Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[PhormUKPRteam]

[QUOTE=Stuart C;34506053]You may not store directly linked information, but your systems do process a lot of personal data and it's entirely possible that the system will be (as happened at AOL) hacked, and that link will be made, and the data exploited by scammers. The systems placed in each ISPs network would become a target for hackers.

As for the "benefits" to the consumer. I do not consider advertising (whether targetted or not) to be a benefit. I personally have no problem with advertising (I moderate this site, which is funded by ads, so for me to have a problem with advertising would be hypocritical) but, I can honestly say that I ignore web based adverts, so targetted ads would provide no benefit.

Also, I personally would not benefit from the webwise protection. I am perfectly capable of protecting myself from scams (on and off line), and find the combination of my own intelligence, the anti spyware/virus software on my PC and my browser's own anti phising systems to be more than adequate. I've been browsing since 1994, and do you know how many times I have been caught out? Twice.

The main problem I have with the system is simple. So far three ISPs have been announced as having signed up. Not one of them (AFAIK) has actually asked their users if they want this system. I realise that CPW have said they'll look at ways of routing the data around Phorm's systems if customers opt out, and Virgin appear to be considering their position, but, they've only done this in response to the fuss caused by forums (such as this one) and the media.

Even where they have talked about the system, they've played up the percieved benefits of the webwise system without actually mentioning that the system watches what people are looking at.

[QUOTE]


Webwise doesn't have personal data or clickstream history stored in the same way as Google or AOL, so accidental or malicious disclosure is impossible.

Nobody wants to be bombarded with ads when they are online. In fact if you want to reduce the amount of advertising you see, Webwise is probably the best thing to come along. The reason is simple: you get bombarded with ads because advertisers today have no idea of the interests of the people to whom they are advertising. So the only way they can get any campaign to work is to throw hundreds of ads at you to see what sticks. It is a terrible system. It wastes your time and attention and wastes their money, whilst generating minimal revenue for only a few websites. If advertisers were aware of the product categories which interested viewers, the net result would be far less advertising.

[popper]

its interesting when you say "We've broken the link between targeting and personal information" thats what your pay masters are telling your PR firm i take it !

this post by an AC
http://www.theregister.co.uk/2008/03...rket/comments/
is also interesting, infact it shows you/they have not infact broken the link at all should they chose to use this simple tieing capability.

"
How is it anonymous exactly.

By Anonymous Coward
Posted Wednesday 12th March 2008 02:37 GMT
firstly even if we opt out (As BT customers) the profiler still sees all our traffic. if we are opted out, we have to have a cookie set to say that. this cookie will be set to .webwise.net which is owned by phorm
(http://a.webwise.net/services/OO?op=out).
if you are opted in then the cookie you get is
(http://a.webwise.net/services/OO?op=in) of course.

so if a person opts in..then BT webwise equipment at BT premisess owned by Phorm (assuming they are ONLY doing what they say they are doing) have your UID + browsing history "digest" and not your IP address.

when you visit in "infected" page, then the webserver will have a advert served by webwise.net..so your opt in cookie (which has the UID in it of course) is sent from YOUR machine right to webwise..and of course, you cant help but send your IP address with the TCP data now can you..so how is it that Phorm cannot use the data from BT WEBWISE plus the data from its WEBSITE PARTNERs (by way of html included advert tags) to correlate IP address to UID then?!?

example opt out cookie
HTTP/1.1 200 OK
Date: Wed, 11 Mar 2008 01:31:19 GMT
Server: Apache
Set-Cookie: OPTED_OUT=YES; expires=Fri, 12-Mar-2010 02:33:02 GMT; domain=.webwise.net; path=/
P3P: CP="NOI DSP LAW CURa DEVa TAIa PSAa PSDa OUR STP BUS UNI COM NAV INT"
Content-Length: 0
Connection: close
Content-Type: text/plain
example opt in cookie
HTTP/1.1 200 OK
Date: Wed, 11 Mar 2008 01:31:19 GMT
Server: Apache
Set-Cookie: uid=9sRe3AeRcDDwA2ASDYXXLg||; expires=Thu, 12-Mar-2009 02:33:39 GMT; path=/services/
P3P: CP="NOI DSP LAW CURa DEVa TAIa PSAa PSDa OUR STP BUS UNI COM NAV INT"
Content-Length: 0
Connection: close
Content-Type: text/plain
"

[tpc]

Glad to see this forum has turned to some intelligent debate and well done to Phorm for taking the time to join. I have read a lot of posts wanting to 'shut this down before it ever takes off'. What about the people who see Phorm as providing something of value? At this early stage you only hear the voices of opposition.
Providing Phorm adheres to it's policy of privacy and is regulated, where is the problem? If you don't want it then SWITCH IT OFF!!!!!!!
It's a clear choice.
Personally speaking, I have no problem with Phorm as long as they respect users privacy which from what I can gather, has been one of their primary goals from the beginning.

