Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[jca111]

Bye guys - off on holiday now for a week. To a place with no internet! Shock - do they still exist!!!!

I'm gonna miss this - I was getting into it. I'll have a lot of posts to read when I get back.

At least Kent and his posse cant see what I am up to for the next few days.... he he!

[manxminx]

Originally Posted by jca111

Bye guys - off on holiday now for a week. To a place with no internet! Shock - do they still exist!!!!

Outer Mongolia? Northern Siberia?

Have a good one, we'll hold the fort while you're away!

Ali.

[mark777]

Anyone here involved in the on-line games community?

I know nothing about it other than it is a big group of internet users who probably frequent their own forums.

Does anyone know where the main forums are and if Phorm has been raised in them?

Might be worth hitting them, with links to inphormationdesk and the Downing Street petition.

[3x2]

not to mention any adverse impact on Virgin Media's reputation, are (and will remain) an important element in our deliberations.

Bit late for that guys - did you think we had forgotten you? Your silence on the issue simply appears as "lets wait and see what happens to BT" Not exactly the assurance we have been waiting for.

Customers will not be forced to use the system,

And how exactly can we be assured that this will be the case. Do we get periodic, independent assessment? Or perhaps you want us to simply take you at your word? I have the same trust in VM as I do in BT.

[Florence]

Originally Posted by mark777

Anyone here involved in the on-line games community?

I know nothing about it other than it is a big group of internet users who probably frequent their own forums.

Does anyone know where the main forums are and if Phorm has been raised in them?

Might be worth hitting them, with links to inphormationdesk and the Downing Street petition.

www.thesgl.com
www.enemydown.co.uk
http://www.devotii.com/
http://www.tnwagroup.com/
Also no electronic sports gaming community would go without sometime booking a HLTV for big games but his company is UK but then again you will get larger coverage. http://www.hltv.org/?pageid=15

[mark777]

Originally Posted by Florence

www.thesgl.com
www.enemydown.co.uk
http://www.devotii.com/
http://www.tnwagroup.com/
Also no electronic sports gaming community would go without sometime booking a HLTV for big games but his company is UK but then again you will get larger coverage. http://www.hltv.org/?pageid=15

Thanks Florence. I shall have a look and do some posting and, I expect, fell very old!

[jca111]

Originally Posted by jca111

Hi - I think we need to spread the profile of this story outside of Technical News sites (like The Register, BBC Technical section etc).

Today I have emailed Radio 4s Today Programmme, World at One, PM, Click and even Newsnight the following email. Please advise if there are other places we should be sending it.

I just had a reporter from BBC Click on the phone to me - because of the email I sent off.

They are doing a report on Phorm, and sounds like they may be at the meeting next week. Wish I wasn't going on hols now!

[CaptJamieHunter]

Originally Posted by jca111

I just had a reporter from BBC Click on the phone to me - cause of the email I sent off.

They are doing a report on Phorm, and sounds like they may be at the meeting next week. Wish I wasn't going on hols now!

Hope you enjoy your holiday! Where are you going that has no internet? Sounds like something I could do with - cold turkey sans net!

[AlexanderHanff]

Just a quick update on the article.

I have just finished the DPA and will (after a cup of coffee) be starting on Copyright, Designs and Patents Act 1988 in the next hour. Once I complete that section I only have the Council of Europe's Convention on Cybercrime and my conclusion to write.

I was hoping to have finished already but I had some family matters to deal with earlier today which delayed my schedule a little. I am still confident I will have the first draft finished today (or early hours of tomorrow morning at the latest).

I have uploaded the updated version but be aware I haven't spell checked or proof read it properly yet so there may be some silly errors.

Alexander Hanff

[bishbosh]

http://www.bbc.co.uk/blogs/technolog...ish_phorm.html

In the comments: A Possibility?

Webwise works by having a layer 7 switch intercept and impersonate the client and server requests on the network: -

You browse to a secure site

The switch takes this request and passes it to the site as its own, adding the Webwise cookie.

When the site responds with its public encryption key, the switch strips the public key for the site out, adds its own public key and forwards the request to you.

Even when you exchange a private key, the switch will also intercept this, (seeing it already has the public key) create its own private key and use its key to communicate with your 'secure' website.

Meanwhile, all this decrypted data is being forwarded into Webwise for 'processing'. This is the fatal flaw with SSL.

If your ISP or your network admin wants to 'snoop' on your browsing, they can.

Bear in mind that you can send certificates in the post on a USB stick, however, header information is NOT encrypted - so they can still see which sites you are visiting, even if they can't decrypt the traffic being sent.

[AlexanderHanff]

Originally Posted by bishbosh

http://www.bbc.co.uk/blogs/technolog...ish_phorm.html

In the comments: A Possibility?

Webwise works by having a layer 7 switch intercept and impersonate the client and server requests on the network: -

You browse to a secure site

The switch takes this request and passes it to the site as its own, adding the Webwise cookie.

When the site responds with its public encryption key, the switch strips the public key for the site out, adds its own public key and forwards the request to you.

Even when you exchange a private key, the switch will also intercept this, (seeing it already has the public key) create its own private key and use its key to communicate with your 'secure' website.

