Comcast to Customer Who Noticed Secretly Injected Code: Maybe It’s Your Fault

https://thenextweb.com/insights/2017/12/11/comcast-continues-to-inject-its-own-code-into-websites-you-visit/

69 29 9 years ago

Crontab• 9 years ago

It's a crying shame when you need a VPN to protect yourself from you ISP.

AFNobody• 9 years ago

It would be a shame if your VPN was in the slow lane and could only push 56k because fast lane services being sold to "unsavory" businesses were against policy at the 2 major residential ISPs you can choose from.

dorchadas• 9 years ago

And only one of which offers reasonable speeds at reasonable prices.

Feniks• 9 years ago

Don't worry VPNs will be illegal soon ;)

guiambros• 9 years ago

Not illegal; just "+$49.99 for the VPN Package".

larrik2• 9 years ago

I love bashing Comcast, but this seems extremely overblown.

philipwhiuk• 9 years ago

You think it's overblown they are performing DPI and a MiTM attack on content traversing across their network?

kemitche• 9 years ago

IF Comcast had actually been legitimately trying to contact the customer via other means (phone, letter, email) AND it was a significant issue (end of life on modem), then it's not unreasonable.

I rather doubt that Comcast tried the phone route, and the article indicates that the modem was not EOL, so overall I think the injection was ridiculous.

bigiain• 9 years ago

I'm also somewhat creeped out by the suggestion that "The notice is typically sent after a customer ignores several emails." - so not only are they injecting Javascript into pages you're browsing, but they're doing it in an individually targeted fashion having correlated it with email they've sent you and possibly data sent (or not sent) via tracking bugs in those emails...

And they're getting it all wrong, sending it to customers who's modems do _not_ need upgrading... Doesn't exactly inspire confidence in their ability to manage and secure the Javascript injection mechanism...

carussell• 9 years ago

There are good reasons to oppose what Comcast is doing. It would be nice if we could focus on those then, instead of the kinds of responses that have been appearing. The latter are not just unlikely to get anything to change, but are probably detrimental. The type of intellectual dishonesty present in the article, its headline, and peanut galleries like HN is the sort of thing that could end up inoculating folks like jlivingood on the Comcast end against worthwhile parts of public criticism.

nkurz4• 9 years ago

Yes, I think it's overblown.

I got what I think is this same message from Comcast a little over a year ago at my father-in-laws house. It alerted me that I needed to upgrade his still working but End-Of-Life cable modem to a newer model to keep continuity of service. I recall being slightly alarmed by the injection, and then somewhat disappointed that they weren't going to continue support for the old modem, but my eventual conclusion was that this was a useful last ditch effort to contact a customer. His contact email for for Comcast is in unchecked comcast.net address, the mailed notifications probably were thrown away as junk mail, he gets multiple spam phone calls per day which he usually ignores, but this message got through.

Surreptitiously modifying web pages would be atrocious, but a last-ditch effort at notifying a customer that they are about to lose service is not the same as Man-In-The-Middle attack for nefarious purposes. I agree that there is a legitimate fear that once it becomes known within the company that this capability exists it will eventually be used for something worse, but (even as someone who despises a lot of Comcast's business practices) alerting customers that they are about to lose service is not something evil in itself.

Everyone technical knows (or should know) that their ISP can modify the content of non-encrypted pages. I can't help but think that most people who complaining about this are actually more distraught at having their illusion of security broken than they are at Comcast's behavior. Getting mad at this is like threatening to sue the locksmith you hired for demonstrating how easily your current locks are easily bypassed with a bump key. The problem is not with the legitimate uses of this sort of injection, but the potential for misuse, which has not yet been demonstrated.

larrik2• 9 years ago

I do think they should just do the "free wifi" trick of redirecting to a new page.

smilekzs• 9 years ago

The user should have checked their email spam folder

How about NO?

tehlike• 9 years ago

More reasons to use free letsencrypt certs.

GCU-Empiricist• 9 years ago

This is yet another example of why Comcast could not pay me to use their service.

0xdeadbeefbabe• 9 years ago

I hope the guy at comcast searching through false positives gets paid.

scarface74• 9 years ago

Many people don't have a choice. Either Comcast or slow DSL from the phone company.

8ytecoder• 9 years ago

This is the sad reality in some cities in the Bay Area (of all the places in the world). With 4k content and at least 10 connected devices in a house going back to a 10Mbps line is a PITA. But a PITA we may have to live with to support local ISPs and express our displeasure with Comcast.

steanne2• 9 years ago

i have the choice of comcast, slow dsl from the phone company, or fiber from the phone company. i choose the slow dsl because that has consumer protections from the state's utility commission. the fiber does not. the phone company is not too happy with me.

dang• 9 years ago

Url changed from https://gizmodo.com/comcast-to-customer-who-noticed-it-secre..., which points to this.

steanne2• 9 years ago

a lot more discussion here[0], including responses from comcast's own jlivingood[1]

[0] https://news.ycombinator.com/item?id=15890551

[1] https://news.ycombinator.com/user?id=jlivingood

Comcast to Customer Who Noticed Secretly Injected Code: Maybe It’s Your Fault

Related Stories