31 ms·

How Verizon and Turn Defeat Browser Privacy Protections

505 points by fortmeaded 12y ago

doctorshady 12y ago
It's frustrating, the internet has become such a creepy "you are the product" medium. The more of this I see, I start to feel like I don't want to be a part of it anymore.
- PhantomGremlin 12y ago
  That would be OK if my cellphone usage was "free". But it's not. I'm paying Verizon hundreds of dollars a month for me and my family. I wonder if an MVNO would be less creepy than Verizon? Probably not, I'd bet they're even sleazier.
  - TD-Linux 12y ago
    Well, it seems that Verizon is the only one doing it. The article mentioned that AT&T ran a pilot program and decided not to do it. So presumably any other US provider would be better than Verizon.
    - killface 12y ago
      yeah, but people will justify it with a hard-on for verizon's network. where somehow in a large city, not a single other provider gets acceptable signal...
  - pde3 12y ago
    In the US, consider Credo Mobile or T-Mobile. Even AT&T discontinued this practice when called out on it, while Verizon's is flatly recalcitrant; their privacy policy says, "If you do not want information to be collected for marketing purposes from services such as the Verizon Wireless Mobile Internet services, you should not use those particular services."
  - incongruity 12y ago
    Well, do you care enough to take your business elsewhere? That's really the last-ditch way for you to have any voice on this. For whatever it's worth, I left them recently for this very reason (your choice is yours, mine is mine, no preaching or judgement here either) – I ended up having a few minute conversation with the confused (but nice) call rep who didn't understand what they were doing but seemed to empathize as I explained it. Ultimately, will my explanation matter? Probably not, but it was all the power I felt I had, beyond cutting them off from my monthly payments. While still not trustworthy in my book, t-mobile is definitely an upgrade, at least in this regard.
- pastycrinkles 12y ago
  Keep your head out of the past. The internet is becoming the way we do everything now; it's a necessity.
  - Zaephyr 12y ago
    The Internet is a necessity. That doesn't make actions like these less creepy.
  - nathanaldensr 12y ago
    "Keep your head out of the past?" What a rediculous rebuttal. Parent poster is well within his or her rights to feel that way. All the evidence we've been presented with in the past few years should lead everyone to the same conclusion. You are being tracked and your data sold to the highest bidder. How is that not cause for concern? Just because it occurred in the past?
  - Maken 12y ago
    Rejecting this kind of bad practices isn't the same as rejecting internet.
  - pdkl95 12y ago
    Just because you don't value your privacy doesn't mean you get to project those values on the rest of us. Spying on your customers doesn't magically become moral simply because technology has made it easy. It most certainly is not necessary. Really, the only reasons surveillance as a business model has worked is most people don't realize the extent that it is going on and by the time they do a monopoly or oligopoly has already established itself. Taking advantage of ignorance is at best rude and offensive, and at worst it should be criminal. Unfortunately, the laws have yet to catch up to abuses like Verizon's MitM rewriting of HTTP headers. Worse, fixing laws and enforcing them against these modern abuses is going to be very hard: regulatory capture's a 'helluva drug.
- userbinator 12y ago
  That was the first thing that came to mind when I read the name "Turn" - as in, "We Turn users into products."
  - junto 12y ago
    What about a browser extension and a website that tracked Turn's advertising clients? The website and extension are there to help users boycott Turn's customers. Can anyone think of a way to automate the collection of those ads and linked clients? Crowd-sourcing maybe?
acdha 12y ago
Discussion for the original researcher's post: https://news.ycombinator.com/item?id=8889224 https://news.ycombinator.com/item?id=8889224 http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/ http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/
- fortmeaded 12y ago
  OP here, I'd be OK with swapping in Mayer's blog post. Will let the mods decide. If you haven't seen it before, this guy's stuff is absurdly good. Encyclopedic knowledge of privacy tech and law.
  - acdha 12y ago
    Yeah, that was main reason why I wanted to share his original post – the EFF (or ProPublica) stories aren't bad but he's done a great job writing about many things of interest to the HN community.
    - dang 12y ago
      Didn't see this yesterday, and I'm sorry we didn't, because we would have switched out the URL. HN prefers original sources, and it's always nicer to give credit (and traffic) to the original creator or researcher. Unfortunately, it's too late to make a difference now, so we'll just leave things as they were. However: if you (or anyone) notice something like this in the future, the best way to alert us is to email hn@ycombinator.com. We can't read all the threads but we do see all those emails, and usually pretty quickly.
yellowapple 12y ago
> In fact, Turn has told EFF that they do not believe that either Do Not Track or a user deleting their cookies is a signal that the user wishes to opt out from tracking. What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Are they for fucking real right now? I mean, I've seen my share of grade-A corporate double-speak, but this takes the goddamn cake. Holy fucking shit. Thank God I'm not a Verizon customer in any capacity (that I know of). With this kind of bullshit, I don't plan on that changing any-the-fuck-time soon.
- quesera 12y ago
  > What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Easy there. IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes. Convenient, isn't it?
  - fortmeaded 12y ago
    Splitting hairs, but it's not exactly a default. It's a preselected option. The user gets some notice and has to accept.
    - higherpurpose 12y ago
      I think that's a difference without a distinction.
  - coherentpony 12y ago
    > IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes. "By signing up for [insert service here], you agree to the privacy policy." How many times did you actually agree with the privacy policy? Devil's advocate, I know, but it's a sobering reminder that pretty much anything you use gives information that is sold. Open a bank account? If so, notice any new junk mail? Pretty hard to live life without a bank account. Your information is still sold to third parties.
roque 12y ago
My guess is that the "entrepreneurial" solution here would be a combination of: - A browser that doesn't support cookies and provides the server with a client controlled session-id (perhaps a user-id also). - Only uses SSL sessions to avoid middle-box injection of HTML headers (this still leaves the provider with the ability to inject data as IP options / TCP headers). - A micropayment solution that allows content providers to get revenue from content rather than ads. Anyone working on the later ?
- kansface 12y ago
  | A micropayment solution that allows content providers to get revenue from content rather than ads. Even if this were popular, you'd still be tracked because it makes money. Really, so few people care about this deeply I don't think it will be solved. Sure, everyone hates it, but no one will switch carriers over it.
- hrjet 12y ago
  > A browser that doesn't support cookies We are working on a browser (https://gngr.info https://gngr.info) that supports cookies but doesn't enable them by default for all websites. We also don't enable JavaScript by default. User needs to enable these on a per-site basis. Enabling for all sites at once is also possible if the user so wishes. In the near future, we also want to support https only sessions (opt-in to begin with and opt-out once https becomes more commonly deployed). About micropayments, there are many. Flattr comes to mind. But I am sure there are more.
