Comcast wants to sell your Web history to advertisers | Hacker News Reader

Comcast wants to sell your Web history to advertisers

washingtonpost.com

187 pointswalterbell157 comments

>A bargained-for exchange of information for service is a perfectly acceptable and widely used model throughout the U.S. economy, including the Internet ecosystem

Isn't bargaining a two sided affair?

Also something that should be part of the article and is a LARGE omission is the fact that Comcast is literally a shareholder in Hulu.

This could mean it is them selling ads on a service they are owners of using the data they gathered as an ISP and not only as a service, like the data Netflix would have. It seems to me a much more egregious offense then them selling my data, something I expect to happen with a monopoly.

Comcast is the company that seems like the entity that one would provide as an example of why Libertarian ideology can't feasibly work, but the example would seem so absurd it still shocks me it exists.

> but the example would seem so absurd it still shocks me it exists.

So what conclusions do you draw about Libertarian - really in this case Austrian - deregulation of markets? Given that:

* Comcast exists

* It provides service to (IIRC) millions of people

* It turns a tidy profit

... it seems like the worst case example you can raise isn't so bad?

I mean, if you're citing Comcast as a worst case criticism of Libertarianism, that's a lot better than say the whole of Venezuela as an example of a planned economy.

If we had a free market, without laws preventing competition like we do now, then there'd likely be alternatives to choose from, e.g. people could pay more for privacy or get a bargain if they don't care about privacy. Since Comcast uses the state to enforce its monopoly, the artificial scarcity has the effect of locking in users. Comcast is a great example of why free markets should exist -- to give users more choice.

Pure laissez-faire capitalism naturally converges toward monopolies. Without regulation, the only thing that prevents monopolies from developing is if there is a low cost of entry to a market. In an industry where there is a very high cost of entry (like building out a massive telecommunication network), the end result is very assuredly a single monopoly power.

Think about it. The telecoms were already broken up once. The continue to attempt to merge (AT&T + T-mobile, TWC + Comcast). Without a regulatory agency disallowing mergers in the name of competition, you wouldn't have choice at all.

The end result of competition is no competition at all.

These are good points but you're leaving off the fact that these companies paid off State legislatures to make competition illegal in various ways. Particularly stopping people in a city or state from using tax dollars to fund something better. It's banned in some with only the local utility able to do it in others. Plus, the big companies got billions in tax subsidies to build their networks with promise of getting broadband to about everyone.

Quite a lot of corruption by a cartel of a few instead of laissez-faire.

Exactly. Businesses will use whatever means at their disposal to remove competition, whether that's government, financial, and even morally reprehensible actions at the expense of others.

My point is that even if companies weren't able to leverage government to reduce competition, they'd find other mechanisms to accomplish the same goal, such as just buying up all the competition.

Think about it. If you're a competitor and trying to make profit, how better to do that than to consolidate with the big players until one player gains significant control over the market to demand whatever price they wish to maximize their profit?

I think the counter point is: What's stopping another player from entering the market? They can only keep buying up the competition if the competition is always willing to sell. More over, the ability to buy up the competition presumes a sufficient surplus of profits to be able to do that in perpetuity. Another large actor (say, Google), could recognize this and enter the market without any intention of selling (only of capturing those surplus profits).

To be clear I'm not for any ideology here -- my point above is to get at what I want to discuss: Is Comcast mostly crappy because of their (regulation provided) monopoly? Do those (particular) regulations exist for good reason? If not, can we work on removing them to level the playing field? (I hope Yes / No / Yes, but don't know!)

> Is Comcast mostly crappy because of their (regulation provided) monopoly? Do those (particular) regulations exist for good reason? If not, can we work on removing them to level the playing field?

1. Yes. Consider the cities where Comcast had to compete with G. Fiber and see how much faster the speeds they are offering are.

2. They exist for good reason for Comcast, not so much for everyone else. And Comcast spent a good deal of money to lobby policymakers to install those regulations in the first place. The government didn't just mandate them out of the blue.

3. You can work on removing them if you have a comparable level of access to policymakers as Comcast does. Do you?

So... which countries have very good competition on wired Internet services without Government forcing competitors to share infrastructure, or otherwise subsidize competition? If free market capitalism had that result when applied to this market, you'd think at least one country would exist somewhere.

I'm anti-free market. It's promises contradict human nature and history. So, I dont have any counterexample to that. ;)

Which promises?

Maybe I should say the proponents of it in my country that ignore the monopolistic effects of land and IP ownership.

Most of Eastern Europe, particularly Romania. Small entrepreneurs were buying a fat uplink and then sharing it between several apartment complexes:

https://motherboard.vice.com/read/why-romanias-internet-is-s...

Who were they buying the uplink from? When the company that owns the cables is also a retail ISP, selling cheap uplink to another retail ISP is never a good idea.

EDIT: From reading a bit, it looks like these neighbourhood ISPs managed to get off the ground and develop significant clout before the telecoms companies managed to start providing consumer retail broadband services?

Austrian Economics - not to mention countless practical examples - say otherwise: http://austrianeconomics.wikia.com/wiki/Monopoly

Depends on what king of monopolies those are. We are better off with an Apple (smartphone) and Google (search) monopoly because they are pretty good in their quality. If they slip (like blackberry or yahoo) someone will throw them out pretty quickly in a free market.

In a non-free market government will eventually help someone accumulate lot more power and money without a competition is sight. Government is the reason why Google fiber is not available in Sunnyvale.

