How Verizon and Turn Defeat Browser Privacy Protections

https://www.eff.org/deeplinks/2015/01/verizon-and-turn-break-browser-privacy-protections

by fortmeaded • 12 years ago

505 173 12 years ago

It's frustrating, the internet has become such a creepy "you are the product" medium. The more of this I see, I start to feel like I don't want to be a part of it anymore.

PhantomGremlin• 12 years ago

That would be OK if my cellphone usage was "free". But it's not. I'm paying Verizon hundreds of dollars a month for me and my family.

I wonder if an MVNO would be less creepy than Verizon? Probably not, I'd bet they're even sleazier.

TD-Linux• 12 years ago

Well, it seems that Verizon is the only one doing it. The article mentioned that AT&T ran a pilot program and decided not to do it.

So presumably any other US provider would be better than Verizon.

pde3• 12 years ago

In the US, consider Credo Mobile or T-Mobile. Even AT&T discontinued this practice when called out on it, while Verizon's is flatly recalcitrant; their privacy policy says, "If you do not want information to be collected for marketing purposes from services such as the Verizon Wireless Mobile Internet services, you should not use those particular services."

incongruity• 12 years ago

Well, do you care enough to take your business elsewhere? That's really the last-ditch way for you to have any voice on this.

For whatever it's worth, I left them recently for this very reason (your choice is yours, mine is mine, no preaching or judgement here either) – I ended up having a few minute conversation with the confused (but nice) call rep who didn't understand what they were doing but seemed to empathize as I explained it. Ultimately, will my explanation matter? Probably not, but it was all the power I felt I had, beyond cutting them off from my monthly payments.

While still not trustworthy in my book, t-mobile is definitely an upgrade, at least in this regard.

pastycrinkles• 12 years ago

Keep your head out of the past. The internet is becoming the way we do everything now; it's a necessity.

Zaephyr• 12 years ago

The Internet is a necessity. That doesn't make actions like these less creepy.

nathanaldensr• 12 years ago

"Keep your head out of the past?" What a rediculous rebuttal. Parent poster is well within his or her rights to feel that way. All the evidence we've been presented with in the past few years should lead everyone to the same conclusion. You are being tracked and your data sold to the highest bidder. How is that not cause for concern? Just because it occurred in the past?

Maken• 12 years ago

Rejecting this kind of bad practices isn't the same as rejecting internet.

pdkl952• 12 years ago

Just because you don't value your privacy doesn't mean you get to project those values on the rest of us. Spying on your customers doesn't magically become moral simply because technology has made it easy. It most certainly is not necessary.

Really, the only reasons surveillance as a business model has worked is most people don't realize the extent that it is going on and by the time they do a monopoly or oligopoly has already established itself. Taking advantage of ignorance is at best rude and offensive, and at worst it should be criminal.

Unfortunately, the laws have yet to catch up to abuses like Verizon's MitM rewriting of HTTP headers. Worse, fixing laws and enforcing them against these modern abuses is going to be very hard: regulatory capture's a 'helluva drug.

userbinator2• 12 years ago

That was the first thing that came to mind when I read the name "Turn" - as in, "We Turn users into products."

junto• 12 years ago

What about a browser extension and a website that tracked Turn's advertising clients? The website and extension are there to help users boycott Turn's customers.

Can anyone think of a way to automate the collection of those ads and linked clients? Crowd-sourcing maybe?

acdha2• 12 years ago

Discussion for the original researcher's post:

https://news.ycombinator.com/item?id=8889224

http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/

fortmeaded4• 12 years ago

OP here, I'd be OK with swapping in Mayer's blog post. Will let the mods decide.

If you haven't seen it before, this guy's stuff is absurdly good. Encyclopedic knowledge of privacy tech and law.

acdha2• 12 years ago

Yeah, that was main reason why I wanted to share his original post – the EFF (or ProPublica) stories aren't bad but he's done a great job writing about many things of interest to the HN community.

yellowapple5• 12 years ago

In fact, Turn has told EFF that they do not believe that either Do Not Track or a user deleting their cookies is a signal that the user wishes to opt out from tracking.

What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means?

Are they for fucking real right now? I mean, I've seen my share of grade-A corporate double-speak, but this takes the goddamn cake. Holy fucking shit. Thank God I'm not a Verizon customer in any capacity (that I know of). With this kind of bullshit, I don't plan on that changing any-the-fuck-time soon.

quesera2• 12 years ago

What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means?

