15

I'm a security-conscious Verizon user, and it has recently come to light that Verizon is now serving up my web traffic to ad partners while en route. I understand that once my data has left the device, it's impractical to try and control it/protect it, but is there anything I can do to protect my information from this technique, or at least make it worthless to advertisers as far as I am concerned (this may be worth asking as a separate question)?

Solutions I'm interested in can be as far-ranging as rooting my phone to install some kind of packet spoofer extension on a mobile browser (Okay, I said I was security-conscious, not security-adept) to using a VPN to route all my web traffic, but I'm obviously not so much interested in "change ISPs". If it can't be avoided, a brief, high-level explanation that details anything these articles left out on the method would be appreciated.

Pertinent quotes from the articles in case the links go down:

Verizon Wireless has been subtly altering the web traffic of its wireless customers for the past two years, inserting a string of about 50 letters, numbers, and characters into data flowing between these customers and the websites they visit.

The company [...] calls this a Unique Identifier Header, or UIDH. It’s a kind of short-term serial number that advertisers can use to identify you on the web, and it’s the lynchpin of the company’s internet advertising program. But critics say that it’s also a reckless misuse of Verizon’s power as an internet service provider—something that could be used as a trump card to obviate established privacy tools such as private browsing sessions or “do not track” features.

And:

Verizon's solution is called the PrecisionID. When consumers visit certain websites or mobile apps, a request is sent through a Verizon network. Precision packages the request, as a hashed, aggregated and anonymous unique identifier, and turns it into a lucrative chunk of data for advertisers.

Verizon said it is not using or selling its first-party subscriber data, but rather deploying partnerships with third-party data providers to target Verizon's massive consumer base.

It's a cookie alternative for a marketing space vexed by the absence of cookies.


UPDATE

While I've heard (but not read for myself) that AT&T has said it will allow opting out, Verizon has waited until just recently to announce that it, too, will allow opting out:

Verizon says it will soon offer customers a way to opt out from having their smartphone and tablet browsing tracked via a hidden un-killable tracking identifier.

Source

  • I wonder if their solution is smart enough to strip out any existing PrecisionID headers before inserting their own... – gowenfawr Oct 28 '14 at 19:58
  • 1
    You may end up with two of the same kind of header, with two different values. I haven't seen this tested anywhere yet. – pseudon Oct 29 '14 at 0:15
  • 4
    In the last sentence, why does the mobile sphere lack cookies? I can see why sites catering to conservative customers or markets would not use them, as their marketbase would not have upgraded, but we have had phones with plenty of space for a couple cookies for a while now. – trysis Oct 29 '14 at 2:29
  • @trysis I don't know, but that might be a good question in its own right on Programmers.SE or maybe here, if it isn't easily searchable. – TylerH Oct 29 '14 at 2:50
  • And don't forget about changing providers, that's your best way to avoid them tracking you. – HocusPocus Oct 29 '14 at 8:52
14

The easiest way to avoid interception/modification of your web traffic is one that you mention in the question which is to use a VPN. This will encrypt traffic between your device and the VPN endpoint and should prevent your ISP from being able to modify web headers or other aspects of your use.

There are VPN clients for most modern mobile operating systems (e.g. OpenVPN which has clients for android and iOS).

One thing to note though is that is using a VPN you are trusting the VPN provider to an extent so it's worth spending some time looking at VPN providers to find one that you're comfortable with. In particular I'd be a bit suspicious of providers who are free as there is a question of how they make money from the service if it's not directly from their customers.

  • How would VPN help? Advertisers are generally associated with sites that we aren't likely to have "VPN" relationships with. And sites that I connect to through VPN generally don't have ads. – user2338816 Oct 29 '14 at 11:15
  • 3
    The question relates to the ISP modifying web traffic as it goes from the user to the site. A VPN helps by encrypting the traffic at the point it passes over the ISPs network to prevent that modification. – Rоry McCune Oct 29 '14 at 13:32
  • @user2338816: See my answer below for the mechanics of how this ISP program works and how a VPN alters things for them. Simple explanation: Your ISP gets data from you and sells it to the advertiser. Using a VPN prevents your ISP from doing this, the advertisers don't get the info. The relationship (or lack of it) of the ad network to the VPN doesn't matter. – Mark Ripley May 28 '16 at 13:44
3

Avoiding the tracking codes is most important for sites to which you don't identify yourself / your device anyway, i.e., anonymous surfing.