[Stuart]

Originally Posted by PhormUKPRteam

Webwise doesn't have personal data or clickstream history stored in the same way as Google or AOL, so accidental or malicious disclosure is impossible.

Google, AFAIK, does not store profile info on you UNLESS YOU SIGN IN TO ONE OF THEIR SERVICES. This is one important difference.

Even if you do, you can block the cookie they use (as you can with Phorm). One major difference is that Google don't install hardware at your ISP, so even if they wanted to, they cannot store profile data on you if you block their cookie. If Phorm wish to, this hardware (at least as described in the patent) would allow them to store info regardless of the user's preference, and the user would have no assurance (beyond not being served ads and Phorm's own assurances) that their data is not being stored. With Google, it *is* physically impossible for them to store profile info on you if you block their cookies. With Phorm, it is not. This is another important difference.

In fact, I am tempted to go so far as to say that if you aren't storing this info, you would not need hardware installed at the ISP. Google manages it using a combination of Javascript, cookies and the servers at their various data centres.

Nobody wants to be bombarded with ads when they are online. In fact if you want to reduce the amount of advertising you see, Webwise is probably the best thing to come along. The reason is simple: you get bombarded with ads because advertisers today have no idea of the interests of the people to whom they are advertising. So the only way they can get any campaign to work is to throw hundreds of ads at you to see what sticks. It is a terrible system. It wastes your time and attention and wastes their money, whilst generating minimal revenue for only a few websites. If advertisers were aware of the product categories which interested viewers, the net result would be far less advertising.

You haven't read my post. It does not waste my time, as I ignore them. And if you believe that greater takeup of products as a result of advertising will reduce the amount of advertising, you clearly have never dealt with advertisers.

[bigbadcol]

hi phorm PR people.

Ok bottom line, whi I do not trust what you are saying and never will trust what your are saying, and no amount of posting will change that.


Phorm's boss had a previous history it created RootKits and spread spywear. And you want us to be trusting now!!!!!


remember the 121 media RootKit?

So now you say "Trust us, we are good we will protect you" yeh Right

[Stuart]

Originally Posted by tpc

Glad to see this forum has turned to some intelligent debate and well done to Phorm for taking the time to join. I have read a lot of posts wanting to 'shut this down before it ever takes off'. What about the people who see Phorm as providing something of value? At this early stage you only hear the voices of opposition.
Providing Phorm adheres to it's policy of privacy and is regulated, where is the problem? If you don't want it then SWITCH IT OFF!!!!!!!
It's a clear choice.
Personally speaking, I have no problem with Phorm as long as they respect users privacy which from what I can gather, has been one of their primary goals from the beginning.

Have you read the thread (or even my post above)? Even if we do switch the system off, we have no guarantee that Phorm won't still store our data. If I trusted the company, I wouldn't consider that a problem. However, bear in mind the history of some of the people involved.

to the forum though.

[popper]

Originally Posted by tpc

Glad to see this forum has turned to some intelligent debate and well done to Phorm for taking the time to join.

I have read a lot of posts wanting to 'shut this down before it ever takes off'.

What about the people who see Phorm as providing something of value? At this early stage you only hear the voices of opposition.

Providing Phorm adheres to it's policy of privacy and is regulated, where is the problem? If you don't want it then SWITCH IT OFF!!!!!!!

It's a clear choice.

Personally speaking, I have no problem with Phorm as long as they respect users privacy which from what I can gather, has been one of their primary goals from the beginning.

tpc

and why is it that we dont see the non apposeing end users/partys giving this thread their thoughts that its legal,proper, just plain right to collect,process or store a persons data stream, then profit from this persons data stream without paying the user for its use with a legal contract.

surely by definition, a persons data stream is their personal property to sell or not as the case may be.

how is collecting, processing or copying a persons property and selling that to 3rd partys for profit ,considered anything but comercial piracy?

you ,as an average person (we assume) say "It's a clear choice", but do YOU really understand and accept all (many,any of) the implications this 'interception for sale' means, do all/many of the others also understand?.

[Traduk]

PhormUKPRteam,

Unfortunately yet again you are outlining what just one component of an integrated system cannot do perhaps in the hopes that we may be steered away from the objective of our concerns.

Webwise may indeed be totally benign but it is the packet scanner which profiles users that is the object of concern. If you persist in focusing purely on one component part and avoid discussion on other parts which are of greater concern then you are not really doing justice to yourself, your employer or your audience. It could easily be argued that by avoiding the central issue more harm is done than good.

