Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
Electronic Frontier Foundation Advertising Privacy Verizon

EFF Hints At Lawsuit Against Verizon For Its Stealth Cookies 81

An anonymous reader writes A few weeks ago I noted how security researchers had discovered that Verizon has been injecting a unique new 'stealth cookie' identifier into all user traffic that tracks user online behavior, even if the consumer opts out. Using a unique Identifier Header, or UIDH, Verizon's ham-fisted system broadcasts your identity all across the web — and remains intact and open to third-party abuse — even if you opt-out of Verizon's behavioral ad programs. Now the Electronic Frontier Foundation has filed a complaint with the FCC and has strongly indicated that they're considering legal action against Verizon for violating consumer privacy laws.
This discussion has been archived. No new comments can be posted.

EFF Hints At Lawsuit Against Verizon For Its Stealth Cookies

Comments Filter:
  • by Kazman20 ( 2935619 ) on Thursday November 06, 2014 @07:16PM (#48329795)
    here's the link to the actual EFF press release/post, not some random board post linking to it. https://www.eff.org/deeplinks/... [eff.org]
  • by sconeu ( 64226 ) on Thursday November 06, 2014 @07:16PM (#48329805) Homepage Journal

    It's so cute when they think that laws apply to $BIG_CORPORATIONS

    • Re:It's so cute... (Score:5, Insightful)

      by Anonymous Coward on Thursday November 06, 2014 @07:43PM (#48330069)

      It's doubly cute when they've done it before and won. :)

      • by Krojack ( 575051 )

        Like Verizon charging it's customers extra to be able to use the Hot-Spot on their phone...

    • Re:It's so cute... (Score:5, Insightful)

      by LessThanObvious ( 3671949 ) on Thursday November 06, 2014 @09:09PM (#48330689)

      The EFF doesn't mess around, good for them. I almost wish my Verizon phone did that tracking. I'd love to be included in that class action. I'd have to make a copy of the $10 check I'd get in two years so I could frame it. I pay Verizon well over a $100 a month. If they think they need to sell out their users privacy on top of that revenue then screw them.

      • Good to see somebody doing, what ACLU used to do...

        • Good to see somebody doing, what ACLU used to do...

          Generally, the ACLU does in meat-space what the EFF does in cyberspace. They have similar general goals, but the ACLU generally doesn't do as much of the computer stuff. Their current list [aclu-il.org] seems to involve plenty of LGBT issues right now, for example, but these are active court cases.

          Many times you don't hear about either organization as much because they get a lot of it sorted out via quick letters, especially at the smaller-scale level. A good letter from EFF or ACLU to a school district or county board,

          • by mi ( 197448 )

            Generally, the ACLU does in meat-space what the EFF does in cyberspace.

            BS. Once, a decade ago, I donated enough to ACLU to warrant sending me a membership card. Still have it somewhere. Guess what? 2 weeks later an invitation to subscribe to a disgusting far-left magazine [thenation.com] showed up, sent to the same "tagged" address as what I gave the ACLU. It had a picture of the then-President in shackles on it — showing today's President that way would've been a national scandal.

            Do you suppose, the USSR [foreignpolicy.com] or Cuba [wikipedia.org], t

            • by Cyberax ( 705495 )

              It had a picture of the then-President in shackles on it — showing today's President that way would've been a national scandal.

              A pity Bush wasn't prosecuted for his role in torture of prisoners. And seriously, I've seen pictures of Obama photoshopped as a monkey, Obama holding a banana, Obama in a prison cell and so on. No scandals so far.

      • by cdrudge ( 68377 )

        And in the end, you'd just end up then paying Verizon well over $110 a month.

        • For $25 worth of service.
          • by Krojack ( 575051 )

            I partly agree with that. I've played Ingress with a group of people before and we we travel around the non AT&T/Verizon users data would often go in and out. They ended up just needing to tether to one of our hotspots.

            The cheaper services in my area have many many dead zones.

  • Like STDs - you give it to and get it from the ones you love.

  • by Anonymous Coward

    Stealthy cookies visible by every one. They should get sued for false advertizing too.

  • by Anonymous Coward

    Why don't ISPs simply focus on efficiently transferring packets and appropriately charging for the service? Are the profits generated by "stealth cookies" or "deep packet analysis" enough to pay for the engineering and hardware cost of these "features"?

    • Why don't ISPs simply focus on efficiently transferring packets and appropriately charging for the service?

      More money to be made by doing it inefficiently and charging you an arm and a leg.

