6

See these two EFF articles about how Verizon puts a tracker ID in the header of a http request, circumventing anti-cookie measures:

How does this technically work? Can the user see that this header is inserted?

I don't have Verizon, so I can't test it. The EFF article mentions two websites that can test for this header. They require that you do not use wifi. Apparently Verizon only uses this for mobile browsing, but I guess this can be used for all browsing - not?

When I do the test on Am I Being Tracked with my phone (4G in Europe) I get the following message: Oops, we received a strange result. Is your Wifi still on? I'm not afraid that this is going on right now, just testing for fun, but still this is strange. Can I test this myself on a private website?

Is there a way to mess with this value? Insert a random user ID in the header with a browser addon or something?

Verizon uses X-UIDH. Other providers may use something else. Is there a way to test for this?

Improve this question
1
  • You could try setting the value yourself and seeing (with httpbin for example) if the proxy overrides it or leaves it untouched. If the latter, you can make a browser extension to set a random value on each request, thus defeating the tracking.
    – user42178
    Jan 17, 2015 at 17:14

2 Answers 2

Reset to default
4

Somehow I ended up on your question when googling for something else. Anyways:

Here is a website to test for the header: http://uidh.crud.net/ .

Verizon achieves this (adding the header info) by what is essentially a man in the middle attack on all HTTP traffic on port 80. Since they control the ingress and egress of your unencrypted data, it's pretty easy to modify the HTTP header information. That are tools out there, like fiddler for Windows, or any proxy server, that you can use to do the same thing to HTTP traffic.

Here is another site that will show you all the header information coming in your HTTP request upon arrival: http://browserspy.dk/headers.php .

Improve this answer
-1

All X- headers are experimental headers that haven't made it into the standards. You won't see anything about the header insertions if you don't inspect your headers at the appropriate point in the pipeline.

Also, look at this thread: https://stackoverflow.com/questions/3561381/custom-http-headers-naming-conventions

The abnf quoting indicates the seriousness of the discussion.

Improve this answer
4
  • 2
    This really doesn't answer the question, the author couldn't care less whether they are experimental headers or not, he just wants to know how this tracking works and how can he prevent it.
    – user42178
    Jan 17, 2015 at 17:12
  • Well people should, because that means any X- headers are valid since they're all experimental.
    – munchkin
    Jan 17, 2015 at 17:57
  • 2
    Yeah but the author asked about how these headers are used for tracking and how can he prevent that.
    – user42178
    Jan 17, 2015 at 18:34
  • Well, if the ietf would just stop accepting X- headers as valid for developers, wouldn't that stop the problem? Just pointing out the reason.
    – munchkin
    Jan 18, 2015 at 2:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .