Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Verizon and Turn Defeat Browser Privacy Protections

eff.org

Post reply on HN
Print view View original

121–130 of 176 posts

Re: How Verizon and Turn Defeat Browser Privacy Protections

#121

Post by jes »

Jgrubb wrote: post #119
jes wrote: post #117

If someone chooses to work for a sleazy company, say one that aggressively violates a person's expressed desire to not be tracked, I would not want to hire them or otherwise associate with them. Should the engineers who enable companies like Turn be shunned by other engineers?

Should engineers who invent new rifle shells, or atomic bombs, or armed drones, or work at the NSA, or Tinder, or Uber, or Groupon, or Zynga be shunned? All of their employers are perceived by some as some as scumbags. If your job that you liked came to you with a challenge like "I want you to invent a brand new way to track our users that nobody has thought of before", would you turn it down? edit: or Facebook, or G…

I won't engage in work that I conclude is immoral, nor will I help others to pursue ends that I consider problematic. I think it's important that you always be free to come to your own conclusions on such matters as well.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#122

Post by nly »

scintill76 wrote: post #53
evmar wrote: post #42

It's strange to read this and then simultaneously read people complaining about HTTP2 requiring SSL. It'd surely be nice if law protected us from bad actors but SSL protects from this in a way that (hopefully) can't be circumvented.

SSL can't really stop it, I think. Here's a thread where I've speculated on a way to inject metadata into SSL handshakes[0] just like they're doing with HTTP headers. If that doesn't work (I'd be interested to hear why), someone else suggested using TCP-IP source/destination metadata queried from the ISP to resolve to a customer. [0] https://news.ycombinator.com/item?id=8506492

If the advertisers and your ISP are cooperating there's nothing you can do. They can easily just redirect all IP packets going to their advertising partners through some encapsulation that encodes your customer id out-of-band, encode it in to their NAT scheme, or just provide customers with static IPs and partners with regular dumps of the database.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#123

Post by fauigerzigerk »

jes wrote: post #117

If someone chooses to work for a sleazy company, say one that aggressively violates a person's expressed desire to not be tracked, I would not want to hire them or otherwise associate with them. Should the engineers who enable companies like Turn be shunned by other engineers?

I don't think that's a good idea. Yes the ad based business model has gone completely off the rails with their aggressive privacy violations and disgusting deception schemes. I think they should be stopped, if necessary by regulating them off the face of the earth.

But personally blaming and shunning regular employees of corporations that break the law or some ethical standard has far reaching ramifications. Bitter ideological battles would take over the personal lives of people who have no say in whether or not their employer decides to use a particular marketing scheme or do business in a particular country.

I think personal blame should be reserved for decision makers. If an employee knows about serious crimes committed by their employer they should simply report it to the police.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#124

Post by Jgrubb »

jes wrote: post #121
Jgrubb wrote: post #119

Earlier quoted context omitted.

Should engineers who invent new rifle shells, or atomic bombs, or armed drones, or work at the NSA, or Tinder, or Uber, or Groupon, or Zynga be shunned? All of their employers are perceived by some as some as scumbags. If your job that you liked came to you with a challenge like "I want you to invent a brand new way to track our users that nobody has thought of before", would you turn it down? edit: or Facebook, or G…

I won't engage in work that I conclude is immoral, nor will I help others to pursue ends that I consider problematic. I think it's important that you always be free to come to your own conclusions on such matters as well.

> I think it's important that you always be free to come to your own conclusions on such matters as well.

I completely agree, but it's equally important not to be too dogmatic about it. For example, to what government do you pay taxes?

Re: How Verizon and Turn Defeat Browser Privacy Protections

#125

Post by jimktrains2 »

nl wrote: post #40
shkkmo wrote: post #27

There are two solutions I see. 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently. 2) Feed them garbage data. We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.

You can't feed them garbage. Verizon operates at the network layer - if you are on their network presumably they will copy the real value over your garbage value. If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets. There are a couple of other solutions you haven't mentions: VPNs: Annoying and currently too hard for most people. Perhaps it is time for device (P…

> If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets.

The question is if they already do this, or will become aware of it and start in in a short period of time.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#126

Post by jimktrains2 »

Normati wrote: post #108
rapht wrote: post #99

It's a wonder to me how no Verizon competitor has jumped at the opportunity to advertise this on a large scale with a message along the lines "it's evil, we don't do that". If the users really care about this issue, that's what would happen on a functioning market anyway...

I doubt most people care. This isn't going to drive customers away. The only way it'll be stopped is if they're legally forced to. For example, see the history of cookies themselves and how most people never cared about them.

It would if I had options.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#128

Post by jes »

fauigerzigerk wrote: post #123
jes wrote: post #117

If someone chooses to work for a sleazy company, say one that aggressively violates a person's expressed desire to not be tracked, I would not want to hire them or otherwise associate with them. Should the engineers who enable companies like Turn be shunned by other engineers?

I don't think that's a good idea. Yes the ad based business model has gone completely off the rails with their aggressive privacy violations and disgusting deception schemes. I think they should be stopped, if necessary by regulating them off the face of the earth. But personally blaming and shunning regular employees of corporations that break the law or some ethical standard has far reaching ramifications. Bitter i…

I'd rather not do things that give the state more power and control over individuals. So I'm not a big fan of regulation in general. I'd rather pursue voluntary means of encouraging virtuous action where and when I can.

Engineers who directly enable this kind of technology are (in my view) not materially different from individuals who write malware. These engineers are members of the group of decision makers, because they know exactly how the code they are writing will be used. I think it's right to not encourage or support their behavior.

In other words, the degree to which I would shun someone is proportional to the knowledge and control they had in the situation under consideration.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#129

Post by jes »

Jgrubb wrote: post #124
jes wrote: post #121

Earlier quoted context omitted.

I won't engage in work that I conclude is immoral, nor will I help others to pursue ends that I consider problematic. I think it's important that you always be free to come to your own conclusions on such matters as well.

> I think it's important that you always be free to come to your own conclusions on such matters as well. I completely agree, but it's equally important not to be too dogmatic about it. For example, to what government do you pay taxes?

Not trying to be sarcastic, but is "too dogmatic" a different way of saying "too principled?"

I pay taxes to several entities, including the government of the United States of America and the state of Washington.

These taxes are non-voluntary and coerced from me under threat of force.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#130

Post by im2w1l »

noonespecial wrote: post #55
hackuser wrote: post #41

Someone who understands this well needs to write a very short 'elevator' explanation for non-technical end-users that we all can copy and paste. That small act would be invaluable to spreading awareness, which is necessary for any progress. I was going to send the EFF article to some Verizon customers I know but I realized they would have no idea what it meant. I don't have time to read it thoroughly and write an acc…

How about: Because your mobile device really belongs to the carrier and not to you, whenever you browse the web with it, they know who you are no matter what. They are now refusing to keep that information secret even if you want them to, instead selling it to advertisers without your consent (even despite your obvious non-consent). They do this by sabotaging your mobile browser so it can't really delete certain cook…

"Whenever you request a web page, Verizon stamps it with a beastly mark, a name-number to give you offers to buy goods."
Post reply on HN