How Verizon's Advertising Header Works • Hacker News Board

Re: How Verizon's Advertising Header Works

#61

Post by colinbartlett » Sat, Oct 25, 2014, 2:07 PM UTC

userbinator wrote: post #45

coldcode wrote: post #30

They need to be publicly attacked for doing this. Only massive embarrassment will change the behavior. Maybe get some politicians involved if there are any they haven't bought yet.

Here is a good analogy to use, one which the politicians will understand: it's like the postal service opening letters not only to read their contents, but to change them before forwarding them onto their intended recipients.

Is it though? Or is it like the postal service scrawling a unique ID on the outside of the envelope?

Re: How Verizon's Advertising Header Works

#62

Post by pixl97 » Sat, Oct 25, 2014, 2:55 PM UTC

monofonik wrote: post #58

I work in mobile advertising (not in the US), and my company is partnered with a mobile carrier that does something similar, although the "header enrichment" as it's called is only enabled on specific domains (i.e. requests to our ad server API). I feel that it's unlikely these headers are being set on all web requests. Has anybody verified this claim?

I looked in the logs on my public web server I host different sites on. I only found one UIDH record in my modsec_audit logs, but most worryingly it was it was for a personal injury trial lawyer. Made some records semi-anonymous.

--eee7b544-A-- [25/Sep/2014:15:33:19 --0500] VCR8D6wUChkAAG-HuKQAAAAH 70.209.73.XXX 32675 X.X.X.X 80 --eee7b544-B-- GET /wp-content/uploads/2012/07/XXXXXXXXXXX.jpg HTTP/1.1 X-UIDH: MTU4NTI5Mjg3AKafKcbQqnDdCMuP+UbmoCyKvEu8MnDsqV0I+AQ2K/M+ User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; XT1030 Build/SU4.21) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36 GSA/3.4.16.1149292.arm Host: www.XXXXXXXXX.com Connection: Keep-Alive Accept-Encoding: gzip

Re: How Verizon's Advertising Header Works

#63

Post by justanothername » Sat, Oct 25, 2014, 3:22 PM UTC

justanothername wrote: post #49

Using the SOPA visibility strategy could be effective. If enough popular sites redirected requests that had a X-UIDH to a Informational page about the privacy intrusion, people might care (if only for the extra click its causing them).

Ah, thinking about it, this plan probably wouldn't work. Its easy enough for them to require sites wanting this ID to opt-in and then only supply the header to the white-listed sites.

Though reading more, sending fake X-UIDH headers on non-Verison traffic could be effective: the consuming sites need to make paid calls to a Verizon service to resolve the token in the header to an identity. Extraneous tokens could cost advertisers money.

Re: How Verizon's Advertising Header Works

#64

Post by sehugg » Sat, Oct 25, 2014, 4:13 PM UTC

Bandwidth costs money, correct? I wonder if for someone with zillions of small HTTP requests (Google, Twitter, Facebook, etc) these costs might be recoverable somehow.

Re: How Verizon's Advertising Header Works

#65

Post by jacques_chester » Sat, Oct 25, 2014, 4:14 PM UTC

dhimes wrote: post #59

jacques_chester wrote: post #48

I happen to be in the process of patenting an opt-in system for authenticating and recording requests from users. One of my design goals was to prevent anyone from piggybacking on the scheme to track the users across multiple requests. It occurs to me that if I'd been suffering from a less overdeveloped sense of decency, I could've filed sooner with something like this and hit Verizon with a lawsuit.

Or even better for Evil jacques_chester, they would have paid more to license it.

That guy really knows how to make out like a bandit.

Re: How Verizon's Advertising Header Works

#66

Post by nkozyra » Sun, Oct 26, 2014, 1:20 AM UTC

jimktrains2 wrote: post #56

nkozyra wrote: post #29

Earlier quoted context omitted.

Given the ordering of the process, that makes sense. I'm not a Verizon customer but I would be gone yesterday if I were after reading about this. As I understand it, they offer an "opt out" that doesn't actually opt you out of this. Truly gross behavior, though.

> I'm not a Verizon customer but I would be gone yesterday if I were after reading about this. And where would you go? AT&T? Is that really a better option? Sprint and TMo just don't have the reception everywhere I go (or didn't last time I checked).

I'm a TMobile customer. Reception is perfectly fine in any metro area. I work in metro areas. Admittedly, I lose service on vacation, but maybe that's for the best.

Re: How Verizon's Advertising Header Works

#67

Post by maxerickson » Sun, Oct 26, 2014, 1:29 AM UTC

nkozyra wrote: post #66

jimktrains2 wrote: post #56

Earlier quoted context omitted.

> I'm not a Verizon customer but I would be gone yesterday if I were after reading about this. And where would you go? AT&T? Is that really a better option? Sprint and TMo just don't have the reception everywhere I go (or didn't last time I checked).

I'm a TMobile customer. Reception is perfectly fine in any metro area. I work in metro areas. Admittedly, I lose service on vacation, but maybe that's for the best.

T-Mobile roams on AT&T.

Or at least, some plans do. My legacy per minute plan does.

I'm pretty sure Sprint roams on Verizon, they just won't offer you service for an address where you would be roaming all the time.

Re: How Verizon's Advertising Header Works

#68

Post by jimktrains2 » Sun, Oct 26, 2014, 2:38 PM UTC

nkozyra wrote: post #66

jimktrains2 wrote: post #56

Earlier quoted context omitted.

> I'm not a Verizon customer but I would be gone yesterday if I were after reading about this. And where would you go? AT&T? Is that really a better option? Sprint and TMo just don't have the reception everywhere I go (or didn't last time I checked).

I'm a TMobile customer. Reception is perfectly fine in any metro area. I work in metro areas. Admittedly, I lose service on vacation, but maybe that's for the best.

> everywhere I go

That included the middle of the Appalachian mountains.