Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797] - Page 60

mertle · 09-03-2008, 16:59

I been thinking about the way PHORM works.

I can see what will happen it will cripple VM ISP. Like I said in a past comment it would not be suprised why we have had issues in the past as VM trialed something on monitoring.

Just think of all of us accessing the web and searching, browsing downloading at some point it will have a cap. To boot them spamming all there rubbish adverts to all and sundry. What happens when the PHORM cap hits its limit it will break.

I have been thinking if done by accident by there sheer volume (not exactly hard with VM fragile nature) or deliberately trying to deceive your footprint you can see what will happen. I really can see there will be users flood to try and give false profiling. All this in my opinion WILL slow down the web for VM users and possible cripple it.

In the end VM will scrap it because it WILL become totally unworkable.

I actually think it really will be quite easy to make a false profile by using a program to try deceive your normal browsing.

**Chris** · 09-03-2008, 17:01

Quote:

Originally Posted by lucevans

Well, it looks like the covert "keep one step ahead of the disgruntled customers" game has started, even before the Phorm system goes live on the VM network.
Anyone following this story from the beginning will have read quite early-on that you could at least partially block the functionality (if not the spying part) of the system by blocking a specific domain. 7 days ago, this domain was clearly identified on the www.webwise.com FAQs as "OIX.net" and so I diligently added it to the blocked domains list of my router.
Guess what? I checked back with the same page this morning, and the same FAQ no longer lists "OIX.net" as the domain to block; it now lists "www.webwise.net".
As I pointed out in a (much) earlier post, it will be SO easy for Phorm to change the name of the server in their system, thus bypassing everyone's block. On this occasion, they've buried this change in their FAQs, but in the future, they may well not even do that.
It is becoming clear that if we want to even hinder their system on our connections, we're going to have to constantly check what they're up to and what connections are being made by our browsers - a full time job in itself.

And this Company expects us to trust them.

Perhaps, but this, from their FAQ page, seems straightforward enough:

Quote:

Originally Posted by www.webwise.com

I delete my cookies regularly, and I want to keep Webwise switched off. How do I do that?

If you regularly delete your cookies and want to ensure that Webwise is permanently switched off, simply add "www.webwise.net" to the Blocked Cookies settings in your browser.

Stuart · 09-03-2008, 17:12

Quote:

Originally Posted by Valerie

gosh - it's hard work keeping up with this! Can someone explain how phorm differs from google ads?

Simple: Unless you have signed into a google service on your browser (such as gmail), then google ads are based on the content of the page you are browsing. This is why people sometimes get ads for things they would never normally be interested in. However, no yt

Apparently, if you sign in to any google service (although google don't actually make this clear), then Google ads do track you. I must stress, I don't know for sure if this does happen. As Google's system is entirely based on the ad code on the page, and cookies (as such, it runs on the browser), it is also easy to block (block javascript on the site, or cookies and Googleads is crippled).

The phorm system works differently. For a start, while the system can be configured so that people need to opt in to recieve the ads, or opt out not to recieve them, it is likely that each isp will opt in all it's users by default.

Secondly, Phorm install hardware on the ISP's network that is used to do the tracking, and insert the ads if appropriate.

Now, while they state that they do not store a personally identifiable browsing history (note: regardless of what they say, they do store a history that can be tracked to the user, if they didn't, then the system wouldn't work), we have no way of checking that they aren't storing the data even if they don't serve ads. It is also difficult to stop them. Well, not that difficult if you want to trust system such as TOR, but bearing in mind that due to the anonymous nature of TOR, there are some dodgy people on it, I am not sure it's trustworthy.

mertle · 09-03-2008, 17:21

Quote:

Originally Posted by Chris T

Perhaps, but this, from their FAQ page, seems straightforward enough:

aye peeps might want to be interested that PHORM uses www.godaddy.com where PHORM register from.

which according to my netanlyser. It comes with some interesting servers for OIX.NET

Referral URL: http://registrar.godaddy.com
Name Server: NS1.OIX.NET
Name Server: NS2.OIX.NET

plus some PHORM whois search finds the PHORM servers

Name Server: NS1.PHORM.COM
Name Server: NS2.PHORM.COM

I would assume blocking these absolutely KILLS PHORM at our end. Unless there are others.

lucevans · 09-03-2008, 17:41

Quote:

Originally Posted by Chris T

Perhaps, but this, from their FAQ page, seems straightforward enough:

Yes Chris - that's my point

- it was straightforward enough last week, too, but the domain was different. So how often are they going to change it? Are we going to have to check their FAQs every week to see what we need to block?

mertle · 09-03-2008, 19:13

I THink PHORM IS LIVE. Just shows how much we are being lied too.

How long as it been LIVE.

I just went on a website and this add on program HAS DETECTED a phorm attack with this program going to forum on a footy website.

It said PHORM was present when accessing the forum.

I have noticed 2 cookies

in the grimsby-townfc.premiumtv.co.uk which look EXTREMELY DODGY

cookietest
takeover

what are these above cookies is this opt out an absolute scam that it dont work and these cookies will enter your pc if opt out exists.

If you dare enter here is the forum please enter at own risk make sure your opted out and the firefox add on working. THIS WEB FORUM IS PHORMED.

(just using the link below you actually can bypass PHORM

http://www.extra-gtfc.co.uk/mbp3321885900php/

However go though its main website and enter this forum through

http://www.grimsby-townfc.premiumtv.co.uk/page/Home/

by going to the tag fans then clicking the messageboard actives PHORM code.

which despite my OPT OUT cookie present puts some dodgy looking cookies.

If I find more sites I will post and see if these cookies are PHORM based.

To be honest would not be suprised this is the first instance of PHORM.