I do not want my on-line activities scanned for profit. I do not wish to be profiled for profit. I can and will implement blocking of almost all types of advertising. If enough people employ ad blockers on a permanent basis the proposed win\win moves towards lose\lose for everybody.

[mertle]

Originally Posted by SMHarman

You are not thinking of the truly big picture, once you have quad play with VM they know your browsing habits, viewing habits, home and mobile phone calling habits and can target even more effectively. With VOD style viewing they will be able to inject the right adverts into those 30 second blocks for the right viewer.

so true there is worry how far they want to take it.

maybe in the future we will have hidden chips in our glasses which turns all adverts on billboards to personal data targeting.

Anybody getting a sort of The NET film feel to phorm. Next we will have all our identies taken.

Someone actually missed a massive issue to what phorm doing.

What do most sites do to try help protect your identity.

Thats it use a personal question PHORM will know everything about you in probable 1 year and could easily guestimate or even start to know these personal questions.

So now hackers and phorm will be able to get your password logins and even know the personal question to gain access.

I bet as soon as phorm goes live security breaches will increase big time.


ps anybody who has downloaded Dephormation firefox addon there is new update.

http://www.dephormation.org.uk/

---------- Post added at 13:53 ---------- Previous post was at 13:31 ----------

another thought what happens if we do get a true opt-out.

But a business who has a website with BT ISP signs up to phorm and we visit that website.

As an opt out surely we should not get phormed but that business wants us monitored so they can target me with phorm.

We got to remember the net brings cross platform ISP together and does this mean opt out would only be for websites under VM ISP and not others.

It also is a consideration for those who plan to goto ISP who dont want phorm.

As many websites will be in in the phorm you still might actually be profiled despite being opt out or non paticapating ISP the way I see it.

[Altern8]

Originally Posted by tpc

Glad to see this forum has turned to some intelligent debate and well done to Phorm for taking the time to join. I have read a lot of posts wanting to 'shut this down before it ever takes off'. What about the people who see Phorm as providing something of value? At this early stage you only hear the voices of opposition.

This is where both Phorm and their ISP partner's should be selling this product to US, the ISP customers, telling us why we should use their product and how 'it' will benefit us. And then leaving the final decision up to US whether or not use their product.

A number of interviews with Phorm have stated they have had customer feedback wanting this system. As yet, I have not seen any user of this thread saying, 'Yes, Phorm and my ISP have asked my opinion about webwise'. Our ISP's should have at least emailed or have a section on their website telling us about this new and exciting feature that will benefit us.

If Phorm have done a great job of selling the product to us, then we would love to opt-in....and that’s how it should have been....each user should opt-in if they *want* this service and not be opted in automatically.

If the user decides to opt-out, then it should mean that and nothing else. No traffic being routed to the profiler but then ignored.

[the_baby_jebus]

Webwise doesn't have personal data or clickstream history stored in the same way as Google or AOL, so accidental or malicious disclosure is impossible.

Nobody wants to be bombarded with ads when they are online. In fact if you want to reduce the amount of advertising you see, Webwise is probably the best thing to come along. The reason is simple: you get bombarded with ads because advertisers today have no idea of the interests of the people to whom they are advertising. So the only way they can get any campaign to work is to throw hundreds of ads at you to see what sticks. It is a terrible system. It wastes your time and attention and wastes their money, whilst generating minimal revenue for only a few websites. If advertisers were aware of the product categories which interested viewers, the net result would be far less advertising.

ah yes.. the ol' party line.. AOL and google = evil, hundreds/thousands of ads, see what sticks.. getting a mite boring reading that phrase everywhere you look..

fact this PR droid seems to be missing, suprising since enough people have been saying it, is that with google and aol we can vote with our feet and not use them if we wish. having their spyware foisted onto us at the isp where we can do nothing about it (unless anyone fancies storming VM or BT data centres??), and even with the opt-out cookie (an idea up there with Einstein, no, really) no-one is convinced that some form of snoopage isn't going to occur, in fact phorm have told us that our data will be hi-jacked but not read. they have also said that there may be other services (i use the word loosely) heaped upon us.

as has been said before. i use firefox, no script, ad blocker, phishing filters and have trained my brain to ignore adverts already so this will mean nothing to me.. apart from my data will be mirrored to a 3rd party server even if i opt out which, even if i get a gold plated certificate with guarantees up the waazoo, i'm not too chuffed with. and no matter what you say this is spyware, something i take great pains to avoid like a plague

trouble is with cable broadband you don't really have an alternative.. i, as a land line bb customer (i know, ****, shouldn't be on the board, yada yada) i will also be voting with my feet.

