Hotel Connectivity Provider SuperClick Tracks You 175
saccade.com writes "During my last hotel stay, I thought it was a pretty strange that it took two browser re-directs before the hotel's Wi-Fi would show me the web page I browsed to. Picasa developer Michael Herf noticed the same the thing and dug a little deeper. He discovered: '...their page does some tracking of each new page you visit in your browser, outside what a normal proxy (which would have access to all your cookies and other information it shouldn't have, anyway) would do. This "adlog" hit appears to also track a "hotel ID" and some other data that identifies you more directly. Notably, I've observed these guys tracking HTTPS URLs, and of course you can't track those through a proxy.' Herf notes the Internet service provider, SuperClick, advertises that it 'allows hoteliers and conference center managers to leverage the investment they have made in their IP infrastructure to create advertising revenue, deliver targeted marketing and brand messages to guests and users on their network...'" Herf was on his honeymoon when he did this sleuthing. Now that's dedication.
I did a little "sleuthing" on my honeymoon (Score:4, Funny)
Re: (Score:3, Funny)
You know how the net is, distractions everywhere !
Not so fast.. (Score:5, Funny)
Well, maybe he was logging onto Picasa to do some uploading...?
Re: (Score:2)
Those hotel movies are expensive.
Re: (Score:2)
There was only 1 box that I "hacked" during my honeymoon...
Double Dipping (Score:2)
However, I remember this happening the last time I stayed in a hotel (a Hilton Garden). At least I kept getting redirected. I am more than a little miffed that hotels are charging me *and* spying on me.
Next time I will use the VPN.
A true nerd (Score:2, Funny)
Re:A true nerd (Score:4, Funny)
Re:A true nerd (Score:5, Funny)
Re:A true nerd (Score:4, Funny)
Putty w/ dynamic proxy support and an SSH server. (Score:5, Informative)
I wouldn't trust any network like that... even if the service itself isn't watching what you're doing, do you trust the other people on that network aren't?
Its easy to surf or do other network apps safely on questionable networks. At least among the Slashdot crowd its easy... but I've educated even my parents on doing that when using public or hotel internet and gave them an SSH account to use at my house.
OpenVPN (Score:5, Informative)
Over that connection I can do anything. Instant messaging, email, SSH, http, ftp, BitTorrent, etc.
Re: (Score:2)
You can reply to this comment or email me. I'm running OS X...Thanks!
Re: (Score:3, Informative)
OpenVPN uses SSL (Score:5, Informative)
You could always put OpenVPN on a port other than 1194 if you think you might run into port blocking, too.
Re: (Score:3, Interesting)
My company does 4-5 day jobs at convention centers, etc. and we currently use IPSEC with an off-the-shelf "VPN Router" product to tunnel back to our office network for access to fileshares and database data. Often, it is difficult and/or expensive to get hotel and convention center folks to give us a public IP address and they won't do port forwarding, etc.
I would love to have a box I can set up that wil
Re: (Score:2)
www.dd-wrt.com
Re: (Score:2)
Re:Putty w/ dynamic proxy support and an SSH serve (Score:3, Informative)
ssh -C -D NNNN @
where NNNN is a port on the local machine. Just setup your network applications to using localhost:NNNN as a socks5 Proxy.
If you are paranoid, make sure DNS lookups are done via the proxy too.
To do that in Firefox. go to about:config in the location bar and make sure that this is set
network.proxy.socks_remote_dns = true
Re: (Score:2)
I didn't know about that setting, and thats excellent information. Hope others mod you up.
Re:Putty w/ dynamic proxy support and an SSH serve (Score:2)
That's my solution as well. I've looked into OpenVPN, but it looks quite complicated to set up in comparison. Of course most browsers do not route their DNS queries through SOCKS despite the fact that SOCKS5 can do that. So the hotel's DNS server can still get an idea of where you're going.
SSH plus Privoxy (Score:2)
My thought would be that you'd need to have a remote server (say at home, on your broadband connection), hopefully with a dyndns name, running sshd and Privoxy. Then from your laptop, you'd establish an SSH tunnel that would go from port 80 on the local machine, over the SSH pipe, and exit into Privoxy's input port on the server. Then it would go through Privoxy, to the web, and return the sa
Re: (Score:2)
The wise man assumes (Score:5, Insightful)
Further than that, welcome to the modern world, cue the cliches (1984, quis custodiet,
Re:The wise man assumes (Score:4, Insightful)
Face it, your ISP is even watching you, noting your bandwidth usage, logging where you go, reading your email to make sure it's not spam, etc. The fact is, any transaction that occurs on the Internet is being logged on a server somewhere, and someone has access to that information. If you're lucky, it's just a sysadmin making sure you don't go over some quota, but you have no way of truly knowing. A true paranoic wouldn't use the Internet at all.