Meanwhile, all this decrypted data is being forwarded into Webwise for 'processing'. This is the fatal flaw with SSL.

If your ISP or your network admin wants to 'snoop' on your browsing, they can.

Bear in mind that you can send certificates in the post on a USB stick, however, header information is NOT encrypted - so they can still see which sites you are visiting, even if they can't decrypt the traffic being sent.

Sounds like the classic "Man in the Middle" attack to me and yes not only possible but heavily documented and researched by security professionals and academics around the world.

Alexander Hanff

[mark777]

Originally Posted by bishbosh

http://www.bbc.co.uk/blogs/technolog...ish_phorm.html

In the comments: A Possibility?

Webwise works by having a layer 7 switch intercept and impersonate the client and server requests on the network: -

You browse to a secure site

The switch takes this request and passes it to the site as its own, adding the Webwise cookie.

When the site responds with its public encryption key, the switch strips the public key for the site out, adds its own public key and forwards the request to you.

Even when you exchange a private key, the switch will also intercept this, (seeing it already has the public key) create its own private key and use its key to communicate with your 'secure' website.

Meanwhile, all this decrypted data is being forwarded into Webwise for 'processing'. This is the fatal flaw with SSL.

If your ISP or your network admin wants to 'snoop' on your browsing, they can.

Bear in mind that you can send certificates in the post on a USB stick, however, header information is NOT encrypted - so they can still see which sites you are visiting, even if they can't decrypt the traffic being sent.

I've tried posting there in the last hour and it fell over. The BBC has admitted to some technical problems with posting to it's blogs. It may work for you though.

---------- Post added at 21:36 ---------- Previous post was at 20:36 ----------

Originally Posted by bishbosh

Bear in mind that you can send certificates in the post on a USB stick, however, header information is NOT encrypted - so they can still see which sites you are visiting, even if they can't decrypt the traffic being sent.

So should we all be asking our banks to do so? Perhaps VM should send us one for their webmail site? Just a thought.

---------- Post added at 21:44 ---------- Previous post was at 21:36 ----------

"Home Secretary Jacqui Smith will be in Downing Street on 17 April for a live webchat from 14:00 BST.

* Log in and post your question

Jacqui will take questions on her remit as Home Secretary with a focus on the Border Agency and the neighbourhood policing teams operating in your area."

Perhaps there are some other questions to answer as well?

http://www.number10.gov.uk/output/Page15259.asp

[AlexanderHanff]

Originally Posted by mark777

I've tried posting there in the last hour and it fell over. The BBC has admitted to some technical problems with posting to it's blogs. It may work for you though.

---------- Post added at 21:36 ---------- Previous post was at 20:36 ----------



So should we all be asking our banks to do so? Perhaps VM should send us one for their webmail site? Just a thought.

---------- Post added at 21:44 ---------- Previous post was at 21:36 ----------

"Home Secretary Jacqui Smith will be in Downing Street on 17 April for a live webchat from 14:00 BST.

* Log in and post your question

Jacqui will take questions on her remit as Home Secretary with a focus on the Border Agency and the neighbourhood policing teams operating in your area."

Perhaps there are some other questions to answer as well?

http://www.number10.gov.uk/output/Page15259.asp

My Question:

Why has the Home Secretary failed to initiate a criminal investigation of the covert trials BT ran to test the new advertising technology from Phorm Inc. in 2006/2007; given that the trials contravened:
Regulation of Investigatory Powers Act 2000 (s1)
Computer Misuse Act 1990(s3)
Fraud Act 2006 (s2)
Copyright, Designs and Patent Act 1988 (s107 (criminal infringement))

Does the Home Secretary believe that large corporate entities are immune and above criminal law?

Alexander Hanff

[CaptJamieHunter]

Originally Posted by mark777

I've tried posting there in the last hour and it fell over. The BBC has admitted to some technical problems with posting to it's blogs. It may work for you though.

"Home Secretary Jacqui Smith will be in Downing Street on 17 April for a live webchat from 14:00 BST.

* Log in and post your question

Jacqui will take questions on her remit as Home Secretary with a focus on the Border Agency and the neighbourhood policing teams operating in your area."

Perhaps there are some other questions to answer as well?

http://www.number10.gov.uk/output/Page15259.asp

If enough of us visit and log a question then we may well get a response. I've logged a question there.

The BBC blog sites have been almost unusable for me recently. Wonder if it's something to do with me being a Linux user?

[AlexanderHanff]

Originally Posted by CaptJamieHunter

If enough of us visit and log a question then we may well get a response. I've logged a question there.

The BBC blog sites have been almost unusable for me recently. Wonder if it's something to do with me being a Linux user?

Probably all those Wii owners using iPlayer and eating up all the BBC's bandwidth

Alexander Hanff

---------- Post added at 22:05 ---------- Previous post was at 22:03 ----------

Anyway, Copyright section is now completed. Just the Council of Europe's Convention on Cybercrime and my conclusion to go Its been a long haul and I fear I will never be able to remove the OPSI logo from my retinas, but hopefully it has been worth it, I know it has for me.

Alexander Hanff