5 ms·

How about: Because your mobile device really belongs to the carrier and not to you, whenever you browse the web with it, they know who you are no matter what.

How about: Because your mobile device really belongs to the carrier and not to you, whenever you browse the web with it, they know who you are no matter what. They are now refusing to keep that information secret even if you want them to, instead selling it to advertisers without your consent (even despite your obvious non-consent). They do this by sabotaging your mobile browser so it can't really delete certain cookies. When you try, they put them right back the next time you use the browser. They also have a way (called a UIDH header) to tell other sites that its you (so they can track your visits) even if you don't have a cookie in your browser.

guelo 12y ago
It doesn't have anything to do with who owns the device.
- noonespecial 12y ago
  Sure it does. If my verizon iphone wasn't 3 months into a locked two year contract I'd just put in a different sim and forget the whole thing.
  - Shivetya 12y ago
    but cannot phones simply be tracked by their own id regardless of carrier. Say you swap from Verizon, if you hit one of their towers they could theoretically use that information even if your not a direct customer. We know the FBI is reading the traffic so I am wondering why someone is surprised a company does it. Its not right for either party
    - gcb0 12y ago
      they could also follow you non stop on the street and enter every store you go and take note of all your purchases by looking over your shoulder. and i don't think much of it is illegal unless you can prove it distress you but I'm not a layer (I'm a productive member of society :)
nhstanley 12y ago
Naive follow up question: Can doing something like routing through a VPN help with this? I assume not, since a forced cookie on your browser will make you always identifiable to the person on the other end, correct?
- jleight 12y ago
  Using a VPN would encrypt your traffic, preventing Verizon from injecting a UIDH header. You could then clear your cookies and websites would not be able to re-add them via the UIDH header since it isn't being sent. This isn't to say that the websites can't identify you via some other means, just that they no longer have the guaranteed UIDH header to identify you.
  - 01Michael10 12y ago
    Another question? Would FF+Adblock Plus+Ghostery stop this UIDH header injection without a VPN?
    - MichaelGG 12y ago
      No the header injection happens after the request leaves your browser. However, adblock can prevent the request going to Turn and other ad sites in the first place. But then the website owner (eg Facebook) can work with the ad network to pass your info to them on the server side, although I'm not sure how widespread this is.
      - bashinator 12y ago
        How about if I wanted to actively subvert the header? Would there be a way to beat Verizon's network to the punch by injecting the same header myself and populating it with garbage data?
        MichaelGG 12y ago
        No, they simply overwrite it. The only way around that would be to take advantage of bugs in their parser. HTTP is a moronic spec, and it allows inane things. For instance, these are valid HTTP headers: X-LineWrap: Hi my name is Header Boy The value of X-LineWrap should be "Hi my name is Header Boy". Edit: Actually I'm not sure if the space before the comment counts or not. Terrible text protocol formats FTW. X-Comment: This is the value (but this is a comment!) The value of X-Comment should be "This is the value". X-MoreFun: I don't recall (offhand) how this header value should (really, the spec is a mess) be interpreted. The value of X-MoreFun should be (I think): "I don't recall how this header value should be interpreted.". So, you might get lucky if they have a non-compliant parser and the target site has a compliant parser. In that case: X-UIDH: garbage1 garbage2 Might get turned into: X-UIDH: verizontrackingvalue garbage2 In which case, a compliant HTTP parser would read the value as "verizontrackingvalue garbage2", which might be enough to mess up their tracking. Also, HTTP has special handling of headers that are "comma separated lists". This should only apply to special-cased built-in headers. But you could try sending multiple X-UIDH headers, with commas in the values, to trick an overly ambitious parser. Maybe. Anyways, this all depends on bugs in HTTP parsers, which probably exist. (Can you tell I despise the HTTP format?) But if exploited enough to matter, they'd simply patch them.
nl 12y ago
That's a terrible synopsis. It doesn't have anything to do with the device at all, and that's the whole point! No matter what you do to attempt to avoid this you can't if you use the Verizon communication layer. The only way around it is to use counter measures to avoid the Verizon software seeing your connection (ie, a VPN).
im2w1l 12y ago
"Whenever you request a web page, Verizon stamps it with a beastly mark, a name-number to give you offers to buy goods."