Easy there.

IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes.

Convenient, isn't it?

fortmeaded4• 12 years ago

Splitting hairs, but it's not exactly a default. It's a preselected option. The user gets some notice and has to accept.

coherentpony2• 12 years ago

IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes.

"By signing up for [insert service here], you agree to the privacy policy."

How many times did you actually agree with the privacy policy? Devil's advocate, I know, but it's a sobering reminder that pretty much anything you use gives information that is sold. Open a bank account? If so, notice any new junk mail? Pretty hard to live life without a bank account. Your information is still sold to third parties.

hackuser3• 12 years ago

IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes.
Convenient, isn't it?

That might be an excuse, but it's not the reason. They easily could read the DNT header and the user agent, and trust DNT headers from non-IE10 browsers.

rhizome• 12 years ago

If the tables were turned, the tracking would be a CFAA violation.

yellowapple5• 12 years ago

I don't use Internet Explorer. I use Firefox. If I have Do Not Track set (which I do), it means that I have explicitly requested to not be tracked, and that such a header is explicitly representative of my wishes.

The sooner we have a full list of all companies which are doing business with Turn, the happier I'll be, since that would provide me with a better target for my (admittedly excessively) strongly-worded frustration.

coherentpony2• 12 years ago

Gloriously filthy composition, but that's probably due to the expected increase in blood pressure from having your civil liberties stripped from you.

I am in unconditional agreement with you here.

oldmanjay• 12 years ago

I get that this falls in line with the accepted local opinion but I thought HN aspired to be better than pandering garbage filled with vulgarity.

hobs• 12 years ago

Vulgarity is to be used sparingly and effectively, and I think many voices want to say the same thing, and it is a valid part of the discussion.

Overall it would have been classier to limit it to the first sentence, but sometimes you have to get spittin mad to get your point across.

yellowapple5• 12 years ago

My apologies. I'm usually more composed than that, but sometimes one encounters this level of malice and simply snaps.

roque2• 12 years ago

My guess is that the "entrepreneurial" solution here would be a combination of: - A browser that doesn't support cookies and provides the server with a client controlled session-id (perhaps a user-id also). - Only uses SSL sessions to avoid middle-box injection of HTML headers (this still leaves the provider with the ability to inject data as IP options / TCP headers). - A micropayment solution that allows content providers to get revenue from content rather than ads.

Anyone working on the later ?

kansface• 12 years ago

| A micropayment solution that allows content providers to get revenue from content rather than ads.

Even if this were popular, you'd still be tracked because it makes money. Really, so few people care about this deeply I don't think it will be solved. Sure, everyone hates it, but no one will switch carriers over it.

hrjet• 12 years ago

A browser that doesn't support cookies

We are working on a browser (https://gngr.info) that supports cookies but doesn't enable them by default for all websites. We also don't enable JavaScript by default. User needs to enable these on a per-site basis. Enabling for all sites at once is also possible if the user so wishes.

In the near future, we also want to support https only sessions (opt-in to begin with and opt-out once https becomes more commonly deployed).

About micropayments, there are many. Flattr comes to mind. But I am sure there are more.

JadeNB7• 12 years ago

Why was this downvoted? It seems like a productive contribution to the conversation—in fact, it's a direct response to another user's question. I can imagine plenty of technical objections, but it seems that they should be made via responses, not downvotes.

higherpurpose3• 12 years ago

I think Aviator doesn't support cookies, among other privacy features:

https://www.whitehatsec.com/aviator/

EFF is working on a "HTTP Nowhere" option for HTTPS Everywhere, which only allows HTTPS connections. On Firefox there already is an HTTP Nowhere addon from someone else.

But as others have said, it's probably easier to just use Tor.

michaelaiello• 12 years ago

https://www.google.com/contributor/welcome/

cyanbane2• 12 years ago

If you were an author (of any sort) could you claim that the transmissions of your material (text) that are under copyright were circumvented (DMCA) via a permacookie under your "moral rights" as an author to publish anonymously?

roque2• 12 years ago

If you are a content provider you may choose not to serve ads on your content.

cyanbane2• 12 years ago

hmm, not talking about the content provider. I am saying if I am an author who was publishing something under anonymity and I assumed I was anonymous because I "cleared my cookies/Enabled Do Not Track settings" during the publication of the material - only to discover that my cookies had been circumvented via permacookie by a commercial entity - is my "moral right" of anonymity is now gone? could I claim the permacookie method was a circumvention under the DMCA?

belovedeagle• 12 years ago

This gave me an interesting related idea...

