Hacker News Reader

Comment by shkkmo | Hacker News Reader

There are two solutions I see.

1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently.

2) Feed them garbage data.

We just need a database of live UIDH numbers and a browser extension to inject a random UIDH number from that list into the header.

View on HN

You can't feed them garbage.

Verizon operates at the network layer - if you are on their network presumably they will copy the real value over your garbage value.

If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets.

There are a couple of other solutions you haven't mentions:

VPNs: Annoying and currently too hard for most people. Perhaps it is time for device (PC and mobile) manufactures to consider offering VPNs integrated with their devices.

Competition: If the US had a more competitive broadband market then people could choose other providers.

Legal action: If Verizon was sued and lost over this then it could have a cautionary effect. However, the loss would have to be huge for it to have an impact, and large financial settlements generally require proof of significant harm. That's going to be hard in this case.

Tor is free and much easier than a VPN.

Tor Browser bundle on Win/Mac/Linux: https://www.torproject.org/download/download-easy.html.en

Orweb on Android: https://play.google.com/store/apps/details?id=info.guardianp...

OnionBrowser on iOS: https://itunes.apple.com/us/app/onion-browser/id519296448?mt...

Tor is so slow as to be unusable for everyday browsing.

Tor Browser is perfectly suitable for everyday browsing. When's the last time you used it for any significant period of time? It's plenty speedy and very stable.

Please, instead of bemoaning your complete lack of privacy online, do something about it for a change. Download Tor Browser right now.

Tor Browser bundle on Win/Mac/Linux: https://www.torproject.org/download/download-easy.html.en

Orweb on Android: https://play.google.com/store/apps/details?id=info.guardianp....

OnionBrowser on iOS: https://itunes.apple.com/us/app/onion-browser/id519296448?mt....

What kind of a weasel word is "everyday" browsing?

Tor has way more latency. It's been a while since I measured bandwidth, but relatively high bandwidth transfers like videos are everyday browsing nowadays. I, for one, frequently use Youtube playlists as ad-hoc background music, for example.

I don't find Tor that slow. Unless you're talking watching videos or something.

That "unless" is a big (if not major) part of everyday Internet usage of a casual user, so your argument only supports parent post.

Hasn't been my recent experience. It's got rather a lot of relay capacity, actually, and has scaled better than I expected.

I2P is also a lot faster than when I last looked, even though i2pd isn't done.

Isn't non-HTTPS traffic susceptible to snooping in Tor?

VPN is insanely easy today. IMO Everyone should use it by default. Too bad it causes an additional load on the internet for the encrypted tunnel traffic.

Another option is a blanket law about internet traffic that states no tracking can be made at all unless given express permission.

VPN is insanely easy today

How do I install a VPN on my SmartTV exactly? How do I make it actually work, even using VPN-on-a-router, given the importance CDNs have and how they use the location of your DNS resolver to attempt to give you nearest copies?

How do I explain to the hypothetical 68 yo grandmother why she has to disable the VPN to use (Australian geoblocked catch-up TV Service) iView and then reenable it to browse, but she won't be able to buy Kindle books when it is enabled unless she had it enabled when she first setup an Amazon account and her credit card also has a US address, and...

How is a user supposed to move the keys from their mobile device to their PC when most users can't even get photos off their phones.

Well since the connection is tunneled to the VPN server, the shortest hop in that topology will be the IP of the VPN server anyway for the CDN.

And you would locate the VPN server inside the same country, unless those services are blocking by ISP or similar.

Why are you even letting your SmartTV connect to the internet at all? Those things are horribly insecure and just spy on you anyway.

Convenience vs. security. It's incredibly convenient to be able to stream Netflix on a TV without having to purchase some other device, use multiple remotes, etc. I would say privacy-conscious consumers are likely the minority. I'd imagine most consumers would rather be able to watch movies with the push of a button than worry about the implications of letting their TV connect to the Internet.

Your grandmother being older and wiser than you, she would stop caring about the user-hostile businesses you mention. Being able to circumvent anti-privacy measures is a good skill to have, but actually doing it is ultimately less useful than quitting.

The recent European cookie law was close to that and got laughed at by tech people. Poor Europeans are constantly being asked for permission "Can we store a cookie on your computer?" whenever they visit a major website.

Also, how do you stop people tracking you by IP? Every web server's log does this by default. How do you allow sessions even? It's not easy to define tracking so it's different from essential operation.

> Poor Europeans are constantly being asked for permission "Can we store a cookie on your computer?" whenever they visit a major website.

As a non-European who visits the BBC, my impression is that it's even less useful than that (you can get that kind of annoying prompt just by setting cookie permissions on your browser to 'always ask'!). Instead of a prompt, you get an intrusive notice that they are setting cookies, and that your remedy if you don't want them to do it is to go away.

