Follow Slashdot blog updates by subscribing to our blog RSS feed


Forgot your password?
Privacy Your Rights Online

Hotel Connectivity Provider SuperClick Tracks You 175 writes "During my last hotel stay, I thought it was a pretty strange that it took two browser re-directs before the hotel's Wi-Fi would show me the web page I browsed to. Picasa developer Michael Herf noticed the same the thing and dug a little deeper. He discovered: '...their page does some tracking of each new page you visit in your browser, outside what a normal proxy (which would have access to all your cookies and other information it shouldn't have, anyway) would do. This "adlog" hit appears to also track a "hotel ID" and some other data that identifies you more directly. Notably, I've observed these guys tracking HTTPS URLs, and of course you can't track those through a proxy.' Herf notes the Internet service provider, SuperClick, advertises that it 'allows hoteliers and conference center managers to leverage the investment they have made in their IP infrastructure to create advertising revenue, deliver targeted marketing and brand messages to guests and users on their network...'" Herf was on his honeymoon when he did this sleuthing. Now that's dedication.
This discussion has been archived. No new comments can be posted.

Hotel Connectivity Provider SuperClick Tracks You

Comments Filter:
  • by Gothmolly ( 148874 ) on Thursday January 11, 2007 @09:35AM (#17555316)
    But it involved chocolate sauce, melted wax, and soft restraints. What is this 'Herf' person thinking, signing onto his laptop while on honeymoon? Go get laid you nerd!
  • Well, I was going to make a snide remark about how they spent their honeymoon, but I really like Picasa, so I refrained.

    However, I remember this happening the last time I stayed in a hotel (a Hilton Garden). At least I kept getting redirected. I am more than a little miffed that hotels are charging me *and* spying on me.

    Next time I will use the VPN.
  • A true nerd would consummate his marriage while surfing on the internet and maybe writing some code while he was at it.
  • by tgd ( 2822 ) on Thursday January 11, 2007 @09:39AM (#17555364)
    If you've got the resources to run an SSH server at home, use Putty with a dynamic proxy and point your browser and IM clients to it via SOCKS5.

    I wouldn't trust any network like that... even if the service itself isn't watching what you're doing, do you trust the other people on that network aren't?

    Its easy to surf or do other network apps safely on questionable networks. At least among the Slashdot crowd its easy... but I've educated even my parents on doing that when using public or hotel internet and gave them an SSH account to use at my house.
    • OpenVPN (Score:5, Informative)

      by Shawn is an Asshole ( 845769 ) on Thursday January 11, 2007 @10:15AM (#17555822)
      Or just use OpenVPN. I use this on my laptop. Set it as the default route, use the internal DNS and your good to go. I also use an internal proxy server. So when I'm at a coffee shop or hotel doing some work, the only thing they get to see is encrypted traffic to port 1194 (udp).

      Over that connection I can do anything. Instant messaging, email, SSH, http, ftp, BitTorrent, etc.
      • Shawn anyway you can show me this?

        You can reply to this comment or email me. I'm running OS X...Thanks!
      • Re: (Score:3, Informative)

        Unfortunately, an SSH connection is much more likely to be allowed out than VPN traffic.
        • OpenVPN uses SSL (Score:5, Informative)

          by SIGBUS ( 8236 ) on Thursday January 11, 2007 @12:11PM (#17557350) Homepage
          Note that OpenVPN can be set up to use a TCP connection instead of a UDP connection, and it uses SSL. No need for weird things like GRE that might not make it through.

          You could always put OpenVPN on a port other than 1194 if you think you might run into port blocking, too.
          • Re: (Score:3, Interesting)

            by josecanuc ( 91 ) *
            On a related note: Does anyone know of any off-the-shelf router/NAT device that supports OpenVPN tunnels?

            My company does 4-5 day jobs at convention centers, etc. and we currently use IPSEC with an off-the-shelf "VPN Router" product to tunnel back to our office network for access to fileshares and database data. Often, it is difficult and/or expensive to get hotel and convention center folks to give us a public IP address and they won't do port forwarding, etc.

            I would love to have a box I can set up that wil
      • by jp10558 ( 748604 )
        Or for the non-techies, Hamachi + internetsharing of choice.
    • by Anonymous Coward
      Dynamic Proxy with OpenSSH:

      ssh -C -D NNNN @

      where NNNN is a port on the local machine. Just setup your network applications to using localhost:NNNN as a socks5 Proxy.
      If you are paranoid, make sure DNS lookups are done via the proxy too.