Re: (Score:2, Funny)
A true paranoic wouldn't use the Internet at all.
Why not, if they're not doing anything illegal, or immoral?
Re:The wise man assumes (Score:5, Insightful)
I just don't think it's anyone's business what books I'm buying, or what threads I'm posting to, or if I look up some rash on WebMD, or talk to my wife on IRC, etc etc. I'm not about to give up my privacy for some corporate bullet point about "leveraging marketing assets." They want that info, they can bloody well ask me.
Re: (Score:3)
You're obviously right though that corporations don't deserve to see into your private life and conversations just so that they can target marketing towards you (though I'd prefer to have marketing I
Re: (Score:3, Insightful)
So, what color is the sky on your planet?
This is the very reason why government should have only the power which it actually requires. It doesn't really matter whether power corrupts, or simply attracts the corrupt, or even the corruptible; t
Re: (Score:2)
Re: (Score:2)
I think this is utterly unacceptable, actually. I think it would be better for the government to simply refuse to use windows until it is secure. First the DOJ drops their case against Microsoft, now my tax dollars are spent on Windows QA? That is fucking ridiculous. I only wish I had a weapons satellite in orbit so I could destroy every Microsoft facility, one at a time, while cackling with glee. With my luck though, the government
Re: (Score:2)
Re: (Score:3, Insightful)
Avoiding the obvious issues with international law, having your activities spied upon tends to change what you do. In some cases, this is a good thing (less crime) - in some cases, it's not.
Consider someone who is aware of wrongdoing by their company/politician/etc. With the (relative) anonymity of the internet, that person can go online and expose th
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
"King Kong", "amazon" and "Mafia" are freely replacable terms.
Re: (Score:2)
Re: (Score:2)
Not if you are the one it happens to.
"I'm not sure what the legal comeback would be for a direct debit card"
You get your money back, like a regular credit card, but it may take some time. Happened to a friend of mine - had his bank account drained and it took about 3-4 weeks to get everything straigtened out and get his money back. Sucked for him - living for about a month with zero money in the bank...
Re: (Score:2)
"I am not doing anything wrong, so you have no business watching me."
Leading up to one logical fallacy pile of useless poop. (Both directions.)
Re: (Score:2)
As for the laws, you use your common sense, and if there really is a law against something weird like trying a
I've always worried about this... (Score:2, Informative)
Of course that's assuming the VPN is secure enough...i'm sure there's a way around everything. Hell, just connecting to the WiFi and checking your email can give anyone your password if they have half a brain.
Good VPNs don't tunnel everything. (Score:2)
E.g., everything going to $COMPANY gets pushed through to the VPN interface, but everything else just goes to eth0/wlan0. So when I'm sitting in Starbucks on the wifi, my corporate email would be encrypted but my personal mail wouldn't. (And for the record I'm not bitching here; I think this is a fine setup and I don't think that my com
You mean you didn't suspect this automatically? (Score:5, Insightful)
Any time I use a network that isn't my own, be it a hotel, restaurant, or even the public library, I just automatically assume that someone who wants to remain unknown is taking an active interest in what I'm doing. Otherwise, why would any of these places provide free networking in the first place. They aren't doing it out of the goodness of their heart and so they can sleep warm and cuddly at night. They're doing it because they've found other ways to make a buck off of it.
Re: (Score:2)
You wrote this as a rhetorical question, but there IS an answer. If they don't have free wireless, you'll go somewhere else. The only place where you typically can't get free wireless is in a casino, because they want you on the floor and spending money. (The casino I work in is an exception - but it's not in Vegas, either.)
Re:You mean you didn't suspect this automatically? (Score:5, Insightful)
Such extreme cynicism (as you seem to be promoting) is detrimental to society, and makes for a poor foundation to live by.
Re: (Score:2)
However, there are a small minority of people who will always act selfishly, and the higher up you go in
Re: (Score:2, Interesting)
Re: (Score:2)
One thing hotels need is their client's trust. If word gets out that a hotel is sharing information on it's clients it could be the end of the establishment at least for the respectable ones. Most pride themselves on their conduct. Filling out a co
Re: (Score:2)
> assume that someone who wants to remain unknown is taking an active interest in what I'm doing. Otherwise, why would
> any of these places provide free networking in the first place. They aren't doing it out of the goodness of their heart
> and so they can sleep warm and cuddly at night. They're doing it because they've found other ways to make a buck off of it.
Actually, if it
Not-quite-honey Moon (Score:2, Insightful)
I call bullshit (Score:2, Flamebait)
Herf was on his honeymoon when he did this sleuthing. Now that's dedication.
