Slashdot Mirror
EFF Hints At Lawsuit Against Verizon For Its Stealth Cookies
An anonymous reader writes A few weeks ago I noted how security researchers had discovered that Verizon has been injecting a unique new 'stealth cookie' identifier into all user traffic that tracks user online behavior, even if the consumer opts out. Using a unique Identifier Header, or UIDH, Verizon's ham-fisted system broadcasts your identity all across the web — and remains intact and open to third-party abuse — even if you opt-out of Verizon's behavioral ad programs. Now the Electronic Frontier Foundation has filed a complaint with the FCC and has strongly indicated that they're considering legal action against Verizon for violating consumer privacy laws.
here's the link to the actual EFF press release/post, not some random board post linking to it. https://www.eff.org/deeplinks/...
It's so cute when they think that laws apply to $BIG_CORPORATIONS
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
Why don't ISPs simply focus on efficiently transferring packets and appropriately charging for the service? Are the profits generated by "stealth cookies" or "deep packet analysis" enough to pay for the engineering and hardware cost of these "features"?
Its surprising more people don't do this. 205.234.28.93 is easily remembered and just rolls off the tip of your tongue.
If Verison is fiddling with the packets going back & forth does it not lose its 'data carrier' status and become one with the end user ? So: if Disney/... sues an end user for downloading it's lastest film: then Verison should be part of the lawsuit as well and liable to pay Disney for the ''theft of its IP''.
.Verison cannot have it both ways, it either copies bytes and the user is 100% responsible or it fiddles with them and so is aware of the content and is thus vicariously liable for any wrong doing.
At least it's not an IPV6 address..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Just reading through the EFF page on this and it sounds like they got a patent on setting a header to track... Wow. That just sounds, ... , I don't know, but :(
Hmm, the humour and sarcasm seem to have been be lost on you.
While viewing stories in "0 Abbreviated and 0 Hidden" mode I noticed threads where the parent comment was missing but the replys are still there!
Censorship Soviet Union style (pre photoshop) http://en.wikipedia.org/wiki/C...
Why can't I claim copyright on my http requests, and deny them the ability to create a derivative work?
X-UIDH: Go suck an egg.
And if only a few people directed their web traffic through a simple proxy that rewrites the X-UIDH header, we could really screw with Verizon's plans.
Have gnu, will travel.
I tried this. They delete your header and replace it with a new one.
IANAL, but I think this violates wire tapping laws, copyright laws, and trespass of chattel laws. Under copyright and trespass of chattel laws you don't need to prove actual damages. If you can claim a "per incident" bases, the money could add up quickly.
It also looks like it violates their own terms of use and privacy policy pages.
What would be interesting is to use their arbitration clauses against them. They say that the arbitrator has all the powers of a court, so you should be able to ask for relief as both money and an injunction that they add this header to "your" connections. If the arbitrator cannot rule this way, then they lose their protection against class action suits.
I don't know what they have access to, but by disabling wifi, they see the traffic directly from the mobile device (which has a couple different IDs on the cellular system), and that's how they know (a) you're a verizon customer, and (b) what device & account it is.
They'll fight for freedom,
wherever there's trouble,
EFF is there!
EFF! A Real Internet Hero...
~Knowledge is knowing that a tomato is a fruit, but Wisdom is knowing not to put it in a fruit salad.
Good to see somebody doing, what ACLU used to do...
In Soviet Washington the swamp drains you.
Well, Ted Kaczynski led something of an anti-corporate campagin. Groups like EarthFirst have done a fair amount of direct action against environmental exploitation.
And workplace shootings aren't unheard of, although they tend to be driven more by personal rather than sociopolitical motivations. Although maybe you could make the argument that many of their grievenaces ultimately derive from soulless busines policies.
But generally, there is little targeted violence against corporations or CEOs. About the only examples I can think of are historical -- the SLA kidnapped Patty Hearst, and the Red Army faction killed the head of Dresdner bank in a botched kidnapping, but there was something more politically motivated about these groups in a kind of Marxist-Lennist way than specific anti-corporate anger.
Is this not an illegal man-in-the-middle intercept and hack of my data?
I created (via my web browser) the http header and request. My device sent that http header and request to another computer with whom I want to communicate. Someone (ATT, Verizon) intercept my data, read it, hack it, and send it along. How is this not completely illegal.
It still gives you a unique identifier (even if its encrypted, its deterministic enough to be used as an ID even if you can't decrypt it) that lets you uniquely identify a household for a period of time. Combined with other more legit tracking methods, you can do some deliciously evil things with it...
Nice try with your misdirection from the actual issue there to a red herring one. The actual problems is that they're tampering with your data (and headers are data)--the sort of thing natural (non-corporate) persons have gone to jail for. It's not merely a case of them inserting an additional header; if your application sets the X-UIDH header, they actually remove it and substitute their own. Mods, please mod parent down for shameless shilling.
"Politicians and diapers must be changed often, and for the same reason."