      To do that in Firefox. go to about:config in the location bar and make sure that this is set

      network.proxy.socks_remote_dns = true
      • by tgd ( 2822 )
        I wish I could mod that up, but since you replied to me, I can't.

        I didn't know about that setting, and thats excellent information. Hope others mod you up.
    • That's my solution as well. I've looked into OpenVPN, but it looks quite complicated to set up in comparison. Of course most browsers do not route their DNS queries through SOCKS despite the fact that SOCKS5 can do that. So the hotel's DNS server can still get an idea of where you're going.

    • Just wondering here, wouldn't you also need to run Privoxy or something similar (an HTTP proxy) on the remote server?

      My thought would be that you'd need to have a remote server (say at home, on your broadband connection), hopefully with a dyndns name, running sshd and Privoxy. Then from your laptop, you'd establish an SSH tunnel that would go from port 80 on the local machine, over the SSH pipe, and exit into Privoxy's input port on the server. Then it would go through Privoxy, to the web, and return the sa
      • by tgd ( 2822 )
        The latest versions of Putty can provide SOCKS5 automatically -- no need to install anything else. You set up a dynamic port forward on, say, port 12345, and then use that port as your SOCKS5 server. It dyanamically sets up the port forwards for you.
  • by Silver Sloth ( 770927 ) on Thursday January 11, 2007 @09:40AM (#17555372)
    that nowadays all his actions are watched and recorded. I live in the UK, which, I believe, has the highest ratio of CCTV cameras per head of population in the world. To me it's no surprise that when I log in at the Marriot I'm watched. Fortunately the first thing I do is establish a VPN tunnel to my company's network where I'm being watched by the CIO.

    Further than that, welcome to the modern world, cue the cliches (1984, quis custodiet, ...)
    • by Billosaur ( 927319 ) * <(wgrother) (at) (> on Thursday January 11, 2007 @10:01AM (#17555622) Journal

      Face it, your ISP is even watching you, noting your bandwidth usage, logging where you go, reading your email to make sure it's not spam, etc. The fact is, any transaction that occurs on the Internet is being logged on a server somewhere, and someone has access to that information. If you're lucky, it's just a sysadmin making sure you don't go over some quota, but you have no way of truly knowing. A true paranoic wouldn't use the Internet at all.

      • Re: (Score:2, Funny)

        by somersault ( 912633 )

        A true paranoic wouldn't use the Internet at all.

        Why not, if they're not doing anything illegal, or immoral?
        • by BVis ( 267028 ) on Thursday January 11, 2007 @10:39AM (#17556100)
          Because some of us still care about our privacy; we also think "If you're not doing anything wrong, what do you have to worry about" is just about the most offensive thing we could think of.

          I just don't think it's anyone's business what books I'm buying, or what threads I'm posting to, or if I look up some rash on WebMD, or talk to my wife on IRC, etc etc. I'm not about to give up my privacy for some corporate bullet point about "leveraging marketing assets." They want that info, they can bloody well ask me.
          • I just don't get why its so offensive, and what I perceive to be the whole american "I'd rather die than lose my 'freedom'" type attitude. Especially considering the way the american government is acting with things like the Patriot Act, etc, americans seem to be less free than the rest of the western world.

            You're obviously right though that corporations don't deserve to see into your private life and conversations just so that they can target marketing towards you (though I'd prefer to have marketing I
            • Re: (Score:3, Insightful)

              by drinkypoo ( 153816 )

              Again, obviously the government has the ability to go too far, for example with things like the Patriot Act, but personally I would prefer them to have some power, as long as they use it responsibly and for its intended purposes, rather than abusing public trust.

              So, what color is the sky on your planet?