It may or may not work depending on the legal status of, among other things, the HTTP standards, but could you claim copyright on transmitted HTTP requests, at least if they contained sufficiently interesting contents?

If you could, then presumably one would have to say that ISPs have implied license to transmit those (implicitly) copyrighted requests to a third party, namely, the server. However, that implied license would presumably not allow the ISP to transmit a derived work to the third party, i.e., the original request augmented with the tracking header.

To argue this one would have to argue that the entire request, headers and all was copyrightable, but I suppose if one did something creative with the headers it could work; e.g., using the HTTP headers as a kind of poem. But of course there's ways to have creative content in something without it being art, just as long as the other side couldn't argue that the headers couldn't be copyrighted because the usual ones are largely predetermined by the standards.

Basically this is just the same idea you had, except instead of invoking the moral right to anonymity, it's invoking the easier-to-digest moral right to the content itself.

I'd say this was all baloney, but the DMCA is so ridiculously broad that it just might work. Of course, this is all pretending that the DMCA is meant to apply to corporations and not just us small folk.

randomwalker• 12 years ago

Some additional research that came out today, with more details of the various things Verizon is doing / plans to do with UIDH: https://freedom-to-tinker.com/blog/englehardt/verizons-track...

(We collaborated with Mayer on this research.)

Code and data that you can play with to verify these results / do other similar experiments, using our web privacy measurement tool OpenWPM: https://github.com/englehardt/verizon-uidh / https://github.com/citp/OpenWPM

x0x04• 12 years ago

quantcast was sued for resuscitating browser cookies when flash LSOs persisted [1], ie taking the cookie value from the LSO and recookie-ing the browser. quantcast and clearspring settled for $2.5m [2]. The crux of the matter seemed to be that users didn't know such data was in flash cookies or associated with quantcast, making it hard to opt-out, though I'm not sure if this is illegal; and violated quantcast and the 3rd party sites' privacy agreements, which appears to be illegal. A lawsuit outline for one plaintiff is here [3] and the full text of the initial filing here [4]. I naively assume there is a clear parallel to this case, though perhaps verizon and turn have thoroughly privacy policied their way out, somewhere in 30 pages of legalese.

According to Jonathan Mayer,

   Commercial supercookies, fingerprinting, and zombie cookies are tolerated 
   (if not permitted) under current United States law. [...] Any associated 
   consumer deception, however, is a violation of the Federal Trade Commission 
   Act and parallel state statutes. [5]

[1] http://www.wired.com/2010/07/zombie-cookies-lawsuit/

[2] http://www.lexology.com/library/detail.aspx?g=bc3a4358-6692-...

[3] https://www.privaworks.com/Details/AlertReference/PrintPrevi...

[4] http://www.wired.com/images_blogs/threatlevel/2010/07/CV10-5...

[5] http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/

username223• 12 years ago

Classic soulless PR-drone reply here:

http://www.turn.com/blog/in-response-to-propublica

"Clearing cookies is not a reliable way for a user to express their desire not to receive tailored advertising,..." Okay, but is it a reliable way for me to express my desire for you not to track me? I assume you ignore the DNT header, and I already block your ads, but still...

"Turn fully supports enabling consumers to express their choice and consent in regards to data use for digital advertising." Choke on a bag of dicks, you sleazy, lying scum.

toufka• 12 years ago

"It is Turn’s policy to always honor the consumer opt-out as enacted through either the Turn website or the NAI or DAA."

What does this actually mean, and how can I do it?

x0x04• 12 years ago

NAI and DAA are industry trade groups; they have cross company opt-out pages via cookies / beaconing

http://www.networkadvertising.org/choices/

http://www.aboutads.info/choices/

fortmeaded4• 12 years ago

The original research checked the Turn / NAI / DAA opt out. According to Mayer, it does't respawn. This part of Turn's response is a lie.

rando3826• 12 years ago

Hi, I see you'd like to start a quest into the dark heart of our corporate bureaucracy to join the other .0001% of customers who aren't having their privacy violated. We respect you. We love you (feel free to share that via social media). Welcome, and good luck.

cjslep• 12 years ago

Clearing your cookies is not the way to opt-out of tailored advertising, and may in fact be counterproductive if you’ve cleared the cookie that indicates you have opted-out.

