Verizon Injects Unique IDs Into HTTP Traffic 206
An anonymous reader writes: Verizon Wireless, the nation's largest wireless carrier, is now also a real-time data broker. According to a security researcher at Stanford, Big Red has been adding a unique identifier to web traffic. The purpose of the identifier is advertisement targeting, which is bad enough. But the design of the system also functions as a 'supercookie' for any website that a subscriber visits. "Any website can easily track a user, regardless of cookie blocking and other privacy protections. No relationship with Verizon is required. ...while Verizon offers privacy settings, they don’t prevent sending the X-UIDH header. All they do, seemingly, is prevent Verizon from selling information about a user."
Just like they said they would.
Is there a way to prevent this? (Score:5, Interesting)
This should be illegal. People have a right to try and avoid being tracked. There has to be a way to prevent this. I'm a sysadmin, not a network guru, so I will defer to those smarter than me here...
Re: (Score:2, Interesting)
third party VPN paid for by a cash card
Re: Is there a way to prevent this? (Score:3, Interesting)
Or just browse https only
Re: (Score:3, Interesting)
To be honest, I don't think this does anything. I think a VPN might be the only current way to avoid this, as your traffic in a VPN tunnel is theoretically not seen by the routers that pass it. I'm not sure if deep packet inspection tools could add the unique ID. I'm not a network engineer, so I don't know for sure. I do know that VPNs of today are rapidly becoming easier to circumvent by those who would do so.
Re: (Score:2)
I don't think you could modify packets that are in an ssl stream and not have ssl detect it and reject the 'broken' packets.
https is mostly secure (other than MitM attacks on certs) and vpn's are also very secure.
I have a vpn and while I use it mostly at home, there is an android client (even for my ancient 2.x android o/s) for the vpn provider I have and so I could get as complete privacy as possible on my phone, while doing inet things.
Re: (Score:3, Informative)
TLS from end to end ...
Re: (Score:3)
So, and why wouldn't TLS help there?
Re: (Score:2)
hmm, true. But maybe they will trigger an "unsafe elements" alert in the browser.
Re: (Score:2)
nope, he's right. Your adversary is the site, not verizon. And the site can make you request non-http stuff, where verizon (which is not the main enemy) injects an id, which can then be read by the site. There is not much protection without using extreme measures like requestpolicy (and not allowing anything using http).
Re: (Score:2)
you're still not getting the szenario, just as i did not in my first post.
VZW does not want to interfere for this szenario. They interfere with http adding an id and ignore https. The website wants your identification. So they generate a token on the https-site and load image.jpg?token from a http(without s) site. Then they know a token vzw correlation and can assign the same token on your next visit.
Hello supercookies.
Not all web sites offer HTTPS (Score:5, Insightful)
Just check "Do Not Track" checkbox in browser (Score:2)
Re: (Score:2)
Rig as many webservers as possible to give users with that header a nag screen
Re: (Score:2, Insightful)
Don't use Verizon as your ISP?
Re:Is there a way to prevent this? (Score:4, Informative)
Don't use Verizon as your ISP?
Personally, I use Verizon and have no other choice for a wireless provider. AT&T has plans to build another tower here in 2021, and it's not like their the champions of my privacy either.
Re: (Score:2)
That's the problem with monopolies (natural or otherwise). Still, there is an option to sign up for just the phone plans without wireless data and use wired or satellite ISPs for internet access.
You could also go the route of circumventing the problem (using the methods others have already suggested) with a bit of added effort/cost, but in that case there's no disincentive to help persuade Verizon to stop the program.
Re: (Score:2)
Still, there is an option to sign up for just the phone plans without wireless data
Are you sure Verizon will even activate voice-only service on a smartphone? AT&T sure won't [slashdot.org].
and use wired or satellite ISPs for internet access.
And if the DSL ILEC for your area is also Verizon, too bad.
Re:Is there a way to prevent this? (Score:4, Interesting)
Unacceptable. Verizon licensed the spectrum from citizens, and therefore has certain obligations.
