Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Verizon revives "zombie cookie" device tracking on AOL's ad network

propublica.org

Post reply on HN
Print view View original

41–50 of 98 posts

Re: Verizon revives "zombie cookie" device tracking on AOL's ad network

#41

Post by Abundnce10 »

bndw wrote: post #31
on_ wrote: post #2

The article just below it indicates users can opt-out but mobile tracking is such a big business I sm sure that if it actually is possible, it is not easy. Anyone have good privacy resources for mobile/iOS. My phone security is nowhere near where it should be.

You can visit http://checkyourinfo.com to see all of the HTTP headers your device is sending in requests, including any your ISP may tack on. Disclosure: I maintain the site

Nice! I'm seeing an `X-Uidh` attribute in my request headers, is that the Verizon Zombie Cookie?

Re: Verizon revives "zombie cookie" device tracking on AOL's ad network

#42

Post by bndw »

Abundnce10 wrote: post #41
bndw wrote: post #31

Earlier quoted context omitted.

You can visit http://checkyourinfo.com to see all of the HTTP headers your device is sending in requests, including any your ISP may tack on. Disclosure: I maintain the site

Nice! I'm seeing an `X-Uidh` attribute in my request headers, is that the Verizon Zombie Cookie?

Looks like that's the one: http://www.verizonwireless.com/support/unique-identifier-hea...

Re: Verizon revives "zombie cookie" device tracking on AOL's ad network

#43

Post by t0mas88 »

bndw wrote: post #31
on_ wrote: post #2

The article just below it indicates users can opt-out but mobile tracking is such a big business I sm sure that if it actually is possible, it is not easy. Anyone have good privacy resources for mobile/iOS. My phone security is nowhere near where it should be.

You can visit http://checkyourinfo.com to see all of the HTTP headers your device is sending in requests, including any your ISP may tack on. Disclosure: I maintain the site

Don't forget to turn off wifi if you want to see the identifiers your provider adds.

Re: Verizon revives "zombie cookie" device tracking on AOL's ad network

#44

Post by happyscrappy »

bduerst wrote: post #34
jerf wrote: post #12

Earlier quoted context omitted.

I never dreamed Apple would in any way officially support, or even acknowledge the existence of, ad blocking.

It's an aggressive strategy. Apple is only blocking internet ads, not in-app ads, which makes it obvious that they're targeting content creators to push them to either Apple newsstand or iOS apps, where Apple gets a cut of the ads. It's disappointing because Apple is using their mobile marketshare to attack and fragment the open web. Users either don't understand or don't care because they have cognitive bias towards…

Apple is not blocking any ads. iAd makes little money and Apple is letting apps that block iAds into the app store. I know some people will oppose Apple no matter what they do but in this case they and the majority of users are right and you are wrong. People have a negative view of advertising for a very good reason.

Re: Verizon revives "zombie cookie" device tracking on AOL's ad network

#46

Post by drumdance »

devit wrote: post #6

They should be sued for that. There is no way most customers are informed and intentionally consenting to them tampering with the HTTP requests they send to include their customer ID. The obvious expectation of a customer of an ISP is that it sends the data through unchanged.

It's on page 73, section 4, subsection i) of the terms of service.

Re: Verizon revives "zombie cookie" device tracking on AOL's ad network

#47

Post by aikah »

bduerst wrote: post #34
jerf wrote: post #12

Earlier quoted context omitted.

I never dreamed Apple would in any way officially support, or even acknowledge the existence of, ad blocking.

It's an aggressive strategy. Apple is only blocking internet ads, not in-app ads, which makes it obvious that they're targeting content creators to push them to either Apple newsstand or iOS apps, where Apple gets a cut of the ads. It's disappointing because Apple is using their mobile marketshare to attack and fragment the open web. Users either don't understand or don't care because they have cognitive bias towards…

Ads considerably degrade the browsing experience on mobile.

Most ads used to be in Flash which was blocked by default since not working on Ios, then everything turned into big and slow HTML5 stunts to replace Flash, which has the exact same effect as Flash : battery drain,... .

Apple, on the other hand controls the in-app anything experience.

Not saying to it's right , just saying that how Apple justifies its strategy.

Re: Verizon revives "zombie cookie" device tracking on AOL's ad network

#48

Post by charonn0 »

13throwaway wrote: post #37
astrodust wrote: post #7

Earlier quoted context omitted.

It's things like this that drive people to want HTTPS everywhere, but even that is subject to subterfuge when the provider inserts their own "trusted" certificates to proxy that traffic. There really should be provisions in the telecom bill that data traffic is to remain absolutely untouched. Just imagine phone calls where mentioning the word "pizza" would trigger an advertisement being injected into it.

I don't know of any ISPs that are currently MITMing HTTPS. That seems like something that would be big news and get a CA revoked. Do you have a source for that?

Not an ISP, but I think this was a reference to Lenovo's recent Superfish scandal.

[0]: http://arstechnica.com/security/2015/02/lenovo-pcs-ship-with...

Re: Verizon revives "zombie cookie" device tracking on AOL's ad network

#49

Post by nandhp »

bndw wrote: post #42
Abundnce10 wrote: post #41

Earlier quoted context omitted.

Nice! I'm seeing an `X-Uidh` attribute in my request headers, is that the Verizon Zombie Cookie?

Looks like that's the one: http://www.verizonwireless.com/support/unique-identifier-hea...

Not that I approve at all of what Verizon is doing, but apart from the item about opting out ("Verizon Wireless will stop inserting the UIDH after a customer opts out of the Relevant Mobile Advertising program"), this stands out:

They plan to (eventually) only send this to Verizon-owned (or contracted) servers. This has two roughly equivalent corollaries:

1. They don't need to use a header for this because they can trivially accomplish the same thing with a database of IP addresses.

2. They can trivially accomplish this with a database of active IP addresses, so it doesn't really matter if they use a header or not.

Incidentally, other ISPs do this too, but for more benign reasons because they don't (as far as I know) own an ad network: for example, T-Mobile automatically logs you in to My T-Mobile when you access it over 3G. Basically, if your ISP wants to track you, they will have no trouble with this (except to the extent that they can be stopped with SSL). You'll just have to switch ISPs, if possible.

Re: Verizon revives "zombie cookie" device tracking on AOL's ad network

#50

Post by jeff_tyrrill »

lukev wrote: post #40

So I have a VPN I use already on my iPhone for sensitive things. Seems like I should use it all the time. Is it possible to make a VPN connection mandatory on a consumer iPhone? It's really a pain having to reconnect manually after I haven't used it for a few minutes.

Yes.

getcloak.com is a combination app and subscription VPN service that makes it easy. You can either switch it on, or set it to always on. You can decide which wi-fi networks (or cellular) to "trust" (exception to always-on).

The VPN, including always-on functionality, is implemented by iOS. The Cloak app merely configures it via API (or via configuration profiles prior to iOS 9).

Post reply on HN