12 ms·
How a banner ad for H&R Block appeared on Apple.com without Apple’s OK
- deleted 14y ago[deleted]
- degenerate 14y agoOriginal (and better imo) article here: https://news.ycombinator.com/item?id=5486006 https://news.ycombinator.com/item?id=5486006
- yk 14y agoThinking about ad injection, it is actually quite scary what a ISP can do. Not only is it easy to display ads (or possibly even malware), but even worse my ISP is installed as a default CA by Firefox. So that they can even inject into SSL connections, with the only "warning" that the certificate was signed by the ISP...
- cheald 14y agoWho is your ISP, and what CA cert do they have installed? The thought of an ISP having CA certs that are a part of default installs is unnerving.
- yk 14y agoTelekom ( actually T-Online, the German ISP branch). The certificate is identified as T-Systems (and I just found another one, Deutsche Telekom AG). Additionally looking through the certificates I found at least Swisscom who appear to have both a CA and an ISP, and AOL. But this is certainly not an exhaustive list but just the ones that caught my eye scrolling through the list of CAs. [EDIT]And for the added 'told you so,' the German parliament uses precisely this certificate https://www.bundestag.de/ https://www.bundestag.de/
- wyager 14y agoI always go through and delete government and ISP certs from my computer's cert store. On OS X, you can do this from Keychain Access.
- raverbashing 14y agoIf you don't need secure access to gov websites this is nice In my case it was the opposite, a gov website mandated the installation of certificates for its use
- cheald 14y agoWell, you can at least remove those from the trusted cert list manually, but it seems like insanely bad juju for ISPs to have their CAs installed with the browser. I wonder if that's worth opening a bug on the Firefox tracker.
- jlgaddis 14y agoWell, considering Mozilla is who put them in there ...
- cheald 14y agoHere's where it was introduced: https://bugzilla.mozilla.org/show_bug.cgi?id=378882 https://bugzilla.mozilla.org/show_bug.cgi?id=378882 Interesting comment on that thread: > This CA was singled out as a CA that signed an excessive number of intermediate authorities (252) which together only have issued 4164 certificates in EFFs talk at C3. This is, by far, the highest number, the next contender is GTE Cybertrust with 93.
- yk 14y agoThe bugzilla thread is an interesting read. And to be fair, the issue with the thousands of certificates is explained in it. It appears that the certificate is used to sign DFN, which in turn signs certificates for most German universities. Btw, Video of the 27C3 talk in question: https://www.youtube.com/watch?v=DRjNV4YMvHI https://www.youtube.com/watch?v=DRjNV4YMvHI
- jlgreco 14y agoThat is why you always tell the installer that you do not have a PC or a Mac. Never let them touch your computers.
- eropple 14y agoI'm not quite sure how you got the idea that he let anyone touch his computers out of his post: he said a default CA by Firefox. There are a number of ISPs that are also CAs that are installed in many browsers by default.
- cstrat 14y agoI have always wondered how long it would take for this sort of behaviour to kick off. This is to the internet what global warming is to the earth... well that might be too far, but this is high tech pollution at its worst.
- 8ig8 14y agozmhenkel's Reddit comments if anyone wants first person accounts: http://www.reddit.com/user/zmhenkel http://www.reddit.com/user/zmhenkel
- _conehead 14y agoAs exciting as this is to be posted on a high-volume website, I honestly doubt CMA is going to change their practices on this issue. If anything, the Acceptable Use Policy change on the 4th was a sign that they'd be reluctant to change their stance on this issue at all. They honestly don't care.
- crgt 14y agoThey might change their tune if they get a letter from a lawyer or two. Can't imagine Apple, for example, likes the idea of third-party ads overlayed on their site.
- seanalltogether 14y agoI could see google bringing a hammer down on them if its true that they are overwriting ad space on certain websites.