guelo 12y ago

It doesn't have anything to do with who owns the device.

noonespecial 12y ago
Sure it does. If my verizon iphone wasn't 3 months into a locked two year contract I'd just put in a different sim and forget the whole thing.
- Shivetya 12y ago
  but cannot phones simply be tracked by their own id regardless of carrier. Say you swap from Verizon, if you hit one of their towers they could theoretically use that information even if your not a direct customer. We know the FBI is reading the traffic so I am wondering why someone is surprised a company does it. Its not right for either party
  - gcb0 12y ago
    they could also follow you non stop on the street and enter every store you go and take note of all your purchases by looking over your shoulder. and i don't think much of it is illegal unless you can prove it distress you but I'm not a layer (I'm a productive member of society :)

nhstanley 12y ago

Naive follow up question: Can doing something like routing through a VPN help with this? I assume not, since a forced cookie on your browser will make you always identifiable to the person on the other end, correct?

jleight 12y ago
Using a VPN would encrypt your traffic, preventing Verizon from injecting a UIDH header. You could then clear your cookies and websites would not be able to re-add them via the UIDH header since it isn't being sent. This isn't to say that the websites can't identify you via some other means, just that they no longer have the guaranteed UIDH header to identify you.
- 01Michael10 12y ago
  Another question? Would FF+Adblock Plus+Ghostery stop this UIDH header injection without a VPN?
  - MichaelGG 12y ago
    No the header injection happens after the request leaves your browser. However, adblock can prevent the request going to Turn and other ad sites in the first place. But then the website owner (eg Facebook) can work with the ad network to pass your info to them on the server side, although I'm not sure how widespread this is.
    - bashinator 12y ago
      How about if I wanted to actively subvert the header? Would there be a way to beat Verizon's network to the punch by injecting the same header myself and populating it with garbage data?
      - MichaelGG 12y ago
        No, they simply overwrite it. The only way around that would be to take advantage of bugs in their parser. HTTP is a moronic spec, and it allows inane things. For instance, these are valid HTTP headers: X-LineWrap: Hi my name is Header Boy The value of X-LineWrap should be "Hi my name is Header Boy". Edit: Actually I'm not sure if the space before the comment counts or not. Terrible text protocol formats FTW. X-Comment: This is the value (but this is a comment!) The value of X-Comment should be "This is the value". X-MoreFun: I don't recall (offhand) how this header value should (really, the spec is a mess) be interpreted. The value of X-MoreFun should be (I think): "I don't recall how this header value should be interpreted.". So, you might get lucky if they have a non-compliant parser and the target site has a compliant parser. In that case: X-UIDH: garbage1 garbage2 Might get turned into: X-UIDH: verizontrackingvalue garbage2 In which case, a compliant HTTP parser would read the value as "verizontrackingvalue garbage2", which might be enough to mess up their tracking. Also, HTTP has special handling of headers that are "comma separated lists". This should only apply to special-cased built-in headers. But you could try sending multiple X-UIDH headers, with commas in the values, to trick an overly ambitious parser. Maybe. Anyways, this all depends on bugs in HTTP parsers, which probably exist. (Can you tell I despise the HTTP format?) But if exploited enough to matter, they'd simply patch them.

nl 12y ago

That's a terrible synopsis. It doesn't have anything to do with the device at all, and that's the whole point! No matter what you do to attempt to avoid this you can't if you use the Verizon communication layer. The only way around it is to use counter measures to avoid the Verizon software seeing your connection (ie, a VPN).

im2w1l 12y ago

"Whenever you request a web page, Verizon stamps it with a beastly mark, a name-number to give you offers to buy goods."