  - JadeNB 12y ago
    Why was this downvoted? It seems like a productive contribution to the conversation—in fact, it's a direct response to another user's question. I can imagine plenty of technical objections, but it seems that they should be made via responses, not downvotes.
- higherpurpose 12y ago
  I think Aviator doesn't support cookies, among other privacy features: https://www.whitehatsec.com/aviator/ https://www.whitehatsec.com/aviator/ EFF is working on a "HTTP Nowhere" option for HTTPS Everywhere, which only allows HTTPS connections. On Firefox there already is an HTTP Nowhere addon from someone else. But as others have said, it's probably easier to just use Tor.
cyanbane 12y ago
If you were an author (of any sort) could you claim that the transmissions of your material (text) that are under copyright were circumvented (DMCA) via a permacookie under your "moral rights" as an author to publish anonymously?
- roque 12y ago
  If you are a content provider you may choose not to serve ads on your content.
  - cyanbane 12y ago
    hmm, not talking about the content provider. I am saying if I am an author who was publishing something under anonymity and I assumed I was anonymous because I "cleared my cookies/Enabled Do Not Track settings" during the publication of the material - only to discover that my cookies had been circumvented via permacookie by a commercial entity - is my "moral right" of anonymity is now gone? could I claim the permacookie method was a circumvention under the DMCA?
    - dangrossman 12y ago
      There is no "moral right of anonymity" in copyright law. Even supposing there was, de-anonymizing you would not violate anything in the DMCA. The anti-circumvention section prohibits circumventing technical access control measures, not circumventing "rights" in general. Circumventing the rights that copyright law does provide an author is just called copyright infringement.
- belovedeagle 12y ago
  This gave me an interesting related idea... It may or may not work depending on the legal status of, among other things, the HTTP standards, but could you claim copyright on transmitted HTTP requests, at least if they contained sufficiently interesting contents? If you could, then presumably one would have to say that ISPs have implied license to transmit those (implicitly) copyrighted requests to a third party, namely, the server. However, that implied license would presumably not allow the ISP to transmit a derived work to the third party, i.e., the original request augmented with the tracking header. To argue this one would have to argue that the entire request, headers and all was copyrightable, but I suppose if one did something creative with the headers it could work; e.g., using the HTTP headers as a kind of poem. But of course there's ways to have creative content in something without it being art, just as long as the other side couldn't argue that the headers couldn't be copyrighted because the usual ones are largely predetermined by the standards. Basically this is just the same idea you had, except instead of invoking the moral right to anonymity, it's invoking the easier-to-digest moral right to the content itself. I'd say this was all baloney, but the DMCA is so ridiculously broad that it just might work. Of course, this is all pretending that the DMCA is meant to apply to corporations and not just us small folk.
randomwalker 12y ago
Some additional research that came out today, with more details of the various things Verizon is doing / plans to do with UIDH: https://freedom-to-tinker.com/blog/englehardt/verizons-tracking-header-can-they-do-better/ https://freedom-to-tinker.com/blog/englehardt/verizons-track... (We collaborated with Mayer on this research.) Code and data that you can play with to verify these results / do other similar experiments, using our web privacy measurement tool OpenWPM: https://github.com/englehardt/verizon-uidh https://github.com/englehardt/verizon-uidh / https://github.com/citp/OpenWPM https://github.com/citp/OpenWPM
- x0x0 12y ago
  quantcast was sued for resuscitating browser cookies when flash LSOs persisted [1], ie taking the cookie value from the LSO and recookie-ing the browser. quantcast and clearspring settled for $2.5m [2]. The crux of the matter seemed to be that users didn't know such data was in flash cookies or associated with quantcast, making it hard to opt-out, though I'm not sure if this is illegal; and violated quantcast and the 3rd party sites' privacy agreements, which appears to be illegal. A lawsuit outline for one plaintiff is here [3] and the full text of the initial filing here [4]. I naively assume there is a clear parallel to this case, though perhaps verizon and turn have thoroughly privacy policied their way out, somewhere in 30 pages of legalese. According to Jonathan Mayer, Commercial supercookies, fingerprinting, and zombie cookies are tolerated (if not permitted) under current United States law. [...] Any associated consumer deception, however, is a violation of the Federal Trade Commission Act and parallel state statutes. [5] [1] http://www.wired.com/2010/07/zombie-cookies-lawsuit/ http://www.wired.com/2010/07/zombie-cookies-lawsuit/ [2] http://www.lexology.com/library/detail.aspx?g=bc3a4358-6692-4c82-94b5-6a1a160bbaaf http://www.lexology.com/library/detail.aspx?g=bc3a4358-6692-... [3] https://www.privaworks.com/Details/AlertReference/PrintPreview.aspx?guid=%7Bb7a1afcf-7795-4138-9401-27272896f095%7D&p=1 https://www.privaworks.com/Details/AlertReference/PrintPrevi... [4] http://www.wired.com/images_blogs/threatlevel/2010/07/CV10-5484-GW-JCGx-Complaint-Summons-Civil-Case-Cover-Sheet1.pdf http://www.wired.com/images_blogs/threatlevel/2010/07/CV10-5... [5] http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/ http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/
username223 12y ago
Classic soulless PR-drone reply here: http://www.turn.com/blog/in-response-to-propublica http://www.turn.com/blog/in-response-to-propublica "Clearing cookies is not a reliable way for a user to express their desire not to receive tailored advertising,..." Okay, but is it a reliable way for me to express my desire for you not to track me? I assume you ignore the DNT header, and I already block your ads, but still... "Turn fully supports enabling consumers to express their choice and consent in regards to data use for digital advertising." Choke on a bag of dicks, you sleazy, lying scum.
- toufka 12y ago
  >"It is Turn’s policy to always honor the consumer opt-out as enacted through either the Turn website or the NAI or DAA." What does this actually mean, and how can I do it?
  - x0x0 12y ago
    NAI and DAA are industry trade groups; they have cross company opt-out pages via cookies / beaconing http://www.networkadvertising.org/choices/ http://www.networkadvertising.org/choices/ http://www.aboutads.info/choices/ http://www.aboutads.info/choices/
    - logn 12y ago
      Their opt out program relies on using 3rd party cookies and only blocks the display of ads (not the collection or other use of the data). Anyone who is doing this should just install an ad blocker.
      - x0x0 12y ago
        Oh absolutely; I was just answering the parent's question, not endorsing.
  - fortmeaded 12y ago
    The original research checked the Turn / NAI / DAA opt out. According to Mayer, it does't respawn. This part of Turn's response is a lie.
shkkmo 12y ago
There are two solutions I see. 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently. 2) Feed them garbage data. We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.
- discardorama 12y ago
  or 3) Contact some of Turn's biggest clients and shame them publicly.
- MBlume 12y ago
  This is fantastic and I'd install it in a heartbeat
- x0x0 12y ago
  verizon overrides; I'm not a web engineer but (I think) ssl protects tcp headers. if so, it's probably the only technical solution is either ssl everywhere or an ssl proxy run by users
  - dllthomas 12y ago
    I interpreted the suggestion as for those not using Verizon to inject fake UIDH. Of course, this could be filtered by making sure the traffic is actually coming from Verizon's networks...
- hackuser 12y ago
  > 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently Why so hopeless? My water is clean, airplanes and roads are safe, retail banks don't lose their customer's savings, etc. Not all regulation works, but this one is pretty straightforward.
  - JadeNB 12y ago
    > Why so hopeless? Because the current US political climate is not in favour of regulations. It is true that we have all the regulations you describe, but each was fought tooth and nail when introduced! EDIT: Original post had slightly more pointed political language.
hackuser 12y ago
Someone who understands this well needs to write a very short 'elevator' explanation for non-technical end-users that we all can copy and paste. That small act would be invaluable to spreading awareness, which is necessary for any progress. I was going to send the EFF article to some Verizon customers I know but I realized they would have no idea what it meant. I don't have time to read it thoroughly and write an accurate, succinct summary. Any volunteers? (The EFF is doing a disservice to the cause by not doing it themselves.)
- mrslx 12y ago
  Verizon is doing the equivalent of a reverse 'butt dial' they are listening to everything you do after you've hung up.
- logn 12y ago
  The tracking is everywhere, it is all around us, even now on this very site. You are tracked when you look out your window, or you turn on your television. You are tracked when you go to work, when you go to church, when you pay your taxes. It is the web that has been pulled over your eyes to blind you from the truth. You are a slave. Like everyone else, you were born into bondage, born into a prison that you cannot smell or taste or touch. A prison for your mind and especially for your Verizon phone.
  - yellowapple 12y ago
    Verizon is a red pill that I'd rather not be swallowing.
- noonespecial 12y ago
  How about: Because your mobile device really belongs to the carrier and not to you, whenever you browse the web with it, they know who you are no matter what. They are now refusing to keep that information secret even if you want them to, instead selling it to advertisers without your consent (even despite your obvious non-consent). They do this by sabotaging your mobile browser so it can't really delete certain cookies. When you try, they put them right back the next time you use the browser. They also have a way (called a UIDH header) to tell other sites that its you (so they can track your visits) even if you don't have a cookie in your browser.
evmar 12y ago
It's strange to read this and then simultaneously read people complaining about HTTP2 requiring SSL. It'd surely be nice if law protected us from bad actors but SSL protects from this in a way that (hopefully) can't be circumvented.
- scintill76 12y ago
  SSL can't really stop it, I think. Here's a thread where I've speculated on a way to inject metadata into SSL handshakes[0] just like they're doing with HTTP headers. If that doesn't work (I'd be interested to hear why), someone else suggested using TCP-IP source/destination metadata queried from the ISP to resolve to a customer. [0] https://news.ycombinator.com/item?id=8506492 https://news.ycombinator.com/item?id=8506492
  - guelo 12y ago
    It's simpler then that. The advertising based site wants to show you the ad, they have no incentive to implement SSL. There's no https://espn.com https://espn.com, for example. Even if they did implement https it would be mixed content because the ad networks' iframes or whatever are http. The solution is things like NoScript or Adblock on Firefox (not Chrome which downloads the ad and just hides it). Or blackholing the ad networks in /etc/hosts.
    - eunice 12y ago
      >(not Chrome which downloads the ad and just hides it) I thought this hadn't been the case for several years now? Am I wrong?
      - magicalist 12y ago
        No, it hasn't been the case since 2010: http://www.theregister.co.uk/2010/07/20/chrome_does_resource_blocking/ http://www.theregister.co.uk/2010/07/20/chrome_does_resource...
    - julianj 12y ago
covercash 12y ago
Somewhat related, does anyone know about Verizon FIOS TV commercial injections and how they possibly relate to FIOS internet tracking? I have IBD and have been spending a lot of time on UC/IBD related sites lately. I've noticed quite a lot of tv commercials for IBD drugs on TV and mentioned it in passing to my friend. He said Verizon uses tech from RGB Networks and similar companies to inject custom commercials into the FIOS TV streams based on FIOS internet data. Does anyone know more about this program?
userbinator 12y ago
I feel like injecting headers is only the start of something far more pernicious; even SSL/TLS can't stop an ISP from determining and tagging where your traffic goes (and consequently, passing that information onto third parties) - all your traffic goes through equipment on their network, after all. As long as your connection to the Internet is tied to your identity in some way (and there is basically no way a non-free ISP is going to let that be anonymous), they can track you. "Obfuscatory routing systems" like Tor can help, but as long as ISPs can observe the traffic on their networks, they know.
- killface 12y ago
  this is what VPNs help prevent.
- mkjones 12y ago
  How would ISPs tag requests going over HTTPS as being from a particular subscriber?
  - mkjones 12y ago
    OK, I can think of a few ways they might do this (DNS tricks and per-user IPv6 addresses, <src ip, src port, dst ip, dst port> => user mapping). These all seem significantly more complex than HTTP header injection though.
jamesdee 12y ago
well, this explains Verizon's desire to have anti-class action lawsuit contracts with their customers...
Animats 12y ago
I'm amazed that they're still doing this. Start pushing for Congressional hearings.
mhuffman 12y ago
I wonder if classifying the Internet as a utility might have any effects through possible regulation of this?
joelthelion 12y ago
That should be illegal, plain and simple.
Aissen 12y ago
It's like they are trying to push HTTPS everywhere. It better happen soon.
terranstyler 12y ago
Frankly, I don't see how regulations or laws should protect the user for several reasons: Firstly, there are already privacy laws yet it doesn't look as if they apply and that Verizon thinks that even in the case of a law suit Verizon will be able to benefit more than this law suit will cost. Secondly, even if a court determines that the conduct of Verizon in this case is not legal, the verdict will still be special enough to not be applicable in a loop hole case. So I see protection provided by law as limited. Thirdly, enforcement is rather difficult and not as obvious as, e.g., a daylight robbery, especially for non-technical observers which I presume to be the vast majority of law enforcement personnel. And finally, (and rather an opinion) I think government is rather delighted to know who does what on the internet, so I don't see a real motive for them to move decisively apart from some half-* voter appeasement.
dredmorbius 12y ago
