Quote:
Originally Posted by kt88man
Please, someone tell me I'm wrong:
So much for the anonymous UID.
On a website that hosts the Phorm/OIX adverts when the advert is fetched by the browser from the use of either an IMG tag or an Iframe, then the (Phorm/OIX) 'adserver' has the UID from the cookie (to know which advert to serve) and the users IP address from the request header (or we won't get the advert back)...
So Phorm now have your (so called anonymous) UID tied to your IP address...
|
According to Richard Clayton's analysis of the system, the unique identifier portion of the cookie is stripped-out by the Phorm hardware in your ISP before it gets to the website, so the website doesn't actually get to see your UID. The decision of what ad to serve you from their website is made by Phorm based on your UID and the ad is then passed to the website by Phorm's hardware for them to serve to you. However, there is an additional, apparently redundant piece of kit in the middle between the Layer 7 intercept hardware and the Phorm-owned ad channel server kit which does not relay your IP address to the Phorm kit. It seems that the only reason for introducing this extra machine into the pathway is to prevent your IP address "going outside the ISP's network" - almost as if they anticipated the legal attacks on their spyware system...