device? You going to make her take the device to the local Comcast store to get it installed? Oh and Chrome and or Firefox could throw a massive spanner into the works by refusing to accept their root cert half way though deployment meaning all those “updated devices’ need to be updated again before they even had a chance to use it at any major scale. Sure it’s possible, I just don’t see it as practical as of today.
        izacus 9y ago
        You're way overthinking this. Go look at how exactly the automated deployment of MITM HTTPS corporate firewall works - it's a few steps affair and gets them 90% there. All they need to do is block YouTube/Google/Facebook until you run the "Comcast internet setup wizard" (remember? those were a thing!) which makes most customer connections MITMable. Then charge extra for all non-MITMed connections ;) Declare Firefox as unsupported, Google will have to cave in to the biggest telco and that's that. This article (and all others about Comcast) clearly proves that Americans have zero leverage over companies like Comcast. The customers are peacfully accepting modification of their network traffic now, why do you think you'll suddenly get any more leverage over a natural monopoly you're forced to use in the future? Especially after dismantling net neutrality?
      - Xylakant 9y ago
        All of these products require that a corporate root certificate is installed on the devices initiating the connection. This would require that all users install the cert on all devices, some of which do not allow such an install. I don’t think you can install certs of your choice on a PlayStation, an Amazon Echo, an Apple TV or any of the home automation systems. This would break all of those devices. It would also break any app that uses cert pinning. All of this is manageable in a corporate setting where you can remotely configure all devices and have a suitable IT support operation, but it would be an absolute support nightmare for comcast if random stuff just breaks when on their network. Think about what happens when Apple TVs or tivio boxes come with a sticker explaining that they don’t work on Comcast networks because Comcast does not allow secure communication. Banks would require their customers not to do internet banking while on Comcast networks since secure connections cannot be established.
        izacus 9y ago
        So they'll be whitelisted. They just need to make use of FB/Google/Amazon/etc. websites impossible without the root cert and they can continue injecting ads into any website content. It's not like they care about injecting ads into PS4 API calls (yet). Also how hard do you think it would be for American telcos to push for inclusion of their MITM certificates? Especially if other companies like Verizon come aboard the profit train?
        Xylakant 9y ago
        Browser vendors distrusted whole CAs for less than full interception. In the end, all of this would require control over the device and Comcast can’t achieve that (unless legislated, but that’s a whole different ballpark)
      - dahart 9y ago
        > I'm always surprised just how many people here on this site think you have fight social/political fights with technology. Especially when it comes to entities that can bribe legislation and control your communication. I don't understand. Your second sentence seems to contradict your first; Comcast bribing legislators is a social/political attack. What did you mean? I currently see more hope in tech solutions than political solutions to the problems of privacy, net neutrality, and script injection. We have the option to use content and routing encryption technology that looks something like TOR or I2P. Instead, we're asking politicians who don't understand the tech to protect us from ISPs who will never stop trying to leverage anything they can find in our traffic. Allowing Comcast to see the traffic at all is the problem, and politics will never prevent that. If it's apparent to you that the political fight is more winnable, or that technical approaches to privacy are doomed, then what is the social/political solution to internet privacy? Because we don't have any right now, and it looks like we're losing the political war.
    - nkkollaw 9y ago
      It would make it harder, perhaps.
  - Crosseye_Jack 9y ago
    Yes, they couldn’t modify the webpage without breaking the cert signing giving the user an error, installing a ca cert on your devices and doing a mitm on your traffic (which would be hard to predict if your device has their cert installed) or getting a already trust CA to forge Certs for them which once recovered would get that trusted CA dragged though the mud by the major browsers.
vages 9y ago
Most interesting part was the reply from the Comcast employee.
- throwaway613834 9y ago
  Specifically the last sentence!
  - tylerruby 9y ago
    For those that haven't seen it: Customer: "Comcast has my phone office number, my cell for texts, my email, and my home address, yet they choose to molest my requested web pages by injecting hundreds of lines of code." Comcast Response: "The notice is typically sent after a customer ignores several emails. Perhaps some of those ended up in your spam folder?" To me this sounds like a crazy ex-lover. "You didn't respond to my texts so I came to your house." No, Comcast, don't do that. They ignore your emails because you're trying to sell them something they don't want. Here is the Twitter of the Comcast rep for anybody interested: https://twitter.com/jlivingood https://twitter.com/jlivingood
    - sleavey 9y ago
      And I bet that by "ignore" they mean "didn't allow remote tracking images in emails to be loaded therefore stopping us from knowing if, when and where the email was viewed".
- exikyut 9y ago
  Yes, indeed it was. It's a fairly standard, unsurprising response for this situation; doesn't try to be defensive, doesn't try to provoke. [Edit: I'm horribly under-perceptive, after reading other comments I see I'm a bit off.] But... this bit. > ... [JL] This is our web notification system, documented in RFC 6108 https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108, which has been in place for many years now. ... Oh, interesting, what Internet technology are they using? > "RFC 6108: Comcast's Web Notification System Design" > February 2011 Cue jawdrop. My instinctive response was to WAT and think "this is not what RFCs were for..." But then I read this part, > Status of This Memo > This document is not an Internet Standards Track specification; it is published for informational purposes. > This is a contribution to the RFC Series, independently of any other RFC stream. The RFC Editor has chosen to publish this document at its discretion and makes no statement about its value for implementation or deployment. Documents approved for publication by the RFC Editor are not a candidate for any level of Internet Standard; ... Hmm. Reading through, this outlines a way to avoid using deep packet inspection by using Squid and Tomcat instead. Initially when I read this my brain was sort of going in the direction of "this kind of thing is where the net neutrality repeal thing started..." but now I've spent a bit of time reading it I don't actually think my snap response was particularly on point. This is a bit of a stream-of-consciousness but I wanted to draw attention to that RFC.
exikyut 9y ago
The gigantic image: https://i.imgur.com/kN2rMhK.jpg https://i.imgur.com/kN2rMhK.jpg (source: http://comcastsupport.i.lithium.com/t5/image/serverpage/image-id/34982i05D20DB4C25229CF/image-dimensions/200000?v=1.0&px=-1h http://comcastsupport.i.lithium.com/t5/image/serverpage/imag... - URL manually edited to display largest possible size) I paged through the JS curiously, and found the URL bnpsa.g.comcast.net/images/mydevicealert/browser/. I wondered what would happen if I hit that from my ISP in Australia. I was surprised: I got an NXDOMAIN back. But I discovered that googling the above URL as a quoted string finds a bunch of copies of the JS scattered around the Internet. Might be useful. So then I tried hitting bnp-service-alerts.gslb2.comcast.com/images/. This actually resolved, and Chrome hung at "Connecting...". After rechecking the URLs I noticed this one was referenced in the JS as HTTPS, so I added that, and promptly got 403 Forbidden. Question to anyone on Comcast [edit: which has been answered]: does http://bnpsa.g.comcast.net/images/mydevicealert/browser/ http://bnpsa.g.comcast.net/images/mydevicealert/browser/ resolve for you?
- mehrdadn 9y ago
  > Question to anyone on Comcast: does http://bnpsa.g.comcast.net/images/mydevicealert/browser/ http://bnpsa.g.comcast.net/images/mydevicealert/browser/ resolve for you? Nope, it does not for me. Non-existent domain.
  - exikyut 9y ago
    Thanks!
  - pdpi 9y ago
    That's the sort of domain I could very well see only resolving from comcast DNS, and them not propagating it anywhere else.
    - deleted 9y ago
      [deleted]
- deusum 9y ago
  Server not found.
ksk 9y ago
I wonder if a website could sue Comcast for copyright violation.
- exikyut 9y ago
  Unfortunately if this were to happen and it succeeded, the precedent would kill the Web Archive. :(
  - Keyframe 9y ago
    Not necessarily. Comcast derives from your work in order to exploit it for commercial purposes. Archive does not. A significant difference.
  - gpm 9y ago
    The Internet Archive is undoubtedly claiming fair use, even if you suppose the works they create aren't derivative works they are still creating copies of and distributing copyrighted material, which violates copyright law absent fair use.
- votepaunchy 9y ago
  Or just enable HTTPS.
- Buge 9y ago
  How is it copyright violation? If this is copyright violation, is it copyright violation of Comcast allowing you to download a file off the internet?
  - lolc 9y ago
    Copyright is "all rights reserved" unless otherwise stated. By publishing a website, you don't give me the right to alter and re-publish it. Whether injecting ads into a website means a derived work was created would have to be found out in court I assume.
  - regularfry 9y ago
    The argument is that it creates a derivative work. The right to create derivative works is separate to the right to distribute or reproduce the content, which is how Comcast is allowed to get the original website into customers' browsers. Comcast are playing into this interpretation by adding their own license to the code they're adding.
tosh 9y ago
"Comcast's Web Notification System Design" https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108
- exikyut 9y ago
  I mentioned my reaction when I found this elsewhere in this thread: https://news.ycombinator.com/item?id=15890746 https://news.ycombinator.com/item?id=15890746
- lsmod 9y ago
  "Must Only Be Used for Critical Service Notifications." [0] https://tools.ietf.org/html/rfc6108#section-3.1 https://tools.ietf.org/html/rfc6108#section-3.1
  - mtgx 9y ago
    > and is instead based in open IETF standards and open source applications. Why did the IETF ever agree to standardize this? It reminds me of their standardization of Cisco's "lawful intercept" router backdoor protocol. https://tools.ietf.org/html/rfc3924 https://tools.ietf.org/html/rfc3924 https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/BlackHat-DC-2010-Cross-Attacking-LawfulI-Intercept-slides.pdf https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/Bl... I guess this is what you get when the IETF literally has NSA agents as chairs of its groups. https://arstechnica.com/information-technology/2014/01/nsa-employee-will-continue-to-co-chair-influential-crypto-standards-group/ https://arstechnica.com/information-technology/2014/01/nsa-e...
    - garaetjjte 9y ago
      These are only informational RFCs, which can be published by anyone. >This RFC is not a candidate for any level of Internet Standard. The IETF disclaims any knowledge of the fitness of this RFC for any purpose
      - SAI_Peregrinus 9y ago
candiodari 9y ago
The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communication. Look at how easy it is to see exactly what they're doing ... All of it screams "no double digit IQs anywhere near this thing". And yes, I mean, I know that's not true. Their people are not this stupid (though some must be). But they do this anyway. The organisation does business analysis at the level of a 5 year old, codes like a 10 year old, obviously this has not passed legal review, ... How can an organisation that executes this badly become this big ? I mean, I know the answer is "government" and government making them a monopoly, but still. WTF.
- exikyut 9y ago
  Yep. The random classList polyfill at the bottom was a nice touch. As I scrolled to this bit I was initially like "oh this'll be nice they encrypted some of--oh. :(" My favorite bit was the "this detects the browser type and version" snippet that was copyrighted 2001. Nice! I think the move to open-source the code was a ham-fisted way to get the "we're modifying copyrighted documents in flight" part past the lawyers. It's admittedly a pretty decent legal move.
  - icebraining 9y ago
    I think the move to open-source the code was a ham-fisted way to get the "we're modifying copyrighted documents in flight" part past the lawyers. It's admittedly a pretty decent legal move. I don't get it, how does that work?
    - Sephr 9y ago
      He is mistaken, it has nothing to do with it. My code is included in Comcast's injected code, but that doesn't mean any of Comcast's liability has shifted to me.
- 9y ago
metaphor 9y ago