It's one thing to replace a mobile phone that you replace every two years anyway. It is another to pull a fibre optic cable through half of your neighbourhood all the way to your living room. The acquisition cost of a new client for utility companies is prohibitive, so it is biasing capitalism a lot (very little competition).

I can't think of a situation in which a monopoly has benefitted consumers over time. I'd kill for a 2003-2008 era Google search product, but the competition is slim. Not to mention, Google likes to use its monopoly to encroach upon other markets.

Apple doesn't have a monopoly on smartphones.

> We are better off with [...] Google (search) monopoly because they are pretty good in their quality.

Better off compared to what alternative ?

Alternatives are the are trying to compete. Samsung or Bing in above case.

Wouldn't a large monopoly just swallow the competition, and the competition would be internal? Its competition between humans that makes companies see success.

You definitely have that completely backwards.

I do like how libertarians play the false dichotomy. Everything must be either Full Libertarianism or Full Communism. No room for the inconvenient realities of a functioning mixed economy.

How did you get that, from what I posted? Either I was unclear, or you meant to reply to someone else?

The irrelevant mention of Venezuela?

Okay, it was me being unclear :)

The OP said he thought Comcast was the worst example of free market policies in action that he could think of.

Leaving aside that Comcast is not operating in anything like a free economy, I was trying to make the point that if it was truly the worst example he could think of, then he should probably reconsider his criticism of free market policies.

I cited Venezuela as the worst (contemporary) example of a planned economy that I could think of, as a counterpoint to his worst example in Comcast.

But yes, the facts are that:

* Almost all economies today are mixed (that is, neither entirely free or entirely planned).

* They mostly work pretty well, in the sense that people nowadays are much better off, by almost every conceivable measure, than in the past.

My argument is that:

* Nations are better off to the extent that their markets are free (e.g. Denmark vs. Cuba).

* Leaving aside the economic outcomes, coercion in economic matters is as morally wrong as in others (e.g. forcing someone to take a customer they don't want is as wrong as prohibiting them from taking a customer they do want; for concrete examples, think gay wedding cakes and legislated segregation on buses).

Yeah, if the worst thing that's happened to you under capitalism is being overcharged by Comcast, you're still having a pretty good day and should look for worse examples. All sorts of things from the US healthcare system to Philip "unacceptable face of capitalism" Green might count as worse.

Thankyou for acknowledging those facts. It's interesting that you choose to mention Denmark. My point was that suggesting applying even the tiniest bit of regulation to a near-monopoly market participant immediately brings out the comparison to Venezuela; it's just hyperbole in the opposite direction. I don't think people are arguing that the US should become more like Venezuela in order to reduce their broadband bills; more that it should learn from Denmark.

My experience of libertarianism is people arguing that any amount of abuse of power by private actors is fine, it's just that government is magic and any use of its power will immediately collapse into abuse. This rests on contorted definitions of "coercion" that don't include restriction of economic options or even anti-market actions by private actors.

"Free market" and "unlimited power for market actors" aren't quite the same thing.

Yes. Personally I blame a misreading of Rand - in particular, Rand's fiction - for this.

People are often surprised to hear that the majority of villains in Atlas Shrugged are businessmen, who seek to obtain political power - that is, the power to legally coerce - over their competitors and customers.

So, if you support capitalism (unfettered free markets) you also need to support strong, objective courts that can severely punish companies that attempt to deal with their customers by fraud (misleading advertising, etc.) or force (cronyism, bribery, corruption).

It's like XP. The practices are mutually reinforcing :)

I'm entirely confused on how the Hulu thing plays.

This could mean it is them selling ads on a service they are owners of using the data they gathered as an ISP and not only as a service, like the data Netflix would have.

Somehow Hulu, using data bought by Comcast is worse when Comcast owns a share of Hulu? How does this change whether Comcast is an owner or not? Hulu could purchase the data either way and since Hulu is an investment, not a subsidiary it would end up a customer of Comcast data. Netflix could also buy the data from Comcast, but of course that makes no sense because Netflix doesn't have ads.

Isn't bargaining a two sided affair?

Yes and here's the deal Comcast is offering, 1. Pay full Rack rate, and we don't sell your data. 2. Take a cut on our rate but we sell your data to advertisers.

Whats one sided about that? One option is "do the same thing you're already doing" and the other is "pay less, lose some privacy"

"Yes and here's the deal Comcast is offering, 1. Pay full Rack rate, and we don't sell your data. 2. Take a cut on our rate but we sell your data to advertisers.

"Whats one sided about that? One option is "do the same thing you're already doing" and the other is 'pay less, lose some privacy'"

But this statement of the deal is ultimately disingenuous - as a monopoly/duopoloy, Comcast is going to be setting its prices, so over time, the deal will become "pay more, maybe a lot more or we do what we want".

That's the case irrespective of them selling information.

Not true, it's harder to pick on a majority.

>Comcast is the company that seems like the entity that one would provide as an example of why Libertarian ideology can't feasibly work, but the example would seem so absurd it still shocks me it exists.

The problem with making lame generalizations about ideologies is that you can pretty much point to any one you like and claim this is an example of its shortcomings.

The reason comcast is the only provider in many locations is because of regulations that prevent new companies from laying cables. Google has effectively unlimited money to throw at Google Fiber, but it's a slow process because of regulatory hurdles.

