Somebody’s Already Using Verizon’s ID to Track Users(propublica.org)
propublica.org
Somebody’s Already Using Verizon’s ID to Track Users
http://www.propublica.org/article/somebodys-already-using-verizons-id-to-track-users?hn
109 comments
That's disappointing. So in the end, Twitter is no better than Google or Facebook when it comes to user tracking.
We are the product, indeed.
We are the product, indeed.
I don't really blame twitter, they're just using information that is being sent to them. The carriers who add these headers are to blame.
But no one is making them use it. Furthermore, they could have warned people.
Of course you are. Are you paying for Twitter?
People are paying for Verizon, though.
That you're the product if you're not the customer does not imply that you're not the product if you are the customer. Companies sell personal data all the time, cause they can make extra money off their customer base.
No, but I am also not a Twitter user.
This is so wrong. An ISP is not meant to interject information into a client's request, build profiles of their subscribers, help "provide targeted content," or any such activity. Apparently ISPs are making so little money by providing services they were originally born to provide, they need to go and do totally unwanted activity like this. They're internet service providers, not customer profiling service providers.
It's clear that these companies do not have their customer's best interests at heart, though I'm not sure that they ever have.
It's clear that these companies do not have their customer's best interests at heart, though I'm not sure that they ever have.
Furthermore the notion that the addition of an HTTP header to the request would be a patentable invention is absurd. The protocol explicitly supports it. Nothing was invented here.
> They're internet service providers, not customer profiling service providers.
Google is a search engine and application provider, not a customer profiling service provider. Similar things could be said of Facebook, cable/satellite TV, automobiles, retail stores, government agencies. But all are focusing on collecting information and building profiles.
Google is a search engine and application provider, not a customer profiling service provider. Similar things could be said of Facebook, cable/satellite TV, automobiles, retail stores, government agencies. But all are focusing on collecting information and building profiles.
Textbook example of escalation. Start with relatively easy to remove cookies. Savvy people clear their caches, the criminals move to automatic localstorage weapons. The savvy people start wearing AdBlock armor and rejoice. The criminals move up to armor piercing injection bullets. The everyday mom and pop don't stand a chance. 1984, yeah right man, orwell is today.
www.runads.com is doing the same for their mobile advertising campaigns.
The ad-tech industry is targeting mobile advertising as the Next Big Thing, and they're right to do so. Anyone not tracking and optimizing ads toward the permacookie will be left behind.
The ad-tech industry is targeting mobile advertising as the Next Big Thing, and they're right to do so. Anyone not tracking and optimizing ads toward the permacookie will be left behind.
[deleted]
Has anyone done any research on how robust their MITMing HTTP handling is?
Will the ISPs overwrite this header if already present?
If so, isn't that a kind of huge problem?
If not, can't someone make a mobile browser that sets these headers to some random value?
If so, isn't that a kind of huge problem?
Make a web service that "coincidentally" uses the same header for something else, or add it as part of a new feature of an existing popular web service. Of course, it should have an app. Tell its users to complain to Verizon when the service breaks for them/the app doesn't work.
Make a web service that "coincidentally" uses the same header for something else, or add it as part of a new feature of an existing popular web service. Of course, it should have an app. Tell its users to complain to Verizon when the service breaks for them/the app doesn't work.
Yes, it will be overwritten. Someone tried it: https://github.com/lightswitch05/Bogus_X-UIDH#update-verizon...
What if it had a different case? Eg x-uidh:
I remember for a while the only way to change the User Agent header for iOS UIWebViews was to set the user agent header in lowercase, as long as it's after the actual header, PHP will uppercase both and the later one will win (for $_SERVER atleast, obviously this is PHP specific.)
I remember for a while the only way to change the User Agent header for iOS UIWebViews was to set the user agent header in lowercase, as long as it's after the actual header, PHP will uppercase both and the later one will win (for $_SERVER atleast, obviously this is PHP specific.)
Yes, the fun is to figure out what they're using and exploit it. HTTP is a terrible format to parse, with lots of idiotic extra features that have no legitimate usage. But it'd be fairly easy for them to harden things, just abort if they run into anything weird.
Which may be a way around this. Run a local proxy that does stuff like use line folding, comments in headers, and other things to make their parse code abort. Of course, you then run the risk of breaking compatibility with actual HTTP servers (with good reason-those are bad features and such messages are probably an attack). And of course the ISP can always fix their code.
