How Verizon and Turn Defeat Browser Privacy Protections

quantcast was sued for resuscitating browser cookies when flash LSOs persisted [1], ie taking the cookie value from the LSO and recookie-ing the browser. quantcast and clearspring settled for $2.5m [2]. The crux of the matter seemed to be that users didn't know such data was in flash cookies or associated with quantcast, making it hard to opt-out, though I'm not sure if this is illegal; and violated quantcast and the 3rd party sites' privacy agreements, which appears to be illegal. A lawsuit outline for one plaintiff is here [3] and the full text of the initial filing here [4]. I naively assume there is a clear parallel to this case, though perhaps verizon and turn have thoroughly privacy policied their way out, somewhere in 30 pages of legalese.

According to Jonathan Mayer,

   Commercial supercookies, fingerprinting, and zombie cookies are tolerated 
   (if not permitted) under current United States law. [...] Any associated 
   consumer deception, however, is a violation of the Federal Trade Commission 
   Act and parallel state statutes. [5]
   

[1] http://www.wired.com/2010/07/zombie-cookies-lawsuit/

[2] http://www.lexology.com/library/detail.aspx?g=bc3a4358-6692-...

[3] https://www.privaworks.com/Details/AlertReference/PrintPrevi...

[4] http://www.wired.com/images_blogs/threatlevel/2010/07/CV10-5...

[5] http://webpolicy.org/2015/01/14/turn-verizon-zombie-cookie/

>"It is Turn’s policy to always honor the consumer opt-out as enacted through either the Turn website or the NAI or DAA."

What does this actually mean, and how can I do it?

> Clearing your cookies is not the way to opt-out of tailored advertising, and may in fact be counterproductive if you’ve cleared the cookie that indicates you have opted-out.

I realize the technical reason cookies exist yet this seems wrong to me.

OP here, I'd be OK with swapping in Mayer's blog post. Will let the mods decide.

If you haven't seen it before, this guy's stuff is absurdly good. Encyclopedic knowledge of privacy tech and law.

The tracking is everywhere, it is all around us, even now on this very site. You are tracked when you look out your window, or you turn on your television. You are tracked when you go to work, when you go to church, when you pay your taxes. It is the web that has been pulled over your eyes to blind you from the truth. You are a slave. Like everyone else, you were born into bondage, born into a prison that you cannot smell or taste or touch. A prison for your mind and especially for your Verizon phone.

How about:

Because your mobile device really belongs to the carrier and not to you, whenever you browse the web with it, they know who you are no matter what. They are now refusing to keep that information secret even if you want them to, instead selling it to advertisers without your consent (even despite your obvious non-consent).

They do this by sabotaging your mobile browser so it can't really delete certain cookies. When you try, they put them right back the next time you use the browser. They also have a way (called a UIDH header) to tell other sites that its you (so they can track your visits) even if you don't have a cookie in your browser.

When you click a button on your mobile web browser, if you're a Verizon customer, advertisers see a special tag assigned to you by Verizon. Since Verizon assigned you the tag, they can give you the same tag on every website. Advertisers have ads on many websites, so they can see the tag and match your browsing history to their logs. In effect, because of the tracking tag Verizon assigns to you, any advertisement you see can track who you are and where you've been.

Is the language on the action alert (linked in the article) any better for you?

https://act.eff.org/action/hold-verizon-accountable-for-viol...

Verizon is doing the equivalent of a reverse 'butt dial' they are listening to everything you do after you've hung up.

This is fantastic and I'd install it in a heartbeat

verizon overrides; I'm not a web engineer but (I think) ssl protects tcp headers. if so, it's probably the only technical solution is either ssl everywhere or an ssl proxy run by users

> 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently

Why so hopeless? My water is clean, airplanes and roads are safe, retail banks don't lose their customer's savings, etc. Not all regulation works, but this one is pretty straightforward.

Step 1: Site operators install backend library to detect uid cookies and send them via API to a central database

Step 2: Privacy-minded activists install a browser extension that reads the uids from central database and spoofs HTTP headers with them. Extension could even cycle through uids on a daily basis to cause more mayhem.

Result: with just a few big sites running this, a few thousand people with the extension could irreparably corrupt the uid header's "uniqueness" and it could no longer be relied upon to respawn a lost cookie session. Because Turn wouldn't know whether it's a real mobile Verizon user, or a jackass with an extension.

Shameless plug: I've already written a browser extension http://flagger.io that spoofs HTTP headers in Chrome and Firefox. Would be easy to add this functionality if people can help on the backend side (writing libraries for node/python/ruby/php/etc.)

You can't feed them garbage.

Verizon operates at the network layer - if you are on their network presumably they will copy the real value over your garbage value.

If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets.

There are a couple of other solutions you haven't mentions:

VPNs: Annoying and currently too hard for most people. Perhaps it is time for device (PC and mobile) manufactures to consider offering VPNs integrated with their devices.

Competition: If the US had a more competitive broadband market then people could choose other providers.

Legal action: If Verizon was sued and lost over this then it could have a cautionary effect. However, the loss would have to be huge for it to have an impact, and large financial settlements generally require proof of significant harm. That's going to be hard in this case.

Regarding regulation, if, as the EFF suggests may be the case, Turn is causing the companies they do business with to violate their stated privacy policies, it would seem that the FTC could take enforcement action without new regulation being needed. An indirect way of kicking in Turn's teeth, but perhaps one that would work.

or 3) Contact some of Turn's biggest clients and shame them publicly.

Hmm... garbage doesn't work beause they override the UIDH as a MitM. So maybe this fact could be exploited in the opposite direction:

Start using the X-UIDH: header for some prominent but non-mission-critical feature in a format that is obviously not related to this tracking number. When Verizon rewrites the header, that feature breaks, and you can make a fuss about it in the media or sue Verizon for breaking your webpage.