- niggler 14y agoIs Ars just ripping sites now? Although now changed, https://news.ycombinator.com/item?id=5505890 https://news.ycombinator.com/item?id=5505890 pointed to an Ars article from yesterday (that reached the front page) that was basically a copy-paste of an SE question
- signed0 14y agoArs has been featuring Stack Exchange questions, with their permission for quite some time. I think it's some sort of partnership. http://arstechnica.com/author/stack-exchange/ http://arstechnica.com/author/stack-exchange/
- eropple 14y agoIt's one of the worst features that they run. I've gotten good enough at guessing which is "Ask Stack" from the headline that I don't click them anymore, though.
- robert_nsu 14y agoThe writer reached out over twitter. I responded with my info on the subject and another individual pointed him to Henkel's blog.
- nkurz 14y agoFacebook eventually addressed the issue by making the site accessible over HTTPS—though, as the authors of the 2008 paper note, HTTPS can be a "rigid and costly" solution. This same excuse has existed for about as long as HTTPS, which dates to Netscape Navigator 1. Is it still that "rigid and costly"? Is there a technical reason that this is an unsolvable problem? Considering the increase in computer and network speed over the last decade and a half, it seems strange that this would still be the case. Perhaps it's just that without pressure from competitors there is no pressure on the sites to solve it?
- benjiweber 14y ago1024bit certificates are only valid until December this year. Then we have to use 2048bit, destroying the benefit we get from faster computers. You need SSL accelerators or pretty fast hardware to handle more than a few thousand SSL handshakes per second on a single machine. This is one of the places cost comes from.
- nl 14y agoYou need SSL accelerators or pretty fast hardware to handle more than a few thousand SSL handshakes per second on a single machine. That's not true - or rather it conflates two unrelated problems. 1) HTTPS/SSL (even with larger certificates) isn't computationally expensive: In January this year (2010), Gmail switched to using HTTPS for everything by default. Previously it had been introduced as an option, but now all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that.[1] 2) The HTTPS initial handshake is slow. However, this isn't because of the power of the machine, or the certificates size. It's cause by round-trip overheard (See [2]). The solution for that is to reuse HTTPS connections as much as possible (which both your server and the browser should try to do for you anyway. But doing things like using the same hostname can help) [1] http://www.imperialviolet.org/2010/06/25/overclocking-ssl.html http://www.imperialviolet.org/2010/06/25/overclocking-ssl.ht... [2] http://pic.dhe.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.itame2.doc_5.1/ss7aumst18.htm http://pic.dhe.ibm.com/infocenter/tivihelp/v2r1/index.jsp?to...
- sigzero 14y agoIt should be made illegal if it isn't already. Since "any site" did not consent, doesn't this injection really "change" their site?
- notatoad 14y agoi believe it counts as copyright infringement. if you modify content in-transit, you're creating a derivative work. not sure if this has ever been tested legally though.
- jiggy2011 14y agoIn such a case wouldn't any form of proxying be copyright infringement, even without modification be copyright infringement? There are also other applications of modification of pages in transit, for example mobile connections often proxy a lower quality version of images (done transparently by the ISP) to save bandwidth. Also some proxies may block videos , ads etc which is as much modification as adding them.
- jeffdavis 14y agoMaybe they should lose their "common carrier" status if they mess with the content? Then they would be responsible for whatever is said on the internet, which would probably dissuade them from doing it.
- deepblueocean 14y agoThis is probably the best counter-argument to the best counter-argument that gets leveled at the people promoting HTTPS-everywhere. People like to say that HTTPS everywhere would break transparent cacheing by ISPs. After all, HTTP is designed to allow caching proxies to exist inline and still supports dynamic content gracefully (er, somewhat, anyway). But in fact the same features that make transparent caching easy make this kind of shenanigans easy. There are tons of companies in this space now. Not just people like NebuAd and R66T, but lots of "subscriber messaging systems" like FrontPorch (which I've heard sells messaging data for behavioral advertising) and PerfTech (which has assured me that they do no such thing). This should be an easy way to push back one of the last "real" arguments against using HTTPS everywhere. There's no excuse not to be running your site on HTTPS all the time - it protects you and your users from all sorts of mischief for a minimal overhead.