"Comcast is the company that seems like the entity that one would provide an example of why government regulations leads to regulatory capture."

This is a debate I'd like to insert a thought into.

I'll rephrase both your sentences. "Comcast is the company that seems like the entity that one would provide an example of how with sufficient connections and power (monetary) one can exploit any loopholes provided in a governing framework."

I do not see this is a partisan or philosophical debate. Comcast doesn't care what govt is in power, +/- some ease of operation, I believe we'll see the same modus operandi. If we leave a hole through insufficient regulation, they'll abuse it. If we leave a hole through to MUCH regulation, they'll abuse it. Here's where I start spewing generic quotes about "who watches the watchmen" and drawing parallels between the almost unwinnable battle of security devs vs. hackers (and at least in the tech world in a lot of instances we have provable math on our side, politics/philosophy doesn't even have that much to be confident in.)

At the risk of deflating any utility of my comment, I can't answer the implied question of "so what" but the correct answer to me is not believing one idiology is somehow immune to what I see as a very side-channel behavior. A focus on how to combat _that_ can be far more productive than more divisive partisanship; and at the additional risk of sounding like a tin foil hatter, "the more we fight among ourselves the more they're SURE to win."

I don't think there's a need to mention tinfoil hats. The way we combat that is by aligning the interests of would-be rule-breakers with those of whom the rules are designed to protect.

My preferred solution is a bit radical, but I think we should make digital infrastructure like internet/cable/telecoms the sole role of the government, just like the way we do with regular roads. R&D may make sense to sponsor with grants/bounties, and construction/maintenance may make sense to subcontract out, but the specs are open-source and up to the public[1] so that if some party were to say, exfiltrate user data for ad targeting use, they'd be in violation of multiple laws and would be arrested (not to mention reviled by the rest of society). It would also require a conspicuous degree and scale of security for someone who's supposed to be transparently manufacturing open hardware (which could then be further inspected by consumers - no more of this restricted binary blob shit).

[1] Implying some other process changes around increased transparency and accessibility of government, and patent reform, but we're blue-skying here.

I've heard about the utilities argument a lot, I don't know enough to have formed a strong opinion on it, but the following devils advocate point has always seemed a legitimate argument:

Govt isn't frankly great at roads+infrastructure. Given the oft-cited statistic of how many of our bridges are dangerously unsafe, I worry that if govt. were running internet we'd all be on 90s era DSL (at best).

There are other arguments rattling around in my head namely concerns re: budget allocation/prioritized areas that leave others in the dark with no free market recompence to serve that market (not to say free market is doing a good job now) but as you can see from even this slight tidbit there's a lot of back and forth in my head, and I don't know the full picture for a lot of these considerations; however the "our existing infrastructure investment isn't fantastic" is something I can observe relatively empirically. Do you have any thoughts to that?

TL;DR Those concerns are reasonable given our current implementation, but if we want to solve this problem we must liberate ourselves from the constraints of that implementation.

It's like talking about whether a feature should be part of the Linux kernel or left to userland. You can say that ideally some functionality ought to be in the kernel without asserting that the current implementation of the kernel is compatible with such ideals.

I think that most people shy away from this thought exercise ("assuming an ideal implementation were available, what would government look like if it were re-imagined from the ground up to address the challenges our society faces today?") because it ignores enough details about the current situation to feel like a complete departure from reality.

If there are objections/concerns regarding some piece of the spec, identify the general solution, even if it sounds like a tautology - then get more specific until you have a solution.

In this case, if your concern is based on the assertion that "we have not proven ourselves capable of implementing government that adequately services public works", we can examine that assertion. I'm not certain that it's true, but if it is, we can ask "why?" until we can form a hypothesis. Then apply the scientific method and repeat until you _know_ why. Then follow the same process for hypothetical solutions. ???. Profit.

Sorry I didn't really answer your question, but hopefully this provides a framework for answering it and any others you should come up with.

No sorry needed, it was the shape of an answer, at least to the extent that I feel like I can respond:

I realize the mental exercise and see the benefit of it, having done so in various isomorphic forms, and come to many of the same answers regarding systemically self-reinforcing power in the form of money and networked influence. I find very little in terms of either incentives or historical precedent to suggest that this will shift without some massive upheaval.

At the risk of being overly pragmatic from this, aside from identifying some root problems of structural government run by fallible humans, I don't necessarily see it as a path to a solution due to the depth of the root problem your analytical framework would identify (from my analysis.)

For the same reason it's not really "useful" (if we're being obnoxiously utilitarian) outside of a thought experiment to ask that question for linux (actually, to some extent, it's more useful in linux since toy OSes are more of a thing than toy governments, and have significantly more chance of both existing as experimental ventures and catching on in any real fashion) I'm not sure how this answer or thought process leads to progress?

Now my turn to apologize, since this was a bit of a braindump-response.

I was with you until you mentioned the Libertarian ideology. Comcast's position is not aided by the "free market". If there was a free market, there would be a ton of other competitors that wouldn't be willing to do this and people could switch over to them.

Comcast has its monopoly position because most cities and states give them local monopoly - which is like the opposite of what a libertarian would allow.

Yeah, only one cable company per area. The only option is a 3G/4G hotspot which charges per GB and is outrageous, then slower DSL. Some people are lucky to have Fiber offered.

Cell phone carriers, there's only 4 I think nationwide than all the other "carriers" just resell them as a white label.

