Slashdot Mirror

Missed a step!

0. between actual source of form and you there is a third party -- perhaps running a phorm box ( http://www.phorm.com/ ) -- who "enhances" the html form. One of the enhancements might be some javascript and iframe magic, or perhaps just a rewrite of the action="https://www.facebook.com/login.php?login_attempt=1". Something as simple as stripping that first "s" in the URL is probably sufficient.

Here in the UK on Virgin's (possibly Phorm-laced offering we have that on a daily basis.

There are currently two "prime time" zones in the day and if you use too much bandwidth during those times you get your service cut in half until midnight.

Sure, they are giving us a free upgrade in speed, but it's totally asynchronous and potentially Phorm riddled.

On the upside, they are reliable (once you have it working), cheap (enough), let you have any port you want all the time and don't throttle BitTorrent.

There are a few companies starting up that are creating software to spy on the ISP's customers. The ISP has to install this box into their data center and it collects data for every subscriber to build a profile. This profile is based on your browsing habits. The companies inject ads into your HTML page to spam you. The ISP gets paid by the companies for this. You are basically getting sold out by your ISP to be spied on by a 3rd party company.

One of these companies is http://www.phorm.com/.
SSL would completely block this. If every website, or at least a large percentage of them, used SSL, even if it was just a domain verified one from a CA so the browsers won't complain, these companies would be out of business before they started. There are large ISPs in the U.K. that are rolling this out already. There are also some ISPs in the USA that are beginning trial installations of this hardware.

Duped? I feel duped, but not in that way.

I have been trying to get an article about Phorm onto the front page for ages.
Maybe I should have tried this angle.

How about a compromised adserver on the Phorm network?
Every BT, Virgin and Carphone Warehouse customer would have malware foisted upon them by their ISP.

News for American nerds, maybe. UK nerds might like to know about things like this without having to check the Phorm files at El Reg.

I've been trying to help out with the BitchX article, seeing as it used to be the best known (and therefore the most notable) IRC client.

The editors wonder why it is notable, I say you knew what it was before you read the article, the article is there so that people who hear about it in a channel can go find out what everyone is talking about.

Is that not the point of Wikipedia?

I made the page on Phorm, but someone already had one up that was speedily deleted because it sounded like an advert.
WHAT? Someone would take the time to advertise Phorm? Why bother, it isn't like 70% of UK internet users are going to opt-in to the service or anything, is it?

How can we educate the general public into being able to raise their voices against something like Phorm without scaring the crap out of them?

Once you know that every character in your page request has been sent through an adware service, you kinda lose control of your bowels ...

Anybody got any more dirt on them?

The data protection implications of this development are alarming, and frankly I don't care what some big accounting firm says about them.

That's a US accounting firm talking about the implications under american law (something which is less than clear from Phorm's press release).

And even their report leaves me less than impressed where it says "Because of inherent limitations in controls, error or fraud may occur and not be detected."
-- (Page 5, second last paragraph, first sentence)

"With OIX and Webwise, consumers are in control: they can switch relevance 'off' or 'on' at any time at Webwise.com. There's no small print and no catches: it's completely up to the consumer."

In the comments on the Techdirt article somebody is saying that Phorm are the latest incarnation of 121media which made the contextplus rootkit. A quick search later and indeed they are the same company.

Anybody got any more dirt on them?

Each person should review the Terms of Service (ToS) they accepted (and most likely continue accept each time they use their Internet connection) and look to see what is stated there. Also, realize that the ISP's will update it with nearly no notice. Inside of those agreements that you agree to generally through your use of their services you'll find all kinds of interesting things. For example, here is some relevant quotes from Verizon's ToS in Section 14.4:

"You hereby consent to Verizon's monitoring of your Internet connection and network performance, and the access to and adjustment of your computer settings, as they relate to the Service, Software, or other services, which we may offer from time to time."

Who is to say that "adjustment of your computer settings" doesn't include adjustment of .html files being delivered to you. Oh and just in case that wasn't strong enough, in Section 15.8 you get:

"15.8 You agree that Verizon assumes no responsibility for the accuracy, integrity, quality completeness, usefulness or value of any Content, data, documents, graphics, images, information, advice, or opinion contained in any emails, message boards, chat rooms or community services, or in any other public services, and does not endorse any advice or opinion contained therein. Verizon does not monitor or control such services, although we reserve the right to do so. Verizon may take any action we deem appropriate, in our sole discretion, to maintain the high quality of our Service and to protect others and ourselves."

Similar allowances are inComcast's Acceptable Use Policy. Basically, folks have to understand what they are signing up for and how often it can change.

There are companies out there today, Phorm for example, who already are working with ISPs around the world in order to put their gear in the ISP networks to create targeting advertising based on all Internet habits, not just specific sites with specific cookies or the like. So far they all seem to be giving you an ability to Opt Out, but that appears to be a way to create good will for the moment. If there was case law backing them up, who knows if they'd continue the practice.