              This is the very reason why government should have only the power which it actually requires. It doesn't really matter whether power corrupts, or simply attracts the corrupt, or even the corruptible; t

              • Exactly, the power it requires, which comes under 'some power'. You agree that there should be a government, and it's pointless even having it if it has no power. It needs to be able to enforce the law which it creates somehow, and I think it should actually be taking an active role in stopping problems like spam as well. I liked how recently it was getting involved in the security of Windows, and I don't even have to be bothered about it using tax payers' money since I don't live in the US anyway, hehe.
                • I liked how recently it was getting involved in the security of Windows

                  I think this is utterly unacceptable, actually. I think it would be better for the government to simply refuse to use windows until it is secure. First the DOJ drops their case against Microsoft, now my tax dollars are spent on Windows QA? That is fucking ridiculous. I only wish I had a weapons satellite in orbit so I could destroy every Microsoft facility, one at a time, while cackling with glee. With my luck though, the government

            • I just don't get why its so offensive, and what I perceive to be the whole american "I'd rather die than lose my 'freedom'" type attitude.

              Let me put this in other, equally as American, terms. These companies are spying on me and profiting from the data they gather on me. I am not receiving any compensation for my private information. THAT is a big problem for me. If they want to negotiate a price to pay me and I get to choose what they can and cannot have access to that would be one thing, but this is

            • Re: (Score:3, Insightful)

              by karmatic ( 776420 )
              You ask - "if you're not doing anything wrong, what do you have to hide?". I ask, "if I'm not doing anything wrong, why do you feel the need to spy on me?".

              Avoiding the obvious issues with international law, having your activities spied upon tends to change what you do. In some cases, this is a good thing (less crime) - in some cases, it's not.

              Consider someone who is aware of wrongdoing by their company/politician/etc. With the (relative) anonymity of the internet, that person can go online and expose th
            • If I'm not doing anything wrong, why do you need to look!?
          • Re: (Score:3, Insightful)

            I just don't think it's anyone's business
            The problem is that it is exactly that - business! While you have money to spend someone will *always* be looking at what you're doing, and trying to convince you to give them some of that luvverly moneys.

        • so, you are saying that, if you legaly buy an copy of "King Kong" from amazon it does not matter that the mafia were monitoring all the SSL data and decoding it through a bot net ?
          "King Kong", "amazon" and "Mafia" are freely replacable terms.
          • I didn't say it doesn't matter. Though the benefits of using the net tend to outweigh the risks of something like that happening. And if it did happen, you just cancel your card. If your card has suddenly been used to buy a car in Russia or whatever then I don't think you'll have too much bother convincing the credit card company that the transaction should be cancelled, though I'm not sure what the legal comeback would be for a direct debit card (which is my preferred means of online shopping).
            • "Though the benefits of using the net tend to outweigh the risks of something like that happening."
              Not if you are the one it happens to.

              "I'm not sure what the legal comeback would be for a direct debit card"
              You get your money back, like a regular credit card, but it may take some time. Happened to a friend of mine - had his bank account drained and it took about 3-4 weeks to get everything straigtened out and get his money back. Sucked for him - living for about a month with zero money in the bank...
        • by jafiwam ( 310805 )
          And the converse:

          "I am not doing anything wrong, so you have no business watching me."

          Leading up to one logical fallacy pile of useless poop. (Both directions.)
  • ...which is why I only get online using my corporate VPN, and never visited any sites that required a login (banking, blog, yadda yadda).

    Of course that's assuming the VPN is secure enough...i'm sure there's a way around everything. Hell, just connecting to the WiFi and checking your email can give anyone your password if they have half a brain.
    • You might want to check your VPN (unless you set it up, of course). I know that mine doesn't actually encrypt and tunnel traffic that's not destined for my company's servers.

      E.g., everything going to $COMPANY gets pushed through to the VPN interface, but everything else just goes to eth0/wlan0. So when I'm sitting in Starbucks on the wifi, my corporate email would be encrypted but my personal mail wouldn't. (And for the record I'm not bitching here; I think this is a fine setup and I don't think that my com
  • by davmoo ( 63521 ) on Thursday January 11, 2007 @09:42AM (#17555384)
    You mean to tell me that Slashdotters, some of the most paranoid people on the planet, didn't just automatically assume hotels did crap like this on their networks to make extra money? Are people here that damned naive? The story that would be news would be a hotel that does *not* do this.

    Any time I use a network that isn't my own, be it a hotel, restaurant, or even the public library, I just automatically assume that someone who wants to remain unknown is taking an active interest in what I'm doing. Otherwise, why would any of these places provide free networking in the first place. They aren't doing it out of the goodness of their heart and so they can sleep warm and cuddly at night. They're doing it because they've found other ways to make a buck off of it.
    • Otherwise, why would any of these places provide free networking in the first place.

