 SUMware Premium join:2002-05-21
| reply to ilago Re: ISP Based Contextual Advertising
said by ilago :Thanks SUMware, I've been following the Register information fairly closely No problem. Kinda stumbled upon that Reg page without expecting it.
said by ilago :As far as I can see from the Hardware Architecture Diagram, there is NO way that the first hop can avoid the Phorm interception, regardless of the protocol being used for accessing the network. It is the Phorm equipment, not the ISPs, determining whether you've opted out. Yep. Agreed. Do ya think we can trust them? 
said by ilago :I find giving a known malware developer access to all users' internet activities at hardware level in the name of advertising to be appalling. Yes, absolutely.
As you've previously indicated, it's amazing that this stunning issue, and its related security/privacy/technology/legal implications, haven't (yet?) attracted the attention that it deserves. Even here many readers seem to be ignoring this.
Your post did attract my attention immediately. Thanks again! |
|
 SUMware Premium join:2002-05-21
| reply to ilago Security firms split over Phorm classification
Keeping score: an update from The Register 14th March 2008 - quote: Security firms are split about whether they will classify Phorm's targeting cookies as adware.
Kaspersky Lab, whose anti-virus engine is licensed to many other security vendors, said it would detect the cookie as adware. However, AVG, developer of the most widely used free of charge anti-virus scanner, said it would not detect Phorm's cookie even though the Czech firm's CTO Karel Obluk describes the technology as "borderline".
As previously reported, Trend Micro said there was a "very high chance" that it would add detection for the tracking cookies as adware. PC Tools echoed Trend's concerns about privacy and security, urging Phorm to apply an opt-in approach.
Specialist anti-spyware firm Sunbelt Software also expressed concerns, saying Phorm's tracking cookies were candidates for detection by its anti-spyware software.
Webroot, another prominent anti-spyware firm, reported difficulties at getting samples of Phorm's tracking cookies for evaluation purposes.
We polled a number of security firms on their attitudes to Phorm. We are waiting for responses from Symantec and McAfee, the two largest anti-malware vendors, as well as Check Point, which markets the popular Zone Alarm personal firewall.
|
|
  ilago Premium join:2005-06-28 Australia
·Internode
| A further reference I dug up which is somewhat scary if anyone doesn't think this has further to go.
quote: Hi all,
I've been seeing lots of hits from Russia on Dephormation.org.uk from IP address 78.110.48.130. Badphorm.org.uk is getting the same.
»groups.google.com/group/news.adm···f106739b
Phorm's share price seems to be taking a dive, but that doesn't mean this issue is going away. |
|
 SUMware Premium join:2002-05-21
| Well, that puts a potentially very interesting spin on things!
Today's news: BT confesses lies over secret Phorm experiments 17th March 2008 - quote: BT has admitted that it secretly used customer data to test Phorm's advertising targeting technology last summer, and that it covered it up when customers and The Register raised questions over the suspicious redirects.
The national telecoms provider now faces legal action from customers who are angry their web traffic was compromised.
FIPR claims Phorm technology breaches UK law March 17, 2008 - quote: The Foundation for Information Policy Research (Fipr) has issued an open letter to the Information Commissioner Richard Thomas, claiming that Phorms ad serving technology is illegal in the UK.
According to Nicholas Bohm, general counsel at Fipr, both parties must consent to interception in order for it to be lawful, according to the Regulation of Investigatory Powers Act.
He says that Phorms system is like the Post Office opening letters to see what the recipient is interested in, and then targeting them with relevant junk mail.
|
|
  ilago Premium join:2005-06-28 Australia
·Internode
| In amongst the "usual" on Slashdot today was this little gem in a thread on Tim Berners-Lee objections.
»yro.slashdot.org/comments.pl?sid···22777122
Whole thread also has some other references that are starting to pull more of the story together »yro.slashdot.org/article.pl?sid=···/1259234
Thanks for the Techwatch link, I hadn't got to that one yet  |
|
 SUMware Premium join:2002-05-21
| said by ilago :In amongst the "usual" on Slashdot today was this little gem in a thread on Tim Berners-Lee objections. I'd read the Berners-Lee piece at BBC "Web creator rejects net tracking". Thanks. This article "Some notes from the Phorm sales pitch" is excellent and highly revealing! Great post. Thank you. |
|
 Mele20 Premium join:2001-06-05 Hilo, HI
| God, that article is absolutely bone chilling.
