Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ISP Advertisement Injection - CMA Communications

zmhenkel.blogspot.com

Post reply on HN
Print view View original

31–40 of 81 posts

Re: ISP Advertisement Injection - CMA Communications

#31

Post by dchest »

joshAg wrote: post #28
richardwhiuk wrote: post #4

HTTPS everywhere would solve this, and the Comcast Javascript injection - I wonder how many more people will deploy things like this before that happens?

https is the wrong solution. that is for preventing others from seeing what you're sending/receiving, not verifying the integrity of what is sent/received. well, it does do that too, but it adds extra unneeded overhead by encrypting everything. Besides, the ISP can easily man-in-the-middle any connection you make and then inject their ads into the webpage, even if you use https. The correct solution is signing the we…

Ha-ha, and let's call this HTTPSEC http://cr.yp.to/talks/2013.02.07/slides.pdf !

(Spoiler: HTTPSEC is not a real thing, it's what we'd had if people who invented DNSSEC, or people like the parent commenter, designed something like TLS).

Re: ISP Advertisement Injection - CMA Communications

#32

Post by rhizome »

_conehead wrote: post #5

I posted about this on reddit a few weeks ago[0]. Someone in the thread said they had contacted the Better Business Bureau, but I'm not sure what their process is or how far it's gotten. There has also been a short email thread in which their official response is this: > Mr. [redacted], > CMA is in the process of trying to find ways to drive income from our internet service in new ways. These new ways would allow us…

The kernel of their user-hostile decision is right here:

Right now, you’re barraged with a lot of internet advertising, popups, etc… This has become part of the internet experience. At the core, we’re simply trying to better customize some of this experience. And possibly give you access to highly relevant local advertising.

"Hey, we're just going to take a piece of the shitty ad-laden pages you visit. Maybe you'll see something you like, but chances are low and beside the point."

Re: ISP Advertisement Injection - CMA Communications

#33

Post by dmiladinov »

omellet wrote: post #18
dmiladinov wrote: post #7

Earlier quoted context omitted.

We hope ads/no-ads arms race would end there. But I could easily see some unscrupulous/greedy ISPs then resorting to setting up SSL proxies to MITM your ostensibly secure traffic, as some private organizations (schools, corporations) already do.

They'd have to have their certs installed on your computer, or be an existing CA. Schools and corps (including the one I work for) can do this because they have admin control over destination machines.

You're absolutely right, I didn't mean to imply what schools & corps currently do was shady in any way (as long as you're aware that they're doing it).

Re: ISP Advertisement Injection - CMA Communications

#34

Post by devicenull »

_conehead wrote: post #5

I posted about this on reddit a few weeks ago[0]. Someone in the thread said they had contacted the Better Business Bureau, but I'm not sure what their process is or how far it's gotten. There has also been a short email thread in which their official response is this: > Mr. [redacted], > CMA is in the process of trying to find ways to drive income from our internet service in new ways. These new ways would allow us…

The BBB has exactly 0 power over anyone, so I really doubt that will fix anything.

Re: ISP Advertisement Injection - CMA Communications

#35

Post by afreak »

It's been long enough for me to state, but I used to work for a contractor hired by CMA Communications.

ISPs of this size try and maximise as much profit out of their customers and being that a lot of CMA's sites were over provisioned and are barely able to provide telephony service without incompetence-y along the way, it is not shocking that ads being injected into pages is a new thing for them.

To see these bullshit ads showing up on random pages is far from surprising.

Re: ISP Advertisement Injection - CMA Communications

#36

Post by _conehead »

_conehead wrote: post #5

I posted about this on reddit a few weeks ago[0]. Someone in the thread said they had contacted the Better Business Bureau, but I'm not sure what their process is or how far it's gotten. There has also been a short email thread in which their official response is this: > Mr. [redacted], > CMA is in the process of trying to find ways to drive income from our internet service in new ways. These new ways would allow us…

Addendum: as soon as they started doing this, all of my port forwarding broke. I'm not sure if this is a coincidence or if it was on their end, but the technicians were of no help.

Re: ISP Advertisement Injection - CMA Communications

#37

Post by astrodust »

devicenull wrote: post #34
_conehead wrote: post #5

I posted about this on reddit a few weeks ago[0]. Someone in the thread said they had contacted the Better Business Bureau, but I'm not sure what their process is or how far it's gotten. There has also been a short email thread in which their official response is this: > Mr. [redacted], > CMA is in the process of trying to find ways to drive income from our internet service in new ways. These new ways would allow us…

The BBB has exactly 0 power over anyone, so I really doubt that will fix anything.

Complaining to the BBB is slightly less useful than posting an angry comment on a YouTube video.

Re: ISP Advertisement Injection - CMA Communications

#38

Post by astrodust »

joshAg wrote: post #28
richardwhiuk wrote: post #4

HTTPS everywhere would solve this, and the Comcast Javascript injection - I wonder how many more people will deploy things like this before that happens?

https is the wrong solution. that is for preventing others from seeing what you're sending/receiving, not verifying the integrity of what is sent/received. well, it does do that too, but it adds extra unneeded overhead by encrypting everything. Besides, the ISP can easily man-in-the-middle any connection you make and then inject their ads into the webpage, even if you use https. The correct solution is signing the we…

If TLS could negotiate certificates instead of supporting one and only one, the backbone of any sane "virtual host" system, then https: wouldn't be a big deal. It'd be the default.

Now you need a separate IP (expensive) or port (annoying) for each virtual host configured with a different SSL cert. This has to stop, but it will not be easy to fix.

Re: ISP Advertisement Injection - CMA Communications

#39

Post by ams6110 »

revelation wrote: post #6
richardwhiuk wrote: post #4

HTTPS everywhere would solve this, and the Comcast Javascript injection - I wonder how many more people will deploy things like this before that happens?

You shouldn't have to encrypt your data to stop your ISP from actively 1) scanning and 2) corrupting it. What is the FCC good for?

If you don't encrypt your data and verify the sites to which you connect (both of which https does) then anybody between you and them can intercept and alter the transmission.

I agree you shouldn't have to do it, but you need to worry about more than just your ISP.

Just assume any unsecured internet connection is actively hostile, and you'll be better off.

Post reply on HN