I never got why 1GB is $10 a gig, when with a VPS I can buy bandwidth for like 10 cents a GB. Why a 100x price increase for just making the bandwidth wireless?

>> Why a 100x price increase for just making the bandwidth wireless?

Because they can and will continue to do so as long as they can.

urm, it does make sense to have a massive increase in price for wireless traffic though. there is a finite amount of data you can carry over wireless technology per m^2 (and its significantly less than you'd expect). this limit doesn't exist with wires, as you can always add another cable.

Capitalist free markets inevitably lead to consolidation of capital and monopolies/oligopolies that influence policy to promote their own rent-seeking. It's sorta why all the monopolies were broken up before and why some mergers are blocked (not nearly enough to promote healthy competition, though). "Free" libertopia markets don't stay free forever. They are self-destructive.

This is especially evident in the hardware IT market. Look, for example, at all the hard drive and SSD manufacturers that existed between 1990 and today. Eventually, they all consolidated back to Seagate & WD. And every smaller SSD company folded or got bought by the people who actually manufacture flash memory.

> which is like the opposite of what a libertarian would allow.

Allowing something assumes you have power to restrict it, which, in the market with consolidated capital you don't, unless you are part of the government, which can overrule an individual corporate mandate.

> why Libertarian ideology can't feasibly work

Don't forget that they don't have any competition, a big part of which is due to laws preventing municipal broadband networks. I don't think anyone is too worried about this in Chattanooga, TN, where over 100,000 people have access to 10gb fiber to their homes.

I think the bigger reason they don't have competition is due to the crazy requirements to become an ISP / cable service for any city in america.

You need to meet with EACH city and sign a "franchise agreement", which specifically spells out what kind of service you will provide and who you will provide it to.

This includes you providing a certain amount of bandwidth for local access / public access channels. It probably also includes promising to service 100% of the city and also whatever pet project the council has (wire up low income housing, provide 1GBPS service to the mayor's uncle back up in the woods on the edge of town, etc. etc.).

Don't forget the public gets to comment, critique this entire process. Jane the cat lover can show up and demand a 24/7 cat pictures channel, if enough of Jane's friends support that, its going to the franchise agreement.

It sounds like a good process in theory, but it just ends up getting super bogged down.

Comcast are the masters of negotiating these things, they have teams and teams of lawyers who do nothing but get these setup.

yeah, we're really not :-)

Imagine if car companies were allowed to sell your driving location history.

That's why their analogy to websites collecting data is awful, by the way: I cam choose whether or not to visit a particular place, but my car goes with me no matter where I go.

I think we are going to see a lot of that soon.

There are already collection going on, though only for internal data analysis. Insurance companies track you for checking liabilities in claims. Tesla tracks you for building their auto-pilot. As more companies install these things it becomes more likely that they will start reselling it.

I remember reading an article a while back about BMW attempting to use location information to display ads for certain stores on the integrated display (iDrive). They even talked about using the weight sensor on the seat (for the air bags) to determine if there was a child in the car or not so that they could optimize the ads.

I can't seem to find a link though. Apparently, the idea was scrapped due to negative publicity, but who knows...

I do know that my car (2011 BMW) has a GSM telemetry link that is in periodic communication with their dealer network, even well after the warranty expired. I get calls all the time from my local dealer saying that my "car called in requesting service". I would normally call BS, but this always occurs after the service light comes on (I change the oil myself and sometimes forget to reset the oil life system).

How much is a persons browsing history going to be worth in the long run? I simply don't see how anyone can make money on knowing that I spend five hours a day on PornHub, two hours on Hacker News and 15 minutes on the Django documentation.

Or even that I primarily spend my money on Amazon when actually buying something.

You do not seem to provide much direct sales potential but perhaps a future mrsweasel, employer or insurance provider might find that information very useful, valuable even.

You're right in that respect, but it says "to advertisers". My data would be valuable as potential blackmail, or as you suggest: Not giving me a job, but for advertisers not so much.

It's my feeling that for the majority of people their browsing data will rarely translate to direct sales.

Maybe it would be useful to detect click fraud on existing ad networks?

Or to make attribution easier for multiple devices in the same household?

Both of those make ad spending more efficient, which translates directly into better revenue for companies buying ads.

Dear mrweasel,

Our unencrypted database was compromised and all your browsing history and our analysis of your daily habits is now on sale on blabnlablabla.onion/sell.php?product=123 starting from 0.002BTC per year of history of a user.

Well for one, it shows that you're using Amazon a lot, so Amazon should advertise products directly to you.

Or inversely, if you use FB a lot, FB shouldn't advertise to you as much

Amazon already advertise to me a lot - on Facebook.

But it's "dumb" targeted advertising; it's nearly always for the exact things I've been browsing lately, or things that I've bought lately.

I guess deep learning and ML in general is where marketing believes they will get answers.

How much would your private browsing history be worth to future potential employers?

Not much. For the companies your future potential employers use to do background checks on you? Probably a lot.

After making a reasonable outlay on a watch in a bricks and mortar store recently and then being retargeted aggressively by watch manufacturers on my browser (apparently card companies selling purchase history is par for the course) I became rather upset about the whole "we like to track everything you do because advertising" theme of the web.

I was recommended and have started using the free "Privacy Badger" Chrome extension from the EFF which is exceptional. The web sans skeezy cookies and 3rd party tracking is a rather different (and enjoyable experience). What's really funny too is that some sites (Bloomberg is an example) simply won't work without all of these nasty trackers switched on.