This is what should occur. Make use of any spectrum contingent upon a series of consumer friendly policies. Failure to comply requires turning the spectrum and any technology that uses it or assists in its use over to auction. Then establish a rule that prohibits anyone over a pay grade access to any industry that uses spectrum for a predetermined duration.
If you set the concequesnces high enough than ideas like this get shot down in the board room.
Re: (Score:2)
bullshit. They bought it from the government, whose representation of its citizens occurs roughly every 5 years for a fortnight. Apart from that time, they do what they like. And even in that fortnight they just tell you what you wanted to hear anyway.
Re: (Score:2)
USA, so more like every two years for the federal government (this is an election year for congress, though not for the presidency) and it lasts a lot longer than a fortnight (which, it should be mentioned, is a word only very rarely used on this side of the pond) due to the degree of campaigning that people do here (though it's definitely a bigger deal on the presidential years).
No argument on the "tell you what you wanted to hear anyway" part, though! Something so far removed from the few very carefully c
Re: (Score:3)
> Don't use Verizon as your ISP?
How quaint. A foreigner.
well lad, in the US of A, you have the freedom of choosing the ISP that was selected to monopolize your burrough.
Or you can use the one mobile provider that has good coverage in your city instead, if you don't want to use that pre-selected ISP.
Re:Is there a way to prevent this? (Score:5, Insightful)
As a sysadmin, you should know that it is easy and cheap to rent a VPS (Virtual Private Server). Then, run squid on the server, or do some fancy routing to send all your web traffic out via a VPN to your VPS. Since most VPS services offer a minimum of 1TB of monthy data, there should not be any excess data usage charges.
Re: (Score:2)
You just need to decide to not be a Verizon customer.
Time and money to move to change ISPs (Score:3)
Re: (Score:3)
In my jurisdiction is altering data (stored or transmitted) without censent a felony. The action of Verizon is hacking and would here be punishable as such.
Re: (Score:2, Insightful)
So your theory is that, now that women have been "integrated" in the military, male soldier's sexual needs have been met?
Re: (Score:2, Insightful)
Re: (Score:3, Insightful)
When soldiering becomes less of a duty and more of a way to delay starting out your life of dismal poverty, you start making the wrong kind of army.
Telling The Story Backwards and Upside Down. (Score:4, Informative)
It's safer for a supermodel to walk down MLK in your favorite large city naked than a homely woman to walk from one end of Fort Hood to the other, wearing ACUs after dark. When soldiering becomes less of a duty and more of a way to delay starting out your life of dismal poverty, you start making the wrong kind of army.
I have come to the conclusion that anything the geek says about women, rape or the military needs to be fact-checked.
A cash-strapped female soldier told a Fort Hood hearing board Tuesday about how a noncommissioned sexual assault prevention officer on base forced her into a prostitution ring so she could buy groceries for her child.
The private testified against Sgt. 1st Class Gregory McQueen during a proceeding similar to a grand jury hearing. McQueen could face some 21 criminal charges if he is slapped with a military court-martial.
''Basically, it was having sex with higher ranking officers for money," the woman told the board.
The private, who was 20 and struggling as a single mother of a 3-year-old child at the time of the alleged prostitution, was granted immunity in return for her testimony. She told the board how McQueen snapped pics of her naked to distribute to potential clients. The two also had sex so McQueen could see how she would ''act out'' with clients.
McQueen, who has since been relieved from his sexual assault prevention duties, faces charges of pandering, conspiracy, adultery and sexual assault.
Another female private claims McQueen sexually assaulted her when he tried to recruit her into the military sex ring.
That woman told investigators that McQueen ''preys on young females who are in bad financial situations and that he keeps their pictures on his cell phone,'' the Austin American-Statesman reported in December.
Fort Hood sexual assault prevention officer ran on-base prostitution ring: witness [nydailynews.com] [June 3, 2014]
Re:Telling The Story Backwards and Upside Down. (Score:5, Informative)
Re: (Score:2)
When soldiering becomes less of a duty and more of a way to delay starting out your life of dismal poverty, you start making the wrong kind of army.