J. Livingood (a Comcast VP) responded to the OP: > [JL] We are not trying to sell you a new one. If you own your modem we're informing you that it is either end of life (EOL) or that you are about to get a speed upgrade that the modem will be unable to deliver. Incidentally, Livingood is a co-author of IETF RFC 6108, which he has conveniently linked. From the RFC's general requirements numero uno: > R3.1.1. Must Only Be Used for Critical Service Notifications. Additional Background: The system must only provide critical notifications, rather than trivial notifications. An example of a critical, non-trivial notification, which is also the primary motivation of this system, is to advise the user that their computer is infected with malware, that their security is at severe risk and/or has already been compromised, and that it is recommended that they take immediate, corrective action NOW. As composed as Livingood's response was, a modem at EOL and/or incapable of supporting an incremental speed upgrade doesn't strike me as critical. To be sure, Comcast is scheduled to increase speeds by 12/19 (at least in my region): 10Mb->25M, 25M->60M, 75M->100M. Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. It would also be interesting to learn if the OP received this message on multiple instances. If yes, it would be in violation of its own requirement--in particular, R3.1.8. User Notification Acknowledgement Must Stop Further Immediate Notifications, which itself is contradictory in its use of must and should: > Additional Background: Once a user acknowledges a critical notification, the notification should immediately stop. EDIT: Apparently, Livingood is an executive.
- glenstein 9y ago
  >As composed as Livingood's response was, a modem at EOL and/or incapable of supporting an incremental speed upgrade doesn't strike me as critical. Exactly. And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" is such a hair-splittingly asinine response considering the rather serious breach of trust posed by the notification system.
  - thaumaturgy 9y ago
    This is just about the worst possible way to notify a customer of any issue anyway, because it legitimizes those stupid ad-based malware popups that have become so prevalent. As more Comcast customers receive JS-based notices like these injected into their normal web traffic, any enterprising jerk can clone the message, change the links to point to their own phishing site, change or omit the phone number, and snag a whole bunch of unsuspecting Comcast customers.
kerpele 9y ago
I love the Comcast representative's comment basically saying "we've been doing this for years, too late to complain now"
jimnotgym 9y ago
I'm struggling to find it, but there was a article a couple of weeks ago about communities forming their own isps. It's beginning to seem very sensible
- bluepeter 9y ago
  https://www.reddit.com/r/Documentaries/comments/7dvqjd/people_building_their_own_internet_in_detroit/ https://www.reddit.com/r/Documentaries/comments/7dvqjd/peopl...
Tepix 9y ago
If my ISP were to try this i would sue them for § 303a Datenveränderung
deleted 9y ago
[deleted]
cies 9y ago
So how exactly is this not criminal?
- betterunix2 9y ago
  They are not blocking, throttling, or interfering (in any way that harms functionality) with legal applications; in a nutshell that is 2015 requirement. Now, if that Javascript happens to interact badly with some particular web page, then you could complain to the FCC as long as the 2015 rules remain in effect (which is more than a week, for what that's worth).
  - danschumann 9y ago
    In a way it throttles.. lets pretend they included 4,000 lines of code in each website, or a 1gig of data. It also throttles the experience by taking up processor cycles to render the data. It harms functionality because the popup covers usable website area, and what was meant to function without closing a popup does not. It blocks screen real estate. I really hope someone makes a case.
  - freen 9y ago
    It's arguably a copyright infringement.
  - cies 9y ago
    I think I've sent an envelope. Digital envelop. They're the mail service. And they secretly mingle with it. That's illegal in my book. I guess the EFF has tried this defense of our freedoms...
gmac 9y ago
Vote with your feet if you can. Meanwhile, use a VPN. https://github.com/jawj/IKEv2-setup https://github.com/jawj/IKEv2-setup https://github.com/trailofbits/algo https://github.com/trailofbits/algo etc.
a_imho 9y ago
Isn't this against the CFAA? Like Comcast is acting without / exceeding authorization?
bluepeter 9y ago
Comcast VP suit isn't helping his cause much on Twitter https://twitter.com/jlivingood/status/939248407562080261 https://twitter.com/jlivingood/status/939248407562080261 Oh and of course he's also retweeting a lovely Net Neutrality tweet... https://twitter.com/feamster/status/938236691126636546 https://twitter.com/feamster/status/938236691126636546
- cornchips 9y ago
  Jason Livingood: "This is a web notification system that presents an overlay service message for non-TLS sessions. Documented in RFC 6108 & in place for many years - https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108 . In this case the alert informs customer of need to upgrade an end of life device." https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108 Comcast's Web Notification System Design Yeah, cuz we're all supposed to know about rfc6108.. Guess I have some catching up to do on "Internet Engineering".
deleted 9y ago
[deleted]
actuator 9y ago
Unfortunately, in the US and Europe at least most people will care about this and even get a response. I think 4-5 years back when I was in one of the cities in which MTNL is there in India, ads were being served in the same way on MTNL. They were injecting an ad serving pop-up on every page served on HTTP. The worst thing was it sometimes used to show some sketchy virus ads also. I complained about it multiple times, never even heard back from them.
- menckenjr 9y ago
  It strikes me that the best way to combat this might be in the browser itself - intercept and remove the offending javascript (or better, redirect its execution into a walled sandbox where it thinks it's setting cookies and downloading code) and remove it from the main page viewing stream.
- mavendependency 9y ago
  You just needed to change to google DNS, which you would have to do anyway - AWS CloudFront doesn't resolve at all in some circles.
BrandoElFollito 9y ago
When reading about Comcast I was always wondering why they have no competition when everyone who comments is complaining. I live in France and use Orange as my fibre provider. 1 Gbps/250 Mbps without constraints. I used to have Free which was great but did not offer fibre when fiber was installed. I switched to Orange in 5 min via a web page. I have another possibility (SFR) but they are despicable liars and for this reason alone I scraped them. This is France, where competition is not a national sport so I was expecting the US to have 5 other companies banging on the door.
- Chriky 9y ago
  In a natural monopoly regulation /increases/ competition and freedom for the consumer. The BBC had an article about this a few years ago [0]. Basically the highly regulated countries had cheaper and faster internet. > Rick Karr, who made a PBS documentary in which he travelled to the UK to find out why prices were lower, says that the critical moment came when the British regulator Ofcom forced British Telecom to allow other companies to use its copper telephone wires going to and from homes. > But US regulators took a different approach. Rather than encouraging competition between operators using the same network, the US encouraged competition between different infrastructure owners - big companies that could afford to build their own networks. > Some believe that UK-style regulation is bad for competition and innovation, however, and suggest that the US is already one of the world leaders in broadband. [0] http://www.bbc.co.uk/news/magazine-24528383 http://www.bbc.co.uk/news/magazine-24528383
  - tankenmate 9y ago
    This UK model is closely related to how roads are funded, as mostly govt funded monopoly on infrastructure (with occasional public private financing, which comes with its own issues, toll roads etc) and common access paid for by users (fuel tax, road tax, etc). The US model is closer to US railroads model, although not entirely accurate, analogy; largely privately owned with some govt owned, funded by large infrastructure companies that charge customers for usage and also due to infrastructure costs are rarely duplicated in close proximity. It's had issues with off and on regulation, profitability, localised monopolies that have a tendency to over charge when they can get away with it.
hardlianotion 9y ago
This is the bit I find amazing: > Comcast has my phone office number, my cell for texts, my email, and my home address, yet they choose to molest my requested web pages by injecting hundreds of lines of code. [JL] The notice is typically sent after a customer ignores several emails. Perhaps some of those ended up in your spam folder? So ignoring spam entitles you to this behaviour?
- oxymoran 9y ago
  What he is saying is that they exhausted all other contact methods. If they stopped after the email and let the persons modem stop working, they would have likely been livid about that as well. Look, I don’t like Comcast any more than you do. But at some point, you need to recognize your biases when evaluating your enemy. I thought this was some nefarious attack based on the headline, but it’s just a critical system message that was thoroughly explained by an executive and you all are freaking out...
  - Operyl 9y ago
    The problem here is that I've had the exact same thing happen, and zero attempt was given. The stupid part? My modem was not EOL, was a BYOM (bring your own modem) that had many years left before EOL. I'm pretty damn sure they're using this as a "first line of contact," not final.
  - bo1024 9y ago
    (a) It's not critical, it's a marketing message. (b) Pretty sure if the person's modem were to actually stop working, they would get in touch with their ISP. Man-in-the-middle attacks by an internet provider are hacking and a breach of trust, and should be criminal in my opinion.
  - csydas 9y ago
    I sincerely disagree, especially as per the report Comcast's own second level confirmed there was no need to replace the modem. It was an automated advertisement done in a very not good way; Comcast's own billing system notifies you of just about everything else; you can forward your billing statements and other such information to other emails, why not this? The reason everyone is freaking out is because they feel pretty darn strongly that the ISP should not be injecting code into webpages delivered, especially not in an automated way without some oversight. If this is to be a service, the bar for what is necessary for such information must be far higher than "an automated system decides it's time." We get into really scary territory just by doing this in the first place, but to use it for advertisements or basic maintenance? That is a misuse of such technology. And no, I don't think people would be as livid as you suggest if the modem just broke; ISP modems are fragile little things, and it's not uncommon to go through them. I don't think I've had a single ISP where I didn't have to eventually, and the natural progression for each one (Comcast included) was: 1. I called the ISP 2. We did some test with support 3. Once we did the Speedtest / reboot song and dance, a new modem was issued that day. This is expected; if I had asked for such a service from Comcast, this would be a different discussion entirely (an Opt-In service), but as it is, it's a pretty lame reason to suggest that Comcast needs to be able to inject data into pages I load. And I rather liked Comcast for the year I had it - I wasn't keen on being on them since I would rather have been with our Municipal, but the place I was at was not yet in a service area for the municipal. More or less, even with my support and canceling experience, I was fine with the service I received. This would have upset me considerably.
pdkl95 9y ago
Anybody want to sue them for copyright infringement? I doubt they acquired authorization to make derivative versions of your website.
pvsukale3 9y ago
BSNL- The state-owned broadband provider here in India does this regularly. They intercept HTTP traffic and redirect it to their plans page. The saddest part is no one really cares about this here.
jijji 9y ago
I've worked at comcast too for a while as a consultant, and I think the problem is that they take people that were working in customer service and promote them to senior engineer roles and management roles. This is why they hire consultants when everything goes upside down. Alot of telco's do this, I've seen this in many datacenter environments with ISP's and telcos. You got guys making decisions that don't really have the background to be making those decisions.
deleted 9y ago
[deleted]
gbraad 9y ago
... And that is why you open https.
tjoff 9y ago
How fucked up are we when we live in a society where this not only dreamed up but actually believed to make sense and implemented. Yes, it speaks volumes about comcast but i also speaks about the culture where comcast exist. And even IF there is backlash from this the whole idea that they might have gotten away with it is just absurd.
bluepeter 9y ago
Ignore their spammy emails? Per their VP, they are totally going to up their game and inject their "notifications" in your everyday Web traffic. https://twitter.com/jlivingood/status/939848009386549248 https://twitter.com/jlivingood/status/939848009386549248