From the above article:
"Even if Phorm is stopped dead tomorrow, the business conditions and legal loopholes are still present to encourage ISPs to try this again and again, and it will certainly be much worse in the US where there is absolutely no legal protections at all, and a ready market for personal data."
I'm sure my ISP (big cable company) is probably salivating at the idea of using this. I installed the Dephormation Firefox extension but it only protects Fx if my ISP were to institute this. Phorm could read everything else on my computer including emails and Instant Messaging. From other posts in this thread, I read which AV vendors will be detecting the phorm cookies and which won't (AVG!) and my AV vendor was not mentioned so I have posted in the Avira forum and asked if they are/will block the cookies and if they say "no" then I will get another AV that does.
The truly depressing and frightening thing here though is that while Phorm may die after what Berners-Lee and others are saying, it will only mean they will reincarnate later with a different name, and slightly different approach, and the ISPs, especially here in the USA, will try again to institute this total tracking of their users and it will easier going here. -- "The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason |
|
  ilago Premium join:2005-06-28 Australia
·Internode
| reply to SUMware quote: This article "Some notes from the Phorm sales pitch" is excellent and highly revealing!
*mind boggling* when you think about how they are doing it. They will be completely untouchable legally once the information leaves the ISP, regardless of the national laws the ISPs are operating under.
I wish I could believe that this is only three ISPs in the UK. I think Phorm have doing a lot of hard work below the radar. I don't think for a moment there is no return on this for them.
 |
|
 Just Basics
join:2003-06-08 Painter, VA
| reply to ilago Re: ISP Based Contextual Advertising
Many of use have already given our ISP the rights to do most anything they want by using their services. I don't use them but here is the T.O.S. from NetZero as an example:
Collection and Use of Personal Information. NetZero will collect, store, compile and utilize information about you, your computer, your phone number and your use of the NetZero Services including, without limitation, information regarding the Web sites you visit and information that you provide in response to NetZero questionnaires, surveys and registration forms. NetZero may provide this information to third parties including advertisers, clients, marketing organizations and others as further set forth in NetZero's Privacy Statement.
Again, I don't use NetZero but my ISP has a similar T.O.S. - check yours and you may be surprised at what you will find.
Some ISP's are already using:
»www.nebuad.com/ »www.adzilla.com/
My ISP was using the Coretel network and the transparent proxy from adzilla - here is a link to a rant about their services:
»www.sendcoffee.com/minorsage/adzilla.html
A way to detect any page changes made by your ISP:
»vancouver.cs.washington.edu/#results
I've never seen any but I still check occasionally. |
|
  CalamityJane Premium,VIP,MVM join:2002-08-27 Eustis, FL
| reply to ilago Oh wow, I had never heard of Phorm until one our Researchers asked me to proofread a blog post he was preparing for the Lavasoft Research Blog. He was livid about this practice (and his blog post was just fine ) »www.lavasoft.com/support/securit···g/?p=203
He was wondering if he was ranting too much LOL.
I'll be sure to point him to this topic! Thanks guys, I know he'll be interested. -- It takes a disaster to make a woman out of a female Microsoft MVP/Windows Security 2003-2008 Proud Member of ASAP (Alliance of Security Analysis Professionals) |
|
  ilago Premium join:2005-06-28 Australia
·Internode
1 edit | quote: My ISP was using the Coretel network and the transparent proxy from adzilla - here is a link to a rant about their services:
»www.sendcoffee.com/minorsage/adzilla.html
A way to detect any page changes made by your ISP:
»vancouver.cs.washington.edu/#results
Thanks Just Basics the detection page is an excellent way to pick up the html changes. My ISP has reasonable ToS for the time being and Australia isn't a big target for advertising yet, but it will come. We have proposals at Government level for the same type of hardware level filtering. To be used as a control against open access to "unsuitable" material 
That's not quite the same issue, but just as serious in a different way and it's why I started researching this issue.
quote: He was wondering if he was ranting too much LOL.
I think he was being very restrained CJ 
edit: corrected Just Basics handle |
|
  ilago Premium join:2005-06-28 Australia | reply to ilago I wonder when the "Phorm Comms Team" or the "Tech Team" will post in this thread?