True, but an enterprising individual could write an extension to cause non-Verizon users to start feeding fake unique identifiers into their own streams. Heck, you may even be able to hijack a website login using it.

something like this? https://github.com/lightswitch05/Bogus_X-UIDH

Exactly. But instead of using it to try to change your UIDH within Verizon, it should encourage non-Verizon customers to just pollute the space with random UIDH values from all over the place.

And (as I previously noted) all Verizon has to do is *check the IP address of the client(!). They know the IPs they own.

Assuming that your adversary is dumb as well as malicious is a mistake.

True, but this header is presented to all sites visited. This wouldn't pollute Verizon's tracking (they could do this without the header). This may instead pollute the third parties which are taking advantage.

> True, but an enterprising individual could write an extension to cause non-Verizon users to start feeding fake unique identifiers into their own streams.

nl (https://news.ycombinator.com/item?id=8890677) addressed this:

> If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets.

If you are using a VPN that proxies your request, couldn't you hide from this tracking?

> If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets.

The question is if they already do this, or will become aware of it and start in in a short period of time.

Regarding regulation, if, as the EFF suggests may be the case, Turn is causing the companies they do business with to violate their stated privacy policies, it would seem that the FTC could take enforcement action without new regulation being needed. An indirect way of kicking in Turn's teeth, but perhaps one that would work.

Step 1: Site operators install backend library to detect uid cookies and send them via API to a central database

Step 2: Privacy-minded activists install a browser extension that reads the uids from central database and spoofs HTTP headers with them. Extension could even cycle through uids on a daily basis to cause more mayhem.

Result: with just a few big sites running this, a few thousand people with the extension could irreparably corrupt the uid header's "uniqueness" and it could no longer be relied upon to respawn a lost cookie session. Because Turn wouldn't know whether it's a real mobile Verizon user, or a jackass with an extension.

Shameless plug: I've already written a browser extension http://flagger.io that spoofs HTTP headers in Chrome and Firefox. Would be easy to add this functionality if people can help on the backend side (writing libraries for node/python/ruby/php/etc.)

Step 3: Turn ignores UIDH headers originating from non-Verizon IPs and Verizon replaces any user-generated UIDH header.

Your solution is not going to fool anyone.

Reading through the original report, I'd doesn't seem that Turn's handling of the header is very sophisticated, in fact they just dumbly accept whatever header you give them.

(Interestingly unless they take extra precautions, this exposes them to a CSP sandboxing vulnerability)

Turn needs to handle these headers basically in realtime, and while I'm not saying it would be impossible to do IP filtering on a header, it would be expensive.

If outsmarting them became a cat and mouse game and people stay ahead of them at any point, that would be good enough to make third party companies that rely on Turn's zombie cookies to lose confidence. Unless turn publishes more info about how they circumvent the circumvention, and this would implicate them further politically and legally.

What they are doing is immoral and probably illegal.

IP filtering compared to checking a HTTP header is trivial - it isn't going to be expensive.

There's no cat and mouse. IP filtering is trivial. Say Verizon has 50M IPs, and let's pretend each is a /22. That's 50K * 22-bit entries, but we'll be inefficient and round to 4 bytes. That's a 200KB lookup table. BFD, and that's an inefficient estimate.

HTTP is a terrible text-based format that's very inefficient to parse. The overheard of another IP lookup per request is negligible.

Your heart's in the right place, but your technical proposal simply doesn't accomplish anything.

And, if you could get traction on people installing plugins or whatever, you could just get them to install adblock.

Hmm... garbage doesn't work beause they override the UIDH as a MitM. So maybe this fact could be exploited in the opposite direction:

Start using the X-UIDH: header for some prominent but non-mission-critical feature in a format that is obviously not related to this tracking number. When Verizon rewrites the header, that feature breaks, and you can make a fuss about it in the media or sue Verizon for breaking your webpage.

(it sounds good on paper; this may not work in practice)

> 1) Regulation. Maybe it'll happen, I don't have much hope of it being done intelligently

Why so hopeless? My water is clean, airplanes and roads are safe, retail banks don't lose their customer's savings, etc. Not all regulation works, but this one is pretty straightforward.

> Why so hopeless?

Because the current US political climate is not in favour of regulations. It is true that we have all the regulations you describe, but each was fought tooth and nail when introduced!

EDIT: Original post had slightly more pointed political language.

verizon overrides; I'm not a web engineer but (I think) ssl protects tcp headers. if so, it's probably the only technical solution is either ssl everywhere or an ssl proxy run by users

I interpreted the suggestion as for those not using Verizon to inject fake UIDH. Of course, this could be filtered by making sure the traffic is actually coming from Verizon's networks...

or 3) Contact some of Turn's biggest clients and shame them publicly.

This is fantastic and I'd install it in a heartbeat

Reply on news.ycombinator.com