Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

Originally Posted by AlexanderHanff

I have a much simpler method of making a web tripwire. With the beauty of AJAX it should be simple enough to generate an MD5 checksum for each individual web page then use AJAX to check if the page matches the MD5 checksum when it arrives at the users browser. If it doesn't match, simply place a HUGE RED "YOU ARE BEING SPIED ON!" banner at the top of the page

In fact it should be possible to create a firefox extension/addon to do it.

Alexander Hanff

That might be a bit too simple, though. as I read it, pages can be interfered with - legitimately - by adblockers, pop-up blockers, etc. I've not looked in detail at how the web tripwires work, but the authors seem to have some comprehensive data indicating WHAT has changed the pages.

[AlexanderHanff]

Originally Posted by JohnHorb

That might be a bit too simple, though. as I read it, pages can be interfered with - legitimately - by adblockers, pop-up blockers, etc. I've not looked in detail at how the web tripwires work, but the authors seem to have some comprehensive data indicating WHAT has changed the pages.

I am not sure on this but I -think- adblock+ changes the page in real time as it is displayed in the browser, so in theory the downloaded version of the page (in which ever temp folder is used on your particular system) should be the same as the one on the original host. This means adblock shouldn't effect a checksum check.

Maybe someone can clarify this?

Alexander Hanff

[Cobbydaler]

Details of how adblock+ works can be found here...

[AlexanderHanff]

Originally Posted by Cobbydaler

Details of how adblock+ works can be found here...

"A content policy is simply a JavaScript (or C++) object that gets called whenever the browser needs to load something."

That seems to match my theory. So it seems the entire page is downloaded and the content policy is applied once it is loaded by the browser in real time as opposed to making physical changes to the file.

Alexander Hanff

[ceedee]

Originally Posted by AlexanderHanff

On a side note, I slept soooooooooooo fine last night so I am nice and refreshed. I think I came up with an angle for the UK version of Computer Misuse Act 1990 in one of my dreams, I will be adding it to my article this afternoon. (Yes I actually dream about Phorm, I will do my penance later)

That's good to hear: you deserve a decent night's sleep at least once a week!
Shame it's a Sunday -- you sound as though you're on phine phorm to have that chat with Kent...

Talking of which, if you do get him on Skype sometime I wonder if you'd consider recording the conversation for future distribution?
If nothing else, it would make transcribing much simpler!

There's a useful summary of available applications at "How to Record Skype Conversations: Tools, Resources, Tips"

[AlexanderHanff]

Originally Posted by ceedee

That's good to hear: you deserve a decent night's sleep at least once a week!
Shame it's a Sunday -- you sound as though you're on phine phorm to have that chat with Kent...

Talking of which, if you do get him on Skype sometime I wonder if you'd consider recording the conversation for future distribution?
If nothing else, it would make transcribing much simpler!

There's a useful summary of available applications at "How to Record Skype Conversations: Tools, Resources, Tips"

I don't have Skype, in fact I am not even sure if it is available for 64bit Linux. If we have a SIPS call it won't be with Skype.

If I have a chat with him I will lay out my terms in an email first stating that I will be recording the call and making a copy available online and if they are not happy with that a call won't happen.

Personally I would prefer to have a live chat with him for a number of reasons:

1. It can be logged so I don't have to spend hours transcribing it
2. I can formulate my questions first and cut and paste them into the chat so I don't forget anything or go off on a tangent.
3. It is -much- easier to keep your emotions in check in an Internet chat than it is on the telephone.

Alexander Hanff
Edit: Let's not forget also that Skype has a backdoor in it to enable the feds to monitor calls which cross the threshold between SIPS and PSTN as enforced by the FCC back in about oooo 2005 I think...

"The FCC specified in an August 5 release that VOIP providers that interconnect with the PSTN must facilitate wire taps within 18 months of the release of the order (see FCC Requires VOIP E911). So at least the PSTN-connected “SkypeOut” portion of Skype’s business appears to be on the hook for compliance under the CALEA laws.