- RossM 14y agoIt's getting to the stage now where I think domains should be sold with an SSL certificate as standard (minimal vetting, no warranty) - just enough to provide encryption, rather than treating it as an optional extra.
- deepblueocean 14y agoOne could argue that DNSSEC is a variant of this - put your SSL certificate in a TXT record in your DNSSEC-signed domain and you no longer need a certificate authority system to sign the certs. Now you can self-sign the cert and get it for free!
- iy56 14y agoIf the best argument in favor of HTTPS everywhere is that it will prevent your ISP from showing you ads, the movement is doomed.
- DanBC 14y agoThe point is not to stop your ISP from showing you ads. The point is to stop your ISP from interfering with your traffic in transit. If I ran a website with ads, and someone was stripping those ads to replace with their own ads, I'd be annoyed. I'd be amazed if that's something Google would tolerate. We've seen plenty of stories from people saying "Google closed my ad account and froze all my money!!!" so I hope they do that to this ISP and or the company serving the ads.
- AJ007 14y agoThe "root" of the problem -- on what marketplace are these display ads being sold?
- deleted 14y ago[deleted]
- dangrossman 14y agoAny of the hundreds of different advertising services that feed into the exchanges that are carried by the major networks. There's likely no direct connection between who sold the ad and who made the deal with this ISP to let them serve that network. H&R Block probably had no idea their ad ever appeared on Apple's site. http://blog.inuvi.com/wp-content/uploads/2011/01/LUMA-Landscape2010-12-12.jpg http://blog.inuvi.com/wp-content/uploads/2011/01/LUMA-Landsc...
- AJ007 14y agoYeah, but somewhere H&R Block purchased the inventory. You don't just generically purchase a 300x280 banner ad without regard to where or how it runs. It has to be connected with some sort of property or impression. It could be a re marketing add, or a demographically targeted ad, but in that case the buyer still purchased it somewhere and some company or company is responsible.
- dangrossman 14y agoEx: ISP signs a contract with "Google Ads for Publishers" to carry their display ads. H&R block buys a retargeting campaign through AdRoll. AdRoll runs this campaign by bidding on the matching cookies through AppNexus. AppNexus feeds into DoubleClick which serves Google's ads. H&R block shows up on the Apple website. H&R is 3 companies separated from their buy and where the ad is shown, and never signified any intent to advertise with an ISP or with Apple. Tracking back the ad to where it was sold gives you AdRoll, which wasn't complicit in the scheme either. Google is the "root" problem in the fictional example.
- kevinburke 14y agoWouldn't you know it, the CMA Communications (the ISP mentioned in the post) website is not accessible via HTTPS. "View My Bill" and similar link you off to a third party domain.
- mbloom1915 14y agowhy wouldn't all ISPs do this for the economic incentive? Is advertising going in this direction?
- crgt 14y agoIf my ISP did this I would switch instantly.
- Jach 14y agoAnd when they all do it, or no other ISP will service your area?
- officemonkey 14y agoThen it's back to Fidonet, eh?
- irahul 14y ago`ssh -D 8080 micro-ec2` and proxy through localhost:8080 till it's sorted out.
- Jach 14y agoExactly! No need to switch ISPs after all. (Though personally I add the -N flag so that the tunnel is clearly separated from the remote shell.)
- lucian1900 14y agoLots of websites block requests from ec2, though. A notable one is Stackoverflow.
- robert_nsu 14y agoThe problem here is that in our city, we have four ISP's. My parents live in a suburb close to the edge of the city. AT&T, Comcast, and the others don't really provide any services out there. I say "not really" because ATT provides phone service, but not DSL or U-Verse.