I realize the technical reason cookies exist yet this seems wrong to me.

shkkmo• 12 years ago

There are two solutions I see.

1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently.

2) Feed them garbage data.

We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.

MBlume• 12 years ago

This is fantastic and I'd install it in a heartbeat

x0x04• 12 years ago

verizon overrides; I'm not a web engineer but (I think) ssl protects tcp headers. if so, it's probably the only technical solution is either ssl everywhere or an ssl proxy run by users

dllthomas• 12 years ago

I interpreted the suggestion as for those not using Verizon to inject fake UIDH. Of course, this could be filtered by making sure the traffic is actually coming from Verizon's networks...

hackuser3• 12 years ago

1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently

Why so hopeless? My water is clean, airplanes and roads are safe, retail banks don't lose their customer's savings, etc. Not all regulation works, but this one is pretty straightforward.

JadeNB7• 12 years ago

Why so hopeless?

Because the current US political climate is not in favour of regulations. It is true that we have all the regulations you describe, but each was fought tooth and nail when introduced!

EDIT: Original post had slightly more pointed political language.

rubbingalcohol2• 12 years ago

Step 1: Site operators install backend library to detect uid cookies and send them via API to a central database

Step 2: Privacy-minded activists install a browser extension that reads the uids from central database and spoofs HTTP headers with them. Extension could even cycle through uids on a daily basis to cause more mayhem.

Result: with just a few big sites running this, a few thousand people with the extension could irreparably corrupt the uid header's "uniqueness" and it could no longer be relied upon to respawn a lost cookie session. Because Turn wouldn't know whether it's a real mobile Verizon user, or a jackass with an extension.

Shameless plug: I've already written a browser extension http://flagger.io that spoofs HTTP headers in Chrome and Firefox. Would be easy to add this functionality if people can help on the backend side (writing libraries for node/python/ruby/php/etc.)

No1• 12 years ago

Step 3: Turn ignores UIDH headers originating from non-Verizon IPs and Verizon replaces any user-generated UIDH header.

Your solution is not going to fool anyone.

nl4• 12 years ago

You can't feed them garbage.

Verizon operates at the network layer - if you are on their network presumably they will copy the real value over your garbage value.

If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets.

There are a couple of other solutions you haven't mentions:

VPNs: Annoying and currently too hard for most people. Perhaps it is time for device (PC and mobile) manufactures to consider offering VPNs integrated with their devices.

Competition: If the US had a more competitive broadband market then people could choose other providers.

Legal action: If Verizon was sued and lost over this then it could have a cautionary effect. However, the loss would have to be huge for it to have an impact, and large financial settlements generally require proof of significant harm. That's going to be hard in this case.

Cyther6062• 12 years ago

Tor is free and much easier than a VPN.

Tor Browser bundle on Win/Mac/Linux: https://www.torproject.org/download/download-easy.html.en

Orweb on Android: https://play.google.com/store/apps/details?id=info.guardianp...

OnionBrowser on iOS: https://itunes.apple.com/us/app/onion-browser/id519296448?mt...

FrankenPC• 12 years ago

VPN is insanely easy today. IMO Everyone should use it by default. Too bad it causes an additional load on the internet for the encrypted tunnel traffic.

Another option is a blanket law about internet traffic that states no tracking can be made at all unless given express permission.

JohnTHaller2• 12 years ago

True, but an enterprising individual could write an extension to cause non-Verizon users to start feeding fake unique identifiers into their own streams. Heck, you may even be able to hijack a website login using it.

ryanhuff• 12 years ago

If you are using a VPN that proxies your request, couldn't you hide from this tracking?

jimktrains23• 12 years ago

If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets.

The question is if they already do this, or will become aware of it and start in in a short period of time.

msabalau• 12 years ago

Regarding regulation, if, as the EFF suggests may be the case, Turn is causing the companies they do business with to violate their stated privacy policies, it would seem that the FTC could take enforcement action without new regulation being needed. An indirect way of kicking in Turn's teeth, but perhaps one that would work.

discardorama• 12 years ago

or 3) Contact some of Turn's biggest clients and shame them publicly.

pdkl952• 12 years ago

Hmm... garbage doesn't work beause they override the UIDH as a MitM. So maybe this fact could be exploited in the opposite direction:

Start using the X-UIDH: header for some prominent but non-mission-critical feature in a format that is obviously not related to this tracking number. When Verizon rewrites the header, that feature breaks, and you can make a fuss about it in the media or sue Verizon for breaking your webpage.