      You wrote this as a rhetorical question, but there IS an answer. If they don't have free wireless, you'll go somewhere else. The only place where you typically can't get free wireless is in a casino, because they want you on the floor and spending money. (The casino I work in is an exception - but it's not in Vegas, either.)

    • by node 3 ( 115640 ) on Thursday January 11, 2007 @11:57AM (#17557144)

      The story that would be news would be a hotel that does *not* do this.
      No. This is news because it's excessive and uncommon.

      Otherwise, why would any of these places provide free networking in the first place. They aren't doing it out of the goodness of their heart and so they can sleep warm and cuddly at night. They're doing it because they've found other ways to make a buck off of it.
      Not everyone is so obsessed with money as you seem to think. Some people, even astute businesspeople, make decisions based on things like, "doing what's right", "giving back to the community", and "providing quality and value". I highly doubt that your average coffee-shop free WiFi is snooping on you.

      Such extreme cynicism (as you seem to be promoting) is detrimental to society, and makes for a poor foundation to live by.
      • by spun ( 1352 )
        I both agree and disagree with you. It is not only detrimental to society to believe that all humans are purely selfish and mercenary, it is not true. Recent experiments in economics have shown that the majority of people will, given the opportunity, value fairness and reciprocity more than pure self interest. It is our high level ability to cooperate with each other that sets us apart from other animals.

        However, there are a small minority of people who will always act selfishly, and the higher up you go in
    • Re: (Score:2, Interesting)

      by arootbeer ( 808234 )
      It seems to me that your average coffee shop or cafe, local bookstore, any place that doesn't have a huge corporate structure behind it like B&N or Starbucks, is not going to have the least bit of interest in where you surf or what you do. If I were a coffee shop owner (I've considered it more than once) and wanted to add wireless, I would go out and buy a nice consumer grade wireless router, plug it into my cable modem, power it on, post the SSID on the counter, and go back to selling coffee. It beco
    • by MeNeXT ( 200840 )
      The hotel staff do not even know what this is all about. To them it is a necessary evil[expense] in order to compete. If you truly wish this to stop, talk to the GM (General Manager) and simply advise him that you do not appreciate the intrusion into your privacy.

      One thing hotels need is their client's trust. If word gets out that a hotel is sharing information on it's clients it could be the end of the establishment at least for the respectable ones. Most pride themselves on their conduct. Filling out a co
    • by jmorris42 ( 1458 ) *
      > Any time I use a network that isn't my own, be it a hotel, restaurant, or even the public library, I just automatically
      > assume that someone who wants to remain unknown is taking an active interest in what I'm doing. Otherwise, why would
      > any of these places provide free networking in the first place. They aren't doing it out of the goodness of their heart
      > and so they can sleep warm and cuddly at night. They're doing it because they've found other ways to make a buck off of it.

      Actually, if it
  • It's not dedication, just means he's not particularly enthusiastic about his honeymoon.
  • I call bullshit (Score:2, Flamebait)

    by PeeAitchPee ( 712652 )

    Herf was on his honeymoon when he did this sleuthing. Now that's dedication.

    Come one. This is slashdot. More like "Herf was taking a break from a month-long WoW session in his parents' basement when he did the sleuthing."

    Like we'd buy that someone here even *knew* a girl, much less got married or went on a honeymoon!

    • by redelm ( 54142 )
      I have no doubt you are speaking from your personal experience. So be it.

      I will speak from mine: I have no doubt. Nerds are actually very attractive to certain women. They like the reliability and equality. Many have been seriously burned being arm candy for jocks & preps.

      As for coding on Honeymoon, why not? Are you assuming an absence of pre-marital sex? There is also such a thing as too much togetherness, and some breathing space even on a week-long honeymoon is a good idea for both.

  • by pdawson ( 89236 ) on Thursday January 11, 2007 @09:48AM (#17555464)
    It turns out that Lorna and I both noticed and both got upset about it, so I'm spending a (small) amount of time figuring out how this thing works and what it's after. After all, I'm still on my honeymoon.

    He's on his honeymoon, but looks like he was lucky enough to marry another geek, so its all good
    • Re: (Score:3, Insightful)

      by DoctorPepper ( 92269 )
      Some of us are lucky, some no so much.

      I had the great fortune to also marry another geek. She's not so much of a computer geek, like me, she's more of a science geek (also like me) and a mathematics geek.