If you dare check it out the add on warns you of phorm.

mogodon · 09-03-2008, 19:38

Quote:

Originally Posted by mertle

I THink PHORM IS LIVE. Just shows how much we are being lied too.

How long as it been LIVE.

I just went on a website and this add on program HAS DETECTED a phorm attack with this program going to forum on a footy website.

It said PHORM was present when accessing the forum.

I have noticed 2 cookies

in the grimsby-townfc.premiumtv.co.uk which look EXTREMELY DODGY

cookietest
takeover

what are these above cookies is this opt out an absolute scam that it dont work and these cookies will enter your pc if opt out exists.

If you dare enter here is the forum please enter at own risk make sure your opted out and the firefox add on working. THIS WEB FORUM IS PHORMED.

(just using the link below you actually can bypass PHORM

http://www.extra-gtfc.co.uk/mbp3321885900php/

However go though its main website and enter this forum through

http://www.grimsby-townfc.premiumtv.co.uk/page/Home/

by going to the tag fans then clicking the messageboard actives PHORM code.

which despite my OPT OUT cookie present puts some dodgy looking cookies.

If I find more sites I will post and see if these cookies are PHORM based.

To be honest would not be suprised this is the first instance of PHORM.

If you dare check it out the add on warns you of phorm.

Is it not just because it opens another FF browser? If you right click any link and open in a new browser the dephormation script runs.

popper · 09-03-2008, 19:38

Mertle didnt you send a DPA notice?, if anyone else did and your also seeing what Mertle said, then its perhaps ICO fun time.....

mainlime · 09-03-2008, 19:39

Quote:

Originally Posted by mertle

I THink PHORM IS LIVE. Just shows how much we are being lied too.

Hang on. Run that past me again. Slowly this time.

What makes you think this is anything to do with Phorm? It seems to be because you don't like the names of the cookies. I could call a cookie "dangerous_fbi_interception_cookie" but it wouldn't mean anything.

What program detected a 'phorm attack'? What is a 'phorm attack' anyway?

lucevans · 09-03-2008, 19:49

Quote:

Originally Posted by mertle

I THink PHORM IS LIVE. Just shows how much we are being lied too.

How long as it been LIVE.

I just went on a website and this add on program HAS DETECTED a phorm attack with this program going to forum on a footy website.

It said PHORM was present when accessing the forum.

I have noticed 2 cookies

in the grimsby-townfc.premiumtv.co.uk which look EXTREMELY DODGY

cookietest
takeover

what are these above cookies is this opt out an absolute scam that it dont work and these cookies will enter your pc if opt out exists.

If you dare enter here is the forum please enter at own risk make sure your opted out and the firefox add on working. THIS WEB FORUM IS PHORMED.

(just using the link below you actually can bypass PHORM

http://www.extra-gtfc.co.uk/mbp3321885900php/

However go though its main website and enter this forum through

http://www.grimsby-townfc.premiumtv.co.uk/page/Home/

by going to the tag fans then clicking the messageboard actives PHORM code.

which despite my OPT OUT cookie present puts some dodgy looking cookies.

If I find more sites I will post and see if these cookies are PHORM based.

To be honest would not be suprised this is the first instance of PHORM.

If you dare check it out the add on warns you of phorm.

Don't panic mertle - this doesn't look like Phorm to me. The two cookies you mention: "takeover" just contains "Y" and cookietest contains "ok" - neither of which provide any information useful to the phorm system (one of them would have to contain an ID string, which is not likely to be "Y" or "ok" !!)

popper · 09-03-2008, 19:57

a false positive then , probably quite a few more of those before we're done.

mertle · 09-03-2008, 20:00

Quote:

Originally Posted by mainlime

Hang on. Run that past me again. Slowly this time.

What makes you think this is anything to do with Phorm? It seems to be because you don't like the names of the cookies. I could call a cookie "dangerous_fbi_interception_cookie" but it wouldn't mean anything.

What program detected a 'phorm attack'? What is a 'phorm attack' anyway?

If you check it out and if this addon works you will see what I am experiencing.

I am not sure about the cookies I just want advice if they could be the little pests they may be inocent to phorm. It about trying to seek them out so we know what to block. The website to the forum DOES activate the PHORM script.

As I state PHORM DOES seem to be live now.

Also this website when entering forums the program DETECTS PHORM.

http://s2.excoboard.com/exco/forum.p...b75601093c8c4a

We are told its NOT supposed to be working yet but this actually seems not the case.

Now it could be from BT but I always thought premium TV was NTL.

No doubt bit more browsing will find others out there.

POPPER no it was not me but it does seem we are in a state of War.

mainlime · 09-03-2008, 20:10

OK, so I've figured out that you're talking about the Dephormation plugin. I've installed it and visited those URLs you listed. Nothing happened. No warning.

mertle · 09-03-2008, 20:11

Quote:

Originally Posted by lucevans

Don't panic mertle - this doesn't look like Phorm to me. The two cookies you mention: "takeover" just contains "Y" and cookietest contains "ok" - neither of which provide any information useful to the phorm system (one of them would have to contain an ID string, which is not likely to be "Y" or "ok" !!)

Thanks but whats activating the warning. Something during this click proscess is going to phorm or the program does not work.

I doubt that as this thing never screamed PHORM 2 days ago on the same site. Not a peep from the addon so why tonight. I willl check my router to see what happens.

If you check my other post found another forum which triggers the addon..

Florence · 09-03-2008, 20:17

Quote:

Originally Posted by popper

Mertle didnt you send a DPA notice?, if anyone else did and your also seeing what Mertle said, then its perhaps ICO fun time.....

Where do we send this and what do I have to do to send them the DPA notice. I have spoken on the phone but the person I spoke to kept saying she has no idea what I was on about, never heard anything about it.

I also requested in the news VM webwise feedback thread that none of my internet acces was to be used.