- mmahemoff 14y agoTLDR: ISP injected script tag ads. I heard on the latest This Week In Security that Comcast was apparently not just injecting JS, but injecting bad JS. Meaning that closures weren't used, so name collisions could occur with the actual sites users were visiting. For this reason, I can see HTTPS becoming standard, even for public, non-logged in users. I'm in the process of updating my site to be all-HTTPS and recently got confirmation (as much as one could ever expect) from Google there's no SEO penalty (http://goo.gl/sbtxq http://goo.gl/sbtxq).
- godfreykfc 14y agoYou're probably referring to https://news.ycombinator.com/item?id=5482178 https://news.ycombinator.com/item?id=5482178
- stephen_g 14y agoIf your site has a login page anywhere on your domain, I think that really every page should be served over HTTPS, and it should use HSTS to make sure the browser knows it should always be accessed that way. Even if your login page posts to https, if there's a man in the middle somewhere between your server and user and your login page is HTTP, they can alter the login page to post somewhere else. If your login page is HTTPS, then they can change links to that page to something different. Only with HTTPS for the entire site is it safe from those attacks. It is still vulnerable if there is a MITM the very first time the browser has ever visited the site, but it's a whole lot better than always being vulnerable!
- zerr 14y agoThank you very much for TLDR. It is horrifying how many life-hours are spent for such bullshit stuffed articles...
- da_n 14y agoI would like to see https everywhere, but the cost of certs is still an issue.
- smackfu 14y agoTo be clear, Comcast wasn't injecting ads, but bandwidth overage messages. Still terrible though.
- prodigal_erik 14y agoYet another reason blindly running javascript from unknown parties is a bad idea. Whitelists for progressive enhancement I want should always have been the default.
- danielweber 14y agoIf the ISP is injecting Javascript, they can just inject it as coming from the same domain. I don't like "force HTTPS everywhere" but these jerks are forcing it. It sucks, but it sucks less than this.
- begurken 14y agoI advise meditating on 'force HTTPS everywhere' for a little while. The idea has a great number of pros, and almost no cons. In general, leaking information to intermediate parties about what you're doing is bad, because they can use it against you, even if you have nothing to hide. At least with SSL, they only know the sites you're visiting, and can't see or fiddle with the content.
- codesuela 14y ago@begurken you've been hellbanned since this post https://news.ycombinator.com/item?id=5466310 https://news.ycombinator.com/item?id=5466310, no idea why https://en.wikipedia.org/wiki/Hellbanning https://en.wikipedia.org/wiki/Hellbanning
- danielweber 14y ago> The idea has a great number of pros, and almost no cons. 1. Certificate problems with embedded devices. 2. Much harder to control what's going on with your network.
- nfm 14y agoI remember reading about someone with neighbours that were stealing their wifi. You can do much more interesting things with a proxy server than just inject ads: http://www.ex-parrot.com/pete/upside-down-ternet.html http://www.ex-parrot.com/pete/upside-down-ternet.html
- IheartApplesDix 14y agoIt's a brave new world out there. Well, I knew this would happen eventually, and I got a lot out of the internet while it lasted. Shit, the last 15 years of my life have been grand thanks to the net, but now it's time to kiss it goodbye. I, for one, welcome our new corporate master feudal lords.
- anoncow 14y agoDid he complain to the FTC?
- _conehead 14y agoHoly cow. It seems this has had a direct effect: they're no longer injecting javascript into webpages. I just tried Amazon, eBay, and a few others where the script injection used to be present, and it's no longer there. I absolutely can not understate just how happy I am about this.
- fauigerzigerk 14y agoSo an internet provider inserted ads into web pages and two bloggers blogged about it. I hate this ultra-low signal to noise style of writing anyway, but using it for a tech piece is more than ridiculous. This isn't a 1970s western movie, nor does it appear in the NYT arts & culture section.
