Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Verizon and Turn Defeat Browser Privacy Protections

eff.org

Post reply on HN
Print view View original

141–150 of 176 posts

Re: How Verizon and Turn Defeat Browser Privacy Protections

#141

Post by magicalist »

jes wrote: post #129
Jgrubb wrote: post #124

Earlier quoted context omitted.

> I think it's important that you always be free to come to your own conclusions on such matters as well. I completely agree, but it's equally important not to be too dogmatic about it. For example, to what government do you pay taxes?

Not trying to be sarcastic, but is "too dogmatic" a different way of saying "too principled?" I pay taxes to several entities, including the government of the United States of America and the state of Washington. These taxes are non-voluntary and coerced from me under threat of force.

> These taxes are non-voluntary and coerced from me under threat of force

Just to be clear, what this really means is that you aren't willing to go to jail for your principles.

That's fine and you're in good company under that criteria, but that's what the GP was getting at.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#142

Post by MichaelGG »

rubbingalcohol wrote: post #111
No1 wrote: post #85

Earlier quoted context omitted.

Step 3: Turn ignores UIDH headers originating from non-Verizon IPs and Verizon replaces any user-generated UIDH header. Your solution is not going to fool anyone.

Reading through the original report, I'd doesn't seem that Turn's handling of the header is very sophisticated, in fact they just dumbly accept whatever header you give them. (Interestingly unless they take extra precautions, this exposes them to a CSP sandboxing vulnerability) Turn needs to handle these headers basically in realtime, and while I'm not saying it would be impossible to do IP filtering on a header, it…

There's no cat and mouse. IP filtering is trivial. Say Verizon has 50M IPs, and let's pretend each is a /22. That's 50K * 22-bit entries, but we'll be inefficient and round to 4 bytes. That's a 200KB lookup table. BFD, and that's an inefficient estimate.

HTTP is a terrible text-based format that's very inefficient to parse. The overheard of another IP lookup per request is negligible.

Your heart's in the right place, but your technical proposal simply doesn't accomplish anything.

And, if you could get traction on people installing plugins or whatever, you could just get them to install adblock.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#143

Post by MichaelGG »

scintill76 wrote: post #105
AlyssaRowan wrote: post #93

Earlier quoted context omitted.

No. An MITM starts changing the ClientHello, and the PreMasterSecret should change because it's all hashed in, and therefore Finished will fail - that's the case with the TLS 1.3 draft and I wouldn't be surprised if TLS 1.2, too, although I'll put it on my list to check. Fallbacks complicate that, but the fallback SCSV signals enough to correctly sound the alarm there too. I'm specifically on the lookout for sneaky w…

I'm sure you know a lot more than I, and you're pushing the boundaries of my limited knowledge, but I read a bit on some things you mentioned... I don't follow how the PreMasterSecret incorporates the ClientHello; PreMasterSecret seems to be just a protocol version and some random bytes. As for the Finished hash check, I didn't know about that, but can't a server complicit with the MITM (i.e., a site wanting to buy c…

Complicit endpoints could just work with Verizon to enable a server to server API to get the subscriber ID of a particular TCP connection. In fact, since this is non visible to end users, if Verizon is clever, that's what they'll do. Then it would not have this public visibility.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#144

Post by magicalist »

eunice wrote: post #110
guelo wrote: post #74

Earlier quoted context omitted.

It's simpler then that. The advertising based site wants to show you the ad, they have no incentive to implement SSL. There's no https://espn.com , for example. Even if they did implement https it would be mixed content because the ad networks' iframes or whatever are http. The solution is things like NoScript or Adblock on Firefox (not Chrome which downloads the ad and just hides it). Or blackholing the ad networks…

>(not Chrome which downloads the ad and just hides it) I thought this hadn't been the case for several years now? Am I wrong?

No, it hasn't been the case since 2010: http://www.theregister.co.uk/2010/07/20/chrome_does_resource...

Re: How Verizon and Turn Defeat Browser Privacy Protections

#145

Post by gcb0 »

Shivetya wrote: post #137
noonespecial wrote: post #101

Earlier quoted context omitted.

