Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Verizon and Turn Defeat Browser Privacy Protections

eff.org

Post reply on HN
Print view View original

171–176 of 176 posts

Re: How Verizon and Turn Defeat Browser Privacy Protections

#171

Post by JadeNB »

jes wrote: post #166
JadeNB wrote: post #164

Earlier quoted context omitted.

In addition to the other replies you've got, this kind of judgement is, I think, beyond most people's capability to make. Should everyone who works at Turn be shunned, or just those who work on this project specifically? If a previously honourable company starts doing dishonourable work, how long a window does an engineer working there have to find another job before he or she is shunned? What does it mean to 'enable…

I appreciate your comment. For me, it's a matter of the degree to which the person sees the ramifications of what they are doing, and the degree to which they directly contribute to the bad actions. For example, the management team that has built a business around tracking people who clearly do not wish to be tracked is highly suspect, in my view. The sysadmin that runs the servers, less so. But if she/he knows what…

Precisely because your questions seem particularly on point, I find them hard to answer; but I wanted to say that I appreciate your thoughtful engagement with respondents in this thread. It's a rare sight, even on HN, and a pleasure.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#172

Post by jes »

dcole2929 wrote: post #158
jes wrote: post #129

Earlier quoted context omitted.

Not trying to be sarcastic, but is "too dogmatic" a different way of saying "too principled?" I pay taxes to several entities, including the government of the United States of America and the state of Washington. These taxes are non-voluntary and coerced from me under threat of force.

"These taxes are non-voluntary and coerced from me under threat of force." False. You can move to another country whose values/morals you agree with more, become a citizen, and renounce your American Citizenship. It's by no means easy but completely doable. You still live here and pay taxes to the US government because your "principles" don't yet outweigh the convenience of living where you do. Make no mistake, Ameri…

I have a different view, but first, thank you for sharing yours.

Yes, I could move to a different country. And I have thought about that quite a bit. There may come a time when I decide to do it.

But it's troubling, morally, to do so. Here's why.

An old man is walking down the street. He's a peaceful guy, minding his own business. A couple of thugs come up to him, stick a gun in his ribs, and demand his wallet.

He doesn't want to do it, but he reluctantly gives up his wallet, in the hope that they won't choose to harm him any further.

If after this incident, the man chooses not to move to a safer neighborhood, would you say that he is then endorsing the actions of the thugs?

In my view, the man has done nothing wrong. He did not initiate force against anyone else. When the thugs, who clearly do not respect individual rights demanded his money, he made a rational calculation and did what he concluded was most likely to save his life.

This is why, while I could move to another country, I'm (currently) unwilling to do so. I would prefer to stay in my home, and work as best I can to be an advocate for virtue and peaceful, voluntary cooperation.

And finally, yes, I agree with you, the government of the United States has done some horrible things. You might have noticed that I am not exactly an advocate of a large and powerful state. :-D

Re: How Verizon and Turn Defeat Browser Privacy Protections

#173

Post by mrslx »

hackuser wrote: post #41

Someone who understands this well needs to write a very short 'elevator' explanation for non-technical end-users that we all can copy and paste. That small act would be invaluable to spreading awareness, which is necessary for any progress. I was going to send the EFF article to some Verizon customers I know but I realized they would have no idea what it meant. I don't have time to read it thoroughly and write an acc…

Verizon is doing the equivalent of a reverse 'butt dial' they are listening to everything you do after you've hung up.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#174

Post by MichaelGG »

bashinator wrote: post #169
MichaelGG wrote: post #140

Earlier quoted context omitted.

No the header injection happens after the request leaves your browser. However, adblock can prevent the request going to Turn and other ad sites in the first place. But then the website owner (eg Facebook) can work with the ad network to pass your info to them on the server side, although I'm not sure how widespread this is.

How about if I wanted to actively subvert the header? Would there be a way to beat Verizon's network to the punch by injecting the same header myself and populating it with garbage data?

No, they simply overwrite it.

The only way around that would be to take advantage of bugs in their parser. HTTP is a moronic spec, and it allows inane things. For instance, these are valid HTTP headers:

  X-LineWrap: Hi my name is
       Header Boy
The value of X-LineWrap should be "Hi my name is Header Boy". Edit: Actually I'm not sure if the space before the comment counts or not. Terrible text protocol formats FTW.

  X-Comment: This is the value (but this is a comment!)
The value of X-Comment should be "This is the value".

  X-MoreFun: I don't recall (offhand) how
    this header value should
    (really, the spec is a mess)
    be interpreted.
The value of X-MoreFun should be (I think): "I don't recall how this header value should be interpreted.".

So, you might get lucky if they have a non-compliant parser and the target site has a compliant parser. In that case:

   X-UIDH: garbage1
      garbage2
Might get turned into:

   X-UIDH: verizontrackingvalue
      garbage2
In which case, a compliant HTTP parser would read the value as "verizontrackingvalue garbage2", which might be enough to mess up their tracking.

Also, HTTP has special handling of headers that are "comma separated lists". This should only apply to special-cased built-in headers. But you could try sending multiple X-UIDH headers, with commas in the values, to trick an overly ambitious parser. Maybe.

Anyways, this all depends on bugs in HTTP parsers, which probably exist. (Can you tell I despise the HTTP format?) But if exploited enough to matter, they'd simply patch them.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#175

Post by _nedR »

Cyther606 wrote: post #51
nl wrote: post #40

Earlier quoted context omitted.

You can't feed them garbage. Verizon operates at the network layer - if you are on their network presumably they will copy the real value over your garbage value. If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets. There are a couple of other solutions you haven't mentions: VPNs: Annoying and currently too hard for most people. Perhaps it is time for device (P…

Tor is free and much easier than a VPN. Tor Browser bundle on Win/Mac/Linux: https://www.torproject.org/download/download-easy.html.en Orweb on Android: https://play.google.com/store/apps/details?id=info.guardianp... OnionBrowser on iOS: https://itunes.apple.com/us/app/onion-browser/id519296448?mt...

Isn't non-HTTPS traffic susceptible to snooping in Tor?

Re: How Verizon and Turn Defeat Browser Privacy Protections

#176

Post by julianj »

nl wrote: post #167
JohnTHaller wrote: post #155

Earlier quoted context omitted.

Exactly. But instead of using it to try to change your UIDH within Verizon, it should encourage non-Verizon customers to just pollute the space with random UIDH values from all over the place.

And (as I previously noted) all Verizon has to do is *check the IP address of the client(!). They know the IPs they own. Assuming that your adversary is dumb as well as malicious is a mistake.

True, but this header is presented to all sites visited. This wouldn't pollute Verizon's tracking (they could do this without the header). This may instead pollute the third parties which are taking advantage.
Post reply on HN