How is it possible to connect your browser to a credit card you used at a brick and mortar store?

Data brokers like Axciom collect offline purchase transactions and have partnerships with Facebook, Google and others, http://blogs.wsj.com/digits/2014/05/14/data-broker-acxiom-mo...

It doesn't really say how exactly they are linking your real world purchase with your online identity.

From that link: > The company was censured by Facebook for the practice, which involved pulling data from apps against the social network’s rules.

Sounds like they just ran an app and misused the API? Are FB and Google really allowing this kind of stuff? Random companies like United, meh I don't expect them to have much scruples. But Google and FB?

Any info on which banks/companies do this? Does it happen with debit cards, too?

> Yes, Your Credit Card Company Is Selling Your Purchase Data To Online Advertisers[0]

[0]: http://www.businessinsider.com/credit-cards-sell-purchase-da...

That's not even close. That's CC companies selling aggregated data. That generally won't identify a user, to link their CC purchase of a watch with watch related ads. (Unless they were the only customer in that region.)

The link says MasterCard sells info on which ZIP codes have which purchases. That's extremely different than offering a cookie (or somehow identifying) to say "this guy bought a watch".

clearly you're not familiar with the advertising industry

Target was able to use credit card purchase data to find out a girl was pregnant and send out marketing content, before her father knew she was pregnant...back in 2011. http://www.nytimes.com/2012/02/19/magazine/shopping-habits.h...

They used their OWN data. I.e. purchases in their store. They buy other records to supplement. Can you point me to the quote in that article that says Target buys a list of purchases _from other merchants_ via the CC processor?

IIRC, they effectively hash your credit card name details and match the hash, against your profile in FB/Google/etc.

Your CC has a home address. Your ISP geolocates your home connection to that address. You browse from home, everybody at the house now gets advertising tied to the purchase history of any cards with that home address.

It might not be quite so direct, but there are a number of ad-network companies focused on exactly this. It can work like:

  1) Sign-up for a "rewards card" or mailing list at a store

  2) Use a credit card with that account

  3) That account is linked to that card within the network or sold to a network

  4) The ad-network profile is then leveraged with a variety of e-commerce sites
     through cookies and the like

  5) Purchases made online with those cookies are linked to purchase histories
     and profiles

You can see how these network profiles are developed and interlinked until "spooky" things start happening. Following a consumer from brick and mortar stores to online is an advertising/e-commerce dream. I know several ad-networks are working towards developing graph databases linking profiles across devices.

I always just assumed the card provider put a cookie on your browser when you logged in to their site (to check your bill e.g) and then sold part of this ID with the purchase history. Could be way off here though.

I thought about trying this (virtual cards for all transactions)

https://privacy.com/

Good call. Apple Pay has a high level of anonymity too.

Tried this service and can't recommend in. Actually I'd recommend against using it. Based on my experience a few months ago - not sure if this changed since then:

In exchange for providing their virtual credit card they required access to my bank account. This means your username and password as well as all of your verification questions. If you use 2FA they don't support your bank account. I really wanted to use the service so I temporarily disabled 2FA to sign-up and then re-enabled it again afterwards (assuming that they just verify ownership of the bank account once). On the next day I got an email stating that my virtual credit card has been disabled, because they can't login to my bank account anymore. In my opinion this is completely unacceptable. I'm not going to give a credit card provider full access to my bank account.

This advertising-after-purchase has always seemed stupid to me: after all, you've already got the item. Sure, you may be interested in buying many items of one class (say, you're a watch collector), but delaying ads for several months would be clearly more effective.

I don't see how you can say that it would clearly be more effective when digital advertising is data driven.

That doesn't mean the conclusions drawn from the data are correct.

I'd presume measuring effect of several months' delay wold be a nontrivial experiment.

> digital advertising is data driven

Data-driven off the cliff. Keep in mind that most people in marketing are clueless about statistics, scientific method and any kind of rational reasoning. Same is true for their customers. You've got people knowing shit who write reports containing bullshit, which are read by people knowing shit, and since no one can actually verify if any of that is meaningful, everyone is happy and money flows around. And the people making tools for analytics actually exploit that too, since they're in competition with one another (see e.g. popular A/B testing tools encouraging you to reach a wrongful conclusion that your intervention worked - which makes you happier about using the tool). Advertising industry is rotten to the core.

Use Square for a purchase, card you used before? You get an automatic email receipt. Convenient. What are they selling?

Cookies are one avenue, but there are others.

Only if you previously gave another merchant your email address before.

But once you've done it, even one time, it will follow you forever. No one can be as diligent 24-7-365 as is necessary to avoid information capture in today's environment.

Macek Ceglowski's talk transcript on how internet advertising became more and more intrusive, still doesn't work well, and what we could do about it. And his talk on intrusive spying and advertising which overlaps:

http://idlewords.com/talks/internet_with_a_human_face.htm

> Recall that advertising is when someone pays you to tell your users they'll be happy if they buy a product or service. Yahoo is an example of a company that runs on advertising. Gawker is a company that runs on advertising. Investor storytime is when someone pays you to tell them how rich they'll get when you finally put ads on your site. Pinterest is a site that runs on investor storytime. Most startups run on investor storytime.

[..] Investor storytime only works if you can argue that advertising in the future is going to be effective and lucrative in ways it just isn't today. If the investors stop believing this, the money will dry up.

to make it work, to keep the edifice of promises from tumbling down, companies have to constantly find ways to make advertising more invasive and ubiquitous.

