Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[flowrebmit]

Originally Posted by ceedee

Now *that* sounds like a Phorm analogy rather than Webwise.

From the Wikipedia entry I took it to be more akin to a brewery paying a pub landlord to record how many customers requested beer rather than wine.

I didn't notice any suggestion that any de-personalised or even individualised information is passed to Webwise just hugely amalgamated gross totals.
I got the impression that Webwise wouldn't have any clue that you'd personally searched Amazon, let alone for a particular title.

Erm, there is no conduit listening in (i.e. the equivalent of the ISP or Telephone company) in your pub analogy. Your analogy in book shop terms could be, if the book shop sales person says to their boss, "that's the third person who's asked for that book today".

[AlexanderHanff]

Originally Posted by flowrebmit

Erm, there is no conduit listening in (i.e. the equivalent of the ISP or Telephone company) in your pub analogy. Your analogy in book shop terms could be, if the book shop sales person says to their boss, "that's the third person who's asked for that book today".

Incorrect, if Phorm was asking the host of the web site you visit, what you were looking at, it would be the equivalent of the flower shop employee talking to their "boss". The fact that Phorm is "wire-tapping" the "call" makes the Book Shop analogy spot on.

Alexander Hanff

[lucevans]

To quote Richard Clayton's technical article on how Phorm works;

"14. The Layer 7 switch will see that the request does not contain a Phorm “cookie” and
will direct the request to a machine located within the ISP network that will pretend to
be www.cnn.com and will return a “307” response which says, in effect, “you want that
page over there”. The page that will be directed to is webwise.net/bind/?<parameters>
where the parameters record the original URL that was wanted.
"

I seem to remember someone over on The Reg commenting that Apple's Safari browser doesn't accept these 307-redirects, and I think I remember reading somewhere in Phorm's own guff that if your browser isn't one the "94% of browsers in use on the web" then the intercept proceeds no further."

Presumably this is determined by inspecting your browser id string, so wouldn't it be possible to bypass the vast majority of the interception process by either using Safari or spoofing your own browser string? (I know, an interception has still taken place - that of your browser id string- but is it abandoned before any DPI takes place on your traffic content?)

Apologies if this is going over old ground.

[AlexanderHanff]

Originally Posted by lucevans

To quote Richard Clayton's technical article on how Phorm works;

"14. The Layer 7 switch will see that the request does not contain a Phorm “cookie” and
will direct the request to a machine located within the ISP network that will pretend to
be www.cnn.com and will return a “307” response which says, in effect, “you want that
page over there”. The page that will be directed to is webwise.net/bind/?<parameters>
where the parameters record the original URL that was wanted.
"

I seem to remember someone over on The Reg commenting that Apple's Safari browser doesn't accept these 307-redirects, and I think I remember reading somewhere in Phorm's own guff that if your browser isn't one the "94% of browsers in use on the web" then the intercept proceeds no further."

Presumably this is determined by inspecting your browser id string, so wouldn't it be possible to bypass the vast majority of the interception process by either using Safari or spoofing your own browser string? (I know, an interception has still taken place - that of your browser id string- but is it abandoned before any DPI takes place on your traffic content?)

Apologies if this is going over old ground.

The problem with that is that many sites detect the browser User Agent and send a "customised" web page specifically for that User Agent (especially in the world of Web 2.0). So reporting the wrong user agent could effect the way the site is rendered in your actual browser.

For example, if I change my user agent to match the user agent of the iPhone browser (to access BBC iPlayer for example since I use 64bit Linux) it completely cocks up other sites if I try to refresh the page. Example of sites this "breaks" are Gmail and Facebook. I end up getting the page sent in a customized format for a hand held device, which is a pain in the butt to navigate on a desktop PC. In the case of gmail, it actually breaks the page if I switch User Agent in the middle of a session. Because gmail uses AJAX to update your inbox on a regular basis, it sends gmail into an infinite "We have encountered a problem" loop.

Alexander Hanff

[ceedee]

Originally Posted by flowrebmit

Erm, there is no conduit listening in (i.e. the equivalent of the ISP or Telephone company) in your pub analogy. Your analogy in book shop terms could be, if the book shop sales person says to their boss, "that's the third person who's asked for that book today".

That's exactly what I meant: Phorm "listens in" but from what I read, Hitwise does not.
Maybe I'm completely wrong (it has been known occasionally..) but I concluded that Hitwise relies on your ISP collating browsing data into huge, amalgamated (and necessarily anonymous) statistics, unlike Phorm which is totally dependent on targetting individual browsing habits.

[flowrebmit]

Originally Posted by AlexanderHanff

Incorrect, if Phorm was asking the host of the web site you visit, what you were looking at, it would be the equivalent of the flower shop employee talking to their "boss". The fact that Phorm is "wire-tapping" the "call" makes the Book Shop analogy spot on.

Alexander Hanff

But Phorm or Hitwise are not talking to the remote subscriber, they are asking my so called "trusted" data carrier to snoop on my conversation.