This may be a tortious (sueable) offense under the Intrusion Upon Seclusion principle. Possibly as a class action: “It is unnecessary to determine the extent to which the right of privacy is protected as a constitutional matter without the benefit of statute.” Beaney, The Constitutional Right to Privacy in the Supreme Court in 1962 The Supreme Court Review 212 (Kurland ed. 1962); Olmstead v. United States, 277 U.S. 438, 478, 48 S.Ct. 564, 72 L.Ed. 944 (1928) (dissenting opinion of Brandeis, J.); “Dykstra, The Right Most Valued by Civilized Man”, 6 Utah L.Rev. 305 (1959); Pound, The Fourteenth Amendment and the Right of Privacy, 13 W.Res.L.Rev. 34 (1961). '[I]t is sufficient to hold that the invasion of the plaintiffs' solitude or seclusion, as alleged in the pleadings, was a violation of their right of privacy and constituted a tort for which the plaintiffs may recover damages to the extent that they can prove them. ‘Certainly, no right deserves greater protection…’' Ezer, Intrusion on Solitude: Herein of Civil Rights and Civil Wrongs, 21 Law in Transition 63, 75 (1961). To make an intrusion on seclusion claim, a plaintiff must generally establish 4 elements: First, that the defendant, without authorization, must have intentionally invaded the private affairs of the plaintiff; Second, the invasion must be offensive to a reasonable person; Third, the matter that the defendant intruded upon must involve a private matter; and Finally, the intrusion must have caused mental anguish or suffering to the plaintiff. h/t Lisa Borel on G+ https://plus.google.com/113175636916099066477/posts/PBi3NECRGfx https://plus.google.com/113175636916099066477/posts/PBi3NECR... More at Wikipedia: http://en.wikipedia.org/wiki/Privacy_laws_of_the_United_States#Intrusion_of_solitude_and_seclusion http://en.wikipedia.org/wiki/Privacy_laws_of_the_United_Stat... Intrusion of solitude occurs where one person intrudes upon the private affairs of another. Intrusion upon seclusion occurs when a perpetrator intentionally intrudes, physically, electronically, or otherwise, upon the private space, solitude, or seclusion of a person, or the private affairs or concerns of a person, by use of the perpetrator's physical senses or by electronic device or devices to oversee or overhear the person's private affairs, or by some other form of investigation, examination, or observation intrude upon a person's private matters if the intrusion would be highly offensive to a reasonable person. h/t paul beard on G+ https://plus.google.com/u/0/104092656004159577193/posts/5XKXud65ajj https://plus.google.com/u/0/104092656004159577193/posts/5XKX... Google, as guardian of Android, should look hard at ensuring user protections from this sort of behavior. Ubiquitous HTTPS might be an option (I haven't looked yet to see if the UIDH header can be defeated via that).
rapht 12y ago
It's a wonder to me how no Verizon competitor has jumped at the opportunity to advertise this on a large scale with a message along the lines "it's evil, we don't do that". If the users really care about this issue, that's what would happen on a functioning market anyway...
- JetSpiegel 12y ago
  It's because the competitors do this too.
  - yellowapple 12y ago
    Not really. Even AT&T doesn't do this (they did at one point, but were apparently called out on it and stopped doing it), and they're pretty damn scummy.
- Normati 12y ago
  I doubt most people care. This isn't going to drive customers away. The only way it'll be stopped is if they're legally forced to. For example, see the history of cookies themselves and how most people never cared about them.
  - jimktrains2 12y ago
    It would if I had options.
ferdi265 12y ago
Couldn't you fake a false UIDH header if you don't use verizon? If yes, then people could publish their UIDH and have other people use it as well. If many do this, the unique identification aspect of UIDH is lost. Something like using a random UIDH from a list of published ones every request.
- zo1 12y ago
  Or just get everyone to use the same UIDH, making it useless for whatever tracking purposes.
karlb 12y ago
Seeing as “turn” is also a verb, this is a great example of a headline that would have been less confusing in sentence case: “How Verizon and Turn defeat browser privacy protections.”
jes 12y ago
If someone chooses to work for a sleazy company, say one that aggressively violates a person's expressed desire to not be tracked, I would not want to hire them or otherwise associate with them. Should the engineers who enable companies like Turn be shunned by other engineers?
- Jgrubb 12y ago
  Should engineers who invent new rifle shells, or atomic bombs, or armed drones, or work at the NSA, or Tinder, or Uber, or Groupon, or Zynga be shunned? All of their employers are perceived by some as some as scumbags. If your job that you liked came to you with a challenge like "I want you to invent a brand new way to track our users that nobody has thought of before", would you turn it down? edit: or Facebook, or Google, etc? These companies are in the business of tracking their users' behavior to be sold to advertisers. I'm not really sure how that's different at the macro level than what Verizon/Turn is doing, and we're shunning an awful lot of engineers at this point.
  - jes 12y ago
    I won't engage in work that I conclude is immoral, nor will I help others to pursue ends that I consider problematic. I think it's important that you always be free to come to your own conclusions on such matters as well.
    - Jgrubb 12y ago
      > I think it's important that you always be free to come to your own conclusions on such matters as well. I completely agree, but it's equally important not to be too dogmatic about it. For example, to what government do you pay taxes?
      - jes 12y ago
        Not trying to be sarcastic, but is "too dogmatic" a different way of saying "too principled?" I pay taxes to several entities, including the government of the United States of America and the state of Washington. These taxes are non-voluntary and coerced from me under threat of force.
jimktrains2 12y ago
Since Verizon is no longer simply a dumb pipe, does this make them liable for the traffic crossing over their network?
tempodox 12y ago
Indeed, this kind of behaviour on the part of Verizon and Turn should result in criminal prosecution.
julianj 12y ago
Maybe instead of adblock for turn, someone should put together a plugin to generate a random header string sized at about 16k just for *.turn.com. On a side note, if your browser automatically filled up the remaining allowed characters in the header (depends on the server of course), it'd be interesting to know how that would be handled by Verizon's support since all sites would get a 400 error when their header injection is enabled.
canvia 12y ago
Does anyone know how flash cookies are handled on cell phones? Is there any way to block or clear them? https://en.wikipedia.org/wiki/Local_shared_object https://en.wikipedia.org/wiki/Local_shared_object This add on is good for clearing them using firefox: https://addons.mozilla.org/en-US/firefox/addon/betterprivacy/ https://addons.mozilla.org/en-US/firefox/addon/betterprivacy...
- kxo 12y ago
  Considering phones haven't had Flash (easily installable, that is) for a considerable amount of time, I doubt you're affected.
TheMagicHorsey 12y ago
Verizon really does come across as a Bond-style corporate villain in stories posted to Hacker News. I'm currently a TMobile customer, and I wonder how many of Verizon's shenanigans are actually just the common MO of all American telecoms. It would otherwise seem egregious if only Verizon is throttling customers on "unlimited" plans, and only Verizon is selling their privacy for money, and only Verizon is pushing garbage smartphones onto customers that don't know any better. How can they be so big if they suck so much ass? Are they successful only because they get their network deployment right? Are regulatory barriers protecting them from competition (I find that hard to believe because wireless, unlike broadband, seems to have multiple competitors in every market). Maybe we just need to take public spectrum away from these donkeys and give it up for use by ad-hoc technologies. I suspect that if we make some standards (or even just broad rules of the road) some peer2peer telecom technologies might emerge and surprise us with their quality (just like BitTorrent is surprisingly good for file downloads, even though its decentralized completely).
DyslexicAtheist 12y ago
is i just me or is Verizon the most evil operator out there? Being based in EU I have no idea of course but there are hardly ever positive news coming out of that firm.

