Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Verizon Wireless injecting tracking UIDs into HTTP requests

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 151 posts

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#111

Post by caf »

peterwwillis wrote: post #68

https://www.verizonwireless.com/b2c/support/customer-agreeme... " We collect personal information about you. We gather some information through our relationship with you, such as information about the quantity, technical configuration, type, destination and amount of your use of our telecommunications services. You can find out how we use, share and protect the information we collect about you in the Verizon Privacy…

The identifier seems more pseudonymous than anonymous.

In fact, isn't "anonymous, unique identifier" an oxymoron?

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#112

Post by sarciszewski »

caf wrote: post #111
peterwwillis wrote: post #68

https://www.verizonwireless.com/b2c/support/customer-agreeme... " We collect personal information about you. We gather some information through our relationship with you, such as information about the quantity, technical configuration, type, destination and amount of your use of our telecommunications services. You can find out how we use, share and protect the information we collect about you in the Verizon Privacy…

The identifier seems more pseudonymous than anonymous. In fact, isn't "anonymous, unique identifier" an oxymoron?

> In fact, isn't "anonymous, unique identifier" a tautology?

I believe the word you are looking for is "oxymoron" which is the opposite of a tautology.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#113

Post by scintill76 »

Seems similar to Apple's Spotlight phone-home thing: unsolicited extra data being sent, a somewhat buried disclosure that it's happening, people having difficulty getting their opt-out preference honored (possibly caused by several confusingly-similar options to disable.)

It does sound like Verizon's is more a case of simply not honoring the option, though, unless some commenters here have just not found the magic checkbox yet.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#114

Post by codezero »

ChuckMcM wrote: post #84
zackify wrote: post #49

Earlier quoted context omitted.

setup a vpn with digitalocean like I do, it's about all we can do.

Well to be clear, on WiFi it does not send the tracking data, only when using the LTE network. That said the only SSL tunnel software I saw was Junos Pulse which is sitting on a ton of bad reviews at the moment because apparently it doesn't work with iOS 8. What VPN software do you use with your iPad?

I use OpenVPN Connect, it's a bit of a pain to set up, but it works well. https://itunes.apple.com/us/app/openvpn-connect/id590379981?...

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#115

Post by CameronNemo »

pillfill wrote: post #25
kator wrote: post #13

This has been going on for ages, not sure why people just now noticed it. They were testing it last year, you could clearly see these headers on a large percentage of traffic coming from their gateways. I'm not expressing an opinion one way or another but they clearly felt the UID is not directly identifiable and thus does not become a privacy issue until they share the mapping of the UID to customer data. My guess i…

The news is that they are injecting it even when you have opted out of CNPI. The disturbing part is a unique ID that follows you despite private browsing and across browsers. The worst part is that it goes to every site you visit (not just VZW or selected advertisers). It can be trivially linked to your existing cookies/identity to follow you even after clearing cookies, changing browsers, switching devices, etc.

Private browsing has never been considered to actually protect your privacy, except for people looking at your local history. It clearly states that in browsers.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#116

Post by userbinator »

peterwwillis wrote: post #68

https://www.verizonwireless.com/b2c/support/customer-agreeme... " We collect personal information about you. We gather some information through our relationship with you, such as information about the quantity, technical configuration, type, destination and amount of your use of our telecommunications services. You can find out how we use, share and protect the information we collect about you in the Verizon Privacy…

It would be fine it they were really just following the "we collect information about you" part, but what they seem to be really doing here is more like "we send unique identifiers associated with you to every other site you visit."

In fact they even say:

We do not share any information that identifies you personally outside of Verizon as part of this program.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#117

Post by tedd4u »

srj wrote: post #96

As this requires reassembling the HTTP request to add the additional header, this probably introduces extra latency too. Fortunately https is becoming more pervasive which bypasses this and any other transparent proxies.

The carriers are working to subvert this -- see the IETF draft for "HTTP/2.0 Explicit Trusted Proxy" or read this article: http://www.theregister.co.uk/2014/02/25/evil_or_benign_trust...

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#118

Post by Too »

youzer wrote: post #20

Let's say I want to send some TCP. That TCP happens to kind of look like HTTP, but it's not. It's just some protocol I made up which looks HTTPish enough to trigger this injection. Doesn't that mean that Verizon isn't actually offering TCP/IP (Internet) access, since they corrupt my protocol stream in transit? Shoudln't that mean they should be charged with fraud if they continue to advertise the fact that they provi…

I once had extremely odd errors being reported by my clients (phonehomes via window.onerror in the browser), things like syntax errors in my otherwise perfectly fine javascript and randomly corrupted data transfered with ajax. So i started investigating and came to the conclusion that someones ISP was trying to inject iframes with ads into any random text transfered over http, including javascript! Pure craziness, if i myself was affected i would change ISP on the spot.

This case was extreme but imagine as you say, a proprietary client and server that think they have implemented HTTP properly but they haven't. Maybe they assume all headers come in a specific order, the request size may not exceed X bytes, a hash of the request has been transfered over another channel, etc etc. Normally this is fine because they always only communicate with each other and they both always do exactly the same "mistake", but now the data essentially becomes corrupted. Can you really blame these applications for "not following spec", they were only designed to communicate with each other.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#119

Post by pyre »

lemcoe9 wrote: post #105
peterwwillis wrote: post #68

https://www.verizonwireless.com/b2c/support/customer-agreeme... " We collect personal information about you. We gather some information through our relationship with you, such as information about the quantity, technical configuration, type, destination and amount of your use of our telecommunications services. You can find out how we use, share and protect the information we collect about you in the Verizon Privacy…

Thank you for posting this, so the lawsuit-happy folks of HN will realize they, once again, have no legal leg to stand on.

And good riddance! Lawsuits from HN folks were really beginning to clog up our court system... /s
Post reply on HN