Sure it does. If my verizon iphone wasn't 3 months into a locked two year contract I'd just put in a different sim and forget the whole thing.

but cannot phones simply be tracked by their own id regardless of carrier. Say you swap from Verizon, if you hit one of their towers they could theoretically use that information even if your not a direct customer. We know the FBI is reading the traffic so I am wondering why someone is surprised a company does it. Its not right for either party

they could also follow you non stop on the street and enter every store you go and take note of all your purchases by looking over your shoulder. and i don't think much of it is illegal unless you can prove it distress you but I'm not a layer (I'm a productive member of society :)

Re: How Verizon and Turn Defeat Browser Privacy Protections

#146

Post by yellowapple »

oldmanjay wrote: post #24
yellowapple wrote: post #9

> In fact, Turn has told EFF that they do not believe that either Do Not Track or a user deleting their cookies is a signal that the user wishes to opt out from tracking. What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Are they for fucking real right now? I mean, I've seen my share of grade-A corporate double-speak, but this takes the goddamn cake. Holy fucking shit. Thank…

I get that this falls in line with the accepted local opinion but I thought HN aspired to be better than pandering garbage filled with vulgarity.

My apologies. I'm usually more composed than that, but sometimes one encounters this level of malice and simply snaps.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#147

Post by jes »

magicalist wrote: post #141
jes wrote: post #129

Earlier quoted context omitted.

Not trying to be sarcastic, but is "too dogmatic" a different way of saying "too principled?" I pay taxes to several entities, including the government of the United States of America and the state of Washington. These taxes are non-voluntary and coerced from me under threat of force.

> These taxes are non-voluntary and coerced from me under threat of force Just to be clear, what this really means is that you aren't willing to go to jail for your principles. That's fine and you're in good company under that criteria, but that's what the GP was getting at.

Thank you for a thought-provoking comment.

Do you think that refusing to pay one's taxes, and thereby ultimately going to jail, is the best way to make a principled stand against the idea that taxation is theft?

As I understand it, in any specific context there are many principles to be considered in making a decision as to how to act.

For example, "Strive to act rationally" is an important principle for me. I try to act based on reason and evidence, to the best of my ability to do so.

Would you consider someone who chose to make a headlong rush at the IRS and their most sacred rule as acting rationally?

I would say such a person was tilting at windmills. I think there are more effective ways for me to work for virtue and justice in the world.

In other words, I don't see being principled as necessarily requiring martyrdom.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#148

Post by yellowapple »

logn wrote: post #54
hackuser wrote: post #41

Someone who understands this well needs to write a very short 'elevator' explanation for non-technical end-users that we all can copy and paste. That small act would be invaluable to spreading awareness, which is necessary for any progress. I was going to send the EFF article to some Verizon customers I know but I realized they would have no idea what it meant. I don't have time to read it thoroughly and write an acc…

The tracking is everywhere, it is all around us, even now on this very site. You are tracked when you look out your window, or you turn on your television. You are tracked when you go to work, when you go to church, when you pay your taxes. It is the web that has been pulled over your eyes to blind you from the truth. You are a slave. Like everyone else, you were born into bondage, born into a prison that you cannot…

Verizon is a red pill that I'd rather not be swallowing.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#149

Post by canvia »

Does anyone know how flash cookies are handled on cell phones? Is there any way to block or clear them?

https://en.wikipedia.org/wiki/Local_shared_object

This add on is good for clearing them using firefox: https://addons.mozilla.org/en-US/firefox/addon/betterprivacy...

Re: How Verizon and Turn Defeat Browser Privacy Protections

#150

Post by yellowapple »

quesera wrote: post #12
yellowapple wrote: post #9

> In fact, Turn has told EFF that they do not believe that either Do Not Track or a user deleting their cookies is a signal that the user wishes to opt out from tracking. What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Are they for fucking real right now? I mean, I've seen my share of grade-A corporate double-speak, but this takes the goddamn cake. Holy fucking shit. Thank…

> What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Easy there. IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes. Convenient, isn't it?

I don't use Internet Explorer. I use Firefox. If I have Do Not Track set (which I do), it means that I have explicitly requested to not be tracked, and that such a header is explicitly representative of my wishes.

The sooner we have a full list of all companies which are doing business with Turn, the happier I'll be, since that would provide me with a better target for my (admittedly excessively) strongly-worded frustration.

Post reply on HN