505 points by fortmeaded 12y ago

It's frustrating, the internet has become such a creepy "you are the product" medium. The more of this I see, I start to feel like I don't want to be a part of it anymore.

PhantomGremlin 12y ago
That would be OK if my cellphone usage was "free". But it's not. I'm paying Verizon hundreds of dollars a month for me and my family. I wonder if an MVNO would be less creepy than Verizon? Probably not, I'd bet they're even sleazier.
- TD-Linux 12y ago
  Well, it seems that Verizon is the only one doing it. The article mentioned that AT&T ran a pilot program and decided not to do it. So presumably any other US provider would be better than Verizon.
  - killface 12y ago
    yeah, but people will justify it with a hard-on for verizon's network. where somehow in a large city, not a single other provider gets acceptable signal...
- pde3 12y ago
  In the US, consider Credo Mobile or T-Mobile. Even AT&T discontinued this practice when called out on it, while Verizon's is flatly recalcitrant; their privacy policy says, "If you do not want information to be collected for marketing purposes from services such as the Verizon Wireless Mobile Internet services, you should not use those particular services."
- incongruity 12y ago
  Well, do you care enough to take your business elsewhere? That's really the last-ditch way for you to have any voice on this. For whatever it's worth, I left them recently for this very reason (your choice is yours, mine is mine, no preaching or judgement here either) – I ended up having a few minute conversation with the confused (but nice) call rep who didn't understand what they were doing but seemed to empathize as I explained it. Ultimately, will my explanation matter? Probably not, but it was all the power I felt I had, beyond cutting them off from my monthly payments. While still not trustworthy in my book, t-mobile is definitely an upgrade, at least in this regard.
pastycrinkles 12y ago
Keep your head out of the past. The internet is becoming the way we do everything now; it's a necessity.
- Zaephyr 12y ago
  The Internet is a necessity. That doesn't make actions like these less creepy.
- nathanaldensr 12y ago
  "Keep your head out of the past?" What a rediculous rebuttal. Parent poster is well within his or her rights to feel that way. All the evidence we've been presented with in the past few years should lead everyone to the same conclusion. You are being tracked and your data sold to the highest bidder. How is that not cause for concern? Just because it occurred in the past?
- Maken 12y ago
  Rejecting this kind of bad practices isn't the same as rejecting internet.
- pdkl95 12y ago
  Just because you don't value your privacy doesn't mean you get to project those values on the rest of us. Spying on your customers doesn't magically become moral simply because technology has made it easy. It most certainly is not necessary. Really, the only reasons surveillance as a business model has worked is most people don't realize the extent that it is going on and by the time they do a monopoly or oligopoly has already established itself. Taking advantage of ignorance is at best rude and offensive, and at worst it should be criminal. Unfortunately, the laws have yet to catch up to abuses like Verizon's MitM rewriting of HTTP headers. Worse, fixing laws and enforcing them against these modern abuses is going to be very hard: regulatory capture's a 'helluva drug.
userbinator 12y ago
That was the first thing that came to mind when I read the name "Turn" - as in, "We Turn users into products."
- junto 12y ago
  What about a browser extension and a website that tracked Turn's advertising clients? The website and extension are there to help users boycott Turn's customers. Can anyone think of a way to automate the collection of those ads and linked clients? Crowd-sourcing maybe?

acdha 12y ago

Discussion for the original researcher's post: https://news.ycombinator.com/item?id=8889224 https://news.ycombinator.com/item?id=8889224 http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/ http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/

fortmeaded 12y ago
OP here, I'd be OK with swapping in Mayer's blog post. Will let the mods decide. If you haven't seen it before, this guy's stuff is absurdly good. Encyclopedic knowledge of privacy tech and law.
- acdha 12y ago
  Yeah, that was main reason why I wanted to share his original post – the EFF (or ProPublica) stories aren't bad but he's done a great job writing about many things of interest to the HN community.
  - dang 12y ago
    Didn't see this yesterday, and I'm sorry we didn't, because we would have switched out the URL. HN prefers original sources, and it's always nicer to give credit (and traffic) to the original creator or researcher. Unfortunately, it's too late to make a difference now, so we'll just leave things as they were. However: if you (or anyone) notice something like this in the future, the best way to alert us is to email hn@ycombinator.com. We can't read all the threads but we do see all those emails, and usually pretty quickly.

yellowapple 12y ago

> In fact, Turn has told EFF that they do not believe that either Do Not Track or a user deleting their cookies is a signal that the user wishes to opt out from tracking. What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Are they for fucking real right now? I mean, I've seen my share of grade-A corporate double-speak, but this takes the goddamn cake. Holy fucking shit. Thank God I'm not a Verizon customer in any capacity (that I know of). With this kind of bullshit, I don't plan on that changing any-the-fuck-time soon.

quesera 12y ago
> What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Easy there. IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes. Convenient, isn't it?
- fortmeaded 12y ago
  Splitting hairs, but it's not exactly a default. It's a preselected option. The user gets some notice and has to accept.
  - higherpurpose 12y ago
    I think that's a difference without a distinction.
- coherentpony 12y ago
  > IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes. "By signing up for [insert service here], you agree to the privacy policy." How many times did you actually agree with the privacy policy? Devil's advocate, I know, but it's a sobering reminder that pretty much anything you use gives information that is sold. Open a bank account? If so, notice any new junk mail? Pretty hard to live life without a bank account. Your information is still sold to third parties.

roque 12y ago

My guess is that the "entrepreneurial" solution here would be a combination of: - A browser that doesn't support cookies and provides the server with a client controlled session-id (perhaps a user-id also). - Only uses SSL sessions to avoid middle-box injection of HTML headers (this still leaves the provider with the ability to inject data as IP options / TCP headers). - A micropayment solution that allows content providers to get revenue from content rather than ads. Anyone working on the later ?

kansface 12y ago
| A micropayment solution that allows content providers to get revenue from content rather than ads. Even if this were popular, you'd still be tracked because it makes money. Really, so few people care about this deeply I don't think it will be solved. Sure, everyone hates it, but no one will switch carriers over it.
hrjet 12y ago
> A browser that doesn't support cookies We are working on a browser (https://gngr.info https://gngr.info) that supports cookies but doesn't enable them by default for all websites. We also don't enable JavaScript by default. User needs to enable these on a per-site basis. Enabling for all sites at once is also possible if the user so wishes. In the near future, we also want to support https only sessions (opt-in to begin with and opt-out once https becomes more commonly deployed). About micropayments, there are many. Flattr comes to mind. But I am sure there are more.
- JadeNB 12y ago
  Why was this downvoted? It seems like a productive contribution to the conversation—in fact, it's a direct response to another user's question. I can imagine plenty of technical objections, but it seems that they should be made via responses, not downvotes.
higherpurpose 12y ago
I think Aviator doesn't support cookies, among other privacy features: https://www.whitehatsec.com/aviator/ https://www.whitehatsec.com/aviator/ EFF is working on a "HTTP Nowhere" option for HTTPS Everywhere, which only allows HTTPS connections. On Firefox there already is an HTTP Nowhere addon from someone else. But as others have said, it's probably easier to just use Tor.