Which may be a way around this. Run a local proxy that does stuff like use line folding, comments in headers, and other things to make their parse code abort. Of course, you then run the risk of breaking compatibility with actual HTTP servers (with good reason-those are bad features and such messages are probably an attack). And of course the ISP can always fix their code.
Apparently you check your mobile connection here: http://lessonslearned.org/sniff
ProPublica reporter/developer here.. There's a tool embedded in the article to see if your carrier is setting a tracking header.
We also published a follow-up about how AT&T has said they will stop using the header: http://www.propublica.org/article/att-stops-using-undeletabl...
We also published a follow-up about how AT&T has said they will stop using the header: http://www.propublica.org/article/att-stops-using-undeletabl...
My provider, TracFone, appears to be sending beacons. This is a low cost pay-as-you-go service that buys airtime from the big carriers. My particular phone uses the Verizon network.
Is there a way to opt out of this?
Is there a way to opt out of this?
When I've read the first part of the first sentence, "Twitter's mobile advertising arm enables its clients to use a hidden...", I've thought "I'm a client, but never heard of ... oh, nevermind.".
For what it's worth, this article is 2 weeks old and it seems Verizon may have either stopped this or is now respecting opt-outs. I'm curious if others are seeing this.
While I was definitely getting that header added to my outbound traffic two weeks ago, it is not happening to me now. I noticed that a day or two ago, and it still seems to be the case now.
While I was definitely getting that header added to my outbound traffic two weeks ago, it is not happening to me now. I noticed that a day or two ago, and it still seems to be the case now.
Nope, they haven't stopped. Reduced a bit, maybe. I'm seeing maybe 5-6% of our HTTP traffic with the X-UIDH header instead of 10% two weeks ago.
AT&T's x-acr header, though, seems to be gone, as others have reported. They were about 0.5% of our traffic.
AT&T's x-acr header, though, seems to be gone, as others have reported. They were about 0.5% of our traffic.
Sometimes the X-UIDH header goes away, but then returns a day or two later – so don't trust any one all-clear check as resolving the issue.
Just checked, I am still transmitting the X-Uidh header.
My phone is still sending this stalking header.
For what it's worth, I am no longer seeing the dox header in requests. Something has clearly changed without much fanfare.
Are you f..ing kidding me? If I pay for Internet access, I demand best-effort of the provider to transfer the data packets unmodified (except, for IPv4, NAT usage), shortest way, to the target IP address.
I do not pay and then want to get tracked so that the provider or some other dickheads can data-mine me and make even more money. If I want this, I can choose a free plan (e.g. unlimited 3G, but with tracking).
About time everyone switches over to HTTPS with HSTS (so that no provider can perform a SSL MITM attack using its own trusted certs).
I do not pay and then want to get tracked so that the provider or some other dickheads can data-mine me and make even more money. If I want this, I can choose a free plan (e.g. unlimited 3G, but with tracking).
About time everyone switches over to HTTPS with HSTS (so that no provider can perform a SSL MITM attack using its own trusted certs).
I continue to be baffled at this. It seems like we are just all ok with a communications provider manipulating data?
I was expecting the feds to bust their doors in. This is US Postal opening every package and rewrapping it to insert advertisements.
I was expecting the feds to bust their doors in. This is US Postal opening every package and rewrapping it to insert advertisements.
> This is US Postal opening every package and rewrapping it to insert advertisements.
No, because ISPs aren't common carriers. It's a pretty common political position (among those who care) that ISPs should be common carriers.
No, because ISPs aren't common carriers. It's a pretty common political position (among those who care) that ISPs should be common carriers.
Frankly, I'm glad that Verizon is doing this, as it weakens their ability to argue that Title II net neutrality isn't necessary because no one is currently messing with traffic. Even better that they're doing it with their wireless network, since, as I understand it, they were given a bit more rope with which to hang themselves in the wireless ISP space.
excellent point.
Right. You know why people so want carriers to be regulated under Title II instead of the 'hybrid' approach?
Because Title II would put an end to all this shit.
Because Title II would put an end to all this shit.
That's exactly the problem. Having worked in telecom/voip space, it always baffled me how an ISP isn't a common carrier.