(it sounds good on paper; this may not work in practice)

hackuser3• 12 years ago

Someone who understands this well needs to write a very short 'elevator' explanation for non-technical end-users that we all can copy and paste. That small act would be invaluable to spreading awareness, which is necessary for any progress.

I was going to send the EFF article to some Verizon customers I know but I realized they would have no idea what it meant. I don't have time to read it thoroughly and write an accurate, succinct summary.

Any volunteers? (The EFF is doing a disservice to the cause by not doing it themselves.)

logn2• 12 years ago

The tracking is everywhere, it is all around us, even now on this very site. You are tracked when you look out your window, or you turn on your television. You are tracked when you go to work, when you go to church, when you pay your taxes. It is the web that has been pulled over your eyes to blind you from the truth. You are a slave. Like everyone else, you were born into bondage, born into a prison that you cannot smell or taste or touch. A prison for your mind and especially for your Verizon phone.

yellowapple5• 12 years ago

Verizon is a red pill that I'd rather not be swallowing.

noonespecial2• 12 years ago

How about:

Because your mobile device really belongs to the carrier and not to you, whenever you browse the web with it, they know who you are no matter what. They are now refusing to keep that information secret even if you want them to, instead selling it to advertisers without your consent (even despite your obvious non-consent).

They do this by sabotaging your mobile browser so it can't really delete certain cookies. When you try, they put them right back the next time you use the browser. They also have a way (called a UIDH header) to tell other sites that its you (so they can track your visits) even if you don't have a cookie in your browser.

guelo2• 12 years ago

It doesn't have anything to do with who owns the device.

nhstanley• 12 years ago

Naive follow up question: Can doing something like routing through a VPN help with this? I assume not, since a forced cookie on your browser will make you always identifiable to the person on the other end, correct?

nl4• 12 years ago

That's a terrible synopsis. It doesn't have anything to do with the device at all, and that's the whole point!

No matter what you do to attempt to avoid this you can't if you use the Verizon communication layer. The only way around it is to use counter measures to avoid the Verizon software seeing your connection (ie, a VPN).

im2w1l• 12 years ago

"Whenever you request a web page, Verizon stamps it with a beastly mark, a name-number to give you offers to buy goods."

chatmasta• 12 years ago

When you click a button on your mobile web browser, if you're a Verizon customer, advertisers see a special tag assigned to you by Verizon. Since Verizon assigned you the tag, they can give you the same tag on every website. Advertisers have ads on many websites, so they can see the tag and match your browsing history to their logs. In effect, because of the tracking tag Verizon assigns to you, any advertisement you see can track who you are and where you've been.

eveningcoffee• 12 years ago

It should be made clear that it is not some pseudo anonymous "you" but it can be directly related to your phone and your contract and from that to you.

dannyobrien• 12 years ago

Is the language on the action alert (linked in the article) any better for you?

https://act.eff.org/action/hold-verizon-accountable-for-viol...

mrslx• 12 years ago

Verizon is doing the equivalent of a reverse 'butt dial' they are listening to everything you do after you've hung up.

evmar• 12 years ago

It's strange to read this and then simultaneously read people complaining about HTTP2 requiring SSL. It'd surely be nice if law protected us from bad actors but SSL protects from this in a way that (hopefully) can't be circumvented.

scintill763• 12 years ago

SSL can't really stop it, I think. Here's a thread where I've speculated on a way to inject metadata into SSL handshakes[0] just like they're doing with HTTP headers. If that doesn't work (I'd be interested to hear why), someone else suggested using TCP-IP source/destination metadata queried from the ISP to resolve to a customer.

[0] https://news.ycombinator.com/item?id=8506492

guelo2• 12 years ago

It's simpler then that. The advertising based site wants to show you the ad, they have no incentive to implement SSL. There's no https://espn.com, for example. Even if they did implement https it would be mixed content because the ad networks' iframes or whatever are http.

The solution is things like NoScript or Adblock on Firefox (not Chrome which downloads the ad and just hides it). Or blackholing the ad networks in /etc/hosts.

AlyssaRowan2• 12 years ago

No. An MITM starts changing the ClientHello, and the PreMasterSecret should change because it's all hashed in, and therefore Finished will fail - that's the case with the TLS 1.3 draft and I wouldn't be surprised if TLS 1.2, too, although I'll put it on my list to check. Fallbacks complicate that, but the fallback SCSV signals enough to correctly sound the alarm there too.