Wait, we can do worse; how about making enlistment an alternative to a prison sentence for newly convicted criminals? (actually, that sounds so awful, I'm surprised it isn't already in place)
Re: (Score:2)
The US military currently has too many and too few recruits. Lots of people want in, because when the economy tanks the military is one of the few options left. But most of them fail the entry qualifications, so the number of qualifying recruits is still too low.
Re: (Score:2)
It's been done. I've a friend who got busted at age 19 for selling heroin. The judge gave him the option of enlisting and volunteering for combat duty, or doing hard time in the state pen. He chose the former--which in those days, was effectively getting a ticket to Vietnam.
There's a photo somewhere showing one of the last US helicopters to take off from Saigon in April 1975. In the photo you can a soldier dangling from one of the landing skids. That's my friend.
Re: (Score:2, Insightful)
.
FTFY.
Re: (Score:2)
So you're saying they made a new network for blackjack and hookers? You know what, forget the network. And the hookers.
Re: (Score:2)
Interesting connective theory.
Noted, as well, is that chemtrails began to appear only after the invention of radio.
Slashdot redirects HTTPS to HTTP (Score:2)
Just install HTTPS Everywhere [...] all good sites work.
You appear to call Slashdot not a good site. It redirects all HTTPS hits from non-subscribers to HTTP.
Maybe the FCC... (Score:3, Funny)
Will tell them to go fuck themselves on this, and make them stop...
Re: (Score:2)
If there ever was a +6 Funny, this is the one.
Free market? (Score:5, Insightful)
They should offer this to the user as an option, where the user has to pay less when tracking is enabled. Otherwise this is abuse of market power to make users agree to being tracked.
Re:Free market? (Score:4, Insightful)
They should offer this to the user as an option, where the user has to pay less when tracking is enabled. Otherwise this is abuse of market power to make users agree to being tracked.
Except it will be the other way around. Pay more to not be tracked.
Re:Free market? (Score:4, Insightful)
I think the free market solution would simply be having enough ISPs so that if one pulls stuff like this you can just switch to another. Some sort of "competition". I suggest we find out why there is only one fast ISP per area, and fix that problem.
Re: (Score:2)
I suggest we find out why there is only one fast ISP per area,
Here's a hint: It's the same reason there is only one electricity provider in most areas. Generally, it is not cost efficient to run multiple sets of wires, but everyone wants electricity.
and fix that problem.
The solution is the same as with electricity. We've tried all the other solutions, many, many, many times over, and we keep coming back to the same small set of best answers; all over the world, in all kinds of cultures and every shade of We
Re: (Score:2)
It's called a natural monopoly. It occurs when the capital cost of entering a market is so high as to render doing to prohibitive for all but the first entry.
Verizon or another of the major ISPs comes first. That means they pay for laying cables, renting mast space, installing equipment and lobbying local government for the appropriate rights. It costs them a fortune, but they can be assured of a return because they'll have 100% of the market - there's no other option for potential customers.
When another IS
Bury conduit and blow wires later (Score:2)
Re:Free market? (Score:5, Insightful)
They should offer this to the user as an option, where the user has to pay less when tracking is enabled. Otherwise this is abuse of market power to make users agree to being tracked.
No because they'll quickly value this service at $50 a month to force you into it.
They should not be altering my HTTP requests. It's wiretapping, plane and simple.
Re: (Score:2)
last time i heard about US ISP/mobile provider shenanigans there was a debate on net neutrality (which the tel cos were wining) arguing that they were not common carriers.
well, that just goes to prove that they are not common carriers. they can even monetize on the service they are already selling you. they don't consider your communication protected in any way.
it is like opening a restaurant and selling your scraps to feed cows. except that they are the only restaurant in town. and after 12sec they take aw
Verizon Fios (Score:2)
Does anyone know if FIOS internet uses the same system? I don't have a Verizon Wireless account.
Re: (Score:2)
Of course not. It's added to your requests when they reach the ISP gateway. Why would you expect to be able to see them on anything between you and that gateway?
