Live data from Hacker News

Verizon Wireless injecting tracking UIDs into HTTP requests

news.ycombinator.com

11–20 of 151 posts

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#12
post #3

How do you opt out of CPNI?

The linked NBC News article explains you can do it through Verizon's customer account web interface, but the parent says that won't work.

..."regardless of whether or not you've opted out of their Customer Proprietary Network Information (CNPI) options."

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#13
This has been going on for ages, not sure why people just now noticed it.

They were testing it last year, you could clearly see these headers on a large percentage of traffic coming from their gateways.

I'm not expressing an opinion one way or another but they clearly felt the UID is not directly identifiable and thus does not become a privacy issue until they share the mapping of the UID to customer data.

My guess is in their minds if you opt-out they just do not provide your UID to 3rd parties for targeting.

In the ever increasing dream of cross device marketing (think your iPad, iPhone and Laptop) many companies are trying to figure out ways to connect these devices to a single individual or family.

IIRC Verizon quietly started rolling out service wide TOS changes to allow this sort of thing a couple years back. That said I'm not sure if their TOS makes it clear how this is implemented and what potential side effects might be caused by the way they've implemented them.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#16
post #5

Hmm, confirmed on Verizon 4G LTE network. Can anybody recommend a good VPN service that works on android?

If you use Chrome and enable Google's Data Compression Proxy, all http traffic is proxied via Google's servers and sent to them via spdy (which is encrypted), so Verizon can't tamper with the requests or see what they are:

https://developer.chrome.com/multidevice/data-compression

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#17
They don't appear to be doing this if you've opted out of "Relevant Mobile Advertising", which is another option [separate from CPNI] on http://verizonwireless.com/myprivacy.

Here's the setting you're looking for:

http://i.imgur.com/QFJJNV5.png

Mods may also want to update the title to include "Wireless" after Verizon; Verizon landline is not doing this anywhere AFAIK.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#18
post #5

Hmm, confirmed on Verizon 4G LTE network. Can anybody recommend a good VPN service that works on android?

If you use Chrome and enable Google's Data Compression Proxy, all http traffic is proxied via Google's servers and sent to them via spdy (which is encrypted), so Verizon can't tamper with the requests or see what they are: https://developer.chrome.com/multidevice/data-compression

So you trade Verizon's tracking for Google's?

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#19
post #14

This makes me rather unhappy. I'm seeing this on Verizon. Can someone with an alternative mobile provider like Sprint or T-Mobile test this, too?

> This makes me rather unhappy. I'm seeing this on Verizon. Can someone with an alternative mobile provider like Sprint or T-Mobile test this, too?

I would guess that voting with your feet would be the most effective response. While many think consumers don't care (or don't understand), we can see many vendors beginning to emphasize confidentiality features.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#20
Let's say I want to send some TCP. That TCP happens to kind of look like HTTP, but it's not. It's just some protocol I made up which looks HTTPish enough to trigger this injection.

Doesn't that mean that Verizon isn't actually offering TCP/IP (Internet) access, since they corrupt my protocol stream in transit? Shoudln't that mean they should be charged with fraud if they continue to advertise the fact that they provide internet access when what they really provide is a broken version of TCP they made up?

It's a serious question.

Post reply on HN