      She also thinks my two great hobbies, computers and ham radio, are "cute", and allows me to spend inordinate amounts of money on them ;-)
  • In Corporate America, hotel tracks you!

    1. Install wifi network
    2. track wifi users' net traffic
    3. ...
    4. Profit!
  • Herf was on his honeymoon when he did this sleuthing. Now that's dedication.
    To whom?
  • Unfortunately, this is only going to become more widespread. Hotel chains are only interested in profit, and running their own in-house ISP just isn't profitable. They will contract out whereever possible, and for the lowest price.

    Superclick already has the backing of major Hotel chains, so it already has recognition in the marketplace (hotel owners). That is not going to change. They would also be very competitive for the services they provide and, given what has been found, it is not unreasonable to thi

  • I noticed some hotels intercept SMTP traffic after a client complained he couldn't send email through our mail server while he was on the road. The hotel's service provider was trying to masquerade as our mail server and attempting to intercept the mail delivery. When I tested it I sent a test message through the mail server that was representing itself as our mail server and received the message 12 hours later. Interesting that it took that long to deliver the message and surprising that they would try to
    • Re: (Score:2, Informative)

      That would be []. Take a look at their customers. Hilton is one.
    • by Svartalf ( 2997 )
      They're intercepting all of the SMTP traffic outbound ostensibly to prevent spammers from renting a room for the night and using their "high-speed" access to cover their tracks. Since my SMTP server can use the alternate authenticated (and SSL encrypted) ports, they're not dinking with my email right at the moment- either way. Their little mail proxy engine is like an open relay and gets rejected by other mailservers if they've got those sorts of countermeasures on. I'd sent some emails to my friends and
      • Re: (Score:2, Insightful)

        The only reason that spam is alive right now is because of its horribly low cost: it costs nothing, basically, to send junk mail through the internet. That nothing would be increased by about $70 a day for a hotel room with high-speed internet.
        • by Svartalf ( 2997 )
          But that reasoning is flawed. You see, all it takes is recruiting one of numerous zombie-net spammers to do your dirty work. No way you're going to get caught. If you go at it from a Hotel room, you're possibly going to get caught.
    • by Alpha232 ( 922118 ) on Thursday January 11, 2007 @10:35AM (#17556058)
      I won't try to claim there is no evil in this instance...
      However there are some providers that do the same type of thing with the genuine interest in helping the guest.

      This is NOT uncommon; this is all about providing transparent network services. There are systems already out there (STSN, that don't even require you to use DHCP.. If your IP is static, it handles the masquerading needed to make it work without your intervention, same for DNS and Mail.

      Take for instance your mom and pop traveler, they are setup for cable broadband, their ISP comes to their home and hard wires the DNS and SMTP settings, and sometimes the IP. Mom and Pop go on vacation and bring their laptop, yes Virginia some non-geeks/non-business people own laptops. What settings do they need to know how to change in order to get online? At a minimum their IP is hopefully DHCP but I'll say that is not always the case, and also DNS which would be set by DHCP unless their IP or DNS settings are hard coded. In this case, the system would see the system using an IP that isn't part of the hotel network and wasn't assigned by the server, so it will do what is needed to make that IP work. Same thing goes for DNS, it will route all DNS requests to its internal DNS server, and sometimes ISP's don't allow public access from the outside.

      As far as SMTP is concerned, would you be surprised that in this age of rampant spam that Mom and Pops ISP refuse connections from outside their network? Also in a growing trend, the ISP the hotel uses wants some assurances that the public access isn't allowing mass spamming. In this case the hotel(or their network provider) routes all SMTP traffic to one server on their network which queues it and sends it out. They could be doing spam checks or simply a queue threshold/throttle to limit the damage Mom and Pops zombified laptop can do.