cyanbane 12y ago

If you were an author (of any sort) could you claim that the transmissions of your material (text) that are under copyright were circumvented (DMCA) via a permacookie under your "moral rights" as an author to publish anonymously?

roque 12y ago
If you are a content provider you may choose not to serve ads on your content.
- cyanbane 12y ago
  hmm, not talking about the content provider. I am saying if I am an author who was publishing something under anonymity and I assumed I was anonymous because I "cleared my cookies/Enabled Do Not Track settings" during the publication of the material - only to discover that my cookies had been circumvented via permacookie by a commercial entity - is my "moral right" of anonymity is now gone? could I claim the permacookie method was a circumvention under the DMCA?
  - dangrossman 12y ago
    There is no "moral right of anonymity" in copyright law. Even supposing there was, de-anonymizing you would not violate anything in the DMCA. The anti-circumvention section prohibits circumventing technical access control measures, not circumventing "rights" in general. Circumventing the rights that copyright law does provide an author is just called copyright infringement.
belovedeagle 12y ago
This gave me an interesting related idea... It may or may not work depending on the legal status of, among other things, the HTTP standards, but could you claim copyright on transmitted HTTP requests, at least if they contained sufficiently interesting contents? If you could, then presumably one would have to say that ISPs have implied license to transmit those (implicitly) copyrighted requests to a third party, namely, the server. However, that implied license would presumably not allow the ISP to transmit a derived work to the third party, i.e., the original request augmented with the tracking header. To argue this one would have to argue that the entire request, headers and all was copyrightable, but I suppose if one did something creative with the headers it could work; e.g., using the HTTP headers as a kind of poem. But of course there's ways to have creative content in something without it being art, just as long as the other side couldn't argue that the headers couldn't be copyrighted because the usual ones are largely predetermined by the standards. Basically this is just the same idea you had, except instead of invoking the moral right to anonymity, it's invoking the easier-to-digest moral right to the content itself. I'd say this was all baloney, but the DMCA is so ridiculously broad that it just might work. Of course, this is all pretending that the DMCA is meant to apply to corporations and not just us small folk.

randomwalker 12y ago

Some additional research that came out today, with more details of the various things Verizon is doing / plans to do with UIDH: https://freedom-to-tinker.com/blog/englehardt/verizons-tracking-header-can-they-do-better/ https://freedom-to-tinker.com/blog/englehardt/verizons-track... (We collaborated with Mayer on this research.) Code and data that you can play with to verify these results / do other similar experiments, using our web privacy measurement tool OpenWPM: https://github.com/englehardt/verizon-uidh https://github.com/englehardt/verizon-uidh / https://github.com/citp/OpenWPM https://github.com/citp/OpenWPM

x0x0 12y ago
quantcast was sued for resuscitating browser cookies when flash LSOs persisted [1], ie taking the cookie value from the LSO and recookie-ing the browser. quantcast and clearspring settled for $2.5m [2]. The crux of the matter seemed to be that users didn't know such data was in flash cookies or associated with quantcast, making it hard to opt-out, though I'm not sure if this is illegal; and violated quantcast and the 3rd party sites' privacy agreements, which appears to be illegal. A lawsuit outline for one plaintiff is here [3] and the full text of the initial filing here [4]. I naively assume there is a clear parallel to this case, though perhaps verizon and turn have thoroughly privacy policied their way out, somewhere in 30 pages of legalese. According to Jonathan Mayer, Commercial supercookies, fingerprinting, and zombie cookies are tolerated (if not permitted) under current United States law. [...] Any associated consumer deception, however, is a violation of the Federal Trade Commission Act and parallel state statutes. [5] [1] http://www.wired.com/2010/07/zombie-cookies-lawsuit/ http://www.wired.com/2010/07/zombie-cookies-lawsuit/ [2] http://www.lexology.com/library/detail.aspx?g=bc3a4358-6692-4c82-94b5-6a1a160bbaaf http://www.lexology.com/library/detail.aspx?g=bc3a4358-6692-... [3] https://www.privaworks.com/Details/AlertReference/PrintPreview.aspx?guid=%7Bb7a1afcf-7795-4138-9401-27272896f095%7D&p=1 https://www.privaworks.com/Details/AlertReference/PrintPrevi... [4] http://www.wired.com/images_blogs/threatlevel/2010/07/CV10-5484-GW-JCGx-Complaint-Summons-Civil-Case-Cover-Sheet1.pdf http://www.wired.com/images_blogs/threatlevel/2010/07/CV10-5... [5] http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/ http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/

username223 12y ago

Classic soulless PR-drone reply here: http://www.turn.com/blog/in-response-to-propublica http://www.turn.com/blog/in-response-to-propublica "Clearing cookies is not a reliable way for a user to express their desire not to receive tailored advertising,..." Okay, but is it a reliable way for me to express my desire for you not to track me? I assume you ignore the DNT header, and I already block your ads, but still... "Turn fully supports enabling consumers to express their choice and consent in regards to data use for digital advertising." Choke on a bag of dicks, you sleazy, lying scum.

toufka 12y ago
>"It is Turn’s policy to always honor the consumer opt-out as enacted through either the Turn website or the NAI or DAA." What does this actually mean, and how can I do it?
- x0x0 12y ago
  NAI and DAA are industry trade groups; they have cross company opt-out pages via cookies / beaconing http://www.networkadvertising.org/choices/ http://www.networkadvertising.org/choices/ http://www.aboutads.info/choices/ http://www.aboutads.info/choices/
  - logn 12y ago
    Their opt out program relies on using 3rd party cookies and only blocks the display of ads (not the collection or other use of the data). Anyone who is doing this should just install an ad blocker.
    - x0x0 12y ago
      Oh absolutely; I was just answering the parent's question, not endorsing.
- fortmeaded 12y ago
  The original research checked the Turn / NAI / DAA opt out. According to Mayer, it does't respawn. This part of Turn's response is a lie.

shkkmo 12y ago

There are two solutions I see. 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently. 2) Feed them garbage data. We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.

