Hacker News Reader

Comment by nl | Hacker News Reader

You can't feed them garbage.

Verizon operates at the network layer - if you are on their network presumably they will copy the real value over your garbage value.

If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets.

There are a couple of other solutions you haven't mentions:

VPNs: Annoying and currently too hard for most people. Perhaps it is time for device (PC and mobile) manufactures to consider offering VPNs integrated with their devices.

Competition: If the US had a more competitive broadband market then people could choose other providers.

Legal action: If Verizon was sued and lost over this then it could have a cautionary effect. However, the loss would have to be huge for it to have an impact, and large financial settlements generally require proof of significant harm. That's going to be hard in this case.

View on HN

True, but an enterprising individual could write an extension to cause non-Verizon users to start feeding fake unique identifiers into their own streams. Heck, you may even be able to hijack a website login using it.

something like this? https://github.com/lightswitch05/Bogus_X-UIDH

Exactly. But instead of using it to try to change your UIDH within Verizon, it should encourage non-Verizon customers to just pollute the space with random UIDH values from all over the place.

And (as I previously noted) all Verizon has to do is *check the IP address of the client(!). They know the IPs they own.

Assuming that your adversary is dumb as well as malicious is a mistake.

True, but this header is presented to all sites visited. This wouldn't pollute Verizon's tracking (they could do this without the header). This may instead pollute the third parties which are taking advantage.

> True, but an enterprising individual could write an extension to cause non-Verizon users to start feeding fake unique identifiers into their own streams.

nl (https://news.ycombinator.com/item?id=8890677) addressed this:

> If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets.

Tor is free and much easier than a VPN.

Tor Browser bundle on Win/Mac/Linux: https://www.torproject.org/download/download-easy.html.en

Orweb on Android: https://play.google.com/store/apps/details?id=info.guardianp...

OnionBrowser on iOS: https://itunes.apple.com/us/app/onion-browser/id519296448?mt...

Tor is so slow as to be unusable for everyday browsing.

Tor Browser is perfectly suitable for everyday browsing. When's the last time you used it for any significant period of time? It's plenty speedy and very stable.

Please, instead of bemoaning your complete lack of privacy online, do something about it for a change. Download Tor Browser right now.

Tor Browser bundle on Win/Mac/Linux: https://www.torproject.org/download/download-easy.html.en

Orweb on Android: https://play.google.com/store/apps/details?id=info.guardianp....

OnionBrowser on iOS: https://itunes.apple.com/us/app/onion-browser/id519296448?mt....

What kind of a weasel word is "everyday" browsing?

Tor has way more latency. It's been a while since I measured bandwidth, but relatively high bandwidth transfers like videos are everyday browsing nowadays. I, for one, frequently use Youtube playlists as ad-hoc background music, for example.

I don't find Tor that slow. Unless you're talking watching videos or something.

That "unless" is a big (if not major) part of everyday Internet usage of a casual user, so your argument only supports parent post.

Hasn't been my recent experience. It's got rather a lot of relay capacity, actually, and has scaled better than I expected.

I2P is also a lot faster than when I last looked, even though i2pd isn't done.

Isn't non-HTTPS traffic susceptible to snooping in Tor?

> If you aren't on their network then they can check IP address and ignore values not from the Verizon subnets.

The question is if they already do this, or will become aware of it and start in in a short period of time.

VPN is insanely easy today. IMO Everyone should use it by default. Too bad it causes an additional load on the internet for the encrypted tunnel traffic.

Another option is a blanket law about internet traffic that states no tracking can be made at all unless given express permission.

VPN is insanely easy today

How do I install a VPN on my SmartTV exactly? How do I make it actually work, even using VPN-on-a-router, given the importance CDNs have and how they use the location of your DNS resolver to attempt to give you nearest copies?

How do I explain to the hypothetical 68 yo grandmother why she has to disable the VPN to use (Australian geoblocked catch-up TV Service) iView and then reenable it to browse, but she won't be able to buy Kindle books when it is enabled unless she had it enabled when she first setup an Amazon account and her credit card also has a US address, and...

How is a user supposed to move the keys from their mobile device to their PC when most users can't even get photos off their phones.

Well since the connection is tunneled to the VPN server, the shortest hop in that topology will be the IP of the VPN server anyway for the CDN.

And you would locate the VPN server inside the same country, unless those services are blocking by ISP or similar.

Why are you even letting your SmartTV connect to the internet at all? Those things are horribly insecure and just spy on you anyway.

Convenience vs. security. It's incredibly convenient to be able to stream Netflix on a TV without having to purchase some other device, use multiple remotes, etc. I would say privacy-conscious consumers are likely the minority. I'd imagine most consumers would rather be able to watch movies with the push of a button than worry about the implications of letting their TV connect to the Internet.

Your grandmother being older and wiser than you, she would stop caring about the user-hostile businesses you mention. Being able to circumvent anti-privacy measures is a good skill to have, but actually doing it is ultimately less useful than quitting.

The recent European cookie law was close to that and got laughed at by tech people. Poor Europeans are constantly being asked for permission "Can we store a cookie on your computer?" whenever they visit a major website.

Also, how do you stop people tracking you by IP? Every web server's log does this by default. How do you allow sessions even? It's not easy to define tracking so it's different from essential operation.

> Poor Europeans are constantly being asked for permission "Can we store a cookie on your computer?" whenever they visit a major website.

As a non-European who visits the BBC, my impression is that it's even less useful than that (you can get that kind of annoying prompt just by setting cookie permissions on your browser to 'always ask'!). Instead of a prompt, you get an intrusive notice that they are setting cookies, and that your remedy if you don't want them to do it is to go away.

If you are using a VPN that proxies your request, couldn't you hide from this tracking?

Reply on news.ycombinator.com