Hacker News Reader

Comment by skywhopper | Hacker News Reader

It doesn't work on SSL yet. Although I won't be surprised when in the near future certain carrier-enhanced phones start coming with a Verizon-signed root CA installed that enables them to crack into your SSL stream and do the same thing.

As for its legality, it shouldn't be, but it likely is. After all, it's well established that ISPs may mess around with your TCP and IP packets to enable NAT. So why not with the HTTP stream?

View on HN

I suppose they can already sneak it into the SSL handshake packets, right? Put something in extended client hello[0] that whoever is interested can look at, and other TLS implementations should be ignoring for compatibility. It's maybe not as easy for ad networks to consume, but where there's money to be made, there's a way.

I think this would work. Am I missing something? Has anyone checked if it's already being done?

[0] https://tools.ietf.org/html/rfc4366#section-2.1

They don't even have to inject anything, it's surprising they're doing this at all. They could just use the TCP/IP source and destination addresses and ports to identify the connection. TLS wouldn't help that. VPN would though.

Maybe, but it sounds more messy. Verizon would have to maintain a semi-public (to their "other" customers, that is, advertisers etc.), low-latency queryable database of {source, destination, customerID} tuples, and ads and/or pages might not finish loading until that query returns. If the ID is more static, the trackers can cache the identity information for awhile after the first time, and Verizon probably has less work to track and resolve IDs.

it's a good reason to buy iphones. Apple will let a poisoned ca cert on their phones about the same time hell freezes over. Android can probably only be trusted if it's a nexus phone.

I regularly install a self signed CA cert to reverse engineer the API behind various apps. Your tech-unsavvy person need only follow a couple of steps to install one too, especially if it's their network saying "This increases performance and speed or w/e guff we need to convince you to do this"

apparently suckers believe that lg, the company that makes tvs that upload shows watched or files on your network, or samsung, the company that needs your phone number, address book, gps location, and accounts in order to download jayz mp3s, wouldn't install a cert for verizon

Reply on news.ycombinator.com