Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Verizon and Turn Defeat Browser Privacy Protections

eff.org

Post reply on HN
Print view View original

131–140 of 176 posts

Re: How Verizon and Turn Defeat Browser Privacy Protections

#131

Post by richardwhiuk »

rubbingalcohol wrote: post #111
No1 wrote: post #85

Earlier quoted context omitted.

Step 3: Turn ignores UIDH headers originating from non-Verizon IPs and Verizon replaces any user-generated UIDH header. Your solution is not going to fool anyone.

Reading through the original report, I'd doesn't seem that Turn's handling of the header is very sophisticated, in fact they just dumbly accept whatever header you give them. (Interestingly unless they take extra precautions, this exposes them to a CSP sandboxing vulnerability) Turn needs to handle these headers basically in realtime, and while I'm not saying it would be impossible to do IP filtering on a header, it…

IP filtering compared to checking a HTTP header is trivial - it isn't going to be expensive.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#132

Post by julianj »

guelo wrote: post #74
scintill76 wrote: post #53

Earlier quoted context omitted.

SSL can't really stop it, I think. Here's a thread where I've speculated on a way to inject metadata into SSL handshakes[0] just like they're doing with HTTP headers. If that doesn't work (I'd be interested to hear why), someone else suggested using TCP-IP source/destination metadata queried from the ISP to resolve to a customer. [0] https://news.ycombinator.com/item?id=8506492

It's simpler then that. The advertising based site wants to show you the ad, they have no incentive to implement SSL. There's no https://espn.com , for example. Even if they did implement https it would be mixed content because the ad networks' iframes or whatever are http. The solution is things like NoScript or Adblock on Firefox (not Chrome which downloads the ad and just hides it). Or blackholing the ad networks…

Agreed. An entry in the hosts file for ad dot turn dot com could be a temporary fix-- until they use a different subdomain. A combination of the above is probably the most optimal solution.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#133

Post by julianj »

JohnTHaller wrote: post #65
nl wrote: post #40

Earlier quoted context omitted.

You can't feed them garbage. Verizon operates at the network layer - if you are on their network presumably they will copy the real value over your garbage value. If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets. There are a couple of other solutions you haven't mentions: VPNs: Annoying and currently too hard for most people. Perhaps it is time for device (P…

True, but an enterprising individual could write an extension to cause non-Verizon users to start feeding fake unique identifiers into their own streams. Heck, you may even be able to hijack a website login using it.

something like this? https://github.com/lightswitch05/Bogus_X-UIDH

Re: How Verizon and Turn Defeat Browser Privacy Protections

#135

Post by 01Michael10 »

jleight wrote: post #118
nhstanley wrote: post #112

Earlier quoted context omitted.

Naive follow up question: Can doing something like routing through a VPN help with this? I assume not, since a forced cookie on your browser will make you always identifiable to the person on the other end, correct?

Using a VPN would encrypt your traffic, preventing Verizon from injecting a UIDH header. You could then clear your cookies and websites would not be able to re-add them via the UIDH header since it isn't being sent. This isn't to say that the websites can't identify you via some other means, just that they no longer have the guaranteed UIDH header to identify you.

Another question? Would FF+Adblock Plus+Ghostery stop this UIDH header injection without a VPN?

Re: How Verizon and Turn Defeat Browser Privacy Protections

#136

Post by HelloNurse »

nl wrote: post #61
FrankenPC wrote: post #59

Earlier quoted context omitted.

VPN is insanely easy today. IMO Everyone should use it by default. Too bad it causes an additional load on the internet for the encrypted tunnel traffic. Another option is a blanket law about internet traffic that states no tracking can be made at all unless given express permission.

VPN is insanely easy today How do I install a VPN on my SmartTV exactly? How do I make it actually work , even using VPN-on-a-router, given the importance CDNs have and how they use the location of your DNS resolver to attempt to give you nearest copies? How do I explain to the hypothetical 68 yo grandmother why she has to disable the VPN to use (Australian geoblocked catch-up TV Service) iView and then reenable it t…

Your grandmother being older and wiser than you, she would stop caring about the user-hostile businesses you mention. Being able to circumvent anti-privacy measures is a good skill to have, but actually doing it is ultimately less useful than quitting.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#137

Post by Shivetya »

noonespecial wrote: post #101
guelo wrote: post #75

Earlier quoted context omitted.

It doesn't have anything to do with who owns the device.

Sure it does. If my verizon iphone wasn't 3 months into a locked two year contract I'd just put in a different sim and forget the whole thing.

but cannot phones simply be tracked by their own id regardless of carrier. Say you swap from Verizon, if you hit one of their towers they could theoretically use that information even if your not a direct customer.

We know the FBI is reading the traffic so I am wondering why someone is surprised a company does it. Its not right for either party

Re: How Verizon and Turn Defeat Browser Privacy Protections

#138

Post by julianj »

Maybe instead of adblock for turn, someone should put together a plugin to generate a random header string sized at about 16k just for *.turn.com.

On a side note, if your browser automatically filled up the remaining allowed characters in the header (depends on the server of course), it'd be interesting to know how that would be handled by Verizon's support since all sites would get a 400 error when their header injection is enabled.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#139

Post by fauigerzigerk »

jes wrote: post #128
fauigerzigerk wrote: post #123

Earlier quoted context omitted.

I don't think that's a good idea. Yes the ad based business model has gone completely off the rails with their aggressive privacy violations and disgusting deception schemes. I think they should be stopped, if necessary by regulating them off the face of the earth. But personally blaming and shunning regular employees of corporations that break the law or some ethical standard has far reaching ramifications. Bitter i…

I'd rather not do things that give the state more power and control over individuals. So I'm not a big fan of regulation in general. I'd rather pursue voluntary means of encouraging virtuous action where and when I can. Engineers who directly enable this kind of technology are (in my view) not materially different from individuals who write malware. These engineers are members of the group of decision makers, because…

I don't think state control over individuals can be adequately characterised in terms of "more" or "less". Sometimes what governments do is to shift power and control from some groups of individuals to others, as in the case of consumer protection laws. In other cases they grab power for themselves, building a survaillance state.

I think the debate should be more about what governments should do and why, not just how much they should do, i.e big or small government.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#140

Post by MichaelGG »

01Michael10 wrote: post #135
jleight wrote: post #118

Earlier quoted context omitted.

Using a VPN would encrypt your traffic, preventing Verizon from injecting a UIDH header. You could then clear your cookies and websites would not be able to re-add them via the UIDH header since it isn't being sent. This isn't to say that the websites can't identify you via some other means, just that they no longer have the guaranteed UIDH header to identify you.

Another question? Would FF+Adblock Plus+Ghostery stop this UIDH header injection without a VPN?

No the header injection happens after the request leaves your browser. However, adblock can prevent the request going to Turn and other ad sites in the first place. But then the website owner (eg Facebook) can work with the ad network to pass your info to them on the server side, although I'm not sure how widespread this is.
Post reply on HN