Re: (Score:2)
Thanks for the pointer. I should have read the hacker news linked in TFA as it was not clear to me whether the header was one way or on both ends of the connection.
HTTPS Everywhere (Score:5, Insightful)
They can't inject into secure traffic. HTTPS solves this problem too.
Re: (Score:2)
I intend to use a proxy in addition to HTTPS-E.
Re:HTTPS Everywhere (Score:4, Insightful)
They can't inject into secure traffic. HTTPS solves this problem too.
Good idea, I just need to figure out what the http address for slashdot is...
Re:HTTPS Everywhere (Score:5, Insightful)
Slashdot actually supports HTTPS just fine. They simply redirect you back to HTTP immediately! Try it yourself: https://slashdot.org/ [slashdot.org] - 302, Location: http://slashdot.org/index2.pl [slashdot.org] - 302, Location: http://slashdot.org/ [slashdot.org]
I wish I was joking...
Re: (Score:2)
Slashdot actually supports HTTPS just fine. They simply redirect you back to HTTP immediately! Try it yourself: https://slashdot.org/ [slashdot.org] - 302, Location: http://slashdot.org/index2.pl [slashdot.org] - 302, Location: http://slashdot.org/ [slashdot.org]
I wish I was joking...
Any idea why they do this? Of all the sites to not to https...
Re: (Score:2)
Educated guess?
The sites made up of custom code written before HTTPS was really all that common. It's such a mess that adding it now would require just as much work as just flat out rewriting the whole site. Last time they tried a site redesigned all the neck beards on here started shooting rocksalt at them and screaming "GET OFF MY LAW!!!"
I suspect this site barely pays for itself. I do not anticipate any large site redesigns ever.
Re: (Score:2)
Soylent News runs on Slashcode (although a fork of an earlier version, I think). HTTPS works just fine, as does Unicode and probably a few other things broken on Slashdot. No IPv6 yet but I'm sure it's coming. It's all on Github so it would be fairly trivial to merge it in to Slashdot.
Re: (Score:3)
TLS (or lack thereof) is, or at least should be, completely transparent to the Perl-based web application powering the site. In fact, the HTTP request itself doesn't even specify anything about the protocol. The request line has the path and stuff after it, and the Host header has the domain name, but doesn't mention the protocol. The absolute minimum they should do would be to return *exactly* the same content over HTTPS that they do over HTTP for a given request (remember, the HTTP traffic is the same whe
Re: (Score:2)
Soylent News can't even email a password to me. If I want to use their site, it's anonymous or not at all. Fuck 'em.
Re: (Score:3)
CPU load. SSL/TLS greatly increases CPU demands on the server(s). For a high-traffic site that costs real money.
Re: (Score:2)
There are tons of reports (just google them) of the server side cpu load being minimal to encrypt traffic. My guess is either the load balancing setup they have doesn't support SSL or their 3rd party ad network doesn't.
In general, I think sites don't support https because of a) the extra cost of a cert, b) they don't care, c) the extra cost of a dedicated IP (SNI isn't supported on IE on XP). You can say "screw XP" all you want, but a good 20% still (of at least my traffic) comes from IE on XP.
Ads would be mixed content (Score:4, Insightful)
Re: (Score:2)
I think they're just limiting non-logged in access to http, not subscriber (paid) only access.
-Harodotus
Re: (Score:2)
They can't inject into secure traffic. HTTPS solves this problem too.
For cellular at least, Verizon keeps pretty tight control over what devices they allow on their network. All they would need to do is to start shipping phones with a Verizon root cert installed that can't be removed. Phone trusts the cert, Verizon proxy performs MITM on SSL traffic...
Re:HTTPS Everywhere (Score:4, Interesting)
quite a valid point!
just like you can NEVER trust a windows (or mac or even linux box) that was not setup by you, especially if its a corporate box that was given to you pre-installed.
almost every company of mid-size or larger preinstalled MitM certs for their spying firewalls. they don't tell employees that, but netadmins and sysadmins pretty much all know this.