The common carrier designation solves an entire slew of problems that were previously experienced with other technologies as well. It addresses privacy, liability for what you are delivering, etc.
The common carrier designation solves an entire slew of problems that were previously experienced with other technologies as well. It addresses privacy, liability for what you are delivering, etc.
To hear the Cisco CEO tell it, placing the ISPs under Title II will take us back to 1950's voice and undermine innovation.
>liability for what you are delivering
While I fear further regulation may introduce unforeseen consequences or inhibit innovation, I also fear doing nothing is proving to have problems as well. Regulations need to be written by people with the knowledge to be very precise about how things are done; we don't want mandatory ISP deep packet inspection (I already get letters from my cable company about HBO torrents that I download).
>liability for what you are delivering
While I fear further regulation may introduce unforeseen consequences or inhibit innovation, I also fear doing nothing is proving to have problems as well. Regulations need to be written by people with the knowledge to be very precise about how things are done; we don't want mandatory ISP deep packet inspection (I already get letters from my cable company about HBO torrents that I download).
Not sure that's accurate. From something posted on Cisco's website: "Apart from payment for the service, the carrier is absolved from liability regarding the content of the messages, and from the actions of the customers of the service. This form of social contract is the basis for the status of a common carrier."
http://www.cisco.com/web/about/ac123/ac147/archived_issues/i...
Effectively, common carriers are protected from liability unless they know that what they carry is not legal.
http://www.cisco.com/web/about/ac123/ac147/archived_issues/i...
Effectively, common carriers are protected from liability unless they know that what they carry is not legal.
<comment class="devils-advocate">
Actually, no. First, there is some legit content on TPB. Secondly, however (and more importantly, in this context), for an ISP to block content in one illegal case implies (in a legal sense, rather than a technical one) the ability to block it in all such cases, which then exposes them to liability for the illegal content they didn't block.
Effectively, the only sustainable way to maintain common carrier status is to maintain a deliberate ignorance of the legality — or lack thereof — of any traffic they might carry.
Effectively, the only sustainable way to maintain common carrier status is to maintain a deliberate ignorance of the legality — or lack thereof — of any traffic they might carry.
Sadly the USPS stuffs your mailbox with advertisements now too. There is no opt out and they've actively discontinued working with third party services that would filter your mail for you.
By mail volume the USPS is basically a government subsidized advertising delivery service these days.
By mail volume the USPS is basically a government subsidized advertising delivery service these days.
"stuffing mailbox with ads" is not in the same league as "opening packages destined to you and inserting ads"
Doesn't the advertising subsidize the rest of the business? And as I recall they receive no government money.
It doesn't subsidize it, such data "products" are a new revenue source for the ISPs. While I don't think it's wrong for them to want to make more money, it is wrong to alter a paid service and go directly against the best interests of their customers.
Er, we're talking about the postal service.
My bad, in this case I agree somewhat. Though it helps fund USPS, I'd rather see USPS be a true public service and be funded by taxes and not funky arrangements with spammers.
or, they should be funded by charging the customers of their service with a price that is profitable.
I can see that. I don't have much of an opinion on the ideal arrangement for USPS myself, although I do think it works fairly well at the moment and maybe we should leave well enough alone in that case. But really I just wanted to set the record straight in terms of what's actually subsidizing what.
I'm not okay with it, but still use Verizon for broadband. I basically have no other choice.
This is why, despite being a big fan of NN, I wonder if it's going to be enough. We need more competition in markets, so when ISPs do chickenfuckery such as this, we can all vote with our feet.
This is why, despite being a big fan of NN, I wonder if it's going to be enough. We need more competition in markets, so when ISPs do chickenfuckery such as this, we can all vote with our feet.
Yep it's time to just stop using plain HTTP. Unfortunately I think that the number of people who care enough about this to suffer the pain are not enough to change ISP behavior.
The people who care enough will begin to use VPNs anyway. A pity that enabling VPN on mobile equals massive battery drain :'(
And breaks custom HOSTS configurations.
Nobody has agreed to send your traffic the 'shortest way' to the target IP address (despite your demand). They routinely send it whichever way is cheapest for themselves, which leads to hot-potato routing among other things.
Does IE even support HSTS?
