Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Verizon and Turn Defeat Browser Privacy Protections

eff.org

Post reply on HN
Print view View original

31–40 of 176 posts

Re: How Verizon and Turn Defeat Browser Privacy Protections

#31

Post by toufka »

username223 wrote: post #26

Classic soulless PR-drone reply here: http://www.turn.com/blog/in-response-to-propublica "Clearing cookies is not a reliable way for a user to express their desire not to receive tailored advertising,..." Okay, but is it a reliable way for me to express my desire for you not to track me? I assume you ignore the DNT header, and I already block your ads, but still... "Turn fully supports enabling consumers to express t…

>"It is Turn’s policy to always honor the consumer opt-out as enacted through either the Turn website or the NAI or DAA."

What does this actually mean, and how can I do it?

Re: How Verizon and Turn Defeat Browser Privacy Protections

#32

Post by x0x0 »

toufka wrote: post #31
username223 wrote: post #26

Classic soulless PR-drone reply here: http://www.turn.com/blog/in-response-to-propublica "Clearing cookies is not a reliable way for a user to express their desire not to receive tailored advertising,..." Okay, but is it a reliable way for me to express my desire for you not to track me? I assume you ignore the DNT header, and I already block your ads, but still... "Turn fully supports enabling consumers to express t…

>"It is Turn’s policy to always honor the consumer opt-out as enacted through either the Turn website or the NAI or DAA." What does this actually mean, and how can I do it?

NAI and DAA are industry trade groups; they have cross company opt-out pages via cookies / beaconing

http://www.networkadvertising.org/choices/

http://www.aboutads.info/choices/

Re: How Verizon and Turn Defeat Browser Privacy Protections

#33

Post by x0x0 »

shkkmo wrote: post #27

There are two solutions I see. 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently. 2) Feed them garbage data. We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.

verizon overrides; I'm not a web engineer but (I think) ssl protects tcp headers. if so, it's probably the only technical solution is either ssl everywhere or an ssl proxy run by users

Re: How Verizon and Turn Defeat Browser Privacy Protections

#34

Post by hackuser »

shkkmo wrote: post #27

There are two solutions I see. 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently. 2) Feed them garbage data. We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.

> 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently

Why so hopeless? My water is clean, airplanes and roads are safe, retail banks don't lose their customer's savings, etc. Not all regulation works, but this one is pretty straightforward.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#35

Post by cjslep »

username223 wrote: post #26

Classic soulless PR-drone reply here: http://www.turn.com/blog/in-response-to-propublica "Clearing cookies is not a reliable way for a user to express their desire not to receive tailored advertising,..." Okay, but is it a reliable way for me to express my desire for you not to track me? I assume you ignore the DNT header, and I already block your ads, but still... "Turn fully supports enabling consumers to express t…

> Clearing your cookies is not the way to opt-out of tailored advertising, and may in fact be counterproductive if you’ve cleared the cookie that indicates you have opted-out.

I realize the technical reason cookies exist yet this seems wrong to me.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#36

Post by plorg »

coherentpony wrote: post #18
quesera wrote: post #12

Earlier quoted context omitted.

> What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Easy there. IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes. Convenient, isn't it?

> IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes. "By signing up for [insert service here], you agree to the privacy policy." How many times did you actually agree with the privacy policy? Devil's advocate, I know, but it's a sobering reminder that pretty much anything you use gives information that is sold. Open a bank account? If so, notice any new…

To play another devil's advocate, shouldn't that also imply that IE10 users sending Do Not Track are in fact explicitly representing their desire not to be tracked? I mean by that same argument the user, by using Windows/IE10 did in fact choose the default settings of the browser, per the terms and conditions agreed to upon installing/purchasing Windows/IE.

Live by the T&C, die by the T&C - unless you can hide your scumminess through underhanded or obfuscated tactics.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#37

Post by hackuser »

quesera wrote: post #12
yellowapple wrote: post #9

> In fact, Turn has told EFF that they do not believe that either Do Not Track or a user deleting their cookies is a signal that the user wishes to opt out from tracking. What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Are they for fucking real right now? I mean, I've seen my share of grade-A corporate double-speak, but this takes the goddamn cake. Holy fucking shit. Thank…

> What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Easy there. IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes. Convenient, isn't it?

> IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes.

> Convenient, isn't it?

That might be an excuse, but it's not the reason. They easily could read the DNT header and the user agent, and trust DNT headers from non-IE10 browsers.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#38

Post by dangrossman »

cyanbane wrote: post #25
roque wrote: post #22

Earlier quoted context omitted.

If you are a content provider you may choose not to serve ads on your content.

hmm, not talking about the content provider. I am saying if I am an author who was publishing something under anonymity and I assumed I was anonymous because I "cleared my cookies/Enabled Do Not Track settings" during the publication of the material - only to discover that my cookies had been circumvented via permacookie by a commercial entity - is my "moral right" of anonymity is now gone? could I claim the permacoo…

There is no "moral right of anonymity" in copyright law. Even supposing there was, de-anonymizing you would not violate anything in the DMCA. The anti-circumvention section prohibits circumventing technical access control measures, not circumventing "rights" in general. Circumventing the rights that copyright law does provide an author is just called copyright infringement.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#39

Post by rubbingalcohol »

shkkmo wrote: post #27

There are two solutions I see. 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently. 2) Feed them garbage data. We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.

Step 1: Site operators install backend library to detect uid cookies and send them via API to a central database

Step 2: Privacy-minded activists install a browser extension that reads the uids from central database and spoofs HTTP headers with them. Extension could even cycle through uids on a daily basis to cause more mayhem.

Result: with just a few big sites running this, a few thousand people with the extension could irreparably corrupt the uid header's "uniqueness" and it could no longer be relied upon to respawn a lost cookie session. Because Turn wouldn't know whether it's a real mobile Verizon user, or a jackass with an extension.

Shameless plug: I've already written a browser extension http://flagger.io that spoofs HTTP headers in Chrome and Firefox. Would be easy to add this functionality if people can help on the backend side (writing libraries for node/python/ruby/php/etc.)

Re: How Verizon and Turn Defeat Browser Privacy Protections

#40

Post by nl »

shkkmo wrote: post #27

There are two solutions I see. 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently. 2) Feed them garbage data. We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.

You can't feed them garbage.

Verizon operates at the network layer - if you are on their network presumably they will copy the real value over your garbage value.

If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets.

There are a couple of other solutions you haven't mentions:

VPNs: Annoying and currently too hard for most people. Perhaps it is time for device (PC and mobile) manufactures to consider offering VPNs integrated with their devices.

Competition: If the US had a more competitive broadband market then people could choose other providers.

Legal action: If Verizon was sued and lost over this then it could have a cautionary effect. However, the loss would have to be huge for it to have an impact, and large financial settlements generally require proof of significant harm. That's going to be hard in this case.

Post reply on HN