Come one. This is slashdot. More like "Herf was taking a break from a month-long WoW session in his parents' basement when he did the sleuthing."
Like we'd buy that someone here even *knew* a girl, much less got married or went on a honeymoon!
Re: (Score:2)
I will speak from mine: I have no doubt. Nerds are actually very attractive to certain women. They like the reliability and equality. Many have been seriously burned being arm candy for jocks & preps.
As for coding on Honeymoon, why not? Are you assuming an absence of pre-marital sex? There is also such a thing as too much togetherness, and some breathing space even on a week-long honeymoon is a good idea for both.
Re: (Score:2)
Since male reproduction is more variable than female, women are torn between aggressive and nurturing males. Sometimes riskily resolved by cuckoldry. The assumption is that other women's daughters won't find nurturing sons as attractive. Probably an equilibrium thing: too many aggressors don't help enough but there are large rewards if there are too few. A predator-prey cycle.
"Sperm Wars" [Robin Baker] begins to scratch the surface (if you ca
Not as stupid as others seem to think (Score:4, Insightful)
He's on his honeymoon, but looks like he was lucky enough to marry another geek, so its all good
Re: (Score:3, Insightful)
I had the great fortune to also marry another geek. She's not so much of a computer geek, like me, she's more of a science geek (also like me) and a mathematics geek.
She also thinks my two great hobbies, computers and ham radio, are "cute", and allows me to spend inordinate amounts of money on them
Obligitory (Score:2)
1. Install wifi network
2. track wifi users' net traffic
3.
4. Profit!
Dedication (Score:2)
A disturbing trend (Score:2, Insightful)
Superclick already has the backing of major Hotel chains, so it already has recognition in the marketplace (hotel owners). That is not going to change. They would also be very competitive for the services they provide and, given what has been found, it is not unreasonable to thi
Some hotels intercept SMTP traffic too (Score:2, Interesting)
Re: (Score:2, Informative)
Some? How about "most"? (Score:3, Informative)
Re: (Score:2, Insightful)
Re: (Score:2)
Re:Some hotels intercept SMTP traffic too (Score:5, Interesting)
However there are some providers that do the same type of thing with the genuine interest in helping the guest.
This is NOT uncommon; this is all about providing transparent network services. There are systems already out there (STSN, et.al.) that don't even require you to use DHCP.. If your IP is static, it handles the masquerading needed to make it work without your intervention, same for DNS and Mail.
Take for instance your mom and pop traveler, they are setup for cable broadband, their ISP comes to their home and hard wires the DNS and SMTP settings, and sometimes the IP. Mom and Pop go on vacation and bring their laptop, yes Virginia some non-geeks/non-business people own laptops. What settings do they need to know how to change in order to get online? At a minimum their IP is hopefully DHCP but I'll say that is not always the case, and also DNS which would be set by DHCP unless their IP or DNS settings are hard coded. In this case, the system would see the system using an IP that isn't part of the hotel network and wasn't assigned by the server, so it will do what is needed to make that IP work. Same thing goes for DNS, it will route all DNS requests to its internal DNS server, and sometimes ISP's don't allow public access from the outside.
As far as SMTP is concerned, would you be surprised that in this age of rampant spam that Mom and Pops ISP refuse connections from outside their network? Also in a growing trend, the ISP the hotel uses wants some assurances that the public access isn't allowing mass spamming. In this case the hotel(or their network provider) routes all SMTP traffic to one server on their network which queues it and sends it out. They could be doing spam checks or simply a queue threshold/throttle to limit the damage Mom and Pops zombified laptop can do.
That last point is also my last point, from the Hotel/ISP point of view you're using a computer that is not controlled by the person who owns the network. Most companies do not allow unsecured systems on their network, in a hotel, that is the idea... so measures must be taken to not only have the network adapt to the user but also to protect the host from their guests.
Re: (Score:2)
What he said. Outgoing SMTP is about the only setting that needs changed from site to site for 99% of users. It used to annoy the hell out me but...
an alternative to your ISPs SMTP is to use Googles SMTP server, which also has the added bonus of being wrapped up in SSL. You need to have a valid account and validate any "from:" address you intend to use on Googles page, but other than that it's been working flawlessly for me for ages now. Works from any location, I use it on my laptop & PDA. Your email
Re: (Score:2, Interesting)
I've assumed that this was the case.... (Score:5, Interesting)
By using this product, nobody can snoop on my activities and I can do what I have to do in complete confidence. Problem solved.
They do, do they ? (Score:3, Funny)
Re: (Score:2)
pardon? (Score:3, Funny)
wow, that's a relationship with a good start.