Using Tor is the best option since you don't have to trust any VPN provider. VPN is the second best, and you can probably find a VPN provider that you trust at least somewhat more than your mobile carrier. Third best is use HTTPS exclusively since the tracking IDs can't be injected into HTTPS transactions - but this also means there are many sites you wouldn't be able to visit.

AT&T says they change their X-ACR header code for you every 24 hours, so you could conceivably ration your anonymous unprotected surfing to a an acceptable minimum each day.

The reality though is that anything you do over HTTP is subject to mobile carrier monitoring, even if they choose not to act on it by, for example, targeting ads to you based on your online behaviors.

  • 7
    Actually a number of tor exit nodes were found to be doing the same type of thing Verizon is doing, and worse - possibly injecting malware into executable downloads. threatpost.com/… – R.. Oct 29 '14 at 3:51
  • Tor project does explicitly warn users about downloads (of all types). But even if Tor exit nodes add a code, you're doing anonymous surfing (presumably) and the code therefore isn't tied to your personal or device or locational identity. Also your exit node changes regularly. – pseudon Oct 29 '14 at 23:51
  • AT&T now says that "opt out" during the beta period will NOT remove the code, but when it goes live, it will. Verizon code has no "opt out". See: forbes.com/sites/kashmirhill/2014/10/29/… – pseudon Oct 29 '14 at 23:54
  • 1
    That article frustrates me because it ends with "can you opt out? Yes" but doesn't tell me where or how. – TylerH Oct 30 '14 at 13:34
  • I can't reproduce the supposed issue on AT&T: lessonslearned.org/sniff shows nothing. – R.. Oct 30 '14 at 13:39
2

Use a VPN service for privacy. To explain how this helps, let's look at how and why your ISP is modifying your IP packets with a unique identifier:

Normal internet browsing (you don't use a VPN):

-Your ISP puts a unique header on all your traffic

-Your ISP sees any DNS requests you make, which is the first step your browser takes whenever visiting a new web site.

-Your ISP builds a database, matching your DNS queries to your Unique ID

-Your ISP now monitizes that information by selling their database to ad networks

-You visit a web site with an ad network. They see unique identifier and tailor the ads you see there.

-Result: ISP Profit, and advertisers that are able to tailor ads to your interests

Now if you use an VPN:

-You send packets to your VPN (they still pass through your ISP, but contents are encrypted)

-Your ISP can't see what DNS queries your browser asks about.

-Your ISP builds their database, and it shows the only place you ever ask about or visit is your VPN.

-Your ISP can still stick a unique ID in your packet headers

-Your ISP sells their database to advertiser networks.

-Your traffic headers are stripped off by your VPN when they decrypt your packet and route them onward.

-Your packets reach your preferred web site with no unique ID attached.

-Even if the ad network figures out who you are, the database only links you to your VPN, not any other site.

-Result: The database isn't worth much to the ad network so the ISP is not rewarded for it's efforts

-Result #2: the ad network will probably use traditional methods (3rd party cookies) instead of ISP database to attempt to tailor ads.

Note that if you have (pre VPN use) entries in the database and the advertisers can link you somehow (cookies) with your ISP unique ID, they can still target you (even after you start using a VPN) with ads targeting your (pre VPN) web history.

As far as opting out goes: even if your ISP is not putting unique identifiers on your packets, they can still build a database of all the sites you like to visit, and sell that database to ad networks. The ad network has to work a little harder to tailor ads because they don't have the identifier. Using a VPN prevents the ISP from building any database of your behavior (other than data usage/volume and times that you surf; i.e. some metadata), so a VPN helps in this case as well.

  • @antipattern Can you provide a citation for that? – TylerH Jun 14 '18 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.