I'm specifically on the lookout for sneaky ways to (GCHQ call it) "stain" traffic like that, and try to remove them. ("Kleptography" is similar, but the endpoint is complicit - there's not a lot can be done when the endpoint is complicit, but more deterministic primitives help both.)

These can be rather subtle - with temporal differentiation as well, even 1 bit allows for a basic binary search/partitioning attack, so anonymity networks like Tor, I2P etc have to be particularly careful about that.

(You shouldn't really be using TLS 1.0/1.1 anymore, and definitely not SSL.)

nly• 12 years ago

If the advertisers and your ISP are cooperating there's nothing you can do. They can easily just redirect all IP packets going to their advertising partners through some encapsulation that encodes your customer id out-of-band, encode it in to their NAT scheme, or just provide customers with static IPs and partners with regular dumps of the database.

covercash• 12 years ago

Somewhat related, does anyone know about Verizon FIOS TV commercial injections and how they possibly relate to FIOS internet tracking?

I have IBD and have been spending a lot of time on UC/IBD related sites lately. I've noticed quite a lot of tv commercials for IBD drugs on TV and mentioned it in passing to my friend. He said Verizon uses tech from RGB Networks and similar companies to inject custom commercials into the FIOS TV streams based on FIOS internet data.

Does anyone know more about this program?

userbinator2• 12 years ago

I feel like injecting headers is only the start of something far more pernicious; even SSL/TLS can't stop an ISP from determining and tagging where your traffic goes (and consequently, passing that information onto third parties) - all your traffic goes through equipment on their network, after all. As long as your connection to the Internet is tied to your identity in some way (and there is basically no way a non-free ISP is going to let that be anonymous), they can track you. "Obfuscatory routing systems" like Tor can help, but as long as ISPs can observe the traffic on their networks, they know.

killface2• 12 years ago

this is what VPNs help prevent.

mkjones2• 12 years ago

How would ISPs tag requests going over HTTPS as being from a particular subscriber?

mkjones2• 12 years ago

OK, I can think of a few ways they might do this (DNS tricks and per-user IPv6 addresses, <src ip, src port, dst ip, dst port> => user mapping). These all seem significantly more complex than HTTP header injection though.

jamesdee• 12 years ago

well, this explains Verizon's desire to have anti-class action lawsuit contracts with their customers...

Animats• 12 years ago

I'm amazed that they're still doing this. Start pushing for Congressional hearings.

mhuffman• 12 years ago

I wonder if classifying the Internet as a utility might have any effects through possible regulation of this?

joelthelion• 12 years ago

That should be illegal, plain and simple.

Aissen• 12 years ago

It's like they are trying to push HTTPS everywhere. It better happen soon.

terranstyler• 12 years ago

Frankly, I don't see how regulations or laws should protect the user for several reasons:

Firstly, there are already privacy laws yet it doesn't look as if they apply and that Verizon thinks that even in the case of a law suit Verizon will be able to benefit more than this law suit will cost.

Secondly, even if a court determines that the conduct of Verizon in this case is not legal, the verdict will still be special enough to not be applicable in a loop hole case. So I see protection provided by law as limited.

Thirdly, enforcement is rather difficult and not as obvious as, e.g., a daylight robbery, especially for non-technical observers which I presume to be the vast majority of law enforcement personnel.

And finally, (and rather an opinion) I think government is rather delighted to know who does what on the internet, so I don't see a real motive for them to move decisively apart from some half-* voter appeasement.

dredmorbius• 12 years ago

This may be a tortious (sueable) offense under the Intrusion Upon Seclusion principle. Possibly as a class action:

“It is unnecessary to determine the extent to which the right of privacy is protected as a constitutional matter without the benefit of statute.” Beaney, The Constitutional Right to Privacy in the Supreme Court in 1962 The Supreme Court Review 212 (Kurland ed. 1962); Olmstead v. United States, 277 U.S. 438, 478, 48 S.Ct. 564, 72 L.Ed. 944 (1928) (dissenting opinion of Brandeis, J.); “Dykstra, The Right Most Valued by Civilized Man”, 6 Utah L.Rev. 305 (1959); Pound, The Fourteenth Amendment and the Right of Privacy, 13 W.Res.L.Rev. 34 (1961). '[I]t is sufficient to hold that the invasion of the plaintiffs' solitude or seclusion, as alleged in the pleadings, was a violation of their right of privacy and constituted a tort for which the plaintiffs may recover damages to the extent that they can prove them. ‘Certainly, no right deserves greater protection…’' Ezer, Intrusion on Solitude: Herein of Civil Rights and Civil Wrongs, 21 Law in Transition 63, 75 (1961).