I wasn't using the sales person as a conduit to talk to the boss, the sales person was the book shop in that example.

[AlexanderHanff]

Originally Posted by flowrebmit

But Phorm or Hitwise are not talking to the remote subscriber, they are asking my so called "trusted" data carrier to snoop on my conversation.

I wasn't using the sales person as a conduit to talk to the boss, the sales person was the book shop in that example.

I misread your initial post (missed out an "if"). I read it as you were stating the Book Shop analogy was not like Phorm, but in actual fact it is spot on. My apologies.

Alexander Hanff

---------- Post added at 14:43 ---------- Previous post was at 14:28 ----------

Wow my fingers seem to be obsessed with flowers instead of books for some reason...I better check the calendar and make sure it is not a birthday/mother's day/anniversary.

All references I made to flower shops should be replaced with book shop

[OF1975]

Alexander if you go ahead with a chat with kent maybe doing it on irc would be a good idea? What ya think?

[flowrebmit]

Originally Posted by ceedee

That's exactly what I meant: Phorm "listens in" but from what I read, Hitwise does not.
Maybe I'm completely wrong (it has been known occasionally..) but I concluded that Hitwise relies on your ISP collating browsing data into huge, amalgamated (and necessarily anonymous) statistics, unlike Phorm which is totally dependent on targetting individual browsing habits.

Technically, Phorm is not listening in, they have supplied the wire-tapping equipment that your ISP will use to bug all of your internet conversation.

In Hitwise, because of the nature of URLs, something that I tried to explain technically in a previous post, some of your internet conversation is appended to the IP address. The Hitwise web-site was vague by what they meant by methodology, it could mean they supply either "the know how", or the software and/or hardware, to enable the ISP to collect the search terms.

[AlexanderHanff]

Originally Posted by flowrebmit

Technically, Phorm is not listening in, they have supplied the wire-tapping equipment that your ISP will use to bug all of your internet conversation.

In Hitwise, because of the nature of URLs, something that I tried to explain technically in a previous post, some of your internet conversation is appended to the IP address. The Hitwise web-site was vague by what they meant by methodology, it could mean they supply either "the know how", or the software and/or hardware, to enable the ISP to collect the search terms.

According to Phorm PR they are not being passed the data by the ISP, it is their equipment doing the listening and the ISP don't have any access to it other than the fact they can physically touch it.

I guess it boils down to who the Layer 7 network technology belongs too, so far we have been led to believe (through their PR) that it is Phorm's.

Alexander Hanff

[flowrebmit]

Originally Posted by AlexanderHanff

Wow my fingers seem to be obsessed with flowers instead of books for some reason...I better check the calendar and make sure it is not a birthday/mother's day/anniversary.

All references I made to flower shops should be replaced with book shop

No worries, I did wonder if it had anything to do with my username and swapping two of the letters!

[AlexanderHanff]

Originally Posted by flowrebmit

No worries, I did wonder if it had anything to do with my username and swapping two of the letters!

Subliminalalalal messaging......

[flowrebmit]

Originally Posted by AlexanderHanff

According to Phorm PR they are not being passed the data by the ISP, it is their equipment doing the listening and the ISP don't have any access to it other than the fact they can physically touch it.

I guess it boils down to who the Layer 7 network technology belongs too, so far we have been led to believe (through their PR) that it is Phorm's.

Alexander Hanff

Does it matter who owns the bugging device? Our ISPs are only allowed to listen in on our data traffic for network routing purposes. If our ISP or Phorm wire-tap our data traffic for other reasons then isn't it interception as defined by RIPA?

[AlexanderHanff]

Originally Posted by flowrebmit

Does it matter who owns the bugging device? Our ISPs are only allowed to listen in on our data traffic for network routing purposes. If our ISP or Phorm wire-tap our data traffic for other reasons then isn't it interception as defined by RIPA?

You don't need to convince me of that I am in the process of writing a legal article about it.

Alexander Hanff

[lucevans]

Originally Posted by AlexanderHanff

According to Phorm PR they are not being passed the data by the ISP, it is their equipment doing the listening and the ISP don't have any access to it other than the fact they can physically touch it.

I guess it boils down to who the Layer 7 network technology belongs too, so far we have been led to believe (through their PR) that it is Phorm's.

Alexander Hanff

I think that it's the layer 7 DPI kit that Phorm are going to "gift" to the ISP to get around the "none of your personal data is transmitted outside the ISP's network" issue. Once "anonymised" by the "anonymiser" hardware (?also gifted to the ISP by Phorm, and therefore allegedly still "inside" the ISP's network), the profile is then passed outside the ISP's network to the Phorm-owned ad channel server box (which could still be located physically inside the ISP's data centre, but is considered to be outside the ISP's network because it belongs to a third party). Apparently this final relay of data does not include the customer's IP address, so Phorm can claim that they receive no PII about the customer.

None of the above alters the fact that the interception, even if it's done by the ISP, is being done for reasons other than essential maintenance of the network, so is illegal within the terms of RIPA without explicit consent of both parties to the communication.