And that's the motor destroying our online privacy. [..] We're addicted to 'big data' not because it's effective now, but because we need it to tell better stories.

[..] Of course, for ad sellers, the crappiness of targeted ads is a feature! It means there's vast room for improvement. So many stories to tell the investors.

This ghost of a business model propels us to ever greater extremes of surveillance. If the algorithms don't work, that's a sign we need more data. If the algorithms do work, then imagine how much better they'll work with more data. There's only one outcome allowed: collect more data.

"Most of us agree to give up our data in exchange for using online services such as Google, Netflix and Facebook. Cable and Internet providers have said it's only fair for them to compete on the same playing field."

No Google and FB are free. Comcast is not only not free but an expensive service and often a monopoly in a market.

This is how it starts, Comcast dips their toe into the water and if it cant get away with this on some limited basis, then it will eventually become the default. AT&T and Verizon are already doing this with wireless businesses. Their argument was also that FB, and Google were doing this and they needed to as well in order to compete.

If this happens we will need to purchase VPN service from a third party in order to protect us from the monopoly internet provider. What a sad state of affairs this will be.

P.S., Can you anyone tell me what I would agree to give up with a Netflix account? This is news to me.

Your browsing pattern on their archive, your watching history, your watching pattern (in terms of time of day, days of week, time of year) as well as location history and ... .

Oh sure but they aren't selling that data to third parties are they?

Wouldn't use of VPN bypass their ability to collect my browsing habits?

If difference in cost of service > cost of monthly VPN, this might be an interesting loophole.

Sadly using a VPN for general usage is getting more difficult.

Many sites block traffic from known VPN providers (PCPartPicker.com just leaves an unhelpful message similar to " we are down right now" of you connect over some VPN providers), and sites like Netflix are blocking all VPNs they can in an effort to stop people from watching things outside their region.

I used to run my whole house through a VPN 24/7, but now I need to only turn it on when I know it won't cause issues.

Do you happen to know/would you mind explaining how Netflix detects VPN usage? Is it through timing measurements?

I believe they just keep a list of known VPN IP addresses. (How they get them in the first place I'm not sure).

It's a wackamole game for sure, but its annoying enough to be a problem, especially for the less technical.

I know I can buy my own VPS and tunnel through that, but now that's another machine I need to maintain, secure, and pay for.

Ahh, that's way less interesting of a mechanism than I thought. Thanks for explaining!

> (How they get them in the first place I'm not sure).

I don't work for Netflix or Hulu. But why couldn't staff there just sign up for VPN services, log in, note the IP address(es) in use and then block those?

Buying a monthly subscription to a few VPN providers seems like a cheap and easy way to solve this.

> I know I can buy my own VPS and tunnel through that

It would be pretty easy for a provider to block access from a VPS. Data center providers have well known blocks of IP addresses, which are static, and it's pretty unlikely that there are any actually humans in a data center watching Netflix.

It would be pretty trivial for Netflix to decide to block certain IP ranges they know to be used by VPS providers to prevent this.

I installed openvpn on a server. Netflix still managed to block my access so maybe they are checking patterns or something.

It's also easy to discover and blacklist the IP address ranges of known server providers.

What about data center IPs? A pay-by-the-hour VPS can be cheaper than any VPN service. I've been using one recently and it hasn't been flagged by any site I care about.

I had a bank account locked to the "show up in a branch with id" level for this.

So explain that if it happens again you intend to switch banks.

Not me. I'm very happen when this happens. When it comes to identity, it's far easier to deal with false positive than theft. For example, my credit card gets flagged for fraud every holiday when I go on a gift card purchasing spree. I have no problem with this.

VPN Is heavyweight I just use a Amazon machine and open a ssh tunnel.

That's not nearly as fast as a real VPN client, though. I used to do the same and it just didn't work well. Nowadays I have an ultra-cheap (3€ per YEAR, from lowendspirit) VPS in the US (it doesn't even have a public IPv4, just 20 forwarded ports) on which I run OpenVPN. I also run another OpenVPN server on my primary server which is a 6€ per month root server in France (kimsufi/OVH).

My question would rather be what about https traffic? Are users forced to install a comcast root certificate?

This might be one of the reasons Comcast is so keen to put cable modems with built in WiFi into people's homes. This would allow them to track Web history all the way down to a particular device. (It could also probably be used to track down who's particular computer was used in file sharing.)

How is this different that a telephone company selling the record of phones you have called?

https://www.fcc.gov/consumers/guides/protecting-your-telepho...

Or credit bureaus selling your information

Verizon actually already sells your web history.

Wait, are they planning to track data and sell targeted ads, or to literally sell web history? The headline implies the latter but I can't see in the article where it says that.

That is a pretty huge distinction..

There is a significant distinction here, but I opine that either behavior is unacceptable for an ISP. I'm reading this and the comments and imagining a telco switchboard operator listening to my call, and then randomly either breaking into my call to suggest I buy something (targeted ads), or then publish the full text of my conversations to any third party (history). And I do mean the full text. The link from home to your ISP must necessarily contain all the inputs you request of the web. This is not analogous to your call history; your computer is only making one "call" (to the ISP) and is having a long "conversation" (all your Internet activity) within that "call".

Disclaimer: I'm not very proficient at how the Internet works at this level. My comment's making it sound more and more like a pen register.

