Live data from Hacker News

Verizon Wireless injecting tracking UIDs into HTTP requests

news.ycombinator.com

131–140 of 151 posts

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#132
post #92

Earlier quoted context omitted.

When most mobile providers get you on the internet, it's through NAT. They're already terminating and re-creating your connections for you, and not providing your "real" tcp/ip packets to the internet, and thus neither the world's "real" internet packets to you. All you get is a translation. You've never gotten "the real internet" on a mobile device. The idea that they may change one more part of your fake connection…

NAT doesn't terminate and recreate connections. It modifies packet headers and forwards them. Modifying headers in order to facilitate transit over a network is one thing, modifying the L7 payload is another.

Well you're right in a sense. But it modifies packets to a point where they are indistinguishable from the original connection, and tracks the incoming and outgoing interface sides as if they were discrete connections (there are at least four flows for every NAT connection).

Often carrier-grade routers will replace every aspect of a tcp/ip packet, like sequence numbers, windows, flags, source and dest ports, etc. Routers like these see everything going through them as a form of NAT; it's just some connections are modified more than others. The exception to this would be interfaces in bridge or monitor mode.

To your second point that modifying some layers is OK but modifying other layers is not: what rationale explains this double standard? What about the application layer do you find to be unique in that there's some expectation of purity? Does a proxy not modify layer 7 to cache and pass traffic? Does DNS not do the same?

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#133
post #72

Earlier quoted context omitted.

No. Your question may have been serious, but it's also ridiculous, unless you have a much more technically detailed contract with Verizon than I've ever seen.

I wonder if it would be possible to have them sign a contract when you sign up since customer is king.

customer is king? With verizon? not in the US.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#134
post #77

Doesn't examining/modifying data exempt you from the DMCA safe harbor protections?

VZW doesn't use SIMs except in some new 4G tech.

Um, how is this relevant?

IANAL, but the DMCA seems to protect you from liability only if you don't examine and modify traffic. If they're looking at the protocol to see if it's HTTP and therefore modifiable, they could look at the host to see if it's going to the pirate bay and block it. This means that when someone goes to the pirate bay on the Verizon Wireless network, Verizon is liable for their actions under the DMCA.

This is like YouTube reviewing videos before they're uploaded. If they were reviewing videos, they could catch copyright violations from the start and thus should.

There's probably legal trickery they could use to get out of it but it seems like a valid point.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#135
post #130

Earlier quoted context omitted.

If they used the proper noun "Internet" then TCP/IP is implied.

No, it really isn't. Even in our world thinking Internet == TCP/IP is a faux pas, roughly equivalent to thinking Internet == WWW. Legally speaking I suspect the term borders on meaningless. Obviously a company offering "internet access" must do something to discharge their contract but I seriously doubt you could ever nail them on this. And if you could and did today, in a month the contracts would be rewritten anyho…

There is no public, global network of networks besides the one known as the Internet, and it exclusively uses the Internet Protocol suite.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#136

What about LTE modems on Verizon? I am testing them and was planning a fairly big rollout to replace some services that previously relied on Sat internet.

Yes, modems, access points, LTE tablets included. Consumer and Enterprise users (including me) are seeing it. Eg: https://twitter.com/innismir/status/525279100907560961

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#137
As a prepaid account I don't have access to the privacy settings. I spent an 1:15 on the phone with Verizon with no luck (no one had any idea what I was talking about). This has huge potential to be abused. It won't take long for companies to link your real name to web traffic and know exactly everything you look at on your phone. Wait until the cable/DSL companies realize the untapped revenue potential.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#138
post #130

Earlier quoted context omitted.

No, it really isn't. Even in our world thinking Internet == TCP/IP is a faux pas, roughly equivalent to thinking Internet == WWW. Legally speaking I suspect the term borders on meaningless. Obviously a company offering "internet access" must do something to discharge their contract but I seriously doubt you could ever nail them on this. And if you could and did today, in a month the contracts would be rewritten anyho…

There is no public, global network of networks besides the one known as the Internet, and it exclusively uses the Internet Protocol suite.

Thinking TCP/IP = IP is also a bit of a faux pas. No fair changing the terms I used out from underneath me and then complaining.

Further... again, go check your contract for your home provider. I'm quite confident it doesn't promise to "serve IP packets", let alone making any promise whatsoever to serve them without modification. Don't lose sight of the context here... pedanting about what protocol is in use isn't going to change the fact that none of them are probably mentioned in your contract.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#139
post #20

Let's say I want to send some TCP. That TCP happens to kind of look like HTTP, but it's not. It's just some protocol I made up which looks HTTPish enough to trigger this injection. Doesn't that mean that Verizon isn't actually offering TCP/IP (Internet) access, since they corrupt my protocol stream in transit? Shoudln't that mean they should be charged with fraud if they continue to advertise the fact that they provi…

When most mobile providers get you on the internet, it's through NAT. They're already terminating and re-creating your connections for you, and not providing your "real" tcp/ip packets to the internet, and thus neither the world's "real" internet packets to you. All you get is a translation. You've never gotten "the real internet" on a mobile device. The idea that they may change one more part of your fake connection…

Verizon LTE devices have a unique, publicly accessible IPv6 address.

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#140
post #89

How is this UID different to an IP address?

It's stable across devices and sessions – if you have a cell phone and a tablet, the UID is the same and it won't change over time even as you move around their network.

In some sense having one ID instead of two unique IPs is better?
Post reply on HN