5 ms·
They don't DPI your traffic for this feature - if Spotfiy detects you're on .tmodns.net, they will serve you from internal Telekom network caches instead of hit
by dylz 12y ago
They don't DPI your traffic for this feature - if Spotfiy detects you're on .tmodns.net, they will serve you from internal Telekom network caches instead of hitting the wider internet. This is pretty much equivalent to australian ISPs' freezones.
They do DPI for other purposes though, such as ensuring that you don't tether without paying (if you use a desktop browser user agent, it'll count your tethering quota separately -- even if you spoof the UA from your phone's browser), and for "caching" HTTP traffic (you'll see a 'X-Via: Harmony proxy' header on any HTTP traffic, on any port).
They also hijack DNS NXDOMAIN for ad-filled pages, with no usable opt out ("opt out" uses a cookie that uses javascript to serve the page anyway, then hide it with a fake nginx 404)
- eli 12y agoYou can avoid the bogus DNS server by manually choosing Google's alternate server 8.8.4.4 (They intercept the primary one 8.8.8.8 as well as 4.2.2.2.)
- jevinskie 12y agoThey do MITM of custom DNS servers? Despicable! I wish DNSCrypt support was more widespread.
- eli 12y agoYup, that's what it looks like. I just encountered it last week: https://gist.github.com/cjp/f4dda3cc0f26ad10a3fe https://gist.github.com/cjp/f4dda3cc0f26ad10a3fe Been meaning to try to dump some traffic so I can see more of what's going on.
- jevinskie 12y agoThat is pretty incredible. I knew about ISP's DNS servers that hijacked NXDOMAIN but I've never before heard of MITMing of third party DNS servers! Wow! Have you contacted T-Mobile about it?
- dylz 12y agocomcast does/did the same.
- eli 12y agoI haven't, but that's a good idea. I'm guessing there are semi-legitimate reasons beyond just forcing people to the stupid NXDOMAIN search page. But I agree that it's pretty unpleasant.
- eli 12y agoJust FYI, I wrote this up (http://esd.io/blog/t-mobile-dns-hijack.html http://esd.io/blog/t-mobile-dns-hijack.html) and I'm told off the record that T-Mobile intends to fix it.
- jevinskie 12y agoAwesome, thank you for going the extra mile and reaching out to T-Mobile! I hope they really do fix it. =)
- spacefight 12y agoThis is really really bad.
- 0x0 12y agoIf you use mobile safari's "request desktop site" (ios8+), will they wrongly claim you're tethering?
- CrazedGeek 12y agoAt least a couple years ago, when I switched the UA in a different browser to Firefox and forgot to switch it back, it did use up all my tethering data. It just cut me off though, they didn't try charging me oodles of money.
- conductor 12y ago> even if you spoof the UA from your phone's browser I don't know about T-Mobile's ways of detection, but AT&T is detecting[0] tethering users by checking the network packets TTL values: If you are tethering then the TTL on their side will be below the expected value of mobile OS's default TTL. There are apps which can hide your tethering usage by altering your device's default TTL. You should still use a mobile browser's UA string, of course. [0] - http://www.redmondpie.com/bypass-network-carriers-tether-detection-on-android-with-clockworkmod-tether-alpha-download-now/ http://www.redmondpie.com/bypass-network-carriers-tether-det...
- khuey 12y agoVPN solves all of those problems.
- phamilton 12y agoHTTPS solves these problems too.
- AnthonyMouse 12y agoHTTPS doesn't do anything for their DNS servers not returning NXDOMAIN as they ought to. Also, clients can use a VPN all on their own, they can't force all the servers they use to use HTTPS if they don't already.
- HoochTHX 12y agoT-mobile user here running Cyanogenmod, dnscrypt, and other goodies, with no problem.
- eli 12y agoOr, you know, paying for tethering.
- __david__ 12y agoCharging extra for tethering is total crap—it's just another way the telecoms are trying to erode net neutrality. The fact that they charge for it makes it seem like somehow IP packets from my computer are totally different from IP packets from my phone. If they are worried about computers using more data, then just charge the correct amount for bandwidth (though honestly, in these days of mobile netflix and nice mobile web browers, I highly doubt computers use much more than phones). Apparently some IP packets are more equal than others. I don't know. There are some lines I'm willing to cross and feel completely ethical, and bypassing stupid arbitrary net-neutrality rules is one of them.
- eli 12y agoI get what you're coming from, but personally I'd feel guilty getting something for free when I know I'm supposed to pay for it -- even if I disagree with the way its priced. It's not that far from people who justify pirating Photoshop because Adobe charges too much for it.
- chrisBob 12y agoI think most of the plans include free tethering now, so I am not too worried about that. I was disappointed to see them redirect to lookup.t-mobile.com though. That is one vote in favor of the people that google everything instead of just typing in a domain name.
- couchand 12y agoI'm a T-Mobile user and they've never asked me to pay for any of the tethering I do.
- fastest963 12y agoI'm not sure if you know that Spotify is doing that, but Grooveshark is also a music streaming partner and we're not doing any special routing/detection for T-Mobile customers, everything is on T-Mobile's end.