- jlivingood 9y ago
  What I meant in the context of that exchange was that the notifications come only after for example multiple emails have not resulted in the device being replaced.
  - freen 9y ago
    If it is truly critical, disconnect the device and use the disconnected landing page as your means of communication. Anything else fails to meet the criteria of "critical". If I buy a crappy 802.11b wifi dongle, are you going to inject JS too?
pleasecalllater 9y ago
You have really pathetic law in the US. After something like that in Europe, the company managers would have really huge problems. And in US people seem to be happy about that. If they wouldn't, it would be changed.
- coldcode 9y ago
  No one is happy, but we have almost zero opportunity to affect change. Look at the FCC's deliberately crappy email campaign for responses on eliminating net neutrality. They won't even release the data to a state DA. Between gerrymandered districts and lock step Republicans controlling everything currently, not to mention local monopolies by the biggest ISPs, our ability to affect change is virtually zero.
- m333t 9y ago
  In the US, we have cities with higher populations than your countries. Lots of people care but their opinions are rendered meaningless by the millions of people who don't.
guest 9y ago
Vote republican, less regulation and looser laws van fix this! I know what you’re going to say - not many companies can afford to pass the threshold to establish themselves on the market as an ISP - that is however easily fixed by givning large incentives to the giants and then hope it will go to make it better for the little guy and not corrosive practises & profit. Whoever didnt se this coming was blind, at some point ppl will realise that jumping onto other nets popping up will be worth it. IM still waiting for the first real netbrowser (excluding the formerly US military funded Tor - which simply lets u access censored and hidden content) that gives you access to a handful of the largest net alternatives only. How no one has commented on how this is illegal is something clearly lacking from the discussion. You create a transaction with one other part when you visit a site, you even bloody normatively shake hands... IF this stands it either means the marketplace has fallen or simply that USA is so fatally corrupt that it cant uphold the sole basis on which it functions by regressive (read: republican) ”theory”.
polock 9y ago
Why are Comcast, Uber like companies trying to be evil? I really hate these.
w_t_payne 9y ago
I thought HTTPS was supposed to prevent this sort of man in the middle attack? (Or at least make it harder) -- and I thought that most websites used HTTPS these days... or am I misunderstanding? If they are able to do this, and are injecting JavaScript for something as low-return as online ads, then what is to prevent them from changing the news headlines on <insert your news website of choice here>, or the stock ticker feed... How do we know that they aren't? Do we, as a community, have any mechanism to detect if these sorts of attacks are occurring?
- singlow 9y ago
 HTTPS does prevent this. This can only be injected on non-secure connections.
 - shrimp_emoji 9y ago
 Use HTTPSEverywhere on your browsers, and then enjoy the "You're close to your monthly limit!" pop-up on the Steam Store!
 - yjftsjthsd-h 9y ago
 What?
 - charleslmunger 9y ago
 I think the intent was to comment that extensions don't protect programs with embedded web views, like the steam store. I'd hope the steam store is using https though...
 GranPC 9y ago
 Only on checkout pages. For the rest of the storefront they actually redirect you from HTTPS to HTTP.
 9y ago
gigatexal 9y ago
Let me just drop Comcast like a bad habit. Oh wait. I can’t. There’s not another provider in my area with similar speeds. So I’m screwed.
- jswizzy 9y ago
  I know and 90% of the web wants to give Comcast even more power to keep out competition by turning the Internet over to lobbyists.
  - marviel 9y ago
    90% of the web? Who specifically are you talking about? Is this big-startup-co or...?
- bunderbunder 9y ago
  For my part, I'm quite happy with the not-Comcast I have at home, compared to the Comcast at my coworking space. The nominal speed is 1/10 as much, but the actual difference in actual experience is much smaller, because the not-Comcast provider does a much better job of actually delivering on the speeds they claim to be selling me. It's really only a noticeable difference when I want to do something like download an OS install image. Which happens infrequently enough that, for me, going with Comcast would have worked out to something on the order of getting that image an hour faster for $200 per time I do it. More importantly, not-Comcast stays up. The coworking space's Internet service is maddeningly intermittent.
RKearney 9y ago
They’ve been doing this for at least 5 years. https://gist.github.com/ryankearney/4146814/42d9ca5ec42fe43c5f7af69a60ae4c60c9bb567f https://gist.github.com/ryankearney/4146814/42d9ca5ec42fe43c...
AndyMcConachie 9y ago
TFA mentions a Comcast tech referencing RFC 6108: "[JL] This is our web notification system, documented in RFC 6108 https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108, which has been in place for many years now." However, RFC 6108 requirement for use R3.1.1 states: R3.1.1. Must Only Be Used for Critical Service Notifications Additional Background: The system must only provide critical notifications, rather than trivial notifications. An example of a critical, non-trivial notification, which is also the primary motivation of this system, is to advise the user that their computer is infected with malware, that their security is at severe risk and/or has already been compromised, and that it is recommended that they take immediate, corrective action NOW. RFC 6108: https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108
- kkmx 9y ago
  Yea they don't really follow that RFC, they just use that RFC as an all-justification for their action.
- robterrell 9y ago
  I'm sure the comcast "tech" knows what's in the RFC. Look in the top-right corner; he's one of its authors. He's also replying in this thread.
  - AndyMcConachie 9y ago
    Do you consider upselling subscribers on modems a critical service notification? I don't.
visarga 9y ago
Apparently the internet is too important to let Americans have it unfiltered. Let's face it - there are people who don't want to let us access the net directly, even though its importance for the public is incalculable.
thriftwy 9y ago
You take one packet from web server, you deliver a different one to the client. That's the definition of fraud.
kkmx 9y ago
This is why we need to get everyone to move to HTTPS ASAP.
free2rhyme214 9y ago
Why don't they use the Chrome Extension - uBlock origin?
- joshribakoff 9y ago
  Ads from website owners are not new, what is new is ISPs injecting into other people's pages, this sets a new precedent. Its a fundamental principle that was violated, so saying "just block it" is like saying people in China should just use a VPN... while a valid point, its still an outrage to some people that a government/ISP would tamper/block your traffic. Not trying to equate Comcast to China by the way, just using a metaphor
shapiro92 9y ago
Can someone tell us if this is legal?
santoshalper 9y ago
I am not fan of Comcast, but this is a bit of a tempest in a tea kettle. In over a decade of having their service, I have only seen them use this once, when my cable modem was nearing EOL and upgrading to a new modem that supported DOCSIS 3 (I think?) gave me a big speed boost. I probably wouldn't have looked at snail mail or email from them, so I appreciated it. I guess their is a "slippery slope" argument to be made here, but in the current incarnation, this is innocuous.
newshorts 9y ago
This behavior is the reason why I’m short on Comcast. They are creating space for an ethically centered company to compete on concerns having nothing to do with internet speeds.
freen 9y ago
In my humble opinion, there is no situation that would merit javascript injection that would not rise to the importance of fully disabling someone's internet connection, if only temporarily. Case #1: Malware. Full disconnect, redirect to explanation. Case #2: EOL hardware causing interference. Full disconnect, redirect to explanation, method to rectify. Case #3: Consumer not getting what they paid for: email me/snailmail. I think the RFC makes it clear: this should not be for trivial notifications, only critical notifications, and if it is truly critical, it should disable the entirety of the connectivity until the user acknowledges/remedies/whatever. I call shenanigans.
deleted 9y ago
[deleted]
swayvil 9y ago
Mediacom does a little injection too. Mostly to warn you about something. Get a big red banner now and then. But that's the just the visible stuff, so who knows? I thought that was illegal. Like, it's editing somebody else's copyrighted work or something.
Brybry 9y ago
Comcast is not alone in this. Cox Communications has been injecting code into HTTP traffic for years. I think sometime around 2008 I first saw them do it (I noticed NoScript blocking a script on a page that it wouldn't normally). If I remember correctly, following it to its source hinted that it was a test for some alert system. In 2012 I saw them injecting a script to notify people that their email servers were down ( https://www.dslreports.com/forum/remark,27826161 https://www.dslreports.com/forum/remark,27826161 ) though the paranoid in me thinks that was an innocuous way to test how acceptable altering traffic would be. The escalation I've seen in the last couple of years is the ability being used for Cox customer surveys. As far as I know they haven't injected anything into my SSL/TLS traffic... yet.
- CydeWeys 9y ago
  > As far as I know they haven't injected anything into my SSL/TLS traffic... yet. You say that as if it were even possible. Or are you referring to the use of SSL stripping? HSTS preloading (or visiting a site with HSTS headers that you've previously visit) will protect you from even that.
- jakeogh 9y ago
  They did that to me a few months ago. I called up and canceled my decade old ~$90/mo acct on the spot. Tethered to 4G, works fine.
- thescriptkiddie 9y ago
  Can confirm. I didn't even notice until they started using their script to inject popups telling me I had "exceeded my data allowance". I literally canceled my Cox Communications account on the spot.
poach123 9y ago
Not JavaScript is 400+
poach123 9y ago
Not JavaScript is 400+
fuzzieozzie 9y ago
Comcast forced me to upgrade a perfectly acceptable modem so I would have to option to have higher speed service (which I do not want)! Here's what they did: 1. asked me to upgrade the modem (emails and letters) 2. Inserted a filter on my line so I lost my connection 3. I bought a new modem (not realizing they stuck a filter there) 4. They removed the filter I guess this approach does not scale as well as the 400 lines of Javascript!
- timzentu 9y ago
  What spec of DOCSIS was your old modem? If it was 1.0, 1.1, or 2.0, sorry you lose all support, the older specs had hard bonded channels that HD TV on them after the swap that they informed people of for 2 years before it happened. And they put TV on them since they were degrading channels due to overuse across the entire network (as in across the country). The later specs allowed for floating channels based on channel maps, which allowed Comcast to bypass those degraded channels. Note: I'm not an apologist, but I worked for Comcast and for a subcontractor. Comcast treated (at least in my opinion) their customers like wallets that called and complained, but under the subcontractor I saw that since they didn't rewire 100% of all networks purchased, it was common that the older lines were causing the degradation and also reflection on other RF channels sometimes on the other side of an area even. Now if Comcast invested in their network as opposed to buying other companies and calling it investment, this might have been fixed, but that would be decades vs. having every modem that wasn't compliant to the new spec swapped.
  - uxp 9y ago
    The SB6121 is a DOCSIS 3.0 4x4 modem rated for 174mbps, SB6141 is a 8x4 rated for 343mbps, and SB6181 is a 16x4 rated for 686mbps. Outside of their capabilities, the hardware on them are nearly identical. There is nothing "EOL" about the SB6121 except for the idea that it's unable to support 200mbps. It's a perfectly good entry-level modem capable of offering speeds that are over 7 times the minimum definition of "high speed internet".
- voidwtf 9y ago
  I don't understand the general attitude against forced modem upgrades. If you lease your modem it's as easy as walking into a Comcast store and swapping it for a new one. If you own your modem, pick the newest model of modem that fits your needs. The newer modems support more channels and newer modulation/technology. This isn't just about supporting newer speeds. In order for them to support those newer speeds for other customers they have to upgrade their equipment to support more channels and newer modulation/technologies. At some point these older technologies are not just wasting resources by being less efficient, but are preventing the company from upgrading their equipment. The reason I don't understand, is because it's common to see people complaining about the state of broadband in America compared to other countries. Yet Comcast is probably the most progressive as far as pushing the technology goes. Don't misunderstand me, I believe Comcast holds a near/total monopoly in many locations around America but at least they're progressive with their network and technology despite the lack of meaningful competition.
