How Verizon and Turn Defeat Browser Privacy Protections • Hacker News Board

Re: How Verizon and Turn Defeat Browser Privacy Protections

#41

Post by hackuser » Thu, Jan 15, 2015, 3:02 AM UTC

Someone who understands this well needs to write a very short 'elevator' explanation for non-technical end-users that we all can copy and paste. That small act would be invaluable to spreading awareness, which is necessary for any progress.

I was going to send the EFF article to some Verizon customers I know but I realized they would have no idea what it meant. I don't have time to read it thoroughly and write an accurate, succinct summary.

Any volunteers? (The EFF is doing a disservice to the cause by not doing it themselves.)

Re: How Verizon and Turn Defeat Browser Privacy Protections

#42

Post by evmar » Thu, Jan 15, 2015, 3:03 AM UTC

It's strange to read this and then simultaneously read people complaining about HTTP2 requiring SSL. It'd surely be nice if law protected us from bad actors but SSL protects from this in a way that (hopefully) can't be circumvented.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#43

Post by covercash » Thu, Jan 15, 2015, 3:13 AM UTC

Somewhat related, does anyone know about Verizon FIOS TV commercial injections and how they possibly relate to FIOS internet tracking?

I have IBD and have been spending a lot of time on UC/IBD related sites lately. I've noticed quite a lot of tv commercials for IBD drugs on TV and mentioned it in passing to my friend. He said Verizon uses tech from RGB Networks and similar companies to inject custom commercials into the FIOS TV streams based on FIOS internet data.

Does anyone know more about this program?

Re: How Verizon and Turn Defeat Browser Privacy Protections

#44

Post by fortmeaded » Thu, Jan 15, 2015, 3:15 AM UTC

toufka wrote: post #31

username223 wrote: post #26

Classic soulless PR-drone reply here: http://www.turn.com/blog/in-response-to-propublica "Clearing cookies is not a reliable way for a user to express their desire not to receive tailored advertising,..." Okay, but is it a reliable way for me to express my desire for you not to track me? I assume you ignore the DNT header, and I already block your ads, but still... "Turn fully supports enabling consumers to express t…

>"It is Turn’s policy to always honor the consumer opt-out as enacted through either the Turn website or the NAI or DAA." What does this actually mean, and how can I do it?

The original research checked the Turn / NAI / DAA opt out. According to Mayer, it does't respawn. This part of Turn's response is a lie.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#45

Post by hrjet » Thu, Jan 15, 2015, 3:31 AM UTC

roque wrote: post #15

My guess is that the "entrepreneurial" solution here would be a combination of: - A browser that doesn't support cookies and provides the server with a client controlled session-id (perhaps a user-id also). - Only uses SSL sessions to avoid middle-box injection of HTML headers (this still leaves the provider with the ability to inject data as IP options / TCP headers). - A micropayment solution that allows content pr…

> A browser that doesn't support cookies

We are working on a browser (https://gngr.info) that supports cookies but doesn't enable them by default for all websites. We also don't enable JavaScript by default. User needs to enable these on a per-site basis. Enabling for all sites at once is also possible if the user so wishes.

In the near future, we also want to support https only sessions (opt-in to begin with and opt-out once https becomes more commonly deployed).

About micropayments, there are many. Flattr comes to mind. But I am sure there are more.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#46

Post by acdha » Thu, Jan 15, 2015, 3:35 AM UTC

fortmeaded wrote: post #13

acdha wrote: post #6

Discussion for the original researcher's post: https://news.ycombinator.com/item?id=8889224 http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/

OP here, I'd be OK with swapping in Mayer's blog post. Will let the mods decide. If you haven't seen it before, this guy's stuff is absurdly good. Encyclopedic knowledge of privacy tech and law.

Yeah, that was main reason why I wanted to share his original post – the EFF (or ProPublica) stories aren't bad but he's done a great job writing about many things of interest to the HN community.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#47

Post by rhizome » Thu, Jan 15, 2015, 3:39 AM UTC

quesera wrote: post #12

yellowapple wrote: post #9

> In fact, Turn has told EFF that they do not believe that either Do Not Track or a user deleting their cookies is a signal that the user wishes to opt out from tracking. What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Are they for fucking real right now? I mean, I've seen my share of grade-A corporate double-speak, but this takes the goddamn cake. Holy fucking shit. Thank…

> What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means? Easy there. IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes. Convenient, isn't it?

If the tables were turned, the tracking would be a CFAA violation.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#48

Post by msabalau » Thu, Jan 15, 2015, 3:40 AM UTC

shkkmo wrote: post #27

There are two solutions I see. 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently. 2) Feed them garbage data. We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.

Regarding regulation, if, as the EFF suggests may be the case, Turn is causing the companies they do business with to violate their stated privacy policies, it would seem that the FTC could take enforcement action without new regulation being needed. An indirect way of kicking in Turn's teeth, but perhaps one that would work.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#49

Post by logn » Thu, Jan 15, 2015, 3:40 AM UTC

x0x0 wrote: post #32

toufka wrote: post #31

Earlier quoted context omitted.

>"It is Turn’s policy to always honor the consumer opt-out as enacted through either the Turn website or the NAI or DAA." What does this actually mean, and how can I do it?

NAI and DAA are industry trade groups; they have cross company opt-out pages via cookies / beaconing http://www.networkadvertising.org/choices/ http://www.aboutads.info/choices/

Their opt out program relies on using 3rd party cookies and only blocks the display of ads (not the collection or other use of the data). Anyone who is doing this should just install an ad blocker.

Re: How Verizon and Turn Defeat Browser Privacy Protections

#50

Post by discardorama » Thu, Jan 15, 2015, 3:44 AM UTC

shkkmo wrote: post #27

There are two solutions I see. 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently. 2) Feed them garbage data. We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.

or 3) Contact some of Turn's biggest clients and shame them publicly.