How Verizon's Advertising Header Works • Hacker News Board

Re: How Verizon's Advertising Header Works

#31

Post by gojomo » Sat, Oct 25, 2014, 12:09 AM UTC

Notably: the exact same device ID (X-UIDH) is injected into HTTP requests from different browsers/apps, or browser tabs in 'privacy' or 'incognito' mode. Also, if you're using 'personal hotspot', any HTTP traffic from a connected desktop/laptop sharing the mobile data service also gets the header.

So VerizonWireless is allowing third-party sites to correlate all HTTP traffic from one device to a single identity, even if you've taken explicit steps (like 'incognito' mode) to try to thwart this, and even if the mobile OS has compartmentalized apps away from seeing each others' identity data/cookies.

Only HTTPS and VPN traffic is immune, and as far as I've been able to find out, there is no way to opt-out. (None of the VerizonWireless privacy settings stop the header from being injected.)

Re: How Verizon's Advertising Header Works

#32

Post by coldcode » Sat, Oct 25, 2014, 12:09 AM UTC

josho wrote: post #16

So, I suppose this means that ads that Verizon customers see are potentially targeted by their home address, age, gender, and call/texting patterns. Holy shit, if I was a customer that would be ending today, even if I was in a contract, I'd say they pretty clearly are in breach of contract over my privacy expectations, by sharing who I am with every website I visit.

I am sure there lawyers wear $5000 suits and made damn sure the contract is confusing as hell and lawsuit proof.

Re: How Verizon's Advertising Header Works

#33

Post by cmdrfred » Sat, Oct 25, 2014, 12:18 AM UTC

At work I was trying to set up VPN access on a few busses we have. We tried using a Verizon device but couldn't because Verizon puts you behind their NAT. It costs $500 to get out from behind it. I guess this is why.

Re: How Verizon's Advertising Header Works

#34

Post by iancarroll » Sat, Oct 25, 2014, 12:31 AM UTC

jtokoph wrote: post #28

andrewstuart2 wrote: post #27

I haven't seen it mentioned anywhere, but this can't work over HTTPS. The message is fully encrypted end-to-end and Verizon Wireless can't do anything to alter the content without destroying the whole message. Seems like a few people know this, lots of talk about SSL & TLS, but I don't think anybody has mentioned it explicitly.

Does Safari on iOS completely block mixed content (http resources embedded on https pages)? If not, any page that embeds an insecure resource can still track you with this cookie.

Some are blocked and some aren't... actually I don't know what isn't/is...

The padlock goes away if mixed content shows, though.

Re: How Verizon's Advertising Header Works

#35

Post by revelation » Sat, Oct 25, 2014, 12:32 AM UTC

Oh, oh, I know, this is the moment where smart people on here tell us that more regulation by the FCC would be a bad thing!

Because you know, a telecommunications provider that manipulates the content of your telecommunication is just screaming out for being an overregulated area of business.

Re: How Verizon's Advertising Header Works

#36

Post by cbd1984 » Sat, Oct 25, 2014, 12:46 AM UTC

revelation wrote: post #35

Oh, oh, I know, this is the moment where smart people on here tell us that more regulation by the FCC would be a bad thing ! Because you know, a telecommunications provider that manipulates the content of your telecommunication is just screaming out for being an overregulated area of business.

If we're going to make fun of a political-theory-cum-religion, we might as well do it right:

Oh, oh, I know, this is when the Free Marketeers will tell us all that it would be so easy to build out a massive continent-spanning cell phone network to compete with Verizon if only the FCC Nanny State weren't in the way.

And that new network would certainly beat a network which has been entrenched for decades, because "Regulatory capture" is the only network effect networks have to deal with. Just keep saying "Regulatory capture" and we're bound to agree that the only way to deal with an imperfect system is to tear it down entirely.

Re: How Verizon's Advertising Header Works

#37

Post by stvswn » Sat, Oct 25, 2014, 12:46 AM UTC

Shouldn't Chrome and Safari simply block this behavior? Google, for instance, is now presented with a rare situation: users' privacy and their own business concerns are aligned (since audience segmenting is a core product of the Google Display Network).

Re: How Verizon's Advertising Header Works

#38

Post by userbinator » Sat, Oct 25, 2014, 1:04 AM UTC

It's one thing for your ISP to be collecting information about you; it's totally another thing for your ISP to be silently modifying your data by adding a tracking header and sending it to all other sites you visit.

Modifying application-level data is something an ISP should never do. What if I happened to be using the exact same header name for some other purpose for a web app API? This should be considered illegal tampering with the content of communications.

The "encrypt everything" proponents are missing the point: yes, encryption (and steganography) can be used to bypass this easily, but I don't want to have to explicitly defend against my ISP modifying my data.

Re: How Verizon's Advertising Header Works

#39

Post by tehwebguy » Sat, Oct 25, 2014, 1:10 AM UTC

stvswn wrote: post #37

Shouldn't Chrome and Safari simply block this behavior? Google, for instance, is now presented with a rare situation: users' privacy and their own business concerns are aligned (since audience segmenting is a core product of the Google Display Network).

This is happening after the request has left the browser and the phone

Re: How Verizon's Advertising Header Works

#40

Post by userbinator » Sat, Oct 25, 2014, 1:10 AM UTC

stvswn wrote: post #37

Shouldn't Chrome and Safari simply block this behavior? Google, for instance, is now presented with a rare situation: users' privacy and their own business concerns are aligned (since audience segmenting is a core product of the Google Display Network).

They can't, because the endpoint is not the one that added the header. Application-level data sent over the network is being modified as it travels through Verizon's equipment.