I wouldn't be so opposed to this if we had more choice of an ISP.

If we had more choice they wouldn't try to do this to begin with. They're only doing this because so many of their customers effectively have no other viable choice.

Google gets web history via Google DNS, and they're the advertiser. So, I don't know that we really care about ISPs collecting and selling similar data. Probably the distinction is we trust Google more than Comcast with the handling of this data, and possibly to what degree we as individuals are abstracted from aggregated data, compared to what Comcast is capable of collecting.

If the trust is low enough to prompt paying more money to Comcast for a non-tracking tier of service, why trust that Comcast is in fact not tracking their non-tracking tier anyway? Why not just pay for VPN service? Or maybe some combination of OpenDNS's DNSCrypt plus HTTPS is sufficient?

I think the distinction is Google has specifically said they won't correlate Google Public DNS data for targeting advertising [1], while Comcast is specifically saying that's exactly what they do want the option to do.

If you don't trust either company, that distinction won't matter. But if you take their statements at face value, there is a difference.

[1] https://en.m.wikipedia.org/wiki/Google_Public_DNS#Privacy

People keep recommending VPSs or ssh/vps/socks running on a VPS

the problem is that if you go to likes of amazon and then place an order your account will be yanked in minutes

good luck then trying to get anyone human there to help you, you are automatically blacklisted

Not if you use SSL on top of your proxy/VPN.

You dont get it, =commercial datacenter ip ranges are blacklisted or trigger flags

I would be surprised if they didn't already track their customers' browsing history (and DNS lookups for insight into HTTPS browsing). Maybe they have to announce it now that they want to sell the data.

and DNS lookups for insight into HTTPS browsing

No need, SNI will tell you the hostname in the stream itself.

I was going to suggest we can change our DNS to someone other than our ISP, but if what you say is correct, then that becomes irrelevant, too.

That doesn't help, they can read your DNS requests as they pass through. Unless you do as some others here suggested and use a full VPN.

Wow. As long as they don't try to do it for https which is probably impossible unless some major flaw is found or you install some plugin. I think in 2016, installing software for an ISP is so outdated, reminds me of AOL and if they went that route I doubt they'd be able to even write software/plugins for all the devices people use such as iOS. It'd basically be spyware.

I do know though with my ISP DNS, I do get ads and search like results on domains where DNS doesn't resolve, but with Google DNS that never happens :)

HTTPS doesn't encrypt the SNI information so Comcast can still tell what sites you're visiting. They can also sniff all your DNS traffic even if it's going to Google's DNS server. DNSoTLS is not deployed anywhere except in testing at this point.

DNS isn't widely encrypted yet? That's scary.

So does that mean if a rogue ISP wanted to, they could serve up Twitter.com on their internal network and return their fake DNS record instead assuming the user's cache expired?

Kinda like a man in the middle but at the DNS level... Only problem is pretty much every, if not all SSL cert company requires domain verification. So they couldn't probably easily fake the SSL part for Twitter.

With DNS encryption your ISP still sees IPs correct? Then it can do reverse DNS lookup. Then it can also serve whatever it wants on said IP.

When I write in browser twitter.com/give-me-lots-of-pr0n does it first connect with twitter.com's port 80 and sends an unencrypted GET request with /give-me-lots-of-pr0n to receive redirect to https://twitter.com/?

> When I write in browser twitter.com/give-me-lots-of-pr0n does it first connect with twitter.com's port 80 and sends an unencrypted GET request with /give-me-lots-of-pr0n to receive redirect to https://twitter.com/?

Probably not, in this case, because Twitter has implemented HSTS[1], and are[2] in a list that comes with your browser that specifies never to connect to the site unencrypted. If they're in the browser list, your browser will never actually connect on port 80; it will silently redirect client-side to HTTPS.

1. https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

2. https://hstspreload.appspot.com/?domain=twitter.com

Of course Comcast wants to do it. If it makes them more money, don't they have a duty to their shareholders to use that asset to generate profit?

It does bother me that privacy is turning into something for the wealthy.

I also think about how companies like Facebook gather an unbelievable amount of information about me and use that to generate $15 every 3 months (I'm in the US). I wish I could just pay $5 every month for an ad-free version.

is that a bit contradictory to be bothered that privacy is turning into something for the wealthy and yet wish you could pay for your privacy on fb?

edit: i think fb would offer that if users would be willing to pay it. something like 400 million daily active users? if t hey could collect 5$ a month off them that'd be a lot of coin

it still values Facebook less than Netflix, which is not for the rich. I'd easily pay $10/month.

But I highly doubt Facebook has ever seriously considered it. It would alter their brand as a data mine to businesses way too much. I highly recommend dns level ad restriction plus heavy stylesheet modification. Just trash the mobile app or route it through an tracking blocking dns proxy. Obviously don't like businesses and never click on ads.

fb made about $1/user/month last year, FYI

My real point was that they collect so much data about their users and individually it's worth almost nothing. They know a huge amount of stuff about me both online and offline and that's worth $5 this month. It's a little depressing.

> If it makes them more money, don't they have a duty to their shareholders to use that asset to generate profit?

Unless explicitly laid out in their corporate charter, no. There is no default effective fiduciary duty to do anything related to profitability, be it "maximize" or otherwise.

This is one of the more pernicious myths about the idea of the corporation that needs to be killed.