      Are the profits generated by "stealth cookies" or "deep packet analysis" enough to pay for the engineering and hardware cost of these "features"?

      Yes, it's almost pure profit. Except if it loses them customers. This is another reason why lack of competition is a bad idea.

  • Instead of having a defeatist attitude or wailing about it on some news site, please consider doing something not totally useless. Donate to the EFF.
    • Why? Seems to me Verizon is getting ready to dump a lot of coin in their laps..

    • Can we do both? Kvetching is a time-honored tradition on Slashdot, and it lets the other readers know that they're not alone in being pissed off. I'd say that it serves a valuable function in that regard, especially if it motivates others to take action, be it donating or spamming their favorite <insert-representative-here>.

      Okay, maybe not 'favorite'. I almost gagged while typing that.

  • by Alain Williams ( 2972 ) <addw@phcomp.co.uk> on Thursday November 06, 2014 @07:49PM (#48330115) Homepage

    If Verison is fiddling with the packets going back & forth does it not lose its 'data carrier' status and become one with the end user ? So: if Disney/... sues an end user for downloading it's lastest film: then Verison should be part of the lawsuit as well and liable to pay Disney for the ''theft of its IP''.

    .Verison cannot have it both ways, it either copies bytes and the user is 100% responsible or it fiddles with them and so is aware of the content and is thus vicariously liable for any wrong doing.

    • Generally routers fiddle with packets all the time, usually not at the application layer though. Firewalls routinely do this as well as intrusion detection and protection systems.

      SO... I don't think Verizon is going to be liable for messing with your http packets. Not to mention that if you are downloading a Disney DVD, you are unlikely to be using http anyway, so Verizon isn't likely to do much to the torrent packets, assuming they even care.

    • by sconeu ( 64226 )

      VZW is *not* a common carrier. They've fought tooth and nail against that.

    • Verison cannot have it both ways

      The lobbyists running the FCC say otherwise.

  • Wait, what? (Score:5, Interesting)

    by canadiannomad ( 1745008 ) on Thursday November 06, 2014 @07:57PM (#48330191) Homepage

    Just reading through the EFF page on this [eff.org] and it sounds like they got a patent on setting a header to track [justia.com]... Wow. That just sounds, ... , I don't know, but :(

    • by Anonymous Coward

      Having a patent to invade consumer privacy does not give the legal authority to break consumer privacy laws.

  • Considering how many people get screwed over by big corporations (oil companies, telecoms, etc.), I'm a little surprised we don't see more examples of unstable victims attempting serious, premeditated harm on the company execs and/or facilities.

    Even if it's just 1 in 10,000,000 people who are that unstable, these companies have a lot of victims.

    • by mi ( 197448 )

      Considering how many people get screwed over by big corporations [...] surprised we don't see more examples of unstable victims attempting serious, premeditated harm [...] these companies have a lot of victims

      Well, if your theory conflicts with the available facts, maybe, the theory is wrong? Maybe, the reason we don't see that much violence is that it is actually very few people, who are "screwed over" by big KKKorporations? (That's the proper spelling for a rant like yours, by the way.) I for one can't

    • by swb ( 14022 )

      Well, Ted Kaczynski led something of an anti-corporate campagin. Groups like EarthFirst have done a fair amount of direct action against environmental exploitation.

      And workplace shootings aren't unheard of, although they tend to be driven more by personal rather than sociopolitical motivations. Although maybe you could make the argument that many of their grievenaces ultimately derive from soulless busines policies.

      But generally, there is little targeted violence against corporations or CEOs. About the

      • by Prune ( 557140 )
        Kaczynski led an anti-technology campaign, not an anti-corporate one (source: his manifesto).
        • by swb ( 14022 )

          You're right For some reason I remember him targeting corporate executives but only the last two fatalities were corporate execs and most of his targets were University professors.

          The thread starter's comment is kind of intriguing, because I can't think of any ideology that's specifically anti-corporate without being part of some other, broader anti-capitalist or anti-technological ideology or philosophy.

          Maybe it will become some kind of emerging ideology, ultimately recycling anti-royalist ideas from the

    • by sjames ( 1099 )

      I suppose it's mostly that people who are violently insane enough to do something newsworthy and yet organized enough to choose a target and actually plan against it are rare.

      I do note that there are more businesses that put people behind heavy plexiglass than there used to be. It's either corporate paranoia or they actually have had increasing numbers of people jump over the desk and "register their dissatisfaction".

