Live data from Hacker News

How Verizon and Turn Defeat Browser Privacy Protections

eff.org

11–20 of 176 posts

Re: How Verizon and Turn Defeat Browser Privacy Protections

#11

It's frustrating, the internet has become such a creepy "you are the product" medium. The more of this I see, I start to feel like I don't want to be a part of it anymore.

Keep your head out of the past. The internet is becoming the way we do everything now; it's a necessity.

Just because you don't value your privacy doesn't mean you get to project those values on the rest of us. Spying on your customers doesn't magically become moral simply because technology has made it easy. It most certainly is not necessary.

Really, the only reasons surveillance as a business model has worked is most people don't realize the extent that it is going on and by the time they do a monopoly or oligopoly has already established itself. Taking advantage of ignorance is at best rude and offensive, and at worst it should be criminal.

Unfortunately, the laws have yet to catch up to abuses like Verizon's MitM rewriting of HTTP headers. Worse, fixing laws and enforcing them against these modern abuses is going to be very hard: regulatory capture's a 'helluva drug.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#12

> In fact, Turn has told EFF that they do not believe that either Do Not Track or a user deleting their cookies is a signal that the user wishes to opt out from tracking. What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Are they for fucking real right now? I mean, I've seen my share of grade-A corporate double-speak, but this takes the goddamn cake. Holy fucking shit. Thank…

> What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means?

Easy there.

IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes.

Convenient, isn't it?

Re: How Verizon and Turn Defeat Browser Privacy Protections

#13
post #6

Discussion for the original researcher's post: https://news.ycombinator.com/item?id=8889224 http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/

OP here, I'd be OK with swapping in Mayer's blog post. Will let the mods decide.

If you haven't seen it before, this guy's stuff is absurdly good. Encyclopedic knowledge of privacy tech and law.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#14

> In fact, Turn has told EFF that they do not believe that either Do Not Track or a user deleting their cookies is a signal that the user wishes to opt out from tracking. What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Are they for fucking real right now? I mean, I've seen my share of grade-A corporate double-speak, but this takes the goddamn cake. Holy fucking shit. Thank…

Gloriously filthy composition, but that's probably due to the expected increase in blood pressure from having your civil liberties stripped from you.

I am in unconditional agreement with you here.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#15
My guess is that the "entrepreneurial" solution here would be a combination of: - A browser that doesn't support cookies and provides the server with a client controlled session-id (perhaps a user-id also). - Only uses SSL sessions to avoid middle-box injection of HTML headers (this still leaves the provider with the ability to inject data as IP options / TCP headers). - A micropayment solution that allows content providers to get revenue from content rather than ads.

Anyone working on the later ?

Re: How Verizon and Turn Defeat Browser Privacy Protections

#16
post #12

> In fact, Turn has told EFF that they do not believe that either Do Not Track or a user deleting their cookies is a signal that the user wishes to opt out from tracking. What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Are they for fucking real right now? I mean, I've seen my share of grade-A corporate double-speak, but this takes the goddamn cake. Holy fucking shit. Thank…

> What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Easy there. IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes. Convenient, isn't it?

Splitting hairs, but it's not exactly a default. It's a preselected option. The user gets some notice and has to accept.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#18
post #12

> In fact, Turn has told EFF that they do not believe that either Do Not Track or a user deleting their cookies is a signal that the user wishes to opt out from tracking. What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Are they for fucking real right now? I mean, I've seen my share of grade-A corporate double-speak, but this takes the goddamn cake. Holy fucking shit. Thank…

> What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Easy there. IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes. Convenient, isn't it?

> IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes.

"By signing up for [insert service here], you agree to the privacy policy."

How many times did you actually agree with the privacy policy? Devil's advocate, I know, but it's a sobering reminder that pretty much anything you use gives information that is sold. Open a bank account? If so, notice any new junk mail? Pretty hard to live life without a bank account. Your information is still sold to third parties.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#19

It's frustrating, the internet has become such a creepy "you are the product" medium. The more of this I see, I start to feel like I don't want to be a part of it anymore.

That would be OK if my cellphone usage was "free". But it's not. I'm paying Verizon hundreds of dollars a month for me and my family. I wonder if an MVNO would be less creepy than Verizon? Probably not, I'd bet they're even sleazier.

In the US, consider Credo Mobile or T-Mobile. Even AT&T discontinued this practice when called out on it, while Verizon's is flatly recalcitrant; their privacy policy says, "If you do not want information to be collected for marketing purposes from services such as the Verizon Wireless Mobile Internet services, you should not use those particular services."

Re: How Verizon and Turn Defeat Browser Privacy Protections

#20
post #12

Earlier quoted context omitted.

> What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Easy there. IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes. Convenient, isn't it?

Splitting hairs, but it's not exactly a default. It's a preselected option. The user gets some notice and has to accept.

I think that's a difference without a distinction.
Post reply on HN