>> here is no default effective fiduciary duty to do anything related to profitability, be it "maximize" or otherwise

I'm not entirely sure that's 100% true. I know the one thing I've seen before when "duty" to shareholders comes up: https://en.wikipedia.org/wiki/Dodge_v._Ford_Motor_Co.

"Interests of shareholders" does not mean the same thing as "maximizing profits." For example, a forward-thinking Comcast executive could make the argument that the goodwill from not looking like creepy spying dudes hiding in your hedges outweighs the short-term increase in revenue.

That's exactly the same as maximizing profits.

That depends on where you're standing and what your timeframe is. Which, by itself, is enough to put the boot to the aforementioned pernicious lie: it's impossible to "maximize profit" for the shareholders, because the shareholders aren't unified in purpose.

That ruling only really prevents companies from directly giving the money away in defiance of the shareholders. It's about 'means' and 'ends'.

It can't meaningfully impose any particular strategy on a company. Think about it for a second: wouldn't profitability maximising oblige all companies to hurtle into whatever new line of business was deemed most profitable at that time - today we're an ISP, tomorrow we're real estate, next week we're hoarding gold?

You're right. Unfortunately, the current culture is "more, more, more", even when it's Comcast, which must be like squeezing blood from a stone at this point (what growth potential is there with an ISP of their size?)

If the board doesn't take action to raise profits, the shareholders will remove uncooperative executives and replace them with those who will. So it might not be de jure in their corporate charter, but that's the reality.

> It does bother me that privacy is turning into something for the wealthy.

A victim mentality will get you nowhere.

From what I know, Comcast is somewhere between $60 and $200 a month. VPN subscriptions are available for less than $5/mo. So privacy from your wireline provider is easily affordable.

We're in the age of computational tools. If you don't spend a modicum of effort to use these tools to protect your interests, you can't really complain when you end up disadvantaged from adversarial parties wielding them against you.

Okay, so I'll extend what I said to it bothers me that privacy is turning into something for the wealthy and the technologically inclined.

It has little to do with technological inclination, but whether you act to design your own situation rather than just choosing between options that are marketed to you.

If you take a look at /r/VPN, you'll see most of the questions are from people who lack technical skills.

If you know enough to even look for /r/VPN or know that such a thing exists or what it does, you are already way ahead of the game.

Reddit is a mainstream site these days, but sure.

The most basic of searches will lead one to articles explaining that there exist various ways of achieving online privacy. At which point one can keep exploring, or ask computer literate friends for recommendations.

If somebody spends a decent amount of time on various social sites, is concerned about privacy, and yet does not do this, their primary missing ingredient is motivation. Nothing in the world can compensate for a lack of self-agency.

(Not even money as you initially lamented, since it means you're actually more valuable to surveil)

The real problem is the vast majority have no idea about any of this. They don't even know their privacy is being violated, it's a completely foreign concept.

We're forced to learn about and deal with bills, taxes, insurance, legal issues, etc. Our society just needs to realize that technology related privacy falls into this category too.

I actually think the vast majority does know their privacy is being violated, but just assumes that's how Internet use goes. They trust that minimizing their reliance on it for "important" things will minimize their exposure, while also not understanding the extent to which surveillance has taken over the physical world.

But alas this doesn't really apply to somebody who seemingly knows their privacy is being violated enough to complain, yet doesn't bother to take straightforward steps to rectify that.

A VPN will certainly not defeat NSA mass surveillance, and likely not adtech's surveillance. But it will most definitely force an ISP to remain a dumb pipe, which is what's under discussion here.

> I actually think the vast majority does know their privacy is being violated

No, I don't think they do. They don't understand how grocery store loyalty cards work or how that data ends up at Facebook as part of their profile.

They might understand that clicking "like" sends a signal to Facebook, but they don't understand that the Facebook they see is slightly different than the Facebook I see because we are both being subjected to different social experiments.

They don't need to know the specific details of what is collected or how it is cataloged to fundamentally be aware that their actions are being recorded. I shouldn't have said "violated" because they're so disempowered they aren't aware that there is a choice.

>duty to their shareholders to use that asset to generate profit

This is so widely said but almost never applicable. You could say this hurts Comcast's profitability because it damages rep. You could say Google is in flagrant disregard because they invest in new technology. Or Apple, because they donated money to charity.

It's simple to see that this must be true: If you could predict which things were profit-generating, then no business would make bad decisions!

I don't know what the legal criteria is, but I'm guessing it'd have to be some pretty severe misdeed (huge negligence?) or outright fraud before there's any legal implication. Before that, you'd imagine the board would step in.

> I don't know what the legal criteria is

It's whatever the corporate charter says and what executives and the board have communicated to investors.

Google doesn't get in trouble (so far) for their X-projects because that's been part of their DNA early on.

VPN. Turn them into the dumb pipes they should be.

The challenge is, then your VPN endpoint has access to all of this data. So who's your trustworthy VPN endpoint?

Your own VPS, I guess.

Now you're just trusting the VPS provider.

This can be a use case for the Intel SGX technology.

At least you can pick between VPS providers. The only way to opt out of Comcast (generally) is to move.

Or the VPS provider's ISP.

Anyone know if Opera, which has build in free VPN (for their developer browser) is good enough (http://www.opera.com/computer/beta) for this?

This wouldn't be that bad, except for the fact that they won't properly disclose it, and I bet the "non-discounted" plans either won't exist or will be extremely expensive

What do you think Facebook and Google are doing...

Reply on news.ycombinator.com