But the DOJ wants more. The Department of Justice's response to the FCC's August 5 announcement, it cheered the commission for progress made, but said, in effect, the work is not yet done (see The FCC Plays Musical Chairs).

The FCC's official order will arrive this month, sources say, and it will likely put more color around the new CALEA rules. But the Commission too seems to acknowledge that the issue is not yet settled. On the same day the new order was announced, it issued another notice of proposed rulemaking (NPRM) asking for a new round of comments on CALEA."

(source: http://www.lightreading.com/document.asp?doc_id=79570 )

Which is exactly why I refuse to use Skype.

[ceedee]

Originally Posted by AlexanderHanff

I have a much simpler method of making a web tripwire. With the beauty of AJAX it should be simple enough to generate an MD5 checksum for each individual web page then use AJAX to check if the page matches the MD5 checksum when it arrives at the users browser. If it doesn't match, simply place a HUGE RED "YOU ARE BEING SPIED ON!" banner at the top of the page

In fact it should be possible to create a firefox extension/addon to do it.

But would that work for those of us who will have blocked the webwise domain or, at least, told VM not to 'inspect' our browsing data?
Surely, we won't be getting modified webpages back from sites with OIX adverts?

Won't we need something that'll simply detect the repeat HTTP redirects or weird cookie activity?

[flowrebmit]

Originally Posted by ceedee

Maybe I've misunderstood the basics of how Hitwise operates?
The difference that I'd consider makes Hitwise less dangerous than Phorm is that they only receive amalgamated data from the ISPs (rather than 'personalised and maybe anonymous' data for Phorm) and, for their saleable statistics, they're only interested in very large datasets.

I've no objection to, say, Amazon knowing that 10% of all VM users visited a bbc.co.uk webpage every day. Or that only 0.0001% (me) reads my blog every week...

I'd put that on about the same level as Google knowing almost every move I make!


Go on, burst my security bubble?

http://www.hitwise.com/who-we-are/co...fact-sheet.php
"Since 1997, Hitwise has pioneered a unique, network-based approach to Internet measurement. Through relationships with ISPs around the world, Hitwise’s patented methodology anonymously captures the online usage, search and conversion behavior of 25 million Internet users."

Keywords hilighted above. Were the users on those ISPs informed that their online usage and searches were being sold to a marketing company? Did they have the option to opt-out?

Why I think the collecting of a URL clickstream is just as bad as Phorm DPI full page scanning:

Your ISP, like your telephone provider, is supposed to just be a conduit for the conversation, it isn't entitled to listen in and profit directly on your conversation (there is an exception, that an ISP may listen in for the express purpose of network routing for such purposes as managing high bandwidth data (e.g. streaming of films) that would otherwise impact low bandwidth activities (e.g. collecting email).

A search based clickstream consists of two parts, the telephone number and the question that you are asking. Let's look at an example for a well known book seller,

http://www.amazon.co.uk/s/ref=nb_ss_...0&Go.y=0&Go=Go

The first part of the URL, http://www.amazon.co.uk is the equivalent of a telephone number. If you look up the name of a book shop in your local town in the telephone directory, you'll hopefully find the telephone number. The equivalent online is performed automatically by the web browser, it asks a DNS (a sort of IP address "telephone" directory) for the IP address for Amazon.

The question that I want to ask my local book shop is do you have products with Bewitched in the title? Online I would enter my question, the search term "Bewitched" into a box on the web page, but when you press <Enter> or click "Go!", your search term is converted into part of a URL s/ref=nb_ss_w_h_/202-2376015-4728622?url=search-alias%3Daps&field-keywords=Bewitched&Go.x=0&Go.y=0&Go=Go. In my opinion, the ISP has no right to record, use or directly profit from my question.

The equivalent for a telephone, would be if my local telephone exchange was being wire-tapped, and a marketing company was listening in on my conversation with my local book shop, recording or using that conversation would be illegal in the UK.