I work at a large networking company and they didn't tell me WHAT they do or HOW they'd spy on me, but I found out via a friend (in germany) exactly what they are doing. in .de, you have to disclose to the employees a lot more than the US requires you to do, and he relayed the info to me about how our corp laptops come preinstalled with corp spyware. ability to active mic, camera, screen caps, all that bullshit in addition to traffic logging.
I'm a network mgmt guy and when I was out interviewing for jobs (the last few years) almost all of them involved DPI and MitM attacks, even though they tried to explain it away as 'troubleshooting information' and 'for the users benefit'. quite bullshitty but they said it with a straight face, like they believe their own BS.
you guys have to start realizing that corp america is all about privacy invasion; of customers and employees, alike. if you have a corp laptop, do NOT login to your home email systems and keep your work laptops entirely clean of anything personal and home related. yeah, even if you see the lock icon on the browser, it means nothing anymore, in a corp LAN.
Re: (Score:2)
And people wonder why I buy my own hardware for work, don't use a company-supplied laptop or phone, and always connect to the corporate net using a VM and never from the host OS...
Step #6 image is all wrong (Score:2)
Step #6 image should have been this instead:
https://doodleaday.files.wordpress.com/2012/03/doodle-1016-money-bags.jpg
I think it illustrates whats happening more appropriately...
Re: (Score:2)
Step #6 image should have been this instead:
https://doodleaday.files.wordpress.com/2012/03/doodle-1016-money-bags.jpg
I think it illustrates whats happening more appropriately...
Except, it's more like pennies. That's what's hilarious about all this privacy invading nonsense we've been subjected to. It's not valuable. They do not make more money with it. Sure, at first it sounds like a great idea. But the mountains of data it generates quickly become completely useless and you just end up sitting on it all and doing nothing with it. I've dealt with marketing people and seen them install their huge data tracking software packages that they paid fortunes for. Several years later and t
Re: (Score:2)
Appropriate that you share the link HTTPS :)
Wonder if a chaff approach would help (Score:5, Insightful)
I wonder... if we wrote addons for popular browsers that would inject bogus X-UIDH headers into every request, whether we could make this kind of inappropriate privacy intrusion prohibitively expensive. If it works as he surmises, maybe we can overwhelm Verizon's ad exchange platform with meaningless data.
Re:Wonder if a chaff approach would help (Score:4, Interesting)
This plan. I like this plan! Put a random value in the header on every request. If you're not on Verizon, it'll look like you are (but as a different person every time). If you *are* on Verizon, you may just confuse the software that is adding those headers, or that is logging them. Poison their tracking data with meaningless garbage, and make it *cost* Verizon money to try and track us.
Well, that and use HTTPS everywhere possible, of course. But that requires that the sites you use allow people to do so (*AHEM* Slashdot, looking at you...)
Oh, and don't use Verizon. That's the best way to hit them in the pocketbook, by far. I like the idea of sending the header even when you don't use Verizon though, as a general-purpose "fuck you!" to them.
Re: (Score:3)
No, not this plan! Since the modified tag is only transmitted from Verizon to advertising sites, Verizon could very easily just strip out all X-UIDH headers coming from you before adding their own.
Re:Wonder if a chaff approach would help (Score:4, Interesting)
Since they're the ones adding the header, the client setting the header is futile. Verizon's version will clobber it.
However, if you happen to run some intermediary servers that handle traffic once a backbone layer is crossed, then you can clobber their value.
Filthy Ingrates (Score:5, Funny)
God. it's like you people don't even appreciate the value added service they are *GIVING* away here. Who wouldn't want to see more perfectly tailored and targeted ads -- some of which even include *VIDEO* again, completely for free.
You have to pay for cable right? The same thing applies, you're getting the service you paid for (TV shows, home shopping channels) with the added bonus of free to view advertisements.
In both cases they're simply giving away high quality, hopefully relevant audio and video. I think that's super generous of them.
And for no charge! And yet, you people still bitch. Absolutely shameful.
Re: (Score:2)
+1.
