Quote:
Originally Posted by pseudonym
I think a bigger problem is websites will be able to read your webwise tracking cookie by embedding some https content on their page. Phorm can't strip the cookie from encrypted streams, so the website will get to see your unique user id. If the website doesn't want to pay for a certificate to read your UID, it should also work if they use a port other than 80.
|
Maybe during the Webwise trials there will be those webmasters who are able to demonstrate the various security problems associated with the Phorm cookies, by intercepting Webwise cookies, associating them with visitor IP addresses, and linking them to a smattering of information that the
website already holds on the visitor, and diverting the visitor to a page that explains what they have been able to do and encourages the visitor to approach their ISP and complain. Something like (with exaggeration just for humour you understand..)
"Welcome. You appear to be using Webwise. I've got a note of your IP address and your Phorm UID and I note that you are interested in **** and *** on my site. It seems you are also a forum member here and from your IP address I think you are Fred Bloggs - how is your sister Mabel? - are her ****'s improving? - keep inserting the cream with the applicator. I could now sell all this information for £*** but I'm a nice guy and I won't. In fact I've already deleted it. But it really is this easy to hack the Webwise system and I think you should tell your ISP. And switch off Webwise. The next person to do this to you might live abroad somewhere like **** or **** and they could well be less honest than me."
Of course I couldn't condone such action...but I expect to see a variety of reports about successful hacking of the system once the trials start, if they ever do.
If a website does this - I wonder if Phorm would claim that the webmaster was acting illegally?
From the tools I've already got from Dephormation, I could probably do something like this with a little work and advice, if I felt like paying for an https certificate. As a charity site I don't think I can justify it, but I hope some anti-Phorm campaigners can come up with something similar before the BT Webwise trials start. After all - trials are for experimenting!