[ceedee]

Originally Posted by AlexanderHanff

Personally I would prefer to have a live chat with him for a number of reasons:

1. It can be logged so I don't have to spend hours transcribing it
2. I can formulate my questions first and cut and paste them into the chat so I don't forget anything or go off on a tangent.
3. It is -much- easier to keep your emotions in check in an Internet chat than it is on the telephone.

Oh, a chat session would be far more interesting from my perspective.
I only brought up Skype because it was previously mentioned.

[AlexanderHanff]

Originally Posted by ceedee

Oh, a chat session would be far more interesting from my perspective.
I only brought up Skype because it was previously mentioned.

Fair enough. You would be amazed how many people don't know about the wire-tap backdoor in VOIP software. Rule of thumb, if you want to use VOIP choose a provider that is -not- based in the US. As far as I am aware no such rulings have ever been made in the EU.

Alexander Hanff

[ceedee]

Originally Posted by flowrebmit

The equivalent for a telephone, would be if my local telephone exchange was being wire-tapped, and a marketing company was listening in on my conversation with my local book shop, recording or using that conversation would be illegal in the UK.

Now *that* sounds like a Phorm analogy rather than Webwise.

From the Wikipedia entry I took it to be more akin to a brewery paying a pub landlord to record how many customers requested beer rather than wine.

I didn't notice any suggestion that any de-personalised or even individualised information is passed to Webwise just hugely amalgamated gross totals.
I got the impression that Webwise wouldn't have any clue that you'd personally searched Amazon, let alone for a particular title.



Edit: Apologies -- read Hitwise for Webwise -- there's just too much wise around today!

Originally Posted by ceedee

Now *that* sounds like a Phorm analogy rather than Webwise.

From the Wikipedia entry I took it to be more akin to a brewery paying a pub landlord to record how many customers requested beer rather than wine.

I didn't notice any suggestion that any de-personalised or even individualised information is passed to Webwise just hugely amalgamated gross totals.
I got the impression that Webwise wouldn't have any clue that you'd personally searched Amazon, let alone for a particular title.

For Webwise, read Hitwise??

[ceedee]

Originally Posted by AlexanderHanff

Fair enough. You would be amazed how many people don't know about the wire-tap backdoor in VOIP software. Rule of thumb, if you want to use VOIP choose a provider that is -not- based in the US. As far as I am aware no such rulings have ever been made in the EU.

I use sip and mobile phones, email and IM.
And wouldn't use any of them to discuss something that I wouldn't mind talking about in the proverbial crowded room of strangers.

If it's not encrypted -- don't trust it.
If it is -- don't rely on it.

[AlexanderHanff]

Originally Posted by ceedee

I use sip and mobile phones, email and IM.
And wouldn't use any of them to discuss something that I wouldn't mind talking about in the proverbial crowded room of strangers.

If it's not encrypted -- don't trust it.
If it is -- don't rely on it.

I run my own email server, and will be adding my own jabber server this summer. I also run my own Asterisk server. With EU data retention laws in place I won't use "public" services.

Lets not even get me started on Echelon.

As for mobile phones, I cancelled mine at Christmas (after 8 years) due to the activation of clauses in RIPA in late October which require all mobile operators to log and retain:

1. Who made a call.
2. Where the call was made from (geographical location based on triangulation from cell towers as opposed to phone number)
3. Who received the call.
4. Where the call was received (triangulation again)
5. The time and duration of the call.

Orange are constantly harassing me to pay them for the rest of my contract but I refuse. I would rather go to court and argue my case.

Alexander Hanff

[Stuart]

Originally Posted by ceedee

Now *that* sounds like a Phorm analogy rather than Webwise.

From the Wikipedia entry I took it to be more akin to a brewery paying a pub landlord to record how many customers requested beer rather than wine.

I didn't notice any suggestion that any de-personalised or even individualised information is passed to Webwise just hugely amalgamated gross totals.
I got the impression that Webwise wouldn't have any clue that you'd personally searched Amazon, let alone for a particular title.

It's worth noting that even if Phorm don't use your personal data for anything, that the system does deal with personal data at some point. That point will be an attraction to hackers (after all, it will contain personal details for thousands of people which may well include credit card details).