knodi 9y ago
Crapcast. If only we in the US had more options, this kind of shit wouldn't fly to well.
- rocky1138 9y ago
  Rogers and Cogeco both do this in Canada, as far as I remember.
  - knodi 9y ago
    Ya, I believe CA is in a worst position than US (in terms of a competitive market).
sathackr 9y ago
As a big ISP that stands to profit from the current FCC standpoint, Comcast is in the crosshairs of the internet community. But if what has been said by all parties is true, I can't find significant fault with Comcast. Here is the text of the "ad" (typed from viewing the attached image in the OP): Get ready, we're increasing Internet speeds in your area. Our records show that the modem you currently have connected to our network won't be able to handle these faster speeds, so we recommend updating your equipment. Buy from a Retailer Before you make your purchase, visit https://mydeviceinfo.xfinity.com to view a list of modems certified to work on our network with your speed tier. Lease and XFINITY Modem Call 1-855-242-2876 and we will send you a Self Install Kit Equipment Update Seems appropriate and to the point. They tell the customer they can either go buy a modem from a retail store, or lease one from XFINITY. Hardly a high-pressure ad. Injecting anything into a website makes me feel a bit dirty, but nobody has refuted Comcast's claim that other communication methods were tried first and that this was more of a last resort. Speaking in general terms because I'm not involved deeply with DOCSIS, older devices are less efficient and generally use more spectrum(even in a cable, there are RF spectrum limitations) to deliver the same speeds. Customers using old devices that don't support the newer and faster standards reduce the total bandwidth available to all customers, increasing costs for both Comcast and its customers. edit: fix formatting. HN needs a preview button.
- rdiddly 9y ago
 It's most likely Comcast's own fault the other messages were ignored. They pollute every communication channel with marketing spam. The Boy who Cried Wolf didn't have man-in-the-middle technology available but the lesson remains the same: if you want to be heard, shut the fuck up until you've got something to say.
- david-s 9y ago
 I recall having this occur a while back. I do not recall receiving any email to my actual email address (maybe they used the comcast one?) nor my physical address, nor seeing any notification in the billing portal.
butterfi 9y ago
I dropped Comcast for a provider that doesn't do this, but given Comcast is a monopoly in many areas, I know this isn't a good option for everyone. But frankly, the only leverage we have over these people is how we spend our money.
Declanomous 9y ago
I'm annoyed by this on several levels. The biggest issue is that I'm using an Arris SB 6121 and I'm getting notifications that my modem is EOL. However, the SB6121 is listed as a supported modem for my speed level on their supported modems page. If I go to their supported modem page, I literally get a page where my current modem is shown as not supported, and the exact same modem is shown next to it as "supported." I'm calling Comcast, and if this isn't immediately resolved I'm filing a fraud claim with the Illinois attorney general. This is the third or fourth time I've had a supported modem that Comcast has claimed isn't supported, and I'm sick of jumping through hoops getting this resolved. Every time this happens their customer service reps tell me that the only way to avoid this is to use one of their modems. I'm sick of this. What a terrible company. Fix your shit before you start injecting garbage into the websites I visit. edit: Proof https://imgur.com/lzKBkMs https://imgur.com/lzKBkMs
- timzentu 9y ago
  FCC complaints are usually more effective, never dealt with one in the current shitty administration, but legally the FCC requires resolution within 7 business days, or at least a plan of action if resolution isn't possible for completion. I used to receive the emails and all the people on an FCC chain put pressure on the lower levels.
  - Steeeve 9y ago
    I can confirm that Comcast responds to FCC complaints effectively. I used that route when they were my provider after a series of unhelpful technical support requests.
    - craftyguy 9y ago
      I'm skepitcal that the current FCC would give a shit about this complaint since it reflects poorly on their supporter (an ISP.)
  - Declanomous 9y ago
    I'll file a complaint with the FCC as well then. I'll probably file one with the City of Chicago too. Might as well put as much pressure as I can on them, because this is ridiculous. I don't care if the issue is bureaucracy, incompetence, or greed, but I know filing lots of complaints with regulatory bodies generally solves the first and the third issue well, and motivates companies to fix the second issue too.
jchavannes 9y ago
This is (one of the reasons) why you should use HTTPS Everywhere and enable blocking of all unencrypted requests. This isn't new. You're susceptible to even worse MITM attacks if you allow unencrypted traffic when using public wifi.
esP3FJhD 9y ago
Do they modify the CSP, or is it not an issue since sites that bother with a strict CSP probably use HTTPS anyway? https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
hi41 9y ago
Does Comcast inject this code in https urls or just http urls? Since https transfer is encrypted I suspect the code injection can't be done. Can someone please tell if my reasoning is correct?
- derimagia 9y ago
  Yeah that's correct, they can't do it in https unless they did something with root certs, which would be 1000x more messed up (And that's saying a lot because this is already pretty despicable). At any rate if they were doing that browsers would revoke the CA.
  - hi41 9y ago
    Thank you, Derimagia.
jancsika 9y ago
Could Comcast hijack DNS and redirect https requests to a page explaining the issue with a button that lets the user go back to the site they wanted to visit? Or do modern browsers mitigate that?
- derimagia 9y ago
  They could but because of HSTS (https://blog.stackpath.com/glossary/hsts/ https://blog.stackpath.com/glossary/hsts/) which would largely mitigate it. They have a preload list in browsers too. But if a site wasn't using HSTS then yeah they could do that. I don't think that's better per-se.
Balgair 9y ago
When folks are getting a new modem via this process, are they signing up for a new contract? What does that contract say, in reference to the issues that going on with NN? Might this perhaps be a way to get people to sign new contracts in preparation for a change to NN being more favorable to the ISPs?
Veratyr 9y ago
Could this legally be construed as creating a derivative work under copyright law? As a site owner, could I prosecute Comcast for infringing on my rights by altering the content of my pages?
- philjohn 9y ago
  That was my first thought - the web page is copyrighted code. Unfortunately, expect to see more of this happening with the useful idiot Pai running the FCC.
brian-armstrong 9y ago
I'm concerned about inviting the Comcast evildoers to here for discourse. It feels like it normalizes what they're doing and sets a bad precedent. Guys like that should be blacklisted from tech, not invited in for tea and crumpets.
kyle-rb 9y ago
>Why did you vandalize my car!? >>Well you weren't responding to my emails, so... >But you can't just do that! >>No, no, it's fine. I've been doing it for years, and I've documented the practice right here.
apl002 9y ago
How can an ISP seriously do this? Is the random domain even aware than comcast is injecting JS into their site?
chrissnell 9y ago
Comcast has been doing this for years and not just to push modem upgrades. They do it for their stupid WiFi app, too: Scroll down this link slightly for a screenshot: https://nas-row.com/showthread.php?t=696 https://nas-row.com/showthread.php?t=696
Aaron1011 9y ago
From Comcast's RFC that's linked in the thread: > R3.1.1. Must Only Be Used for Critical Service Notifications > Additional Background: The system must only provide critical notifications, rather than trivial notifications. An example of a critical, non-trivial notification, which is also the primary motivation of this system, is to advise the user that their computer is infected with malware, that their security is at severe risk and/or has already been compromised, and that it is recommended that they take immediate, corrective action NOW. Not only is Comcast trying to justify this awful practice, they picked one of the worst possible examples to do so. There is no set of circumstances under which a 'You have malware!' popup should be taken seriously.
tehlike 9y ago
Let's encrypt adoption will end this for once and for all.
bedros 9y ago
Cox is also trying to sell new modems to its customers. Last year when I called cox in California complaining about slow speed at prime time (6-9p) the customer rep told me getting a newer modem will make it faster; I told her my modem is only 3 years old; and asked her how a newer modem would make it faster, she could not answer that I think we should have a regulation that forces ISP to post the average speed of their networks at peek time everytime they advertise their theoretical network.
WhitneyLand 9y ago
They’re just business people trying make a profit and the market will work to collectively accept or reject this practice, is that what they would say? Would you make this decision if it doubled your salary? I love making money, helathy forms of capitalism, fierce competition, and benefiting as a consumer from other companies competing. But I’ll not be a part of this for any job, not in a free country where there are so many opportunities to do better that this. No sir, I respectfully decline your offer.
sslalltheway 9y ago
Umm.. You should not be using http to begin with. Everything else is the results of not using ssl for everything.
zeep 9y ago
A family member got a letter asking them to change their modem but they are also saying that their connection speed slowed down... are they throttling older modems? (I didn't get a chance to do speed tests yet)
kels 9y ago
I had this happen to me recently when I hit 90% of my data cap from Comcast for the first time. At first I noticed that all traffic was being hijacked to show me a full page message that I was at 90% of my data limit and to contact the Comcast Security Assurance team. It looks really scammy like those alerts from "Microsoft" that my computer is infected. After clicking on the acknowledge link multiple times it wouldn't stop so I called the security assurance team. While waiting on hold for 30 minutes it finally stopped but I was already irate. I had to argued with the rep because he told me that I could disable the web notifications and he finally found out that Comcast removed that option and he apologized that there was nothing he could do.
cjsawyer 9y ago
My friend has Comcast and I was absolutely floored when a bandwitch notification popped up on stack overflow. We need to burn these monsers at the stake.
vm 9y ago
All the more reason for ISP competition. The government will be slow to (or just won't) police this behavior so the ideal is to enable customers to quickly replace awful service providers with alternatives.
- masonic 9y ago
  All the more reason for ISP competition Agreed, and decreasing competition is one negative impact if pure net neutrality is enforced. Nobody is going to build out (or improve) an ISP infrastructure only to have Netflix/Hulu/Youtube suck up most of your bandwidth from 5PM to midnight local time, forcing you to continually expand your infrastructure on your own dime. Google foresaw this, hence Google Fiber / Alphabet build-outs being stopped 14 months ago.
amazingman 9y ago
I was greeted with this injected advertising a few weeks ago and was floored. And yet here I am stuck in a contract, with no good alternatives even if I weren’t.
Feniks 9y ago
WTF America continues to be an example to us all... of what not to do ;) I shall keep up my vigilance against the telecom industry.
nathan_long 9y ago
Imagine that you get a letter from a friend. In the middle of the letter is a strange paragraph praising the postal service's new product. You later learn that this was inserted by the postal service. I'd argue that both you and your friend have been harmed by this and that the postal service should be punished. Their job is to deliver messages unmodified and uninspected. Here, the friend is a web page and the postal service is the ISP. Same deal. Injecting content into a page defames (and possibly breaks) the site and deceives the requester. (Yes, the site should use HTTPS to prevent this. And you should lock your house's door. But that doesn't excuse dishonest ISPs or burglars who take advantage when you don't.)
sschueller 9y ago
Does the injected code count towards the data cap? If so there may be a legal case there.
ataturk 9y ago
It's getting so we can't trust anyone in the data stream at all--not only is the NSA hoovering up all our data, but now the ISPs are doing all kinds of shenanigans, too.
LogicX 9y ago
FWIW, looks like this may be a service comcast uses: http://www.frontporch.com/ http://www.frontporch.com/
kup0 9y ago
Our local ISP Shentel does this as well, mostly for data cap alerts.
vorotato 9y ago
I wonder if this violates the CFAA if/when this gets run on a businesses machine.