      That last point is also my last point, from the Hotel/ISP point of view you're using a computer that is not controlled by the person who owns the network. Most companies do not allow unsecured systems on their network, in a hotel, that is the idea... so measures must be taken to not only have the network adapt to the user but also to protect the host from their guests.
      • What he said. Outgoing SMTP is about the only setting that needs changed from site to site for 99% of users. It used to annoy the hell out me but...

        an alternative to your ISPs SMTP is to use Googles SMTP server, which also has the added bonus of being wrapped up in SSL. You need to have a valid account and validate any "from:" address you intend to use on Googles page, but other than that it's been working flawlessly for me for ages now. Works from any location, I use it on my laptop & PDA. Your email

  • by 8127972 ( 73495 ) on Thursday January 11, 2007 @10:17AM (#17555832)
    .... for years. That's why I've begun to use a remote access product called the MobiKEY []. It is a USB token that creates an SSL tunnel with 2 factor authentication (some sort of PKI based scheme) to your home/work computer. The company that makes this has a managed service called MobiNET that helps to broker the connection so that even Joe Sixpack can connect anywhere there is a net connection. Also, since it's SSL, I don't have to change my firewall settings.

    By using this product, nobody can snoop on my activities and I can do what I have to do in complete confidence. Problem solved.
  • by Joebert ( 946227 ) on Thursday January 11, 2007 @10:25AM (#17555948) Homepage
    Are theese guys based in Soviet Russia by any chance ?
  • pardon? (Score:3, Funny)

    by rucs_hack ( 784150 ) on Thursday January 11, 2007 @10:28AM (#17555980)
    On his honeymoon?

    wow, that's a relationship with a good start.

    • Well he and his wife cooperated in tracking it down because they both noticed and were annoyed by it. So, aside from the fact that I suspect you're being sarcastic, I'd have to agree with you. A great start. :-)

      • well no, not sarcastic. A new wife, a hotel, I can see more to do then things on a computer.

        Why were they so interested on solving such a problem during a honeymoon? Sounds like an avoidance strategy to me.

  • HTTPS tracking (Score:2, Informative)

    by ACMENEWSLLC ( 940904 )
    >>Notably, I've observed these guys tracking HTTPS URLs, and of course you can't track those through a proxy.

    Um, yes, you can. It is possible with todays hardware.

    Here are a few; []

    Another; ls/94de9e89-b7a1-6d6f-9479-84b866a2ffab/webwasher- 1000-csm-appliance/ [] sher_products/csm_appliance/index.html?lang=de_EN []
    "WW1000 has the ability to scan encrypted SSL"

    • How does this work? Is it brute-forcing SSL encryption? Acting like a transparent proxy and making the client think/spoofing its communicating with the host?

    • The days of HTTPS being valuable are long gone. We can look inside this traffic realtime. I monitor & block traffic to HTTPS sites myself..

      The only way this is possible (barring someone having cracked SSL, which hasn't happened) is through a man-in-the-middle attack. If you try that, the user will get a message on the screen when they connect to https sights saying the certficicate is bad, unless you can somehow get them to recognize you as Certificate Authority by installing a root CA key. You can do
  • FreeNX (Score:3, Informative)

    by astrashe ( 7452 ) on Thursday January 11, 2007 @11:13AM (#17556556) Journal
    I use FreeNX to go back to my home desktop through a ssh tunnel. I use the local desktop only if I want some multimedia -- I'll start streaming a radio station, then pull up my home desktop, etc.

    FreeNX is fast enough to make this viable.

    You get a lot of advantages from doing it this way. There's the privacy angle, which is a big thing. But you also get your main desktop -- the one with all of your stuff on it.

    And you don't need a really fast laptop. Once it's fast enough to run FreeNX, you're ok. I use a thinkpad I bought on ebay for $200. It's not just cheap, it's from the era when laptops ran cool enough to actually hold on your lap.

    • what does this give you that you couldn't get by tunnelling X via XDMCP over SSH? Doing remote-display stuff is part of the fundamental design of X, after all.
      • Re: (Score:3, Informative)

        by drinkypoo ( 153816 )
        what does this give you that you couldn't get by tunnelling X via XDMCP over SSH? Doing remote-display stuff is part of the fundamental design of X, after all.

        It makes the connection dramatically faster and more responsive. Like, as usable as Microsoft's Remote Desktop Connection. X is not very efficient. NX does some other things too but that's the biggie.

      • by Godji ( 957148 )
        Could you maybe provide some information on the stuff you just mentioned? I've never heard of it, but I'm interested. Some links maybe? Thank you.
  • Whorehousing (Score:3, Interesting)

    by Anonymous Coward on Thursday January 11, 2007 @11:32AM (#17556784)
    As a former employee of a hotel service provider, we would certainly store MAC addresses indefinitely, proxy (and occasionally read) outgoing email (and deny SMTP service for the flimsiest of pretexts), and best of all, t2 support would often tail the squid logs in search of the best pr0n. If the company had been in any way organised you can bet we'd have been selling (aggregate only! honest!) data to the first bidder.