- ck2 14y agoI'm terrified to let them tamper with it but Congress really needs to make laws that regulate ISP behavior in the USA. They will never do it on their own. The problem with such a bill is it will have a dozen riders for very horrible things.
- Uchikoma 14y agoMy problem with HTTPS is Google: They push it on every front, but - for various reasons - consider HTTPS and HTTP different pages, meaning you do not get link juice from any HTTP links if you're site is HTTPS only. (1. don't listen to people telling you otherwise, it's an expensive experiment 2. redirects do not transfer all the juice, they count as links themselves, from my experience it's like not having external links to your site at all 3. If you do not depend on Google b/c you're SaaS, go for HTTPS only)
- rocky1138 14y agoWhere are you getting the data that you don't get Google juice for HTTP-to-HTTPS links?
- Uchikoma 14y agoFrom first hand experience. Then lately there was a discussion on /r/seo I currently can't find with a link to Matt Cutts who said redirects are handled the way links transfer juice. [edit] People extrapolate that 301 are different because Google tells them to use 301 when moving pages.
- bonaldi 14y agoHTTPS will not prevent this: the ISP can issue their own CA to their users and then decrypt/encrypt https as it passes through them. (Many corporations already do this). What will prevent this is legislation and/or competition. It amazes me that US Internet access has very little of either. All the drawbacks of monopoly Internet, with all the drawbacks of unregulated Internet.
- pellias 14y agoSlight correction, ISP or Corporation can run a HTTPS proxy. In effect, your 'HTTPS' connection is to the IPS/Corporate proxy only.
- peripitea 14y agoI'm confused as to how what you're saying or what parent is saying would work. The trusted CAs live on your computer, and should not be susceptible to tampering by your ISP. And how can your ISP or corporate network set up an HTTPS proxy like you're suggesting without triggering a warning to the user that they are not connecting to the SSL certificate's specified domain? Is there something about SSL/TLS that I'm fundamentally misunderstanding?
- deleted 14y ago[deleted]
- enginous 14y agoNope, you're right. The ISP would have to install the CA certificate on every device on the network, which is a nontrivial task. Furthermore, if the ISP has done that, they don't need you to go through a proxy. Your connection is already going directly through them. Edit: However (as you can see by some of the responses in this thread), there's certainly the possibility that your ISP itself is an actual certificate authority recognized by browsers. That scenario is indeed quite worrying.
- bonaldi 14y ago
- olalonde 14y agoThis is quite common in China. Even the largest ISPs do it.
- oracuk 14y agoWe have had a similar case publicly exposed here in the UK a little while ago with Phorm and British Telecom: http://www.bbc.co.uk/news/technology-13015194 http://www.bbc.co.uk/news/technology-13015194 There is a good chance that such practices may be found to be illegal in a UK court (Regulation of Investigatory Powers Act primarily with some discussion about applying the Data Protection Act or Computer Misuse Act) but they haven't been tested yet. Both companies very quickly stepped back from the 'trial' they were conducting when it became clear there might be public support for a test case.
- girlvinyl 14y agoDoes anyone know the CFAA implications here? My system is a "protected" system, this would clearly be unauthorized access.
- kgosser 14y agoAnyone else find it interesting that R66T is vaguely read as "ROOT" -- this is some kind of cruel joke, right?
- rgbrgb 14y agoDid anyone else have trouble hitting the back button after that article? I find that equally skeezy. Edit: It seems they've mapped command-back-arrow to a non-default action. Not cool.
- greglindahl 14y agoVery interesting that r66t.com doesn't appear in the 2 most popular adblock+ block lists!
- SpikeDad 14y agoAn interesting article but was overly verbose. Could have said the same thing in half the space. However, a big FU to Arstechnica for prostituting the name of Apple to get more visits to the article. The headline did not need to imply that Apple.com was hacked or that Apple was somehow unaware of what's happening at their site. It's sleazy journalism and beneath the usual ethics of Arstechnica