Hacker News Reader

Comment by dylz | Hacker News Reader

They don't DPI your traffic for this feature - if Spotfiy detects you're on .tmodns.net, they will serve you from internal Telekom network caches instead of hitting the wider internet. This is pretty much equivalent to australian ISPs' freezones.

They do DPI for other purposes though, such as ensuring that you don't tether without paying (if you use a desktop browser user agent, it'll count your tethering quota separately -- even if you spoof the UA from your phone's browser), and for "caching" HTTP traffic (you'll see a 'X-Via: Harmony proxy' header on any HTTP traffic, on any port).

They also hijack DNS NXDOMAIN for ad-filled pages, with no usable opt out ("opt out" uses a cookie that uses javascript to serve the page anyway, then hide it with a fake nginx 404)

View on HN

> even if you spoof the UA from your phone's browser

I don't know about T-Mobile's ways of detection, but AT&T is detecting[0] tethering users by checking the network packets TTL values: If you are tethering then the TTL on their side will be below the expected value of mobile OS's default TTL. There are apps which can hide your tethering usage by altering your device's default TTL. You should still use a mobile browser's UA string, of course.

[0] - http://www.redmondpie.com/bypass-network-carriers-tether-det...

You can avoid the bogus DNS server by manually choosing Google's alternate server 8.8.4.4 (They intercept the primary one 8.8.8.8 as well as 4.2.2.2.)

They do MITM of custom DNS servers? Despicable! I wish DNSCrypt support was more widespread.

Yup, that's what it looks like. I just encountered it last week: https://gist.github.com/cjp/f4dda3cc0f26ad10a3fe

Been meaning to try to dump some traffic so I can see more of what's going on.

That is pretty incredible. I knew about ISP's DNS servers that hijacked NXDOMAIN but I've never before heard of MITMing of third party DNS servers! Wow! Have you contacted T-Mobile about it?

comcast does/did the same.

I haven't, but that's a good idea. I'm guessing there are semi-legitimate reasons beyond just forcing people to the stupid NXDOMAIN search page. But I agree that it's pretty unpleasant.

Just FYI, I wrote this up (http://esd.io/blog/t-mobile-dns-hijack.html) and I'm told off the record that T-Mobile intends to fix it.

Awesome, thank you for going the extra mile and reaching out to T-Mobile! I hope they really do fix it. =)

This is really really bad.

I think most of the plans include free tethering now, so I am not too worried about that. I was disappointed to see them redirect to lookup.t-mobile.com though. That is one vote in favor of the people that google everything instead of just typing in a domain name.

If you use mobile safari's "request desktop site" (ios8+), will they wrongly claim you're tethering?

At least a couple years ago, when I switched the UA in a different browser to Firefox and forgot to switch it back, it did use up all my tethering data. It just cut me off though, they didn't try charging me oodles of money.

I'm a T-Mobile user and they've never asked me to pay for any of the tethering I do.

I'm not sure if you know that Spotify is doing that, but Grooveshark is also a music streaming partner and we're not doing any special routing/detection for T-Mobile customers, everything is on T-Mobile's end.

VPN solves all of those problems.

HTTPS solves these problems too.

HTTPS doesn't do anything for their DNS servers not returning NXDOMAIN as they ought to. Also, clients can use a VPN all on their own, they can't force all the servers they use to use HTTPS if they don't already.

T-mobile user here running Cyanogenmod, dnscrypt, and other goodies, with no problem.

Or, you know, paying for tethering.

Charging extra for tethering is total crap—it's just another way the telecoms are trying to erode net neutrality. The fact that they charge for it makes it seem like somehow IP packets from my computer are totally different from IP packets from my phone. If they are worried about computers using more data, then just charge the correct amount for bandwidth (though honestly, in these days of mobile netflix and nice mobile web browers, I highly doubt computers use much more than phones).

Apparently some IP packets are more equal than others.

I don't know. There are some lines I'm willing to cross and feel completely ethical, and bypassing stupid arbitrary net-neutrality rules is one of them.

I get what you're coming from, but personally I'd feel guilty getting something for free when I know I'm supposed to pay for it -- even if I disagree with the way its priced. It's not that far from people who justify pirating Photoshop because Adobe charges too much for it.

No this is like buying Photoshop and Adobe saying you can't let your friend come over and use it without paying for a new license.

I paid for the data. There is no difference if I use the data request comes from my mobile device or if it comes from my laptop connected to my mobile device.

Price discrimination is not a god given right nor is it criminal (usually) to avoid. (I can't think of a case where avoiding price discrimination is criminal, but I'm sure there is)

You don't get to set the terms by which someone else sells you something. And strictly speaking Adobe's license probably does prohibit a second user.

Reply on news.ycombinator.com