Slashdot Mirror
AT&T Hotspots Now Injecting Ads
An anonymous reader writes: Computer scientist Jonathan Mayer did some investigating after seeing some unexpected ads while he browsed the web at an airport (Stanford hawking jewelry? The FCC selling shoes?). He found that AT&T's public Wi-Fi hotspot was messing with HTTP traffic, injecting advertisements using a service called RaGaPa. As an HTML pages loads over HTTP, the hotspot adds an advertising stylesheet, injects a simple advertisement image (as a backup), and then injects two scripts that control the loading and display of advertising content. Mayer writes, "AT&T has an (understandable) incentive to seek consumer-side income from its free Wi-Fi service, but this model of advertising injection is particularly unsavory. Among other drawbacks: It exposes much of the user's browsing activity to an undisclosed and untrusted business. It clutters the user's web browsing experience. It tarnishes carefully crafted online brands and content, especially because the ads are not clearly marked as part of the hotspot service.3 And it introduces security and breakage risks, since website developers generally don't plan for extra scripts and layout elements."
Soon someone will have a script or browser extension for this.
Mod me down, my New Earth Global Warmingist friends!
Free WiFi is a trap, news at 11!
Why is modifying a web site in this way not copyright infringement? Is not AT&T creating an unauthorized derivative work?
"National Security is the chief cause of national insecurity." - Celine's First Law
AT&T is initiating a man-in-the-middle attack. Can you really trust those ads? I mean they're injecting scripts. Who knows what those do, right?
So, basically AT&T is placing their advertising on someone's web site without paying for the privilege? Were I the content owner, I'd be speaking to my lawyers first thing. The sad thing is that major companies don't even seem to worry breaching the public's trus or their reputations anymore. How long until Comcast decides to force extra advertising into my cable internet browsing. Oh! That's right, I cancelled them after the NetFlix throttling episode. So now, I guess I have to cancel DirecTV (AT&T) too.
Time for https on all websites.
...oh wait...
So when I browse Pirate Torrent sites at an AT&T hotspot, then AT&T can get sued for profiting from piracy?
Didn't they claim to just be a carrier in order to not being held liable for what the users do with that connection? By delivering content they've created aren't they having their cake and eating it, too?
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
The free ATT hotspots I've found to be basically unusable tarpits of service that would make me grateful for the whine and hiss of a 9600 baud modem.
I've mostly encountered them at McDonalds where they were almost always unusable. I kind of wonder how they get their Internet service for these, whether they just steal from whatever the specific franchise might have or whether it's something more retarded, like an ancient 3G hotspot above the ceiling.
Anybody who is surprised by shit like this is an idiot.
Everybody setting up "free" hotspots wants to monetize with anayltics and ads.
Google wanting to sell you a router they can control is also going to lead to monetizing and ads.
The problem is unless we have really good quality tools to block this shit, we're never going to stop it. And this is why we can't trust ad infrastructure at all and need to block it .. because it's being done by people who want money, and don't give a crap about your security of your privacy.
Until this shit is deemed illegal (ie the computer fraud and abuse act), it will continue. Because the assholes at AT&T feel it is their right to do anything they want with your internet traffic.
Never trust that "free" doesn't come with strings like this. And never trust than any corporation won't revert to being sociopaths and decide they can do anything they want to.
Lost at C:>. Found at C.
mint update manager seems to query for descriptions of package updates via http. So wifi that interferes with http somtimes causes mint to give nonsonse descriptions for updates.
breaking end-to-end connections is really really really bad.
SURELY NOT!!!!!
Adherence to the law.
Even for free products.
Fine, but require AT&T to disclose (in large font) that it's not an internet connection, since the content is being modified en route.
Something like:
WARNING: Web pages you view may be recorded or altered by AT&T or its affiliates. Web pages and other content retrieved may not reflect the content available over a standard internet connection. Information you enter or retrieve may be transferred or sold to third parties. AT&T is not responsible for malware injected into your content by its affiliates, or damage done to you or your computer by said malware.
(Actually, I think that last sentence should be in large font at the top of every web page that uses ads inject by third parties)
The right to protest the State is more sacred than the State.
But they could inject local CSS and local scripts into the page, so if you trust the current hostname by default (which many do for basic functionality) then NoScript won't help you here.
They're not free. As in AT&T hotspots are not accessible to everyone who wanders by, but are only for paying AT&T customers. You log in using your existing account. So yes, as a customer I expect decent service for a product I pay for, not additional monetization. If it's unacceptable to sell my customer lists to advertisers then it's also unacceptable to inject side advertisements into a paid product.
And despite being a paid customer, I suspect some one being paid by advertisers is going to pop on here and accuse us of being cheap ass freeloaders by using adblock. Yet this is yet another perfect argument about why ad block is a necessary tool to fight against the tactics being used by immoral advertisers.
Except that it's not free. This service is for paying customers. Which makes this behavior even worse, actually.
AT&T's hotspots used to be faster back when they were non-free.
I used them a few times back then, generally at McDonald's, as an AT&T customer ("free" for me).
They seemed backed by a T1, based on speeds and traceroute guessery in an empty store. And that was generally better than the alternatives at that time (3G or nothing), so was certainly welcome. But that was a different time...
These days a T1 with multiple freeloading users is painfully slow. Overall experience can be helped considerably with some very careful QoS at the endpoint to prioritize small data streams over more lengthy streams but this is something they apparently aren't doing.
The last time I was at a McDonald's and wanted a cup of free WiFi I had far better results turning my cell phone into a 4G hotspot and paying by the gigabyte.
Same with the local public library: They have free Wifi, and welcome you to use it, but it's so slow that it's useless.
Kid-proof tablet..
My home ISP -- China Telecom -- does this to me, for the service that I pay for. And no, I can't use a VPN 100% of the time because China is getting pretty good at killing VPN connections. It doesn't even matter if I use a non-ISP DNS server, because it's standard in China to poison DNS results (I've not tried experimenting with DNSSEC yet).
In my case I'll try to load Bing (which isn't blocked by Golden Shield), and the only content will be a meta reload instruction. The rest of the "real" page will have been served via an injected javascript with a shitty Chinese ad at the bottom. Reloading will fetch the real page, as the ads aren't injected 100% of the time, but only seemingly randomly.
--Jim (me)
Once again, I'm shocked, SHOCKED I tell you!!
Just cruising through this digital world at 33 1/3 rpm...
I once got a 300 baud modem to handshake with me by whistling the carrier tone.
Seven puppies were harmed during the making of this post.
https://www.eff.org/Https-ever...
Website Just Down For Me? Find out