Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

techcrunch.com

Post reply on HN
Print view View original

101–110 of 156 posts

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#101

Post by chatmasta »

An ad injector by definition is a proxy that sits somewhere between the user's initial request and the end web server. It could be a local program, a browser extension, a remote proxy, or any proxy on the route of request to response. If it has access to data in transit, it can modify it. Often it doesn't even need access to the data because it can just append a block of javascript to an incoming HTTP response.

Obviously this is harmful to users because the implication is that the technique also requires SSL stripping, or trusting invalid root certificates like we saw with Superfish. It's also harmful to advertisers and ad networks because it pollutes tracking data and makes it hard to determine click fraud.

But let's not kid ourselves. Google does not care about the user. They simply have no need for ad injectors because they already have far superior methods of tracking us and invasively advertising to us (reading our email, watching our GPS location, knowing when we are home, what videos we watch, etc.) To google this is just a nuisance and they get some free PR for standing up to it along with a respected academic institution. Yay, google! Protector of users!

But wait. Isn't this exactly what Verizon, ATT, and Comcast are all doing? Verizon was modifying HTTP headers during the summer. ATT charges users not to inject tracking into packets. Comcast injects HTML into xfinitiwifi connections. How is this any different? Sure, tracking headers do not manifest themselves in annoying pop up ads, but they are still messing with user requests and have almost as many security implications.

If Google is going to take a stand against ad injectors, they need to take a stand against all packet injection. These scammy popups are just the bottom of the totem pole. If they could get away with what the big telecoms are doing, they would obvioisly do that instead.

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#102

Post by alpeb »

In the case of chrome extensions and apps, Google was working on an ad solution a couple of years ago but didn't end up releasing anything. In light of no viable monetization solution for this kind of software it's natural devs have to resort to this kind of practices.

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#103

Post by chatmasta »

radicaledward wrote: post #77
chatmasta wrote: post #66

Earlier quoted context omitted.

It takes less than sixty seconds and requires nothing more than installing a browser extension.

I think they meant that it takes the users a long time to learn to be cynical.

This is a good point. I often take for granted how quickly I can recognize advertisement from non advertisement. I attribute most of it to spending my early days on the Internet reading marketing forums and running ad campaigns myself. Nowadays marketing is very subtle. Often you find yourself reading content and don't even realize somebody paid for that content to build their brand, drive traffic, etc. Look at recipe sites for example. If you watch your ad blocker count the ads, recipe sites always have one of the highest numbers. Who would ever think that if they didn't know what to look for?

My rule of thumb is "if nobody would write this without getting paid for it, then somebody probably got paid for it."

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#104

Post by comex »

chatmasta wrote: post #101

An ad injector by definition is a proxy that sits somewhere between the user's initial request and the end web server. It could be a local program, a browser extension, a remote proxy, or any proxy on the route of request to response. If it has access to data in transit, it can modify it. Often it doesn't even need access to the data because it can just append a block of javascript to an incoming HTTP response. Obvio…

Google has mostly transitioned to HTTPS which makes network packet injection/sniffing useless on their sites. Since it's no longer their problem, why do they need to take a stand?

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#105

Post by jacquesm »

TeMPOraL wrote: post #64
jacquesm wrote: post #37

Earlier quoted context omitted.

That's probably where we're headed. Hypervisors running single-application kernels talking via message passing over some networking protocol to display servers and other virtualized hardware.

Am I the only one who thinks this reality sucks? Everything locked down, no way to tweak or repurpose any of your software. I know, there are bad actors out there, etc. but shouldn't there be a limit for destroying utility of things in the name of security?

It definitely sucks to some degree, but it is the same kind of change when going from a small town or a rural area into a big city.

The houses where I lived in Canada weren't locked, they didn't even have locks. In Amsterdam it would take about 6 seconds from the time you left to have your house burgled if you did that.

As far as it reduces your ability to tweak or repurpose your software: I don't think that it has to be that way but it will definitely be harder than in an environment of trust.