They have posted in almost every other forum I've found that relates to Phorm. |
|
 Mele20 Premium join:2001-06-05 Hilo, HI
| reply to Just Basics That page says it detected a change on every page. But it is a poorly constructed web page with nothing to click on to see the "further information". Plus, what is there is text on top of text and boxes on top of boxes. I assume that the changes it picked up were from the Proxomitron. I used Fx 1.5 which is my main browser. It said it assumes one uses a "modern" browser and only evidently likes Fx 2. Well, Fx2 has just been proven yet again to be inferior to 1.5 privacy wise. That page should accept Fx 1.5 I think. I'm not sure the version of Fx is why there is nothing clickable there. The page refused to stop loading also even when it said "done" in the status bar. -- "The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason |
|
 Just Basics
join:2003-06-08 Painter, VA
| reply to ilago Taken from a discussion at this link: »www.digitalspy.co.uk/forums/show···t=759341 ----------- Quote Whether you "opt-out" by having the actual "opt-out cookie" or by simply blocking Phorm/Webwise cookies, your data is still mirrored to the "Profiler" equipment located at the ISP, which although allegedly owned by the ISP still runs Phorm's software & exists solely to profile your browsing data. "Opting-out" just means that you don't get the "benefit" of targeted adverts, plus allegedly your data does not pass from the "Profiler" to Phorm's own servers. End quote
Quote I think this is the much more worrying side to the problem, and something a lot of people seem to be missing. The opt-out given by Phorm really isn't an opt-out at all - it stops the targeting advertising, but all your requests are still going through their servers, you no longer have a direct internet connection, and they still get to profile you.
The cookie and the firefox addon are just saying "dont show me targetted advertisements", it isn't stopping what's happening behind the scenes, your privacy is still being violated, and because it's on the ISP network there's not really anything you can do about it. End quote
Although the delivery is somewhat different than Adzilla which uses a transparent proxy the end result is still the same. You will be sharing your browsing habits and will be profiled by a third party.
This all could really be a great selling point for an ISP that does not Create a Richer Browsing Experience for their customers. I'd sign up in a minute! |
|
 Mele20 Premium join:2001-06-05 Hilo, HI
| reply to ilago According to the NY Times, Phorm will be coming to major USA broadband ISPs very soon:
"A Company Promises the Deepest Data Mining Yet
Amid debate over how much data companies like Google and Yahoo should gather about people who surf the Web, one new company is drawing attention and controversy by boasting that it will collect the most complete information of all.
The company, called Phorm, has created a tool that can track every single online action of a given consumer, based on data from that persons Internet service provider. The trick for Phorm is to gain access to that data, and it is trying to negotiate deals with telephone and cable companies, like AT&T, Verizon and Comcast, that provide broadband service to millions."
»www.nytimes.com/2008/03/20/busin···business -- "The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason |
|
  ilago Premium join:2005-06-28 Australia
·Internode
| 
This is not good.
There's a little bit more today in The Register, including a link to the UK Privacy Report that Phorm has been using to justify how good they are at privacy.
»www.theregister.co.uk/2008/03/19···8020_pi/
And some more comment here »www.politicalpenguin.org.uk/blog/cat,25/ |
|
 SUMware Premium join:2002-05-21
2 edits | reply to Just Basics Possible Regulation?
said by Just Basics :The opt-out given by Phorm really isn't an opt-out at all - it stops the targeting advertising, but all your requests are still going through their servers, you no longer have a direct internet connection, and they still get to profile you. This angers the NSA/CIA/FBI who want to be the first in line to monitor your entire data stream.  -
A Push to Limit the Tracking of Web Surfers Clicks quote: After reading about how Internet companies like Google, Microsoft and Yahoo collect information about people online and use it for targeted advertising, one New York assemblyman said there ought to be a law.
So he drafted a bill, now gathering support in Albany, that would make it a crime punishable by a fine to be determined for certain Web companies to use personal information about consumers for advertising without their consent.
And because it would be extraordinarily difficult for the companies that collect such data to adhere to stricter rules for people in New York alone, these companies would probably have to adjust their rules everywhere, effectively turning the New York legislation into national law.
Should these companies be able to sell or use whats essentially private data without permission? The easy answer is absolutely not, said the assemblyman who sponsored the bill, Richard L. Brodsky, a Democrat who has represented part of Westchester County since 1982.
Mr. Brodsky is not the only lawmaker with this idea. In Connecticut, the General Law Committee of the state assembly has introduced a bill that focuses on data collection rules for ad networks, the companies that serve ads on sites they do not own.
The New York bill, still a work in progress, is shaping up as much broader. Although it is likely to see some tinkering before it comes to a vote which Mr. Brodsky hopes will happen this spring it aims to force Web sites to give consumers obvious ways to opt out of advertising based on their browsing history and Web actions.