It's planned for IE 12.
https://status.modern.ie/httpstricttransportsecurityhsts?ter...
https://status.modern.ie/httpstricttransportsecurityhsts?ter...
I wonder in how many states doing this is an illegal form of tampering with electronic communications. It seems to me interfering with communications would be illegal unless it is necessary for network operations, which advertising trackers obviously are not.
I still don't understand why I appear to be the only Verizon customer on the Internet that doesn't have this header injected. There is nothing special about my account (other than its age, perhaps, I have only been a Verizon customer since the iPhone 6 release,) but it just doesn't show up for me.
Which site are you using to test?
Are you sure you're not using any proxies, VPNs, or local wifi?
I have seen the header disappear for a brief period, only to return a day later. I've seen another user reporting that the header disappeared after they used all web-based opt-outs, and complained by phone... but then reappeared after traveling to a different region.
So there does appear to be some volatility and inconsistency in what Verizon is doing. Also, reportedly, government and some business accounts may be immune.
So keep checking, especially after travel: even if you haven't seen it so far, you might someday.
Are you sure you're not using any proxies, VPNs, or local wifi?
I have seen the header disappear for a brief period, only to return a day later. I've seen another user reporting that the header disappeared after they used all web-based opt-outs, and complained by phone... but then reappeared after traveling to a different region.
So there does appear to be some volatility and inconsistency in what Verizon is doing. Also, reportedly, government and some business accounts may be immune.
So keep checking, especially after travel: even if you haven't seen it so far, you might someday.
Are you connected over Wi-Fi instead of Verizon's wireless network?
Update: I turned off Wi-Fi and still didn't find the header. I wonder if business vs personal accounts makes a difference? I'm on a shared business plan.
Update: Perhaps they are identifying identification sites and not tacking it on in those cases? Quite a stretch and tin foil hatish.
Update: Or perhaps someone else on the shared plan already opted out.
Update: I turned off Wi-Fi and still didn't find the header. I wonder if business vs personal accounts makes a difference? I'm on a shared business plan.
Update: Perhaps they are identifying identification sites and not tacking it on in those cases? Quite a stretch and tin foil hatish.
Update: Or perhaps someone else on the shared plan already opted out.
FWIW, I'm an old Verizon customer (had a grandfathered unlimited plan until about half a year ago), and I also don't see it. Galaxy S4.
Edit: apparently this is old and they may have stopped for the moment?
Edit: apparently this is old and they may have stopped for the moment?
I'm not seeing it either. I have a new 2GB data plan through Verizon with a rooted Galaxy S4 and every "test" site I visit doesn't show it. I'm not on WiFi.
Dumb question, but are you actually using the cellular network while you test it, and not accidentally using some associated wifi network?
Did you enable Do Not Track in your browser settings?
Amusingly, yes, but other people reported doing the same and still seeing the header be sent.
> Google has proposed a new Internet protocol called SPDY that would prevent these types of header injections – much to the dismay of many telecom companies who are lobbying against it
Wow, I was pretty ambivalent about SPDY/HTTP2 before but now I really hope it catches on.
Wow, I was pretty ambivalent about SPDY/HTTP2 before but now I really hope it catches on.
Actually a binary format (designed to be machine-friendly) is better for MITM injections as it's easier to parse and manipulate... the only benefit of HTTP2/SPDY is that iirc it requires TLS.
I'm waiting for the first carrier to perform SSL MITM.
I'm waiting for the first carrier to perform SSL MITM.
They're already planning it: "Involve the user: Obtain user consent to trust service provider to decrypt select HTTPS"
Quote from someone working for a satellite internet provider for airlines.
Source: http://www.atis.org/openweballiance/docs/OWAKickoffSlides051... page 27
Quote from someone working for a satellite internet provider for airlines.
Source: http://www.atis.org/openweballiance/docs/OWAKickoffSlides051... page 27
As bad as it is, at the least it should be easy to opt-out of that (unless they do something ridiculous like charge you extra if you refuse to opt-in). Just remove the certificate your ISP gives you.
> I'm waiting for the first carrier to perform SSL MITM.
Nokia, funnily enough, did this on certain dumbphone models. Not a carrier, I know, but still interesting.
http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/
Nokia, funnily enough, did this on certain dumbphone models. Not a carrier, I know, but still interesting.
http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/
> the only benefit of HTTP2/SPDY is that iirc it requires TLS.
