Verizon Wireless injecting tracking UIDs into HTTP requests

#1

Post by pillfill » Thu, Oct 23, 2014, 7:15 PM UTC

See @KennWhite: https://twitter.com/kennwhite/status/525110471733817344

Verizon Wireless is injecting a UID into all HTTP requests made on the VZW network, regardless of whether or not you've opted out of their Customer Proprietary Network Information (CNPI) options.

It's injected at the network level- So it tracks across browsers and ignores 'private browsing', do-not-track headers, overriding the UIDH in the client/curl, everything. My confirmation showing the headers only appearing in unprotected HTTP requests (disappearing when VPNed):

https://twitter.com/rammic/status/525360201361530880

If you're on the VZW cell network and not using wifi, you can check your own ID here (via @j4cob):

http://uidh.crud.net/

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#2

Post by chatmasta » Thu, Oct 23, 2014, 7:26 PM UTC

I'm on Verizon and got "did not receive X-UIDH header" message from uidh.crud.net. Possibly because it says "1x" at the top of my phone and that means it's on another network?

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#3

Post by sp332 » Thu, Oct 23, 2014, 7:32 PM UTC

How do you opt out of CPNI?

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#4

Post by Eiriksmal » Thu, Oct 23, 2014, 7:32 PM UTC

chatmasta wrote: post #2

I'm on Verizon and got "did not receive X-UIDH header" message from uidh.crud.net. Possibly because it says "1x" at the top of my phone and that means it's on another network?

Could be 4G only? Just did it from a 4G LTE tablet, got a big ol' X-UIDH string of what appears to be Base64.

Edit: Also, on a positive match, the page displays a link to an NBC News article on Verizon's CPNI (Customer Proprietary Network Information).

http://www.nbcnews.com/tech/security/why-you-should-check-yo...

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#5

Post by mfkp » Thu, Oct 23, 2014, 7:33 PM UTC

Hmm, confirmed on Verizon 4G LTE network.

Can anybody recommend a good VPN service that works on android?

Re: Verizon Wireless injecting tracking UIDs into HTTP requests

#6

Post by [deleted] » Thu, Oct 23, 2014, 7:33 PM UTC

chatmasta wrote: post #2

I'm on Verizon and got "did not receive X-UIDH header" message from uidh.crud.net. Possibly because it says "1x" at the top of my phone and that means it's on another network?