discardorama 12y ago
or 3) Contact some of Turn's biggest clients and shame them publicly.
MBlume 12y ago
This is fantastic and I'd install it in a heartbeat
x0x0 12y ago
verizon overrides; I'm not a web engineer but (I think) ssl protects tcp headers. if so, it's probably the only technical solution is either ssl everywhere or an ssl proxy run by users
- dllthomas 12y ago
  I interpreted the suggestion as for those not using Verizon to inject fake UIDH. Of course, this could be filtered by making sure the traffic is actually coming from Verizon's networks...
hackuser 12y ago
> 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently Why so hopeless? My water is clean, airplanes and roads are safe, retail banks don't lose their customer's savings, etc. Not all regulation works, but this one is pretty straightforward.
- JadeNB 12y ago
  > Why so hopeless? Because the current US political climate is not in favour of regulations. It is true that we have all the regulations you describe, but each was fought tooth and nail when introduced! EDIT: Original post had slightly more pointed political language.

hackuser 12y ago

Someone who understands this well needs to write a very short 'elevator' explanation for non-technical end-users that we all can copy and paste. That small act would be invaluable to spreading awareness, which is necessary for any progress. I was going to send the EFF article to some Verizon customers I know but I realized they would have no idea what it meant. I don't have time to read it thoroughly and write an accurate, succinct summary. Any volunteers? (The EFF is doing a disservice to the cause by not doing it themselves.)

mrslx 12y ago
Verizon is doing the equivalent of a reverse 'butt dial' they are listening to everything you do after you've hung up.
logn 12y ago
The tracking is everywhere, it is all around us, even now on this very site. You are tracked when you look out your window, or you turn on your television. You are tracked when you go to work, when you go to church, when you pay your taxes. It is the web that has been pulled over your eyes to blind you from the truth. You are a slave. Like everyone else, you were born into bondage, born into a prison that you cannot smell or taste or touch. A prison for your mind and especially for your Verizon phone.
- yellowapple 12y ago
  Verizon is a red pill that I'd rather not be swallowing.
noonespecial 12y ago
How about: Because your mobile device really belongs to the carrier and not to you, whenever you browse the web with it, they know who you are no matter what. They are now refusing to keep that information secret even if you want them to, instead selling it to advertisers without your consent (even despite your obvious non-consent). They do this by sabotaging your mobile browser so it can't really delete certain cookies. When you try, they put them right back the next time you use the browser. They also have a way (called a UIDH header) to tell other sites that its you (so they can track your visits) even if you don't have a cookie in your browser.

evmar 12y ago

It's strange to read this and then simultaneously read people complaining about HTTP2 requiring SSL. It'd surely be nice if law protected us from bad actors but SSL protects from this in a way that (hopefully) can't be circumvented.

scintill76 12y ago
SSL can't really stop it, I think. Here's a thread where I've speculated on a way to inject metadata into SSL handshakes[0] just like they're doing with HTTP headers. If that doesn't work (I'd be interested to hear why), someone else suggested using TCP-IP source/destination metadata queried from the ISP to resolve to a customer. [0] https://news.ycombinator.com/item?id=8506492 https://news.ycombinator.com/item?id=8506492
- guelo 12y ago
  It's simpler then that. The advertising based site wants to show you the ad, they have no incentive to implement SSL. There's no https://espn.com https://espn.com, for example. Even if they did implement https it would be mixed content because the ad networks' iframes or whatever are http. The solution is things like NoScript or Adblock on Firefox (not Chrome which downloads the ad and just hides it). Or blackholing the ad networks in /etc/hosts.
  - eunice 12y ago
    >(not Chrome which downloads the ad and just hides it) I thought this hadn't been the case for several years now? Am I wrong?
    - magicalist 12y ago
      No, it hasn't been the case since 2010: http://www.theregister.co.uk/2010/07/20/chrome_does_resource_blocking/ http://www.theregister.co.uk/2010/07/20/chrome_does_resource...
  - julianj 12y ago

covercash 12y ago

Somewhat related, does anyone know about Verizon FIOS TV commercial injections and how they possibly relate to FIOS internet tracking? I have IBD and have been spending a lot of time on UC/IBD related sites lately. I've noticed quite a lot of tv commercials for IBD drugs on TV and mentioned it in passing to my friend. He said Verizon uses tech from RGB Networks and similar companies to inject custom commercials into the FIOS TV streams based on FIOS internet data. Does anyone know more about this program?

userbinator 12y ago

I feel like injecting headers is only the start of something far more pernicious; even SSL/TLS can't stop an ISP from determining and tagging where your traffic goes (and consequently, passing that information onto third parties) - all your traffic goes through equipment on their network, after all. As long as your connection to the Internet is tied to your identity in some way (and there is basically no way a non-free ISP is going to let that be anonymous), they can track you. "Obfuscatory routing systems" like Tor can help, but as long as ISPs can observe the traffic on their networks, they know.

killface 12y ago
this is what VPNs help prevent.
mkjones 12y ago
How would ISPs tag requests going over HTTPS as being from a particular subscriber?
- mkjones 12y ago
  OK, I can think of a few ways they might do this (DNS tricks and per-user IPv6 addresses, <src ip, src port, dst ip, dst port> => user mapping). These all seem significantly more complex than HTTP header injection though.

jamesdee 12y ago

well, this explains Verizon's desire to have anti-class action lawsuit contracts with their customers...

Animats 12y ago

I'm amazed that they're still doing this. Start pushing for Congressional hearings.

mhuffman 12y ago

I wonder if classifying the Internet as a utility might have any effects through possible regulation of this?

joelthelion 12y ago

That should be illegal, plain and simple.

Aissen 12y ago

It's like they are trying to push HTTPS everywhere. It better happen soon.

terranstyler 12y ago

Frankly, I don't see how regulations or laws should protect the user for several reasons: Firstly, there are already privacy laws yet it doesn't look as if they apply and that Verizon thinks that even in the case of a law suit Verizon will be able to benefit more than this law suit will cost. Secondly, even if a court determines that the conduct of Verizon in this case is not legal, the verdict will still be special enough to not be applicable in a loop hole case. So I see protection provided by law as limited. Thirdly, enforcement is rather difficult and not as obvious as, e.g., a daylight robbery, especially for non-technical observers which I presume to be the vast majority of law enforcement personnel. And finally, (and rather an opinion) I think government is rather delighted to know who does what on the internet, so I don't see a real motive for them to move decisively apart from some half-* voter appeasement.