999 points by CSDude 9y ago

sccxy 9y ago

That is one reason why HTTPS is must for all sites.

nkkollaw 9y ago
Would HTTPS help at all in this case, though..?
- Xylakant 9y ago
  Yes. You can’t inject code in a TLS-secured connection unless you can MITM TLS and if they can do that, all is lost anyways.
  - izacus 9y ago
    There are several corporate firewall products that can do just that. Comcast can just start demanding that their customers install their root cert and that's that. Remember they are the only venue to access the internet for a lot of people, what are they going to do? Stop using the pretty much mandatory communication and information platform? I'm always surprised just how many people here on this site think you can fight social/political fights with technology. Especially when it comes to entities that can bribe legislation and control your communication.
    - mseebach 9y ago
      They could, but they don't. Until they do, or imply in any way that they might, let's stick to the facts and leave wild, flailing speculation to reddit. Regardless of what an ISP might do, HTTPS everywhere is excellent advice.
      - izacus 9y ago
        After all the horrible consumer practices Comcast does regularly you'll still give them the benefit of the doubt? How many times do they have to prove themselves as untrustworthy and consumer hostile that you'll stop sitting there and just hoping that next magical tech will make them stop trying to extract maximum money and inject ads into your stream? Yes, HTTPS is great and should be deployed everywhere. But thinking that they'll just give up on injecting ads into your stream when a large chunk of people use it is hopelessly naive - especially when off-the-shelf enterprise solutions that MITM HTTPS traffic already exist.
        Xylakant 9y ago
        The technical capability to MiTM TLS exists since the very moment TLS was designed. It all hinges on the ability to get a trusted certificate for the domain you want to MiTM. You can do TLS MiTM with Apache if you choose to. Acquiring the Cert has always been the problem and nothing changed in that regard. Strictly speaking, things on that front have become harder since browsers are becoming more and more strict about enforcing TLS security. If Comcast moved to distributing a CA cert to their customers I could quite well imagine that all Browser vendors block that root, as they’ve done with CA that fell out of trust.
        izacus 9y ago
        Comcast and their telco friends just managed to lobby legislation away while completely ignoring complaints and good business. It doesn't look like Americans have any power to fight against these companies so trust into other for-profit companies which are reliant to Comcast & Co. for their profits seems a bit optimistic to me :/
        lostcolony 9y ago
        That post wasn't about legislation. It was about the fact that if Comcast started trying to install root certs on the machines of customers using them for their ISP (which itself is unlikely because of the extra cost both to install, and to troublehsoot, i.e., "why can't I browse anything when I am on my new phone"), Google, Apple, and Microsoft could, and likely would, decide to reject them in their respective browsers as being untrusted. Because they have seen fit to do that in other instances where user security was compromised, and an ISP MITM every bit of your traffic is no less alarming.
    - Crosseye_Jack 9y ago
      > Comcast can just start demanding that their customers install their root cert and that's that. Comcast can demand all they want but they are going to have to hand hold a lot of people though the process. Sure Windows/Mac could offer a nice executable to install it for you but you still have to get people to install it and that’s not something there while customer base will be able to do. The process of installing CA’s on iOS devices involves even more steps. And this is a process that will have to be completed every time an new device is put on their network. What about even more “locked down” systems? Your IoT doorbell? Your networked cctv camera? Your Smart TV? Is it possible? Sure. Is it practical? If kazakhstan couldn’t do it I’m going to struggle to see Comcast pull it off (though if anyone can, it’s prob them). See in a Corp environment where they own all the devices it’s fairly easy to do as most of your deployed hardware if going to be able to remote install what IT asks of them, your mobile devices are going to be enrolled into MDM’s and you will have IT staff on hand to help staff enroll their devices. None of which Comcast have. We are not talking about your avg hacker news reader configuring their devices to get online, we are talking about people like my mother who can just about browse the web and play games on her iPad and struggles to set the alarm on it. How you going to get her to install the rootca without having some do it for her? Sure get the installer to do it? But what about all your existing customers? You going to schedule a call out for each of them? And what about when she gets a new device? You going to make her take the device to the local Comcast store to get it installed? Oh and Chrome and or Firefox could throw a massive spanner into the works by refusing to accept their root cert half way though deployment meaning all those “updated devices’ need to be updated again before they even had a chance to use it at any major scale. Sure it’s possible, I just don’t see it as practical as of today.
      - izacus 9y ago
        You're way overthinking this. Go look at how exactly the automated deployment of MITM HTTPS corporate firewall works - it's a few steps affair and gets them 90% there. All they need to do is block YouTube/Google/Facebook until you run the "Comcast internet setup wizard" (remember? those were a thing!) which makes most customer connections MITMable. Then charge extra for all non-MITMed connections ;) Declare Firefox as unsupported, Google will have to cave in to the biggest telco and that's that. This article (and all others about Comcast) clearly proves that Americans have zero leverage over companies like Comcast. The customers are peacfully accepting modification of their network traffic now, why do you think you'll suddenly get any more leverage over a natural monopoly you're forced to use in the future? Especially after dismantling net neutrality?
    - Xylakant 9y ago
      All of these products require that a corporate root certificate is installed on the devices initiating the connection. This would require that all users install the cert on all devices, some of which do not allow such an install. I don’t think you can install certs of your choice on a PlayStation, an Amazon Echo, an Apple TV or any of the home automation systems. This would break all of those devices. It would also break any app that uses cert pinning. All of this is manageable in a corporate setting where you can remotely configure all devices and have a suitable IT support operation, but it would be an absolute support nightmare for comcast if random stuff just breaks when on their network. Think about what happens when Apple TVs or tivio boxes come with a sticker explaining that they don’t work on Comcast networks because Comcast does not allow secure communication. Banks would require their customers not to do internet banking while on Comcast networks since secure connections cannot be established.
      - izacus 9y ago
        So they'll be whitelisted. They just need to make use of FB/Google/Amazon/etc. websites impossible without the root cert and they can continue injecting ads into any website content. It's not like they care about injecting ads into PS4 API calls (yet). Also how hard do you think it would be for American telcos to push for inclusion of their MITM certificates? Especially if other companies like Verizon come aboard the profit train?
        Xylakant 9y ago
        Browser vendors distrusted whole CAs for less than full interception. In the end, all of this would require control over the device and Comcast can’t achieve that (unless legislated, but that’s a whole different ballpark)
    - dahart 9y ago
      > I'm always surprised just how many people here on this site think you have fight social/political fights with technology. Especially when it comes to entities that can bribe legislation and control your communication. I don't understand. Your second sentence seems to contradict your first; Comcast bribing legislators is a social/political attack. What did you mean? I currently see more hope in tech solutions than political solutions to the problems of privacy, net neutrality, and script injection. We have the option to use content and routing encryption technology that looks something like TOR or I2P. Instead, we're asking politicians who don't understand the tech to protect us from ISPs who will never stop trying to leverage anything they can find in our traffic. Allowing Comcast to see the traffic at all is the problem, and politics will never prevent that. If it's apparent to you that the political fight is more winnable, or that technical approaches to privacy are doomed, then what is the social/political solution to internet privacy? Because we don't have any right now, and it looks like we're losing the political war.
  - nkkollaw 9y ago
    It would make it harder, perhaps.
- Crosseye_Jack 9y ago
  Yes, they couldn’t modify the webpage without breaking the cert signing giving the user an error, installing a ca cert on your devices and doing a mitm on your traffic (which would be hard to predict if your device has their cert installed) or getting a already trust CA to forge Certs for them which once recovered would get that trusted CA dragged though the mud by the major browsers.

vages 9y ago

Most interesting part was the reply from the Comcast employee.

throwaway613834 9y ago
Specifically the last sentence!
- tylerruby 9y ago
  For those that haven't seen it: Customer: "Comcast has my phone office number, my cell for texts, my email, and my home address, yet they choose to molest my requested web pages by injecting hundreds of lines of code." Comcast Response: "The notice is typically sent after a customer ignores several emails. Perhaps some of those ended up in your spam folder?" To me this sounds like a crazy ex-lover. "You didn't respond to my texts so I came to your house." No, Comcast, don't do that. They ignore your emails because you're trying to sell them something they don't want. Here is the Twitter of the Comcast rep for anybody interested: https://twitter.com/jlivingood https://twitter.com/jlivingood
  - sleavey 9y ago
    And I bet that by "ignore" they mean "didn't allow remote tracking images in emails to be loaded therefore stopping us from knowing if, when and where the email was viewed".
exikyut 9y ago
Yes, indeed it was. It's a fairly standard, unsurprising response for this situation; doesn't try to be defensive, doesn't try to provoke. [Edit: I'm horribly under-perceptive, after reading other comments I see I'm a bit off.] But... this bit. > ... [JL] This is our web notification system, documented in RFC 6108 https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108, which has been in place for many years now. ... Oh, interesting, what Internet technology are they using? > "RFC 6108: Comcast's Web Notification System Design" > February 2011 Cue jawdrop. My instinctive response was to WAT and think "this is not what RFCs were for..." But then I read this part, > Status of This Memo > This document is not an Internet Standards Track specification; it is published for informational purposes. > This is a contribution to the RFC Series, independently of any other RFC stream. The RFC Editor has chosen to publish this document at its discretion and makes no statement about its value for implementation or deployment. Documents approved for publication by the RFC Editor are not a candidate for any level of Internet Standard; ... Hmm. Reading through, this outlines a way to avoid using deep packet inspection by using Squid and Tomcat instead. Initially when I read this my brain was sort of going in the direction of "this kind of thing is where the net neutrality repeal thing started..." but now I've spent a bit of time reading it I don't actually think my snap response was particularly on point. This is a bit of a stream-of-consciousness but I wanted to draw attention to that RFC.

exikyut 9y ago

The gigantic image: https://i.imgur.com/kN2rMhK.jpg https://i.imgur.com/kN2rMhK.jpg (source: http://comcastsupport.i.lithium.com/t5/image/serverpage/image-id/34982i05D20DB4C25229CF/image-dimensions/200000?v=1.0&px=-1h http://comcastsupport.i.lithium.com/t5/image/serverpage/imag... - URL manually edited to display largest possible size) I paged through the JS curiously, and found the URL bnpsa.g.comcast.net/images/mydevicealert/browser/. I wondered what would happen if I hit that from my ISP in Australia. I was surprised: I got an NXDOMAIN back. But I discovered that googling the above URL as a quoted string finds a bunch of copies of the JS scattered around the Internet. Might be useful. So then I tried hitting bnp-service-alerts.gslb2.comcast.com/images/. This actually resolved, and Chrome hung at "Connecting...". After rechecking the URLs I noticed this one was referenced in the JS as HTTPS, so I added that, and promptly got 403 Forbidden. Question to anyone on Comcast [edit: which has been answered]: does http://bnpsa.g.comcast.net/images/mydevicealert/browser/ http://bnpsa.g.comcast.net/images/mydevicealert/browser/ resolve for you?

mehrdadn 9y ago
> Question to anyone on Comcast: does http://bnpsa.g.comcast.net/images/mydevicealert/browser/ http://bnpsa.g.comcast.net/images/mydevicealert/browser/ resolve for you? Nope, it does not for me. Non-existent domain.
- exikyut 9y ago
  Thanks!
- pdpi 9y ago
  That's the sort of domain I could very well see only resolving from comcast DNS, and them not propagating it anywhere else.
  - deleted 9y ago
    [deleted]
deusum 9y ago
Server not found.

ksk 9y ago

I wonder if a website could sue Comcast for copyright violation.

exikyut 9y ago
Unfortunately if this were to happen and it succeeded, the precedent would kill the Web Archive. :(
- Keyframe 9y ago
  Not necessarily. Comcast derives from your work in order to exploit it for commercial purposes. Archive does not. A significant difference.
- gpm 9y ago
  The Internet Archive is undoubtedly claiming fair use, even if you suppose the works they create aren't derivative works they are still creating copies of and distributing copyrighted material, which violates copyright law absent fair use.
votepaunchy 9y ago
Or just enable HTTPS.
Buge 9y ago
How is it copyright violation? If this is copyright violation, is it copyright violation of Comcast allowing you to download a file off the internet?
- lolc 9y ago
  Copyright is "all rights reserved" unless otherwise stated. By publishing a website, you don't give me the right to alter and re-publish it. Whether injecting ads into a website means a derived work was created would have to be found out in court I assume.
- regularfry 9y ago
  The argument is that it creates a derivative work. The right to create derivative works is separate to the right to distribute or reproduce the content, which is how Comcast is allowed to get the original website into customers' browsers. Comcast are playing into this interpretation by adding their own license to the code they're adding.

tosh 9y ago

"Comcast's Web Notification System Design" https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108

exikyut 9y ago
I mentioned my reaction when I found this elsewhere in this thread: https://news.ycombinator.com/item?id=15890746 https://news.ycombinator.com/item?id=15890746
lsmod 9y ago
"Must Only Be Used for Critical Service Notifications." [0] https://tools.ietf.org/html/rfc6108#section-3.1 https://tools.ietf.org/html/rfc6108#section-3.1
- mtgx 9y ago
  > and is instead based in open IETF standards and open source applications. Why did the IETF ever agree to standardize this? It reminds me of their standardization of Cisco's "lawful intercept" router backdoor protocol. https://tools.ietf.org/html/rfc3924 https://tools.ietf.org/html/rfc3924 https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/BlackHat-DC-2010-Cross-Attacking-LawfulI-Intercept-slides.pdf https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/Bl... I guess this is what you get when the IETF literally has NSA agents as chairs of its groups. https://arstechnica.com/information-technology/2014/01/nsa-employee-will-continue-to-co-chair-influential-crypto-standards-group/ https://arstechnica.com/information-technology/2014/01/nsa-e...
  - garaetjjte 9y ago
    These are only informational RFCs, which can be published by anyone. >This RFC is not a candidate for any level of Internet Standard. The IETF disclaims any knowledge of the fitness of this RFC for any purpose
    - SAI_Peregrinus 9y ago

candiodari 9y ago

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communication. Look at how easy it is to see exactly what they're doing ... All of it screams "no double digit IQs anywhere near this thing". And yes, I mean, I know that's not true. Their people are not this stupid (though some must be). But they do this anyway. The organisation does business analysis at the level of a 5 year old, codes like a 10 year old, obviously this has not passed legal review, ... How can an organisation that executes this badly become this big ? I mean, I know the answer is "government" and government making them a monopoly, but still. WTF.