If it passed, computer users could request that companies like Google, Yahoo, AOL and Microsoft, which routinely keep track of searches and surfing conducted on their own properties, not follow them around. Users would also have to give explicit permission before these companies could link the anonymous searching and surfing data from around the Web to information like their name, address or phone number.
Because there is no federal legislation on these subjects, Mr. Brodskys bill and, to a lesser extent, the one in Connecticut could set interesting precedents.
In recent weeks, Microsoft and Yahoo have sent lobbyists to meet with Mr. Brodsky, and AOL, a unit of Time Warner, is planning a meeting. Unlike most Web companies, Microsoft favors legislation about online privacy and advertising practices and has lobbied federal lawmakers to establish regulations, said Michael Hintze, associate general counsel for Microsoft.
Microsoft asked Mr. Brodsky to broaden his bill to include all sorts of companies that serve ads around the Web, not just those that show ads based on users behavior. Such a change would create a bill that more clearly includes Microsofts chief competitor, Google.
Mr. Brodsky says he has asked the Web companies point-blank if they would support legislation similar to what he has proposed. Microsoft gave him a firm yes, but Yahoo, he said, seemed to be opposed to any sort of regulation. Yahoo declined to comment on its meeting with Mr. Brodsky.
-
ISP Tracking: The Mother of All Privacy Battles quote: Big companies like AOL, Microsoft and Yahoo, and smaller ones like Revenue Science, are gathering various crumbs about online behavior to use in their advertising systems. They are limited to gathering data from their own sites and their networks of affiliates.
Eventually, cellphone companies will start to face the same choice. If there is a G.P.S. unit in your phone, it will be able to keep track of what stores you visit, among many other things.
All these partial schemes may well be rendered as useless as a blindfolded spy by some new companies that want to tap into the records of Internet service providers. Their objective: following every single click users make. That way, in theory, they have the best ability to find ads that can indulge each users passion of the moment. Among the companies trying to build out this sort of system are Phorm, NebuAd, FrontPorch.
|
|
  ilago Premium join:2005-06-28 Australia
·Internode
| This is on the news page here. It refers to the Register article I linked to earlier.
"Rootkit and spyware developer turned behavioral advertising firm Phorm has agreed to let an independent analyst inspect the source code for their controversial browsing history tracking technology. Like NebuAD in the States, the company pays ISPs to install deep packet inspection hardware on their network to track user behavior. Unlike NebuAD, Phorm has a pretty shady history in spyware, and is trying to convince UK users that the ISP money-grab is really an anti-phishing solution. Both companies are fighting an uphill battle in gaining consumer trust."
»Phorm Opens Source Code For Inspection
I don't have much faith in the code inspection. It needs ongoing compliance and independent auditing. It could be changed remotely within a few minutes once it's in place. These guys are experts at that 
Thanks for this reference SUMware.
quote: If it passed, computer users could request that companies like Google, Yahoo, AOL and Microsoft, which routinely keep track of searches and surfing conducted on their own properties, not follow them around. Users would also have to give explicit permission before these companies could link the anonymous searching and surfing data from around the Web to information like their name, address or phone number.
Because there is no federal legislation on these subjects, Mr. Brodskys bill and, to a lesser extent, the one in Connecticut could set interesting precedents.
|
|
 Just Basics
join:2003-06-08 Painter, VA
| reply to SUMware SUMWare, I don't care if a Federal Agency monitors my every movement on the internet - but that is just my own opinion. There have already been many discussions on this topic and what it boils down to is whether using the internet is a right or a privilege. I consider it a privilege and pay my ISP for that privilege.
What I do care about is that my information is shared with a third party for profit without my knowledge which has already happened. Whether it happens at the ISP level or a server along the line makes little difference to me.
What really concerns me is the apathy that is apparent in this thread about a subject that could forever change the internet.
Where are the indignant people who object strenuously when a website sets a tracking cookie? Where is the outrage that was caused by the Sony rootkit or Windows validation? And the list goes on.
It leads me to think that most really don't care whether their connection to the internet is compromised at the ISP level and their ISP is willingly co-operating with what is no more than an advertising agency.
Do you really trust your ISP enough to not share even more of your personal information with this third party? How about your name, address and even credit card information they have on file? What is to prevent them from doing so? |
|
 SUMware Premium join:2002-05-21
2 edits | said by Just Basics :What really concerns me is the apathy that is apparent in this thread about a subject that could forever change the internet. Where are the indignant people who object strenuously when a website sets a tracking cookie? Where is the outrage I agree. |
|