dredmorbius 12y ago

This may be a tortious (sueable) offense under the Intrusion Upon Seclusion principle. Possibly as a class action: “It is unnecessary to determine the extent to which the right of privacy is protected as a constitutional matter without the benefit of statute.” Beaney, The Constitutional Right to Privacy in the Supreme Court in 1962 The Supreme Court Review 212 (Kurland ed. 1962); Olmstead v. United States, 277 U.S. 438, 478, 48 S.Ct. 564, 72 L.Ed. 944 (1928) (dissenting opinion of Brandeis, J.); “Dykstra, The Right Most Valued by Civilized Man”, 6 Utah L.Rev. 305 (1959); Pound, The Fourteenth Amendment and the Right of Privacy, 13 W.Res.L.Rev. 34 (1961). '[I]t is sufficient to hold that the invasion of the plaintiffs' solitude or seclusion, as alleged in the pleadings, was a violation of their right of privacy and constituted a tort for which the plaintiffs may recover damages to the extent that they can prove them. ‘Certainly, no right deserves greater protection…’' Ezer, Intrusion on Solitude: Herein of Civil Rights and Civil Wrongs, 21 Law in Transition 63, 75 (1961). To make an intrusion on seclusion claim, a plaintiff must generally establish 4 elements: First, that the defendant, without authorization, must have intentionally invaded the private affairs of the plaintiff; Second, the invasion must be offensive to a reasonable person; Third, the matter that the defendant intruded upon must involve a private matter; and Finally, the intrusion must have caused mental anguish or suffering to the plaintiff. h/t Lisa Borel on G+ https://plus.google.com/113175636916099066477/posts/PBi3NECRGfx https://plus.google.com/113175636916099066477/posts/PBi3NECR... More at Wikipedia: http://en.wikipedia.org/wiki/Privacy_laws_of_the_United_States#Intrusion_of_solitude_and_seclusion http://en.wikipedia.org/wiki/Privacy_laws_of_the_United_Stat... Intrusion of solitude occurs where one person intrudes upon the private affairs of another. Intrusion upon seclusion occurs when a perpetrator intentionally intrudes, physically, electronically, or otherwise, upon the private space, solitude, or seclusion of a person, or the private affairs or concerns of a person, by use of the perpetrator's physical senses or by electronic device or devices to oversee or overhear the person's private affairs, or by some other form of investigation, examination, or observation intrude upon a person's private matters if the intrusion would be highly offensive to a reasonable person. h/t paul beard on G+ https://plus.google.com/u/0/104092656004159577193/posts/5XKXud65ajj https://plus.google.com/u/0/104092656004159577193/posts/5XKX... Google, as guardian of Android, should look hard at ensuring user protections from this sort of behavior. Ubiquitous HTTPS might be an option (I haven't looked yet to see if the UIDH header can be defeated via that).

rapht 12y ago

It's a wonder to me how no Verizon competitor has jumped at the opportunity to advertise this on a large scale with a message along the lines "it's evil, we don't do that". If the users really care about this issue, that's what would happen on a functioning market anyway...

JetSpiegel 12y ago
It's because the competitors do this too.
- yellowapple 12y ago
  Not really. Even AT&T doesn't do this (they did at one point, but were apparently called out on it and stopped doing it), and they're pretty damn scummy.
Normati 12y ago
I doubt most people care. This isn't going to drive customers away. The only way it'll be stopped is if they're legally forced to. For example, see the history of cookies themselves and how most people never cared about them.
- jimktrains2 12y ago
  It would if I had options.

ferdi265 12y ago

Couldn't you fake a false UIDH header if you don't use verizon? If yes, then people could publish their UIDH and have other people use it as well. If many do this, the unique identification aspect of UIDH is lost. Something like using a random UIDH from a list of published ones every request.

zo1 12y ago
Or just get everyone to use the same UIDH, making it useless for whatever tracking purposes.

karlb 12y ago

Seeing as “turn” is also a verb, this is a great example of a headline that would have been less confusing in sentence case: “How Verizon and Turn defeat browser privacy protections.”

jes 12y ago

If someone chooses to work for a sleazy company, say one that aggressively violates a person's expressed desire to not be tracked, I would not want to hire them or otherwise associate with them. Should the engineers who enable companies like Turn be shunned by other engineers?

Jgrubb 12y ago
Should engineers who invent new rifle shells, or atomic bombs, or armed drones, or work at the NSA, or Tinder, or Uber, or Groupon, or Zynga be shunned? All of their employers are perceived by some as some as scumbags. If your job that you liked came to you with a challenge like "I want you to invent a brand new way to track our users that nobody has thought of before", would you turn it down? edit: or Facebook, or Google, etc? These companies are in the business of tracking their users' behavior to be sold to advertisers. I'm not really sure how that's different at the macro level than what Verizon/Turn is doing, and we're shunning an awful lot of engineers at this point.
- jes 12y ago
  I won't engage in work that I conclude is immoral, nor will I help others to pursue ends that I consider problematic. I think it's important that you always be free to come to your own conclusions on such matters as well.
  - Jgrubb 12y ago
    > I think it's important that you always be free to come to your own conclusions on such matters as well. I completely agree, but it's equally important not to be too dogmatic about it. For example, to what government do you pay taxes?
    - jes 12y ago
      Not trying to be sarcastic, but is "too dogmatic" a different way of saying "too principled?" I pay taxes to several entities, including the government of the United States of America and the state of Washington. These taxes are non-voluntary and coerced from me under threat of force.

jimktrains2 12y ago

Since Verizon is no longer simply a dumb pipe, does this make them liable for the traffic crossing over their network?

tempodox 12y ago

Indeed, this kind of behaviour on the part of Verizon and Turn should result in criminal prosecution.

julianj 12y ago

Maybe instead of adblock for turn, someone should put together a plugin to generate a random header string sized at about 16k just for *.turn.com. On a side note, if your browser automatically filled up the remaining allowed characters in the header (depends on the server of course), it'd be interesting to know how that would be handled by Verizon's support since all sites would get a 400 error when their header injection is enabled.

canvia 12y ago

Does anyone know how flash cookies are handled on cell phones? Is there any way to block or clear them? https://en.wikipedia.org/wiki/Local_shared_object https://en.wikipedia.org/wiki/Local_shared_object This add on is good for clearing them using firefox: https://addons.mozilla.org/en-US/firefox/addon/betterprivacy/ https://addons.mozilla.org/en-US/firefox/addon/betterprivacy...

kxo 12y ago
Considering phones haven't had Flash (easily installable, that is) for a considerable amount of time, I doubt you're affected.

TheMagicHorsey 12y ago

Verizon really does come across as a Bond-style corporate villain in stories posted to Hacker News. I'm currently a TMobile customer, and I wonder how many of Verizon's shenanigans are actually just the common MO of all American telecoms. It would otherwise seem egregious if only Verizon is throttling customers on "unlimited" plans, and only Verizon is selling their privacy for money, and only Verizon is pushing garbage smartphones onto customers that don't know any better. How can they be so big if they suck so much ass? Are they successful only because they get their network deployment right? Are regulatory barriers protecting them from competition (I find that hard to believe because wireless, unlike broadband, seems to have multiple competitors in every market). Maybe we just need to take public spectrum away from these donkeys and give it up for use by ad-hoc technologies. I suspect that if we make some standards (or even just broad rules of the road) some peer2peer telecom technologies might emerge and surprise us with their quality (just like BitTorrent is surprisingly good for file downloads, even though its decentralized completely).

DyslexicAtheist 12y ago

is i just me or is Verizon the most evil operator out there? Being based in EU I have no idea of course but there are hardly ever positive news coming out of that firm.