Re: (Score:2)
Well he and his wife cooperated in tracking it down because they both noticed and were annoyed by it. So, aside from the fact that I suspect you're being sarcastic, I'd have to agree with you. A great start. :-)
Re: (Score:2)
Why were they so interested on solving such a problem during a honeymoon? Sounds like an avoidance strategy to me.
Re: (Score:2)
HTTPS tracking (Score:2, Informative)
Um, yes, you can. It is possible with todays hardware.
Here are a few;
http://www.esafe.com/eSafe/traffic_solutions.asp [esafe.com]
Another;
http://www.scmagazine.com/us/products/productdetai ls/94de9e89-b7a1-6d6f-9479-84b866a2ffab/webwasher- 1000-csm-appliance/ [scmagazine.com]
http://www.cyberguard.com/products/webwasher/webwa sher_products/csm_appliance/index.html?lang=de_EN [cyberguard.com]
"WW1000 has the ability to scan encrypted SSL"
The
Re: (Score:2)
Re: (Score:2)
The days of HTTPS being valuable are long gone. We can look inside this traffic realtime. I monitor & block traffic to HTTPS sites myself..
The only way this is possible (barring someone having cracked SSL, which hasn't happened) is through a man-in-the-middle attack. If you try that, the user will get a message on the screen when they connect to https sights saying the certficicate is bad, unless you can somehow get them to recognize you as Certificate Authority by installing a root CA key. You can do
Mod Parent Up (Score:2)
FreeNX (Score:3, Informative)
FreeNX is fast enough to make this viable.
You get a lot of advantages from doing it this way. There's the privacy angle, which is a big thing. But you also get your main desktop -- the one with all of your stuff on it.
And you don't need a really fast laptop. Once it's fast enough to run FreeNX, you're ok. I use a thinkpad I bought on ebay for $200. It's not just cheap, it's from the era when laptops ran cool enough to actually hold on your lap.
Re: (Score:2)
Re: (Score:3, Informative)
It makes the connection dramatically faster and more responsive. Like, as usable as Microsoft's Remote Desktop Connection. X is not very efficient. NX does some other things too but that's the biggie.
Re: (Score:2)
Whorehousing (Score:3, Interesting)
And don't even get me started on the plan to introduce targetted ads direct to the browser on *every page*. What? you think we used squid for performance?
Hotels want to know EVERYTHING (Score:3, Informative)
Re: (Score:2)
In soviet Russia... (Score:5, Funny)
Oh, wait...
Re: (Score:2, Insightful)
Fight Back . . . (Score:2)
Re: (Score:2)
Worry; (Score:2)
Our tax dollars are going to build out networks that are going to be used, in this fashion, to track our activities - probably as a revenue source, by selling our personal information to advertisers (or worse).
And then, the whole shebang will be sold to a monopolist for pennies on the dollar by crooked politicians.
Other than that, I think municipal wireless is a great idea. . .
I've seen worse (Score:2)
As others have noted, it's good to proxy. And it's wise to assume the worst about hotel networks; no, any foreign network; no, any network; no, any communications medium. Probably even your own thoughts.
VPN (Score:2)
Shouldnt be trusting another persons network in the first place.
I work for a competing pay to use service. (Score:3, Informative)
Thankfully it sounds like they are not even trying to lie about what is happening, and are say they are trying to push advertisements to their wireless users so I don't need to explain why they wouldn't be using a proxey.
After a user authenticates at a location there is no need for any of this redirecting per page every time a user tries going to a different site. Any good wireless gateway (and many bad ones) simply track each user using a session assigned to their mac address on the gateway, Nothing needs to be done to track service usage as long as they are active.
The only reason (and I don't know why they haven't been using this as the excuse) is to be able to claim monitoring illegal web usage such as kiddy porn or illegal music downloads. We had a few places claim they needed to be able to track this, but we dropped them instead of willingly tracking users for a b.s. reason.
This is just another case where a company that is charging for a service are trying to make even more money doing secretive and underhanded business practices.
Re: (Score:2)
I'll save you the effort. You [boingo.com] work [boingo.com] for Boingo wireless [boingo.com].
Hotel ToS can be very onerous (Score:2)
Come on now... (Score:2)
/happy customer...
Wait just a sec... (Score:2)
Probably went something like: (Score:3, Insightful)
Re: (Score:3, Informative)
Set up an squid/ssh server at home/work, set
Re: (Score:2)
There are SSL proxies that will present to you a certificate for www.whateveryouwentto.com, and talk to you in SSL while talking to the website in SSL. Yes, you'll get a "who the hell signed this thing?" popup... unless of course you've installed the signing certificate from the proxy as a trusted certificate. R
Of course I click "yes". (Score:2)