Sunday, November 2, 2014

Verizon’s new found “Super Cookie”

In the recent news we’ve seen various government organizations lobbying for backdoors in all of our technology. The FBI is using scare tactics for congress, trying to demonstrate all the “bad things” phone encryption would cause and absurd claims about how we need this or we’re going to die. Government security organizations are pushing for legislation, and doing anything possible to assist with their losing battle for the surveillance and monitoring of the American people.  All this talk about how things are starting to become more secure, with things like Apple and Google opting to set encrypting mobile information as the default has given many the appearance of hope in this battle for privacy.

Yet behind their customer’s backs, Verizon Wireless has been found to be leaking information and privacy in a manner that you have no control over. Verizon has been subtly altering the web traffic of its wireless customers for the past two years, inserting an extra string of characters into the data flowing between customers and the websites they visit. This string holds a unique identifier that users have absolutely no control over. This is geared towards Verizon ramping up data collection of its wireless customers, tracking their personal information and web habit for more tailored advertisements and data that can be sold to third parties.

Although this has been occurring for the past 2 years, it has only become apparent in the past week. A member of the EFF (Electronic Frontier Foundation) noticed a Verizon “super cookie” modifying their traffic. This Unique Identifier Header, or UIDH, broadcasts your unique identity across the web, even if you opt-out of Verizon’s programs. Anyone can easily track a user, regardless of cookie blocking and other privacy protections. No relationship with Verizon is required; any site can do it without any knowledge or consent of their user.

While Verizon offers privacy settings, they don’t prevent sending the header. All they do is, possibly, stop from Verizon selling your information. Their program is legitimate, and they even have a program that rewards you for allowing Verizon to track you and use your information. They state that if you opt-out of their relevant ad program they won’t use the header to pitch targeted ads, yet that’s completely irrelevant since you’re broadcasting a unique identifier to every website you visit regardless. There is virtually no way to disable this besides using a third-party VPN network, and other complicated methods.

We see our ISPs as trusted connectors for users, and they shouldn’t be modifying our traffic to the internet in any manner. What Verizon is doing is completely unethical and immoral, and an obvious exploitation of their power as the biggest wireless provider in the US. What frightens me is that we are moving towards a world where as a consumer, we are no longer to expect any form of privacy as the standard. It isn’t simply us going from point A to point B, and worrying about being watched by the NSA or someone, or point B telling someone else that we came from point A, but now even going through a completely different path without our knowledge or consent to get to our destination.


No comments:

Post a Comment