Yeah...except the NSA-agent-hiring IETF [1] gave up on that at the last minute.
http://arstechnica.com/security/2014/01/nsa-employee-will-co...
Yeah...except the NSA-agent-hiring IETF [1] gave up on that at the last minute.
http://arstechnica.com/security/2014/01/nsa-employee-will-co...
HTTP2 doesn't require encryption but it does compress the headers. I'm guessing compression makes it too CPU-intensive for telecoms to manipulate the headers on the fly.
I wish they'd require encryption. Perhaps make http:// be TLS but without certificate verification.
This is in progress. HTTP 2.0 does exactly what you specify. The tcpinc working group at the IETF is also looking at adding this at a lower level for all TCP connections.
Uh, they removed the TLS requirement.
[deleted]
Then the telecoms would MITM it anyways.
Certificate pinning and web-of-trust verification would make that difficult to maintain for long.
It's unlikely they'll ever get mass usage because both are uncomfortable to work with.
If a certificate is compromised, changing it means all pinned clients will get a huge warning. Either the user ignores the warning (in which case pinning is useless) or he doesn't and the site is harmed. Keeping a compromised certificate is even worse.
For WoT you first need a web of trusted individuals.
Unfortunately key distribution over insecure channels is still an unsolved problem.
If a certificate is compromised, changing it means all pinned clients will get a huge warning. Either the user ignores the warning (in which case pinning is useless) or he doesn't and the site is harmed. Keeping a compromised certificate is even worse.
For WoT you first need a web of trusted individuals.
Unfortunately key distribution over insecure channels is still an unsolved problem.
[deleted]
telecom companies are actually lobbying against spdy?
This is the anti-SPDY lobbying alliance, http://www.atis.org/openweballiance/index.asp
They seem to be deathly afraid of becoming "dumb pipes".
They seem to be deathly afraid of becoming "dumb pipes".
Holding back innovation just because it would wipe out their business.
This, my dear friends, is why ISPs need to become regulated, government-owned utilites. Or has anyone seen regulators preventing experiments on self-driving cars and trains in order to keep train conductor's jobs?
This, my dear friends, is why ISPs need to become regulated, government-owned utilites. Or has anyone seen regulators preventing experiments on self-driving cars and trains in order to keep train conductor's jobs?
> Or has anyone seen regulators preventing experiments on self-driving cars and trains in order to keep train conductor's jobs?
Yes? Isn't that the crux of the Uber and AirBnB and Aereo battles?
Yes? Isn't that the crux of the Uber and AirBnB and Aereo battles?
Yet, these laws you mention actually make sense (at least those Uber and Airbnb "fight" against).
Taxi regulations exist to prevent Uber's "surge pricing" model, thereby guaranteeing the customer the same price for the same distance, no matter how late at night it is or how drunk the customer is (at least in Germany; the taxi market as a whole seems to be broken in the US so that's another story).
Hotel regulations exist to protect other tenants in a building from the kind of bullshit which has happened multiple times: ever-changing, drunk tenants demolishing stuff, being loud, throwing sex parties, etc.
The only law area being "disrupted" where the existing regulations don't protect any legitimate interests aside from MAFIAA's Big Money is the TV distribution, and I'm sad that Aereo got problems there. But well, that's the area of Big Money, no chance to compete there :(
Taxi regulations exist to prevent Uber's "surge pricing" model, thereby guaranteeing the customer the same price for the same distance, no matter how late at night it is or how drunk the customer is (at least in Germany; the taxi market as a whole seems to be broken in the US so that's another story).
Hotel regulations exist to protect other tenants in a building from the kind of bullshit which has happened multiple times: ever-changing, drunk tenants demolishing stuff, being loud, throwing sex parties, etc.
The only law area being "disrupted" where the existing regulations don't protect any legitimate interests aside from MAFIAA's Big Money is the TV distribution, and I'm sad that Aereo got problems there. But well, that's the area of Big Money, no chance to compete there :(
A solution to this is to setup openvpn on a VM someplace and route all your phone's data traffic through that. I've done this using the Fedora open vpn guide (https://fedoraproject.org/wiki/Openvpn). To get it working on the iPhone I also had to add this to the server config:
push "redirect-gateway" push "dhcp-option DNS 8.8.8.8"
push "redirect-gateway" push "dhcp-option DNS 8.8.8.8"
The problem with doing this is that now all your web traffic is associated with the IP of the VM, which is presumably even easier to track back to you.