Maybe there is an easy way to get both ease of fiddling and very high security but I haven't seen anything like that yet. There are some interesting research projects revolving around 'capability based operating systems' and such, maybe that's where they key lies, or in some other development currently underway.

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#106

Post by jacquesm »

TeMPOraL wrote: post #57
brador wrote: post #38

Earlier quoted context omitted.

It's the 30 second youtube ads that finally got me to install adblock again after 3 years without. Also the javascript late load "oops click" tricks they're pulling to scam advertisers now (google search, youtube, bing search - all use late load javascript to get misclicks).

> It's the 30 second youtube ads that finally got me to install adblock again after 3 years without. Same here. I couldn't be bothered to install AdBlock for many years, but the mandatory before-video ads were the straw that broke the camel's back for me. > Also the javascript late load "oops click" tricks they're pulling to scam advertisers now (google search, youtube, bing search - all use late load javascript to g…

> Same here. I couldn't be bothered to install AdBlock for many years, but the mandatory before-video ads were the straw that broke the camel's back for me.

That's because people in general don't mind wasting a bit of screen space but the mandatory wasting of time is of a completely different order. Time is our most precious capital.

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#107

Post by MBCook »

code_duck wrote: post #82
gadders wrote: post #39

Browsing sites on my Android phone is the worst. I frequently get re-directed right off the page to either Google Play to install some dodgy app, or some site that tries to download the APK directly.

This happens a lot on iOS too - even some respectable sites have ads that open the App Store without any user intervention. I'm not sure why Apple allows this.

They stopped it with iOS 8, but after a few weeks someone had found a way around it and the problem was back.

It doesn't effect me much, which must say something about the sites I read. But it is obnoxious as hell.

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#108

Post by jacquesm »

comex wrote: post #104
chatmasta wrote: post #101

An ad injector by definition is a proxy that sits somewhere between the user's initial request and the end web server. It could be a local program, a browser extension, a remote proxy, or any proxy on the route of request to response. If it has access to data in transit, it can modify it. Often it doesn't even need access to the data because it can just append a block of javascript to an incoming HTTP response. Obvio…

Google has mostly transitioned to HTTPS which makes network packet injection/sniffing useless on their sites. Since it's no longer their problem, why do they need to take a stand?

- ssl stripping

- browser extensions

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#110

Post by chatmasta »

comex wrote: post #104
chatmasta wrote: post #101

An ad injector by definition is a proxy that sits somewhere between the user's initial request and the end web server. It could be a local program, a browser extension, a remote proxy, or any proxy on the route of request to response. If it has access to data in transit, it can modify it. Often it doesn't even need access to the data because it can just append a block of javascript to an incoming HTTP response. Obvio…

Google has mostly transitioned to HTTPS which makes network packet injection/sniffing useless on their sites. Since it's no longer their problem, why do they need to take a stand?

If Verizon owns your phone (literally, in the case of their edge program), all they need to do to inject tracking into HTTP packets is install a trusted root cert for themselves on your phone. One might argue that's not even wrong for them to do.

Also, Verizon and ISP's in general don't need access to unencrypted HTTPS data to track you. HTTP is an application layer protocol (top of OSI model), but your ISP can track you all the way down to the physical layer (bottom of OSI model). They still have all the metadata of your packets, even if they don't have the unencrypted content of them, because they literally own the wires/spectrum that your device used to send data. That means they can see when you use the Internet, what IP addresses you go to, how much content you send to each, etc etc. I don't think I need to explain to HN how much you can extract from metadata.

My point is that Verizon is not playing the game of injecting the actual ads you see. They inject tracking codes, or track you in other ways, but they still sell that data to the same advertisers who benefit from ad injectors. (Because ultimately, an ad is an ad, no matter how it got in your computer, and if you click it, the advertiser stands to benefit.)

Google should take a stand because the problem of ad injection is a symptom of the bigger problem, which is messing with user traffic in general.

Perhaps the solution is breaking up control of the OSI model. The companies running your cable should not be the same ones servicing you in the application layer.

Post reply on HN