    And don't even get me started on the plan to introduce targetted ads direct to the browser on *every page*. What? you think we used squid for performance?

  • by AndSheWas ( 1049788 ) on Thursday January 11, 2007 @11:37AM (#17556844)
    I work for a certain hotel company, I'm the person who you get when you call to make a reservation. If you have any kind of identifying profile or number, then you're activity is being tracked. Whether you stayed on business or pleasure, who you're companion was, what floor you like, how many beds, on what occasion you decided to stay at the hotel...any information i can gather about you, i am paid to gather. We use an integrated soft phone that is linked with our reservations system. I know what number you are calling from. If you have stayed with us before, chances are you have a profile, and i have your address, credit card number, and possibly how many kids you have. The hotels want your business so badly, they want to REALLY get to know you, and have your favorite flower on the bed when you come in, or if you know the concierge well enough, your favorite escort. So if you want to keep you're personal info "secret", don't earn points towards that free stay, and don't get a profile number. We get paid extra for making these profiles, so watch out for people just making you one, without your expressed consent. It happens all of the time. i watch it happen everyday. I'm looking for a new job.
  • by Zaatxe ( 939368 ) on Thursday January 11, 2007 @11:43AM (#17556932)
    Hotel Connectivity Provider SuperClick Tracks You!

    Oh, wait...
    • Re: (Score:2, Insightful)

      by Miraba ( 846588 )
      Why did I have to scan most of the way down the page to find this? For shame, people.
  • In light of this information, it is obviously the duty of every red-blooded geek to fight back by stealing free porn [] from any hotel which uses this system.
    • dude, please dont link content-stealing blogs that just links to ANOTHER blog that stole its content from another site. Useless.
  • by jafac ( 1449 )
    This was my worry in all the activity to provide municipal wireless around the country.

    Our tax dollars are going to build out networks that are going to be used, in this fashion, to track our activities - probably as a revenue source, by selling our personal information to advertisers (or worse).

    And then, the whole shebang will be sold to a monopolist for pennies on the dollar by crooked politicians.

    Other than that, I think municipal wireless is a great idea. . .
  • I've stayed at one hotel that was intercepting HTTP requests and rewriting them so that if you went to, say, Amazon, you'd be buying with their referral code. Pretty sleazy.

    As others have noted, it's good to proxy. And it's wise to assume the worst about hotel networks; no, any foreign network; no, any network; no, any communications medium. Probably even your own thoughts.

  • by nurb432 ( 527695 )
    Problem solved.

    Shouldnt be trusting another persons network in the first place.
  • by blanks ( 108019 ) on Thursday January 11, 2007 @01:12PM (#17558408) Homepage Journal
    For the last 3 years I have worked for another pay to use wireless service.  I won't say the name but we supply most of the wireless service in Hiltons, Radisons and Embassy suites in the united states.

    Thankfully it sounds like they are not even trying to lie about what is happening, and are say they are trying to push advertisements to their wireless users so I don't need to explain why they wouldn't be using a proxey.

    After a user authenticates at a location there is no need for any of this redirecting per page every time a user tries going to a different site.  Any good wireless gateway (and many bad ones) simply track each user using a session assigned to their mac address on the gateway, Nothing needs to be done to track service usage as long as they are active.

    The only reason (and I don't know why they haven't been using this as the excuse) is to be able to claim monitoring illegal web usage such as kiddy porn or illegal music downloads.  We had a few places claim they needed to be able to track this, but we dropped them instead of willingly tracking users for a b.s. reason.

    This is just another case where a company that is charging for a service are trying to make even more money doing secretive and underhanded business practices.
  • Depending on the hotel, the terms of service can claim all sorts of crazy things. Whether these are enforceable or not is another matter (IANAL). I usually anticipate that they reserve the right to log just about anything, but the worst I've seen was from a hotel in San Francisco. The service there (which wasn't even free at the time - 2003), claimed that anything you uploaded through the service you provided a perpetual, royalty-free license for them to do whatever they want with it. This would mean th
  • Just relakks []!

    /happy customer...
  • Or rather, that's not dedication *wink*.

Some people carve careers, others chisel them.