You'd have to do something exceedingly clever like have the VM automatically route VPN traffic into Tor.
You'd have to do something exceedingly clever like have the VM automatically route VPN traffic into Tor.
Well, it depends on your goal. In this case it is to avoid Verizon adding stuff to my http traffic.
Another argument for Net Neutrality. Just pass the data through please.
Verizon has been pushing their "Smart Rewards" program on me for months (http://www.verizonwireless.com/wcms/myverizon/smart-rewards....). After reading the fine print, you are actually consenting to monitoring of all traffic through your account that will be shared to third parties. I respect the fact they have some sort of opt in that has some return... Inho they are swindling the typical oblivious consumer trolling for a free Jamba Juice gift card
It's a little amusing and rather sad that the word "smart" now seems to be used to describe products and services that act against their users and often perform surveillance on them, implying that it's somehow a "smart" thing to let this happen.
It appears that there is a huge business opportunity for someone to find a way to defeat this type of tracking. Of course, it would probably need to be a subscription type of service, which bodes well for steady recurring revenue.
Just add some mobile-specific marketing to a VPN service.
"took steps to secure these Device IDs, and began allowing their users to delete them, in the same way they could delete cookies in their desktop Web browser."
That's a joke. Android's permission model encourages users to freely give out their device serial number. The permission to read device ID is hidden behind the permission that allows an app to determine if you're on a call. A totally innocuous permission (which should not be a permission) smuggles in a very intrusive one.
Oh, and for a kicker, device ID permission also gives apps access to the number of who you call or calls you. So even security conscious users that check permissions can easily get tricked. "Sure, I want this flashlight app to turn off if I get a call so I don't blind myself trying to answer" - bam, you just gave away your permanent ID and call logs.
This could be a negligent incompetent mistake on Google's part, but it seems unlikely because it's so nonsensical and they've done nothing to rectify it in years.
That's a joke. Android's permission model encourages users to freely give out their device serial number. The permission to read device ID is hidden behind the permission that allows an app to determine if you're on a call. A totally innocuous permission (which should not be a permission) smuggles in a very intrusive one.
Oh, and for a kicker, device ID permission also gives apps access to the number of who you call or calls you. So even security conscious users that check permissions can easily get tricked. "Sure, I want this flashlight app to turn off if I get a call so I don't blind myself trying to answer" - bam, you just gave away your permanent ID and call logs.
This could be a negligent incompetent mistake on Google's part, but it seems unlikely because it's so nonsensical and they've done nothing to rectify it in years.
I'm also starting to believe that Android's extremely vague permissions are not that vague because of their engineers' incompetence, but because it was done this way on purpose.
Google promised at I/O that a permission system with more fine-grain control would come in Lollipop, but it's still nowhere to be seen.
Google promised at I/O that a permission system with more fine-grain control would come in Lollipop, but it's still nowhere to be seen.
Agree with this, especially after their fine-grain control App Ops, which received a very positive response, was completely removed, and the reason they gave for doing so quite nonsensical: "it can break apps" - obviously, that's why people want to use it - to prevent apps from "breaking" their personal privacy.
(My Android's ID/serial number is 0123456789ABCDEF, the same as tens of millions others out there, so I'm not so worried about it. One of the perks of owning an unbranded generic Chinese device, along with a new random MAC address whenever I reset the WiFi...)
(My Android's ID/serial number is 0123456789ABCDEF, the same as tens of millions others out there, so I'm not so worried about it. One of the perks of owning an unbranded generic Chinese device, along with a new random MAC address whenever I reset the WiFi...)
It's unlikely your IMEI is non unique though.
I suppose...but couldn't they just track you by IP address anyway?
Currently they inject the header with an ID which changes e.g. daily and charge third parties to associate the ID with a profile. They can only inject in HTTP.
If instead the third party (e.g. an adserver) contacts a Verizon server with the IP (and port number in case of carrier grade NAT) on every request and that server gives back the profile and Verizon charges the adserver for this, then nobody would ever know and there would be not much protection against it (without a third party proxy or vpn to hide the IP).