(it sounds good on paper; this may not work in practice)

That would be OK if my cellphone usage was "free". But it's not. I'm paying Verizon hundreds of dollars a month for me and my family.

I wonder if an MVNO would be less creepy than Verizon? Probably not, I'd bet they're even sleazier.

Keep your head out of the past. The internet is becoming the way we do everything now; it's a necessity.

That was the first thing that came to mind when I read the name "Turn" - as in, "We Turn users into products."

If you are a content provider you may choose not to serve ads on your content.

This gave me an interesting related idea...

It may or may not work depending on the legal status of, among other things, the HTTP standards, but could you claim copyright on transmitted HTTP requests, at least if they contained sufficiently interesting contents?

If you could, then presumably one would have to say that ISPs have implied license to transmit those (implicitly) copyrighted requests to a third party, namely, the server. However, that implied license would presumably not allow the ISP to transmit a derived work to the third party, i.e., the original request augmented with the tracking header.

To argue this one would have to argue that the entire request, headers and all was copyrightable, but I suppose if one did something creative with the headers it could work; e.g., using the HTTP headers as a kind of poem. But of course there's ways to have creative content in something without it being art, just as long as the other side couldn't argue that the headers couldn't be copyrighted because the usual ones are largely predetermined by the standards.

Basically this is just the same idea you had, except instead of invoking the moral right to anonymity, it's invoking the easier-to-digest moral right to the content itself.

I'd say this was all baloney, but the DMCA is so ridiculously broad that it just might work. Of course, this is all pretending that the DMCA is meant to apply to corporations and not just us small folk.

| A micropayment solution that allows content providers to get revenue from content rather than ads.

Even if this were popular, you'd still be tracked because it makes money. Really, so few people care about this deeply I don't think it will be solved. Sure, everyone hates it, but no one will switch carriers over it.

> A browser that doesn't support cookies

We are working on a browser (https://gngr.info) that supports cookies but doesn't enable them by default for all websites. We also don't enable JavaScript by default. User needs to enable these on a per-site basis. Enabling for all sites at once is also possible if the user so wishes.

In the near future, we also want to support https only sessions (opt-in to begin with and opt-out once https becomes more commonly deployed).

About micropayments, there are many. Flattr comes to mind. But I am sure there are more.

I think Aviator doesn't support cookies, among other privacy features:

https://www.whitehatsec.com/aviator/

EFF is working on a "HTTP Nowhere" option for HTTPS Everywhere, which only allows HTTPS connections. On Firefox there already is an HTTP Nowhere addon from someone else.

But as others have said, it's probably easier to just use Tor.

SSL can't really stop it, I think. Here's a thread where I've speculated on a way to inject metadata into SSL handshakes[0] just like they're doing with HTTP headers. If that doesn't work (I'd be interested to hear why), someone else suggested using TCP-IP source/destination metadata queried from the ISP to resolve to a customer.

[0] https://news.ycombinator.com/item?id=8506492

It's because the competitors do this too.

I doubt most people care. This isn't going to drive customers away. The only way it'll be stopped is if they're legally forced to. For example, see the history of cookies themselves and how most people never cared about them.

Should engineers who invent new rifle shells, or atomic bombs, or armed drones, or work at the NSA, or Tinder, or Uber, or Groupon, or Zynga be shunned? All of their employers are perceived by some as some as scumbags.

If your job that you liked came to you with a challenge like "I want you to invent a brand new way to track our users that nobody has thought of before", would you turn it down?

edit: or Facebook, or Google, etc? These companies are in the business of tracking their users' behavior to be sold to advertisers. I'm not really sure how that's different at the macro level than what Verizon/Turn is doing, and we're shunning an awful lot of engineers at this point.

Not everyone has the luxury to be able to refuse or quit a paying job. It'd be harsh to judge like this. It would of course do to shun the firms which do this - ultimately we want to eliminate the behaviour - not the people.

I don't think that's a good idea. Yes the ad based business model has gone completely off the rails with their aggressive privacy violations and disgusting deception schemes. I think they should be stopped, if necessary by regulating them off the face of the earth.

But personally blaming and shunning regular employees of corporations that break the law or some ethical standard has far reaching ramifications. Bitter ideological battles would take over the personal lives of people who have no say in whether or not their employer decides to use a particular marketing scheme or do business in a particular country.

I think personal blame should be reserved for decision makers. If an employee knows about serious crimes committed by their employer they should simply report it to the police.

In addition to the other replies you've got, this kind of judgement is, I think, beyond most people's capability to make. Should everyone who works at Turn be shunned, or just those who work on this project specifically? If a previously honourable company starts doing dishonourable work, how long a window does an engineer working there have to find another job before he or she is shunned? What does it mean to 'enable' Turn? That is, could a third-party indirectly enable them? How do we make the judgement when this has happened? For example, should W3C be shunned for making a standard that can be abused in this way?

this is what VPNs help prevent.

How would ISPs tag requests going over HTTPS as being from a particular subscriber?

Considering phones haven't had Flash (easily installable, that is) for a considerable amount of time, I doubt you're affected.

Or just get everyone to use the same UIDH, making it useless for whatever tracking purposes.

> What the fuck, Turn? You got a different explanation for what the fuck "Do Not Track" means?

Easy there.

IE10 defaults to Do Not Track enabled. So sending the header is not explicitly representative of the user's wishes.

Convenient, isn't it?

Gloriously filthy composition, but that's probably due to the expected increase in blood pressure from having your civil liberties stripped from you.

I am in unconditional agreement with you here.

I get that this falls in line with the accepted local opinion but I thought HN aspired to be better than pandering garbage filled with vulgarity.