exikyut 9y ago
Yep. The random classList polyfill at the bottom was a nice touch. As I scrolled to this bit I was initially like "oh this'll be nice they encrypted some of--oh. :(" My favorite bit was the "this detects the browser type and version" snippet that was copyrighted 2001. Nice! I think the move to open-source the code was a ham-fisted way to get the "we're modifying copyrighted documents in flight" part past the lawyers. It's admittedly a pretty decent legal move.
- icebraining 9y ago
  I think the move to open-source the code was a ham-fisted way to get the "we're modifying copyrighted documents in flight" part past the lawyers. It's admittedly a pretty decent legal move. I don't get it, how does that work?
  - Sephr 9y ago
    He is mistaken, it has nothing to do with it. My code is included in Comcast's injected code, but that doesn't mean any of Comcast's liability has shifted to me.
9y ago

metaphor 9y ago

J. Livingood (a Comcast VP) responded to the OP: > [JL] We are not trying to sell you a new one. If you own your modem we're informing you that it is either end of life (EOL) or that you are about to get a speed upgrade that the modem will be unable to deliver. Incidentally, Livingood is a co-author of IETF RFC 6108, which he has conveniently linked. From the RFC's general requirements numero uno: > R3.1.1. Must Only Be Used for Critical Service Notifications. Additional Background: The system must only provide critical notifications, rather than trivial notifications. An example of a critical, non-trivial notification, which is also the primary motivation of this system, is to advise the user that their computer is infected with malware, that their security is at severe risk and/or has already been compromised, and that it is recommended that they take immediate, corrective action NOW. As composed as Livingood's response was, a modem at EOL and/or incapable of supporting an incremental speed upgrade doesn't strike me as critical. To be sure, Comcast is scheduled to increase speeds by 12/19 (at least in my region): 10Mb->25M, 25M->60M, 75M->100M. Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. It would also be interesting to learn if the OP received this message on multiple instances. If yes, it would be in violation of its own requirement--in particular, R3.1.8. User Notification Acknowledgement Must Stop Further Immediate Notifications, which itself is contradictory in its use of must and should: > Additional Background: Once a user acknowledges a critical notification, the notification should immediately stop. EDIT: Apparently, Livingood is an executive.

glenstein 9y ago
>As composed as Livingood's response was, a modem at EOL and/or incapable of supporting an incremental speed upgrade doesn't strike me as critical. Exactly. And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" is such a hair-splittingly asinine response considering the rather serious breach of trust posed by the notification system.
- thaumaturgy 9y ago
  This is just about the worst possible way to notify a customer of any issue anyway, because it legitimizes those stupid ad-based malware popups that have become so prevalent. As more Comcast customers receive JS-based notices like these injected into their normal web traffic, any enterprising jerk can clone the message, change the links to point to their own phishing site, change or omit the phone number, and snag a whole bunch of unsuspecting Comcast customers.

kerpele 9y ago

I love the Comcast representative's comment basically saying "we've been doing this for years, too late to complain now"

jimnotgym 9y ago

I'm struggling to find it, but there was a article a couple of weeks ago about communities forming their own isps. It's beginning to seem very sensible

bluepeter 9y ago
https://www.reddit.com/r/Documentaries/comments/7dvqjd/people_building_their_own_internet_in_detroit/ https://www.reddit.com/r/Documentaries/comments/7dvqjd/peopl...

Tepix 9y ago

If my ISP were to try this i would sue them for § 303a Datenveränderung

deleted 9y ago

[deleted]

cies 9y ago

So how exactly is this not criminal?

betterunix2 9y ago
They are not blocking, throttling, or interfering (in any way that harms functionality) with legal applications; in a nutshell that is 2015 requirement. Now, if that Javascript happens to interact badly with some particular web page, then you could complain to the FCC as long as the 2015 rules remain in effect (which is more than a week, for what that's worth).
- danschumann 9y ago
  In a way it throttles.. lets pretend they included 4,000 lines of code in each website, or a 1gig of data. It also throttles the experience by taking up processor cycles to render the data. It harms functionality because the popup covers usable website area, and what was meant to function without closing a popup does not. It blocks screen real estate. I really hope someone makes a case.
- freen 9y ago
  It's arguably a copyright infringement.
- cies 9y ago
  I think I've sent an envelope. Digital envelop. They're the mail service. And they secretly mingle with it. That's illegal in my book. I guess the EFF has tried this defense of our freedoms...

gmac 9y ago

Vote with your feet if you can. Meanwhile, use a VPN. https://github.com/jawj/IKEv2-setup https://github.com/jawj/IKEv2-setup https://github.com/trailofbits/algo https://github.com/trailofbits/algo etc.

a_imho 9y ago

Isn't this against the CFAA? Like Comcast is acting without / exceeding authorization?

bluepeter 9y ago

Comcast VP suit isn't helping his cause much on Twitter https://twitter.com/jlivingood/status/939248407562080261 https://twitter.com/jlivingood/status/939248407562080261 Oh and of course he's also retweeting a lovely Net Neutrality tweet... https://twitter.com/feamster/status/938236691126636546 https://twitter.com/feamster/status/938236691126636546

cornchips 9y ago
Jason Livingood: "This is a web notification system that presents an overlay service message for non-TLS sessions. Documented in RFC 6108 & in place for many years - https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108 . In this case the alert informs customer of need to upgrade an end of life device." https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108 Comcast's Web Notification System Design Yeah, cuz we're all supposed to know about rfc6108.. Guess I have some catching up to do on "Internet Engineering".

deleted 9y ago

[deleted]

actuator 9y ago

Unfortunately, in the US and Europe at least most people will care about this and even get a response. I think 4-5 years back when I was in one of the cities in which MTNL is there in India, ads were being served in the same way on MTNL. They were injecting an ad serving pop-up on every page served on HTTP. The worst thing was it sometimes used to show some sketchy virus ads also. I complained about it multiple times, never even heard back from them.

menckenjr 9y ago
It strikes me that the best way to combat this might be in the browser itself - intercept and remove the offending javascript (or better, redirect its execution into a walled sandbox where it thinks it's setting cookies and downloading code) and remove it from the main page viewing stream.
mavendependency 9y ago
You just needed to change to google DNS, which you would have to do anyway - AWS CloudFront doesn't resolve at all in some circles.

BrandoElFollito 9y ago

When reading about Comcast I was always wondering why they have no competition when everyone who comments is complaining. I live in France and use Orange as my fibre provider. 1 Gbps/250 Mbps without constraints. I used to have Free which was great but did not offer fibre when fiber was installed. I switched to Orange in 5 min via a web page. I have another possibility (SFR) but they are despicable liars and for this reason alone I scraped them. This is France, where competition is not a national sport so I was expecting the US to have 5 other companies banging on the door.

Chriky 9y ago
In a natural monopoly regulation /increases/ competition and freedom for the consumer. The BBC had an article about this a few years ago [0]. Basically the highly regulated countries had cheaper and faster internet. > Rick Karr, who made a PBS documentary in which he travelled to the UK to find out why prices were lower, says that the critical moment came when the British regulator Ofcom forced British Telecom to allow other companies to use its copper telephone wires going to and from homes. > But US regulators took a different approach. Rather than encouraging competition between operators using the same network, the US encouraged competition between different infrastructure owners - big companies that could afford to build their own networks. > Some believe that UK-style regulation is bad for competition and innovation, however, and suggest that the US is already one of the world leaders in broadband. [0] http://www.bbc.co.uk/news/magazine-24528383 http://www.bbc.co.uk/news/magazine-24528383
- tankenmate 9y ago
  This UK model is closely related to how roads are funded, as mostly govt funded monopoly on infrastructure (with occasional public private financing, which comes with its own issues, toll roads etc) and common access paid for by users (fuel tax, road tax, etc). The US model is closer to US railroads model, although not entirely accurate, analogy; largely privately owned with some govt owned, funded by large infrastructure companies that charge customers for usage and also due to infrastructure costs are rarely duplicated in close proximity. It's had issues with off and on regulation, profitability, localised monopolies that have a tendency to over charge when they can get away with it.

hardlianotion 9y ago

This is the bit I find amazing: > Comcast has my phone office number, my cell for texts, my email, and my home address, yet they choose to molest my requested web pages by injecting hundreds of lines of code. [JL] The notice is typically sent after a customer ignores several emails. Perhaps some of those ended up in your spam folder? So ignoring spam entitles you to this behaviour?

oxymoran 9y ago
What he is saying is that they exhausted all other contact methods. If they stopped after the email and let the persons modem stop working, they would have likely been livid about that as well. Look, I don’t like Comcast any more than you do. But at some point, you need to recognize your biases when evaluating your enemy. I thought this was some nefarious attack based on the headline, but it’s just a critical system message that was thoroughly explained by an executive and you all are freaking out...
- Operyl 9y ago
  The problem here is that I've had the exact same thing happen, and zero attempt was given. The stupid part? My modem was not EOL, was a BYOM (bring your own modem) that had many years left before EOL. I'm pretty damn sure they're using this as a "first line of contact," not final.
- bo1024 9y ago
  (a) It's not critical, it's a marketing message. (b) Pretty sure if the person's modem were to actually stop working, they would get in touch with their ISP. Man-in-the-middle attacks by an internet provider are hacking and a breach of trust, and should be criminal in my opinion.
- csydas 9y ago
  I sincerely disagree, especially as per the report Comcast's own second level confirmed there was no need to replace the modem. It was an automated advertisement done in a very not good way; Comcast's own billing system notifies you of just about everything else; you can forward your billing statements and other such information to other emails, why not this? The reason everyone is freaking out is because they feel pretty darn strongly that the ISP should not be injecting code into webpages delivered, especially not in an automated way without some oversight. If this is to be a service, the bar for what is necessary for such information must be far higher than "an automated system decides it's time." We get into really scary territory just by doing this in the first place, but to use it for advertisements or basic maintenance? That is a misuse of such technology. And no, I don't think people would be as livid as you suggest if the modem just broke; ISP modems are fragile little things, and it's not uncommon to go through them. I don't think I've had a single ISP where I didn't have to eventually, and the natural progression for each one (Comcast included) was: 1. I called the ISP 2. We did some test with support 3. Once we did the Speedtest / reboot song and dance, a new modem was issued that day. This is expected; if I had asked for such a service from Comcast, this would be a different discussion entirely (an Opt-In service), but as it is, it's a pretty lame reason to suggest that Comcast needs to be able to inject data into pages I load. And I rather liked Comcast for the year I had it - I wasn't keen on being on them since I would rather have been with our Municipal, but the place I was at was not yet in a service area for the municipal. More or less, even with my support and canceling experience, I was fine with the service I received. This would have upset me considerably.

pdkl95 9y ago

Anybody want to sue them for copyright infringement? I doubt they acquired authorization to make derivative versions of your website.

pvsukale3 9y ago

BSNL- The state-owned broadband provider here in India does this regularly. They intercept HTTP traffic and redirect it to their plans page. The saddest part is no one really cares about this here.