To make an intrusion on seclusion claim, a plaintiff must generally establish 4 elements:

First, that the defendant, without authorization, must have intentionally invaded the private affairs of the plaintiff;

Second, the invasion must be offensive to a reasonable person;

Third, the matter that the defendant intruded upon must involve a private matter; and

Finally, the intrusion must have caused mental anguish or suffering to the plaintiff.

h/t Lisa Borel on G+

https://plus.google.com/113175636916099066477/posts/PBi3NECR...

More at Wikipedia:

http://en.wikipedia.org/wiki/Privacy_laws_of_the_United_Stat...

Intrusion of solitude occurs where one person intrudes upon the private affairs of another.

Intrusion upon seclusion occurs when a perpetrator intentionally intrudes, physically, electronically, or otherwise, upon the private space, solitude, or seclusion of a person, or the private affairs or concerns of a person, by use of the perpetrator's physical senses or by electronic device or devices to oversee or overhear the person's private affairs, or by some other form of investigation, examination, or observation intrude upon a person's private matters if the intrusion would be highly offensive to a reasonable person.

h/t paul beard on G+

https://plus.google.com/u/0/104092656004159577193/posts/5XKX...

Google, as guardian of Android, should look hard at ensuring user protections from this sort of behavior. Ubiquitous HTTPS might be an option (I haven't looked yet to see if the UIDH header can be defeated via that).

rapht• 12 years ago

It's a wonder to me how no Verizon competitor has jumped at the opportunity to advertise this on a large scale with a message along the lines "it's evil, we don't do that".

If the users really care about this issue, that's what would happen on a functioning market anyway...

JetSpiegel• 12 years ago

It's because the competitors do this too.

yellowapple5• 12 years ago

Not really. Even AT&T doesn't do this (they did at one point, but were apparently called out on it and stopped doing it), and they're pretty damn scummy.

Normati2• 12 years ago

I doubt most people care. This isn't going to drive customers away. The only way it'll be stopped is if they're legally forced to. For example, see the history of cookies themselves and how most people never cared about them.

jimktrains23• 12 years ago

It would if I had options.

ferdi265• 12 years ago

Couldn't you fake a false UIDH header if you don't use verizon?

If yes, then people could publish their UIDH and have other people use it as well. If many do this, the unique identification aspect of UIDH is lost.

Something like using a random UIDH from a list of published ones every request.

zo1• 12 years ago

Or just get everyone to use the same UIDH, making it useless for whatever tracking purposes.

karlb• 12 years ago

Seeing as “turn” is also a verb, this is a great example of a headline that would have been less confusing in sentence case:

“How Verizon and Turn defeat browser privacy protections.”

jes7• 12 years ago

If someone chooses to work for a sleazy company, say one that aggressively violates a person's expressed desire to not be tracked, I would not want to hire them or otherwise associate with them.

Should the engineers who enable companies like Turn be shunned by other engineers?

Jgrubb2• 12 years ago

Should engineers who invent new rifle shells, or atomic bombs, or armed drones, or work at the NSA, or Tinder, or Uber, or Groupon, or Zynga be shunned? All of their employers are perceived by some as some as scumbags.

If your job that you liked came to you with a challenge like "I want you to invent a brand new way to track our users that nobody has thought of before", would you turn it down?

edit: or Facebook, or Google, etc? These companies are in the business of tracking their users' behavior to be sold to advertisers. I'm not really sure how that's different at the macro level than what Verizon/Turn is doing, and we're shunning an awful lot of engineers at this point.

jes7• 12 years ago

I won't engage in work that I conclude is immoral, nor will I help others to pursue ends that I consider problematic. I think it's important that you always be free to come to your own conclusions on such matters as well.

bloodorange• 12 years ago

Not everyone has the luxury to be able to refuse or quit a paying job. It'd be harsh to judge like this. It would of course do to shun the firms which do this - ultimately we want to eliminate the behaviour - not the people.

fauigerzigerk2• 12 years ago

I don't think that's a good idea. Yes the ad based business model has gone completely off the rails with their aggressive privacy violations and disgusting deception schemes. I think they should be stopped, if necessary by regulating them off the face of the earth.

