Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Verizon and Turn Defeat Browser Privacy Protections

eff.org

Post reply on HN
Print view View original

51–60 of 176 posts

Re: How Verizon and Turn Defeat Browser Privacy Protections

#51

Post by Cyther606 »

nl wrote: post #40
shkkmo wrote: post #27

There are two solutions I see. 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently. 2) Feed them garbage data. We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.

You can't feed them garbage. Verizon operates at the network layer - if you are on their network presumably they will copy the real value over your garbage value. If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets. There are a couple of other solutions you haven't mentions: VPNs: Annoying and currently too hard for most people. Perhaps it is time for device (P…

Tor is free and much easier than a VPN.

Tor Browser bundle on Win/Mac/Linux: https://www.torproject.org/download/download-easy.html.en

Orweb on Android: https://play.google.com/store/apps/details?id=info.guardianp...

OnionBrowser on iOS: https://itunes.apple.com/us/app/onion-browser/id519296448?mt...

Re: How Verizon and Turn Defeat Browser Privacy Protections

#52

Post by rando3826 »

toufka wrote: post #31
username223 wrote: post #26

Classic soulless PR-drone reply here: http://www.turn.com/blog/in-response-to-propublica "Clearing cookies is not a reliable way for a user to express their desire not to receive tailored advertising,..." Okay, but is it a reliable way for me to express my desire for you not to track me? I assume you ignore the DNT header, and I already block your ads, but still... "Turn fully supports enabling consumers to express t…

>"It is Turn’s policy to always honor the consumer opt-out as enacted through either the Turn website or the NAI or DAA." What does this actually mean, and how can I do it?

Hi, I see you'd like to start a quest into the dark heart of our corporate bureaucracy to join the other .0001% of customers who aren't having their privacy violated. We respect you. We love you (feel free to share that via social media). Welcome, and good luck.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#53

Post by scintill76 »

evmar wrote: post #42

It's strange to read this and then simultaneously read people complaining about HTTP2 requiring SSL. It'd surely be nice if law protected us from bad actors but SSL protects from this in a way that (hopefully) can't be circumvented.

SSL can't really stop it, I think. Here's a thread where I've speculated on a way to inject metadata into SSL handshakes[0] just like they're doing with HTTP headers. If that doesn't work (I'd be interested to hear why), someone else suggested using TCP-IP source/destination metadata queried from the ISP to resolve to a customer.

[0] https://news.ycombinator.com/item?id=8506492

Re: How Verizon and Turn Defeat Browser Privacy Protections

#54

Post by logn »

hackuser wrote: post #41

Someone who understands this well needs to write a very short 'elevator' explanation for non-technical end-users that we all can copy and paste. That small act would be invaluable to spreading awareness, which is necessary for any progress. I was going to send the EFF article to some Verizon customers I know but I realized they would have no idea what it meant. I don't have time to read it thoroughly and write an acc…

The tracking is everywhere, it is all around us, even now on this very site. You are tracked when you look out your window, or you turn on your television. You are tracked when you go to work, when you go to church, when you pay your taxes. It is the web that has been pulled over your eyes to blind you from the truth. You are a slave. Like everyone else, you were born into bondage, born into a prison that you cannot smell or taste or touch. A prison for your mind and especially for your Verizon phone.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#55

Post by noonespecial »

hackuser wrote: post #41

Someone who understands this well needs to write a very short 'elevator' explanation for non-technical end-users that we all can copy and paste. That small act would be invaluable to spreading awareness, which is necessary for any progress. I was going to send the EFF article to some Verizon customers I know but I realized they would have no idea what it meant. I don't have time to read it thoroughly and write an acc…

How about:

Because your mobile device really belongs to the carrier and not to you, whenever you browse the web with it, they know who you are no matter what. They are now refusing to keep that information secret even if you want them to, instead selling it to advertisers without your consent (even despite your obvious non-consent).

They do this by sabotaging your mobile browser so it can't really delete certain cookies. When you try, they put them right back the next time you use the browser. They also have a way (called a UIDH header) to tell other sites that its you (so they can track your visits) even if you don't have a cookie in your browser.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#56

Post by userbinator »

I feel like injecting headers is only the start of something far more pernicious; even SSL/TLS can't stop an ISP from determining and tagging where your traffic goes (and consequently, passing that information onto third parties) - all your traffic goes through equipment on their network, after all. As long as your connection to the Internet is tied to your identity in some way (and there is basically no way a non-free ISP is going to let that be anonymous), they can track you. "Obfuscatory routing systems" like Tor can help, but as long as ISPs can observe the traffic on their networks, they know.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#57

Post by userbinator »

doctorshady wrote: post #2

It's frustrating, the internet has become such a creepy "you are the product" medium. The more of this I see, I start to feel like I don't want to be a part of it anymore.

That was the first thing that came to mind when I read the name "Turn" - as in, "We Turn users into products."

Re: How Verizon and Turn Defeat Browser Privacy Protections

#58

Post by zevyoura »

Cyther606 wrote: post #51
nl wrote: post #40

Earlier quoted context omitted.

You can't feed them garbage. Verizon operates at the network layer - if you are on their network presumably they will copy the real value over your garbage value. If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets. There are a couple of other solutions you haven't mentions: VPNs: Annoying and currently too hard for most people. Perhaps it is time for device (P…

Tor is free and much easier than a VPN. Tor Browser bundle on Win/Mac/Linux: https://www.torproject.org/download/download-easy.html.en Orweb on Android: https://play.google.com/store/apps/details?id=info.guardianp... OnionBrowser on iOS: https://itunes.apple.com/us/app/onion-browser/id519296448?mt...

Tor is so slow as to be unusable for everyday browsing.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#59

Post by FrankenPC »

nl wrote: post #40
shkkmo wrote: post #27

There are two solutions I see. 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently. 2) Feed them garbage data. We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.

You can't feed them garbage. Verizon operates at the network layer - if you are on their network presumably they will copy the real value over your garbage value. If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets. There are a couple of other solutions you haven't mentions: VPNs: Annoying and currently too hard for most people. Perhaps it is time for device (P…

VPN is insanely easy today. IMO Everyone should use it by default. Too bad it causes an additional load on the internet for the encrypted tunnel traffic.

Another option is a blanket law about internet traffic that states no tracking can be made at all unless given express permission.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#60

Post by hobs »

oldmanjay wrote: post #24
yellowapple wrote: post #9

> In fact, Turn has told EFF that they do not believe that either Do Not Track or a user deleting their cookies is a signal that the user wishes to opt out from tracking. What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Are they for fucking real right now? I mean, I've seen my share of grade-A corporate double-speak, but this takes the goddamn cake. Holy fucking shit. Thank…

I get that this falls in line with the accepted local opinion but I thought HN aspired to be better than pandering garbage filled with vulgarity.

Vulgarity is to be used sparingly and effectively, and I think many voices want to say the same thing, and it is a valid part of the discussion.

Overall it would have been classier to limit it to the first sentence, but sometimes you have to get spittin mad to get your point across.

Post reply on HN