jijji 9y ago

I've worked at comcast too for a while as a consultant, and I think the problem is that they take people that were working in customer service and promote them to senior engineer roles and management roles. This is why they hire consultants when everything goes upside down. Alot of telco's do this, I've seen this in many datacenter environments with ISP's and telcos. You got guys making decisions that don't really have the background to be making those decisions.

deleted 9y ago

[deleted]

gbraad 9y ago

... And that is why you open https.

tjoff 9y ago

How fucked up are we when we live in a society where this not only dreamed up but actually believed to make sense and implemented. Yes, it speaks volumes about comcast but i also speaks about the culture where comcast exist. And even IF there is backlash from this the whole idea that they might have gotten away with it is just absurd.

bluepeter 9y ago

Ignore their spammy emails? Per their VP, they are totally going to up their game and inject their "notifications" in your everyday Web traffic. https://twitter.com/jlivingood/status/939848009386549248 https://twitter.com/jlivingood/status/939848009386549248

jlivingood 9y ago
What I meant in the context of that exchange was that the notifications come only after for example multiple emails have not resulted in the device being replaced.
- freen 9y ago
  If it is truly critical, disconnect the device and use the disconnected landing page as your means of communication. Anything else fails to meet the criteria of "critical". If I buy a crappy 802.11b wifi dongle, are you going to inject JS too?

pleasecalllater 9y ago

You have really pathetic law in the US. After something like that in Europe, the company managers would have really huge problems. And in US people seem to be happy about that. If they wouldn't, it would be changed.

coldcode 9y ago
No one is happy, but we have almost zero opportunity to affect change. Look at the FCC's deliberately crappy email campaign for responses on eliminating net neutrality. They won't even release the data to a state DA. Between gerrymandered districts and lock step Republicans controlling everything currently, not to mention local monopolies by the biggest ISPs, our ability to affect change is virtually zero.
m333t 9y ago
In the US, we have cities with higher populations than your countries. Lots of people care but their opinions are rendered meaningless by the millions of people who don't.

guest 9y ago

Vote republican, less regulation and looser laws van fix this! I know what you’re going to say - not many companies can afford to pass the threshold to establish themselves on the market as an ISP - that is however easily fixed by givning large incentives to the giants and then hope it will go to make it better for the little guy and not corrosive practises & profit. Whoever didnt se this coming was blind, at some point ppl will realise that jumping onto other nets popping up will be worth it. IM still waiting for the first real netbrowser (excluding the formerly US military funded Tor - which simply lets u access censored and hidden content) that gives you access to a handful of the largest net alternatives only. How no one has commented on how this is illegal is something clearly lacking from the discussion. You create a transaction with one other part when you visit a site, you even bloody normatively shake hands... IF this stands it either means the marketplace has fallen or simply that USA is so fatally corrupt that it cant uphold the sole basis on which it functions by regressive (read: republican) ”theory”.

polock 9y ago

Why are Comcast, Uber like companies trying to be evil? I really hate these.

w_t_payne 9y ago

I thought HTTPS was supposed to prevent this sort of man in the middle attack? (Or at least make it harder) -- and I thought that most websites used HTTPS these days... or am I misunderstanding? If they are able to do this, and are injecting JavaScript for something as low-return as online ads, then what is to prevent them from changing the news headlines on <insert your news website of choice here>, or the stock ticker feed... How do we know that they aren't? Do we, as a community, have any mechanism to detect if these sorts of attacks are occurring?

singlow 9y ago
HTTPS does prevent this. This can only be injected on non-secure connections.
- shrimp_emoji 9y ago
  Use HTTPSEverywhere on your browsers, and then enjoy the "You're close to your monthly limit!" pop-up on the Steam Store!
  - yjftsjthsd-h 9y ago
    What?
    - charleslmunger 9y ago
      I think the intent was to comment that extensions don't protect programs with embedded web views, like the steam store. I'd hope the steam store is using https though...
      - GranPC 9y ago
        Only on checkout pages. For the rest of the storefront they actually redirect you from HTTPS to HTTP.
        9y ago

gigatexal 9y ago

Let me just drop Comcast like a bad habit. Oh wait. I can’t. There’s not another provider in my area with similar speeds. So I’m screwed.

jswizzy 9y ago
I know and 90% of the web wants to give Comcast even more power to keep out competition by turning the Internet over to lobbyists.
- marviel 9y ago
  90% of the web? Who specifically are you talking about? Is this big-startup-co or...?
bunderbunder 9y ago
For my part, I'm quite happy with the not-Comcast I have at home, compared to the Comcast at my coworking space. The nominal speed is 1/10 as much, but the actual difference in actual experience is much smaller, because the not-Comcast provider does a much better job of actually delivering on the speeds they claim to be selling me. It's really only a noticeable difference when I want to do something like download an OS install image. Which happens infrequently enough that, for me, going with Comcast would have worked out to something on the order of getting that image an hour faster for $200 per time I do it. More importantly, not-Comcast stays up. The coworking space's Internet service is maddeningly intermittent.

RKearney 9y ago

They’ve been doing this for at least 5 years. https://gist.github.com/ryankearney/4146814/42d9ca5ec42fe43c5f7af69a60ae4c60c9bb567f https://gist.github.com/ryankearney/4146814/42d9ca5ec42fe43c...

AndyMcConachie 9y ago

TFA mentions a Comcast tech referencing RFC 6108: "[JL] This is our web notification system, documented in RFC 6108 https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108, which has been in place for many years now." However, RFC 6108 requirement for use R3.1.1 states: R3.1.1. Must Only Be Used for Critical Service Notifications Additional Background: The system must only provide critical notifications, rather than trivial notifications. An example of a critical, non-trivial notification, which is also the primary motivation of this system, is to advise the user that their computer is infected with malware, that their security is at severe risk and/or has already been compromised, and that it is recommended that they take immediate, corrective action NOW. RFC 6108: https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108

kkmx 9y ago
Yea they don't really follow that RFC, they just use that RFC as an all-justification for their action.
robterrell 9y ago
I'm sure the comcast "tech" knows what's in the RFC. Look in the top-right corner; he's one of its authors. He's also replying in this thread.
- AndyMcConachie 9y ago
  Do you consider upselling subscribers on modems a critical service notification? I don't.

visarga 9y ago

Apparently the internet is too important to let Americans have it unfiltered. Let's face it - there are people who don't want to let us access the net directly, even though its importance for the public is incalculable.

thriftwy 9y ago

You take one packet from web server, you deliver a different one to the client. That's the definition of fraud.

kkmx 9y ago

This is why we need to get everyone to move to HTTPS ASAP.

free2rhyme214 9y ago

Why don't they use the Chrome Extension - uBlock origin?

joshribakoff 9y ago
Ads from website owners are not new, what is new is ISPs injecting into other people's pages, this sets a new precedent. Its a fundamental principle that was violated, so saying "just block it" is like saying people in China should just use a VPN... while a valid point, its still an outrage to some people that a government/ISP would tamper/block your traffic. Not trying to equate Comcast to China by the way, just using a metaphor

shapiro92 9y ago

Can someone tell us if this is legal?

santoshalper 9y ago

I am not fan of Comcast, but this is a bit of a tempest in a tea kettle. In over a decade of having their service, I have only seen them use this once, when my cable modem was nearing EOL and upgrading to a new modem that supported DOCSIS 3 (I think?) gave me a big speed boost. I probably wouldn't have looked at snail mail or email from them, so I appreciated it. I guess their is a "slippery slope" argument to be made here, but in the current incarnation, this is innocuous.

newshorts 9y ago

This behavior is the reason why I’m short on Comcast. They are creating space for an ethically centered company to compete on concerns having nothing to do with internet speeds.

freen 9y ago

In my humble opinion, there is no situation that would merit javascript injection that would not rise to the importance of fully disabling someone's internet connection, if only temporarily. Case #1: Malware. Full disconnect, redirect to explanation. Case #2: EOL hardware causing interference. Full disconnect, redirect to explanation, method to rectify. Case #3: Consumer not getting what they paid for: email me/snailmail. I think the RFC makes it clear: this should not be for trivial notifications, only critical notifications, and if it is truly critical, it should disable the entirety of the connectivity until the user acknowledges/remedies/whatever. I call shenanigans.

deleted 9y ago

[deleted]

swayvil 9y ago

Mediacom does a little injection too. Mostly to warn you about something. Get a big red banner now and then. But that's the just the visible stuff, so who knows? I thought that was illegal. Like, it's editing somebody else's copyrighted work or something.

Brybry 9y ago

Comcast is not alone in this. Cox Communications has been injecting code into HTTP traffic for years. I think sometime around 2008 I first saw them do it (I noticed NoScript blocking a script on a page that it wouldn't normally). If I remember correctly, following it to its source hinted that it was a test for some alert system. In 2012 I saw them injecting a script to notify people that their email servers were down ( https://www.dslreports.com/forum/remark,27826161 https://www.dslreports.com/forum/remark,27826161 ) though the paranoid in me thinks that was an innocuous way to test how acceptable altering traffic would be. The escalation I've seen in the last couple of years is the ability being used for Cox customer surveys. As far as I know they haven't injected anything into my SSL/TLS traffic... yet.

CydeWeys 9y ago
> As far as I know they haven't injected anything into my SSL/TLS traffic... yet. You say that as if it were even possible. Or are you referring to the use of SSL stripping? HSTS preloading (or visiting a site with HSTS headers that you've previously visit) will protect you from even that.
jakeogh 9y ago
They did that to me a few months ago. I called up and canceled my decade old ~$90/mo acct on the spot. Tethered to 4G, works fine.
thescriptkiddie 9y ago
Can confirm. I didn't even notice until they started using their script to inject popups telling me I had "exceeded my data allowance". I literally canceled my Cox Communications account on the spot.

poach123 9y ago

Not JavaScript is 400+

poach123 9y ago

Not JavaScript is 400+

fuzzieozzie 9y ago

Comcast forced me to upgrade a perfectly acceptable modem so I would have to option to have higher speed service (which I do not want)! Here's what they did: 1. asked me to upgrade the modem (emails and letters) 2. Inserted a filter on my line so I lost my connection 3. I bought a new modem (not realizing they stuck a filter there) 4. They removed the filter I guess this approach does not scale as well as the 400 lines of Javascript!

timzentu 9y ago
What spec of DOCSIS was your old modem? If it was 1.0, 1.1, or 2.0, sorry you lose all support, the older specs had hard bonded channels that HD TV on them after the swap that they informed people of for 2 years before it happened. And they put TV on them since they were degrading channels due to overuse across the entire network (as in across the country). The later specs allowed for floating channels based on channel maps, which allowed Comcast to bypass those degraded channels. Note: I'm not an apologist, but I worked for Comcast and for a subcontractor. Comcast treated (at least in my opinion) their customers like wallets that called and complained, but under the subcontractor I saw that since they didn't rewire 100% of all networks purchased, it was common that the older lines were causing the degradation and also reflection on other RF channels sometimes on the other side of an area even. Now if Comcast invested in their network as opposed to buying other companies and calling it investment, this might have been fixed, but that would be decades vs. having every modem that wasn't compliant to the new spec swapped.
- uxp 9y ago
  The SB6121 is a DOCSIS 3.0 4x4 modem rated for 174mbps, SB6141 is a 8x4 rated for 343mbps, and SB6181 is a 16x4 rated for 686mbps. Outside of their capabilities, the hardware on them are nearly identical. There is nothing "EOL" about the SB6121 except for the idea that it's unable to support 200mbps. It's a perfectly good entry-level modem capable of offering speeds that are over 7 times the minimum definition of "high speed internet".
voidwtf 9y ago
I don't understand the general attitude against forced modem upgrades. If you lease your modem it's as easy as walking into a Comcast store and swapping it for a new one. If you own your modem, pick the newest model of modem that fits your needs. The newer modems support more channels and newer modulation/technology. This isn't just about supporting newer speeds. In order for them to support those newer speeds for other customers they have to upgrade their equipment to support more channels and newer modulation/technologies. At some point these older technologies are not just wasting resources by being less efficient, but are preventing the company from upgrading their equipment. The reason I don't understand, is because it's common to see people complaining about the state of broadband in America compared to other countries. Yet Comcast is probably the most progressive as far as pushing the technology goes. Don't misunderstand me, I believe Comcast holds a near/total monopoly in many locations around America but at least they're progressive with their network and technology despite the lack of meaningful competition.