The sad part is that some idiots will not see the implied <SARCASM> tags.
Re: (Score:3)
Re: (Score:2)
... I have this sudden urge to write a browser extension. I'm not sure *how* I want it to render <sarcasm> tags, but I think I do want it to do so. Just in case.
Don't use HTTP. Use HTTPS. (Score:3)
Don't want your carrier messing with your traffic?
Use HTTPS.
Hello Vodafone (Score:5, Informative)
Re: (Score:2)
Just checked. AT&T does this as well with an x-acr header
Switch carriers (Score:2)
Just another reason not to spend your money with Verizon.
Re: (Score:2)
No, unless the exit node uses verizon wireless, too.
Re: (Score:2)
Run a Tor exit-node on your Verizon network?
That should allow SnR to effectively mask you against tracking.
Re: (Score:2)
The first tor hop is encrypted, so no. Technically, if the exit node is on verizon wireless, then it would have the code of exit node, not yours.
Re: (Score:2)
The slashdot objection is that slashdot itself isn't on HTTPS. Come on, guys! Does whoever posted this article not see the need??
Re: (Score:2)
No, it's actually much worse than that. Slashdot supports HTTPS just fine. They simply force you back to HTTP (using a redirect *out* of HTTPS whenever you request an HTTPS page)! Total bullshit; there's no legitimate reason for such behavior. Even without dedicated TLS hardware, the overhead of HTTPS is pretty trivial for modern servers.
HTTP-only ad network (Score:2)
Re:which Verizon services (Score:4, Interesting)
I'm on fios and just checked headers, nothing like this (yet).
Re: (Score:3)
Where did you check from? You don't see the headers on your end; they're only added at the ISP gateway. Unless you were able to bounce a request off an external web server and see the headers that it *received* - which don't have to be the ones you sent - then you don't know. Oh, and don't use HTTPS for the test, since they obviously can't modify those requests.
Re:which Verizon services (Score:4, Informative)
Re: (Score:2)
> Any tips on moving to a pay-as-you-go plan that lets me keep my phone number?
DO NOT cancel your account!
call the new company, say you want to port your number.
the system is F*up... you will have to give the new co your account number AND PASSWORD for the old one. so if it is your SSN as it is by default, change it before if you care (or stop believing that SSN is secret, you are a grow up).
anyway, i cancelled ATT and then ported to TMOBILE. ATT was obliged by law to reactivate my account to complete t
Re: (Score:2)
I just checked using over my Verizon mobile phone and sure enough there is the X-UIDH header. [centralops.net]
I just checked with my AT&T mobile phone and found an "x-acr" header which seems to serve much the same purpose, so switching away from Verizon might not help. (The header is not present when accessing the site through a VPN, so it wasn't sent by the browser.)
The content seems to be based on the Anonymous Customer Reference [gsma.com] concept promoted by the GSM Alliance.
Re: (Score:2)
I'm aware. I used some random site I found on google that displays my sent headers.
Re: (Score:2)
If it does load, that doesn't mean the NSA isn't still spying on you...
Re: (Score:2)
You'll be easily recognizable as the only surfer without fingerprints.
Re: (Score:2)
Does that unique identifier get passed down all the way to the server you're trying to connect to, even if you go through a proxy server or reset your router? This is significantly worse than MAC or IP addresses.
Re: (Score:2)
I always find it interesting when people post thing like this and never mention the brand/model of the product so the rest of us can avoid it. It's like we've gotten so worked about lawsuits we censor ourselves now.
Re: (Score:2)
Not really. Even if your derivative work idea was valid and could be used to stop Verizon, they would just update their Terms of Service (TOS) to explicitly have you grant them this right and waive any claims.
Frankly, while i haven't checked, is very likely that their existing TOS grants them the right to make any change to your traffic they see fit, so it's likely that any derivative work would fail on it's face based on your existing contract.
Spoof it (Score:2)
They could remove your headers and add their own.
Re: (Score:2)
that will cure the disease by killing the patient [slashdot.org].
TFTFY.