Slashdot Mirror
A Setback for ISP Web Tracking
angelheaded tips a Wired story about the resignation of Bob Dykes, CEO of net eavesdropping firm NebuAd. NebuAd has encountered financial troubles lately as the privacy controversy surrounding the company's tracking methods has driven communications companies away. Over in the UK, Phorm responded to the NebuAd news by affirming that it is making progress with its advertising methods. From The Register:
"In response to the outcry over our revealing its two secret trials, BT said in April it would re-engineer the planned deployment so traffic to and from customers who do not want their web use profiled for marketing purposes would not come into contact with the Phorm system. The original blueprint meant that a opt-out cookie would tell the technology to simply ignore refuseniks' browsing as it passed through. It's thought the change has proved tricky. Phorm did not immediately respond to a request for comment on the alleged technical problems, but [BT's chief press officer Adam Liversage] said: 'We have been working on some things with Phorm.'"
Why not just go to the big pipe guys and ask if they could sniff connections inbound and outbound on arbitrary nodes?
Doing a sniffed bridged router is a piece of cake and it allows sniffing of all unencrypted content.
who is going to prison for tapping 18,000 people
http://www.theregister.co.uk/2008/09/05/bt_phorm_police_meeting/
this is not including the private actions they will be facing for copyright infrigement, insider trading, fraud
Why is it that every internet business thinks that in order to profit they need to stick ads everywhere?
Taxation is legalized theft, no more, no less.
This needs to be so clearly illegal that no American ISP would have thought about trying it to begin with.
There is no such thing as coincidence. NebuAd was just a small fry. Someone will do this with the blessing of this government.
Based on what I've read, cookies are one of the main ways a Web site tracks its users. So then why should I trust these "opt-out" cookies from companies like DoubleClick and NebuAd to not track me, as opposed to just blocking their cookies from ever getting to my machine in the first place?
If you are interested in what phorm /webwise actually does here is a technical paper:
Richard Claytons technical paper:
http://www.cl.cam.ac.uk/~rnc1/080518-phorm.pdf
This change is essential. The original phorm design redirected all traffic to the phorm site, then back to the original destination once the tracking cookie was inserted. I can't be the only developer whose software uses a simple HTTP GET library (for retrieving data) that doesn't support redirects. Phorm would break it and god knows how many other apps.
For the majority of net users this should be a very positive incident and the title should/could have reflected this, it's by all measure a Setback for Snoopers.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Ok, maybe someone can explain this to me. a cookie is just a file on your computer right?. So how is the isp (or router sniffing the packets), going to retrieve this cookie and not target ads at me. Not all my packets may not go through the same router every time (though I'm sure usually they do). So are they going to request this cookie for every packet? keep a big local list on the router of ip addresses to not sniff and have to check against that list everytime and hope the ip of my non-static ip address doesn't change ever?
What?
Surely it's easy. When you sign up with BT^H^H your ISP you are either put into group a which are routed through Phorm or group b who aren't, at your disgression. There is no technical difficulty at all.
BT manage a system which has multiple virtual ISPs all on the same copper ADSL network. Do they seriously expect us to believe that they can't split their own customers into two groups based on the account a particular client logs into their system with?
More likely, they are hoping to mislead the general (i.e. technologically illiterate) public into thinking that it's somehow impossible for only some of the customers to have Phorm.
This is why no-one sane uses BT as their internet provider.
I'm willing to bet that BT has some sort of DPI chassis deployed...maybe even Sandvine. I'll also assume that they are using RADIUS for auth....even with the DHCP stuff they have which will be hidden from the user. With that said...
The solution is simple. Physically connect the NebuAD device to the DPI chassis (think loopback and not inline). Create a rule that will redirect all HTTP traffic (remember, DPI here so port 80 is irrilivant) is by default sent to the DPI chassis. Then create a custom RADIUS attribute that will be seen by the DPI chassis. Any subscriber that has that VSA will not be sent to the DPI chassis.
I don't see what the big deal is no matter what country you're in. Each broadband customer is using more data but rates are not going up. This has to be account for somehow. Providers can either raise rates, impliment usage caps, or shape the traffic that's OK to be delayed. Bandwidth for the service providers is not getting cheaper at the same rate that demand is growing. Oversubscription is a requirement in all home based packages....otherwise it would be a dedicated product offering with business rates. No matter what action the service providers implement the bloggers will make a scene about it as change is bad.
If I have my choice I'll take the same rate, no usage cap, and shape my P2P during times of congestion. Now if I could just get someone to listen to my opinion.....
Time for HTTPS:// everywhere.
... forever???? Maybe.
... oh my!) is now legal for telecom (thanks Obama) to use inside the USA so politicians need cover by making sure you think everyone else wants to SPY to know what you are up to, too. Great political cover. We attack the Phorms and NebuAds and ignore the ENABLERs Pelosi & the republi-Crats she leads.
... at least then we know they are watching us (and likely not ALL of us LIKE THEY ARE DOING RIGHT NOW).
Back on July 9, Obama followed Pelosi's lead and legalized spying on Americans (which Bush had been doing since shortly after 9-11.
They aren't parking a van outside your house, folks, they are recording EVERYONE's web traffic and keeping it
The Narus suite of deep packet inspection spy gear (covert spying in Iraq
The game is called SELLING ADs. You know the do-not-call list? We need a do-not-spy list.
This is called HTTPS:// which makes it VERY CPU INTENSIVE for spy gear to decipher all our ramblings. Know it. Use it. Implement it so your web sites don't get tampered with on their way to the customer's browser.
Keep the NebuAds and Phorms of the world from recording your business is your own damn business and we need to use the tools and our heads.
If we wise up, the gov't will force us to give them (GOV'T, CIA, FBI) our encrpytion keys but that is the equivalent of a search warrant and we can keep changing them to keep them on their toes
Don't stay un-encrypted at the web server level or the browser we need to stop the SPYING now.
The DNA databases, the warrantless wiretapping, the mail snooping, the CCTV cameras on every street, the web tracking, etc.
It's all about delivering the right advertisements!
I never start with the assumption that my network traffic is not being sniffed by a man-in-the-middle. Some disgruntled ISP employee looking to steal identities. Somebody playing with bgp or whatever. Then there is the fact that my traffic hits a 10. net as a second hop. I'm sure this is just my lame ISP being lame, but it looks odd.
So it is really in your best interest to assume that all of your unencrypted traffic, and indeed the weaker versions of that are being intercepted.
I do take issue with JavaScript injection that amounts to a man-in-the-middle attack http://www.theregister.co.uk/2008/06/23/topolski_takes_on_nebuad/
Injecting content and claiming that it is from google.com while using it to add essentially spyware javascript is just dirty. I'm sure someone could rally Google into tearing them a new one if this crops up again. They have tons of lobbying money right?