knodi 9y ago

Crapcast. If only we in the US had more options, this kind of shit wouldn't fly to well.

rocky1138 9y ago
Rogers and Cogeco both do this in Canada, as far as I remember.
- knodi 9y ago
  Ya, I believe CA is in a worst position than US (in terms of a competitive market).

sathackr 9y ago

As a big ISP that stands to profit from the current FCC standpoint, Comcast is in the crosshairs of the internet community. But if what has been said by all parties is true, I can't find significant fault with Comcast. Here is the text of the "ad" (typed from viewing the attached image in the OP): Get ready, we're increasing Internet speeds in your area. Our records show that the modem you currently have connected to our network won't be able to handle these faster speeds, so we recommend updating your equipment. Buy from a Retailer Before you make your purchase, visit https://mydeviceinfo.xfinity.com to view a list of modems certified to work on our network with your speed tier. Lease and XFINITY Modem Call 1-855-242-2876 and we will send you a Self Install Kit Equipment Update Seems appropriate and to the point. They tell the customer they can either go buy a modem from a retail store, or lease one from XFINITY. Hardly a high-pressure ad. Injecting anything into a website makes me feel a bit dirty, but nobody has refuted Comcast's claim that other communication methods were tried first and that this was more of a last resort. Speaking in general terms because I'm not involved deeply with DOCSIS, older devices are less efficient and generally use more spectrum(even in a cable, there are RF spectrum limitations) to deliver the same speeds. Customers using old devices that don't support the newer and faster standards reduce the total bandwidth available to all customers, increasing costs for both Comcast and its customers. edit: fix formatting. HN needs a preview button.

rdiddly 9y ago
It's most likely Comcast's own fault the other messages were ignored. They pollute every communication channel with marketing spam. The Boy who Cried Wolf didn't have man-in-the-middle technology available but the lesson remains the same: if you want to be heard, shut the fuck up until you've got something to say.
david-s 9y ago
I recall having this occur a while back. I do not recall receiving any email to my actual email address (maybe they used the comcast one?) nor my physical address, nor seeing any notification in the billing portal.

butterfi 9y ago

I dropped Comcast for a provider that doesn't do this, but given Comcast is a monopoly in many areas, I know this isn't a good option for everyone. But frankly, the only leverage we have over these people is how we spend our money.

Declanomous 9y ago

I'm annoyed by this on several levels. The biggest issue is that I'm using an Arris SB 6121 and I'm getting notifications that my modem is EOL. However, the SB6121 is listed as a supported modem for my speed level on their supported modems page. If I go to their supported modem page, I literally get a page where my current modem is shown as not supported, and the exact same modem is shown next to it as "supported." I'm calling Comcast, and if this isn't immediately resolved I'm filing a fraud claim with the Illinois attorney general. This is the third or fourth time I've had a supported modem that Comcast has claimed isn't supported, and I'm sick of jumping through hoops getting this resolved. Every time this happens their customer service reps tell me that the only way to avoid this is to use one of their modems. I'm sick of this. What a terrible company. Fix your shit before you start injecting garbage into the websites I visit. edit: Proof https://imgur.com/lzKBkMs https://imgur.com/lzKBkMs

timzentu 9y ago
FCC complaints are usually more effective, never dealt with one in the current shitty administration, but legally the FCC requires resolution within 7 business days, or at least a plan of action if resolution isn't possible for completion. I used to receive the emails and all the people on an FCC chain put pressure on the lower levels.
- Steeeve 9y ago
  I can confirm that Comcast responds to FCC complaints effectively. I used that route when they were my provider after a series of unhelpful technical support requests.
  - craftyguy 9y ago
    I'm skepitcal that the current FCC would give a shit about this complaint since it reflects poorly on their supporter (an ISP.)
- Declanomous 9y ago
  I'll file a complaint with the FCC as well then. I'll probably file one with the City of Chicago too. Might as well put as much pressure as I can on them, because this is ridiculous. I don't care if the issue is bureaucracy, incompetence, or greed, but I know filing lots of complaints with regulatory bodies generally solves the first and the third issue well, and motivates companies to fix the second issue too.

jchavannes 9y ago

This is (one of the reasons) why you should use HTTPS Everywhere and enable blocking of all unencrypted requests. This isn't new. You're susceptible to even worse MITM attacks if you allow unencrypted traffic when using public wifi.

esP3FJhD 9y ago

Do they modify the CSP, or is it not an issue since sites that bother with a strict CSP probably use HTTPS anyway? https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

hi41 9y ago

Does Comcast inject this code in https urls or just http urls? Since https transfer is encrypted I suspect the code injection can't be done. Can someone please tell if my reasoning is correct?

derimagia 9y ago
Yeah that's correct, they can't do it in https unless they did something with root certs, which would be 1000x more messed up (And that's saying a lot because this is already pretty despicable). At any rate if they were doing that browsers would revoke the CA.
- hi41 9y ago
  Thank you, Derimagia.

jancsika 9y ago

Could Comcast hijack DNS and redirect https requests to a page explaining the issue with a button that lets the user go back to the site they wanted to visit? Or do modern browsers mitigate that?

derimagia 9y ago
They could but because of HSTS (https://blog.stackpath.com/glossary/hsts/ https://blog.stackpath.com/glossary/hsts/) which would largely mitigate it. They have a preload list in browsers too. But if a site wasn't using HSTS then yeah they could do that. I don't think that's better per-se.

Balgair 9y ago

When folks are getting a new modem via this process, are they signing up for a new contract? What does that contract say, in reference to the issues that going on with NN? Might this perhaps be a way to get people to sign new contracts in preparation for a change to NN being more favorable to the ISPs?

Veratyr 9y ago

Could this legally be construed as creating a derivative work under copyright law? As a site owner, could I prosecute Comcast for infringing on my rights by altering the content of my pages?

philjohn 9y ago
That was my first thought - the web page is copyrighted code. Unfortunately, expect to see more of this happening with the useful idiot Pai running the FCC.

brian-armstrong 9y ago

I'm concerned about inviting the Comcast evildoers to here for discourse. It feels like it normalizes what they're doing and sets a bad precedent. Guys like that should be blacklisted from tech, not invited in for tea and crumpets.

kyle-rb 9y ago

>Why did you vandalize my car!? >>Well you weren't responding to my emails, so... >But you can't just do that! >>No, no, it's fine. I've been doing it for years, and I've documented the practice right here.

apl002 9y ago

How can an ISP seriously do this? Is the random domain even aware than comcast is injecting JS into their site?

chrissnell 9y ago

Comcast has been doing this for years and not just to push modem upgrades. They do it for their stupid WiFi app, too: Scroll down this link slightly for a screenshot: https://nas-row.com/showthread.php?t=696 https://nas-row.com/showthread.php?t=696

Aaron1011 9y ago

From Comcast's RFC that's linked in the thread: > R3.1.1. Must Only Be Used for Critical Service Notifications > Additional Background: The system must only provide critical notifications, rather than trivial notifications. An example of a critical, non-trivial notification, which is also the primary motivation of this system, is to advise the user that their computer is infected with malware, that their security is at severe risk and/or has already been compromised, and that it is recommended that they take immediate, corrective action NOW. Not only is Comcast trying to justify this awful practice, they picked one of the worst possible examples to do so. There is no set of circumstances under which a 'You have malware!' popup should be taken seriously.

tehlike 9y ago

Let's encrypt adoption will end this for once and for all.

bedros 9y ago

Cox is also trying to sell new modems to its customers. Last year when I called cox in California complaining about slow speed at prime time (6-9p) the customer rep told me getting a newer modem will make it faster; I told her my modem is only 3 years old; and asked her how a newer modem would make it faster, she could not answer that I think we should have a regulation that forces ISP to post the average speed of their networks at peek time everytime they advertise their theoretical network.

WhitneyLand 9y ago

They’re just business people trying make a profit and the market will work to collectively accept or reject this practice, is that what they would say? Would you make this decision if it doubled your salary? I love making money, helathy forms of capitalism, fierce competition, and benefiting as a consumer from other companies competing. But I’ll not be a part of this for any job, not in a free country where there are so many opportunities to do better that this. No sir, I respectfully decline your offer.

sslalltheway 9y ago

Umm.. You should not be using http to begin with. Everything else is the results of not using ssl for everything.

zeep 9y ago

A family member got a letter asking them to change their modem but they are also saying that their connection speed slowed down... are they throttling older modems? (I didn't get a chance to do speed tests yet)

kels 9y ago

I had this happen to me recently when I hit 90% of my data cap from Comcast for the first time. At first I noticed that all traffic was being hijacked to show me a full page message that I was at 90% of my data limit and to contact the Comcast Security Assurance team. It looks really scammy like those alerts from "Microsoft" that my computer is infected. After clicking on the acknowledge link multiple times it wouldn't stop so I called the security assurance team. While waiting on hold for 30 minutes it finally stopped but I was already irate. I had to argued with the rep because he told me that I could disable the web notifications and he finally found out that Comcast removed that option and he apologized that there was nothing he could do.

cjsawyer 9y ago

My friend has Comcast and I was absolutely floored when a bandwitch notification popped up on stack overflow. We need to burn these monsers at the stake.

vm 9y ago

All the more reason for ISP competition. The government will be slow to (or just won't) police this behavior so the ideal is to enable customers to quickly replace awful service providers with alternatives.

masonic 9y ago
All the more reason for ISP competition Agreed, and decreasing competition is one negative impact if pure net neutrality is enforced. Nobody is going to build out (or improve) an ISP infrastructure only to have Netflix/Hulu/Youtube suck up most of your bandwidth from 5PM to midnight local time, forcing you to continually expand your infrastructure on your own dime. Google foresaw this, hence Google Fiber / Alphabet build-outs being stopped 14 months ago.

amazingman 9y ago

I was greeted with this injected advertising a few weeks ago and was floored. And yet here I am stuck in a contract, with no good alternatives even if I weren’t.

Feniks 9y ago

WTF America continues to be an example to us all... of what not to do ;) I shall keep up my vigilance against the telecom industry.

nathan_long 9y ago

Imagine that you get a letter from a friend. In the middle of the letter is a strange paragraph praising the postal service's new product. You later learn that this was inserted by the postal service. I'd argue that both you and your friend have been harmed by this and that the postal service should be punished. Their job is to deliver messages unmodified and uninspected. Here, the friend is a web page and the postal service is the ISP. Same deal. Injecting content into a page defames (and possibly breaks) the site and deceives the requester. (Yes, the site should use HTTPS to prevent this. And you should lock your house's door. But that doesn't excuse dishonest ISPs or burglars who take advantage when you don't.)

sschueller 9y ago

Does the injected code count towards the data cap? If so there may be a legal case there.

ataturk 9y ago

It's getting so we can't trust anyone in the data stream at all--not only is the NSA hoovering up all our data, but now the ISPs are doing all kinds of shenanigans, too.

LogicX 9y ago

FWIW, looks like this may be a service comcast uses: http://www.frontporch.com/ http://www.frontporch.com/

kup0 9y ago

Our local ISP Shentel does this as well, mostly for data cap alerts.

vorotato 9y ago

I wonder if this violates the CFAA if/when this gets run on a businesses machine.