But personally blaming and shunning regular employees of corporations that break the law or some ethical standard has far reaching ramifications. Bitter ideological battles would take over the personal lives of people who have no say in whether or not their employer decides to use a particular marketing scheme or do business in a particular country.

I think personal blame should be reserved for decision makers. If an employee knows about serious crimes committed by their employer they should simply report it to the police.

jes7• 12 years ago

I'd rather not do things that give the state more power and control over individuals. So I'm not a big fan of regulation in general. I'd rather pursue voluntary means of encouraging virtuous action where and when I can.

Engineers who directly enable this kind of technology are (in my view) not materially different from individuals who write malware. These engineers are members of the group of decision makers, because they know exactly how the code they are writing will be used. I think it's right to not encourage or support their behavior.

In other words, the degree to which I would shun someone is proportional to the knowledge and control they had in the situation under consideration.

JadeNB7• 12 years ago

In addition to the other replies you've got, this kind of judgement is, I think, beyond most people's capability to make. Should everyone who works at Turn be shunned, or just those who work on this project specifically? If a previously honourable company starts doing dishonourable work, how long a window does an engineer working there have to find another job before he or she is shunned? What does it mean to 'enable' Turn? That is, could a third-party indirectly enable them? How do we make the judgement when this has happened? For example, should W3C be shunned for making a standard that can be abused in this way?

jes7• 12 years ago

I appreciate your comment.

For me, it's a matter of the degree to which the person sees the ramifications of what they are doing, and the degree to which they directly contribute to the bad actions.

For example, the management team that has built a business around tracking people who clearly do not wish to be tracked is highly suspect, in my view.

The sysadmin that runs the servers, less so. But if she/he knows what the company is all about, I'd urge him/her to either try to change the mindset within the company (likely, impossible) or start looking for another gig.

I would not ask anyone to sacrifice themselves, but neither should they be facilitating unhelpful behaviors.

Verizon, of course, is enabling Turn (as I understand the situation.) Companies that are customers of Turn are also enabling them, in my view.

How do you see it?

jimktrains23• 12 years ago

Since Verizon is no longer simply a dumb pipe, does this make them liable for the traffic crossing over their network?

tempodox• 12 years ago

Indeed, this kind of behaviour on the part of Verizon and Turn should result in criminal prosecution.

julianj4• 12 years ago

Maybe instead of adblock for turn, someone should put together a plugin to generate a random header string sized at about 16k just for *.turn.com.

On a side note, if your browser automatically filled up the remaining allowed characters in the header (depends on the server of course), it'd be interesting to know how that would be handled by Verizon's support since all sites would get a 400 error when their header injection is enabled.

canvia• 12 years ago

Does anyone know how flash cookies are handled on cell phones? Is there any way to block or clear them?

https://en.wikipedia.org/wiki/Local_shared_object

This add on is good for clearing them using firefox: https://addons.mozilla.org/en-US/firefox/addon/betterprivacy...

kxo• 12 years ago

Considering phones haven't had Flash (easily installable, that is) for a considerable amount of time, I doubt you're affected.

TheMagicHorsey• 12 years ago

Verizon really does come across as a Bond-style corporate villain in stories posted to Hacker News. I'm currently a TMobile customer, and I wonder how many of Verizon's shenanigans are actually just the common MO of all American telecoms.

It would otherwise seem egregious if only Verizon is throttling customers on "unlimited" plans, and only Verizon is selling their privacy for money, and only Verizon is pushing garbage smartphones onto customers that don't know any better.

How can they be so big if they suck so much ass? Are they successful only because they get their network deployment right? Are regulatory barriers protecting them from competition (I find that hard to believe because wireless, unlike broadband, seems to have multiple competitors in every market).

Maybe we just need to take public spectrum away from these donkeys and give it up for use by ad-hoc technologies. I suspect that if we make some standards (or even just broad rules of the road) some peer2peer telecom technologies might emerge and surprise us with their quality (just like BitTorrent is surprisingly good for file downloads, even though its decentralized completely).

DyslexicAtheist• 12 years ago

is i just me or is Verizon the most evil operator out there? Being based in EU I have no idea of course but there are hardly ever positive news coming out of that firm.

How Verizon and Turn Defeat Browser Privacy Protections

Related Stories