      • by dbc ( 135354 )

        Definitely corporate paranoia. I've seen it in action. Company gets big enough that corporate security is a sizable organization. Security hires a couple of professional paranoids to do corporate level security planning. They identify various important people that need to be protected from threats -- they don't have to be actual threats yet, the planners are paid to be professional paranoids and plan for things that *might* happen. And since they can generalize from what has happened to similarly situat

  • by Browzer ( 17971 ) on Thursday November 06, 2014 @08:09PM (#48330289)

    While viewing stories in "0 Abbreviated and 0 Hidden" mode I noticed threads where the parent comment was missing but the replys are still there!

    Censorship Soviet Union style (pre photoshop) http://en.wikipedia.org/wiki/C... [wikipedia.org]

  • Copyright? (Score:2, Interesting)

    by Anonymous Coward

    Why can't I claim copyright on my http requests, and deny them the ability to create a derivative work?

    • http headers are not art, they are generic templates devoid of artistic content. Your email, however, is most certainly copyrighted and the NSA owes you royalties for their duplication.
    • by Kludge ( 13653 ) on Thursday November 06, 2014 @10:52PM (#48331243)

      Is this not an illegal man-in-the-middle intercept and hack of my data?
      I created (via my web browser) the http header and request. My device sent that http header and request to another computer with whom I want to communicate. Someone (ATT, Verizon) intercept my data, read it, hack it, and send it along. How is this not completely illegal.

  • So, what happens ... (Score:4, Interesting)

    by PPH ( 736903 ) on Thursday November 06, 2014 @08:44PM (#48330537)

    ... if my web browser already uses the X-UIDH header label? If Verizon monkeys with it, they could be breaking some app. And get charged with tampering. Never mind that I just set it to:

    X-UIDH: Go suck an egg.

    And if only a few people directed their web traffic through a simple proxy that rewrites the X-UIDH header, we could really screw with Verizon's plans.

    • So, what happens ... (Score:5, Interesting)

      by Anonymous Coward on Thursday November 06, 2014 @08:57PM (#48330623)

      I tried this. They delete your header and replace it with a new one.

      IANAL, but I think this violates wire tapping laws, copyright laws, and trespass of chattel laws. Under copyright and trespass of chattel laws you don't need to prove actual damages. If you can claim a "per incident" bases, the money could add up quickly.

      It also looks like it violates their own terms of use and privacy policy pages.

      What would be interesting is to use their arbitration clauses against them. They say that the arbitrator has all the powers of a court, so you should be able to ask for relief as both money and an injunction that they add this header to "your" connections. If the arbitrator cannot rule this way, then they lose their protection against class action suits.

    • Good for you, you created your own unique ID that can be used to track you just as effectively as the one they use themselves. What were you trying to accomplish?

      • by PPH ( 736903 )

        You missed part 2 of my comment. Where the user changes the header value at their discretion.

  • They'll fight for freedom,
    wherever there's trouble,
    EFF is there!


    EFF! A Real Internet Hero...
  • by Anonymous Coward

    Fines mean nothing to these companies. Demand they cease this immediately or the executives go to jail.

  • Wouldn't a VPN on your mobile device block this?

  • The code is encrypted and rotates every week. It can only be used by contracted partners of Verizon, and the contract contains a "no-advertising" clause. The EFF should spend money on something actually important.
    • by Shados ( 741919 ) on Friday November 07, 2014 @12:38AM (#48331659)

      It still gives you a unique identifier (even if its encrypted, its deterministic enough to be used as an ID even if you can't decrypt it) that lets you uniquely identify a household for a period of time. Combined with other more legit tracking methods, you can do some deliciously evil things with it...

    • by Prune ( 557140 )
      Nice try with your misdirection from the actual issue there to a red herring one. The actual problems is that they're tampering with your data (and headers are data)--the sort of thing natural (non-corporate) persons have gone to jail for. It's not merely a case of them inserting an additional header; if your application sets the X-UIDH header, they actually remove it and substitute their own. Mods, please mod parent down for shameless shilling.
  • What happens if you send your own X-UIDH header? Does Verizon add a second header, replace the one you sent, or leave it alone? Can anyone on Verizon's network test this? I imagine that they probably ignore what headers are already being sent and simply add an additional one, as that would be the least work for them, but if they abstain from adding a X-UIDH header when one is already present then one could use this to re-anonymise your connection.

The last thing one knows in constructing a work is what to put first. -- Blaise Pascal

Working...