[SMHarman]

So, I read the EY report properly this morning. Some thoughts...

• it is performed by EY, LLP 5 Times Sq, in NY, not EY, LLP the UK entity, why? Both have sufficient expertise
• it is performed to AICPA standards, not ICAEW standards
• it is addressed to Phorm inc, 264 W 40th NY, NY. Not Phorm plc 222 Regent St.
• the process as described talks about opt out mechanisms. If this becomes an opt in process as TT are discussing then one of the key aspects has significantly changed (for the better IMHO) but how does that change the security process as auditited.
• the wording of the management control descriptions is interesting. Phorms systems do not use or store. Rather than phorms systems cannot use and store.
• it goes on to say this specific data cannot be accessed by our ISP partners. So our ISP partners are allowing hardware to be injected into their networks on their premises that scans data packets and they cannot see what this hardware is doing!
• Page 4 we have created a privacy policy - well it is easy to create a policy, less easy to stick to it.
• Page 6 Para 6 is it not an inconsistency that the doc says 'for example phorm may tell a merchant that our network contains 50,000 users who have visited a travel website URL in the past six months, but cannot disclose which randomly generated IDs have visited that URL because the information is not stored' yet they say on Page 5 Para 3 (end of) Phorm Service will retain only information about general categories of interest associated with an ID such as IDnnn is interested in travel [to paraphrase]'
• Again Page 5 Para 5 the bullet points Phorm does not collect, not cannot collect or will not collect.
• Page 7 Para 2 For a US report issued by a US firm to a US recipent why is the data protection officer located in the UK?
• Page 7 Para 7 nice clause about export of data to other countries there. 'if you use your computer and usual browser in a country other than your home country to log on to the internet via one of our partner ISPs in that other country, the data Phorm holds in its systems that is associated with that cookie may be automatically transferred to Phorm's systems in that other country.'
• Pages 8 - 13 is a nice piece of padding, basically the AICPA template for creation of a privacy policy. So if you get the Phorm privacy policy it should map nicely to this template.

Page 7 Para 7 nice clause about export of data to other countries there. 'if you use your computer and usual browser in a country other than your home country to log on to the internet via one of our partner ISPs in that other country, the data Phorm holds in its systems that is associated with that cookie may be automatically transferred to Phorm's systems in that other country.'
Gives another scenareo, you take your laptop usually connected to TTs firewalled implementation of Phorm around to your mates for some gaming or whatever and log on to his internet connection which is with VM, now your cookie from Phorm and your data will pass to the phorm harvester. Great.

I don't know where I read it, but someone wrote a great thing about giving data and the benefits of giving. Well I don't need anti-phishing I use IE7 and that has it built in and enabled by default, though the install clearly asks if you want to switch it off as you will be passing data to Microsoft.

I don't mind giving google my data as they give me fantastic search results in return. If they were mediocre results like MS Live then I woudl not be using them. There is a reason Google is the No.1 search engine.

[manxminx]

PhormPRUK said:

Nobody wants to be bombarded with ads when they are online. In fact if you want to reduce the amount of advertising you see, Webwise is probably the best thing to come along.

NO.NO.NO. Have you never heard of a little Firefox plug-in called adblock plus????? That reduces the online adverts I see to ZERO, nada, no adverts!! Can Phorm do that? NO. So Phorm IS NOT probably the best thing to come along.

Don't you Phorm people understand - I don't want adverts - \I don't care if they are targeted or not, the fact is I DON'T WANT THEM, I don't want my browsing intercepted, I don't want Phorm.

Do you not understand that? What I want to do is opt out of the phorm system. In other words, I don't want any Phorm software touching, intercepting or cataloguing either my data or that of my website. I don't want my data being routed to any sort of profiling system. I don't care if you don't collect any data or not, I don't want my traffic intercepted. Is that clear enough?

It's really quite simple, and I am amazed that these Phorm PR people don't understand this.

[popper]

the US 'green eggs and ham' just poped in the old noggin there, shame its not going to turn out like that story though for Phorm or the ISPs.

[TheNorm]

Originally Posted by SMHarman

... a TCP packet contains an envelope or header which everyone needs to read, and a private body ...

If the private body is exposed, is it against the law to view it?

Originally Posted by Traduk

.... Anybody who seals communication within an envelope or packet has the expectancy, under law, that any unlawful or unjustified breach of privacy will be punished under the various laws covering snooping.....

Surely a "sealed communication" would be data sent over https, or otherwise encrypted.

If I carry out a conversation in public, I shouldn't be surprised if people overhear what I'm saying.