Mike Gerwitz

Free Software Hacker+Activist

aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMike Gerwitz <mtg@gnu.org>2015-11-20 22:31:23 -0500
committerMike Gerwitz <mtg@gnu.org>2015-11-20 23:11:58 -0500
commit38081104efb9ec977db156cc3fdb43db8b7ed0b1 (patch)
tree1134d23e55f6c7a61152903cf97c7bf861ff2c7a
parent8f1cfe3f9c0b6e266f1d9e3f9be034984349f2b1 (diff)
downloadthoughts-38081104efb9ec977db156cc3fdb43db8b7ed0b1.zip
thoughts-38081104efb9ec977db156cc3fdb43db8b7ed0b1.tar.gz
thoughts-38081104efb9ec977db156cc3fdb43db8b7ed0b1.tar.bz2
Comcast injects JavaScript into web pages
It seems that Comcast has decided that it is a good idea to [inject JavaScript into web pages][js] visited by its customers in order to inform them of Copyright violations. This is a huge violation of user privacy and trust. Further, it shows that an ISP (and probably others) feel that they have the authority to dictate what is served to the user on a free (as in speech) Internet. Why should we believe that they won't start injecting other types of scripts that spy on the user or introduce advertising? What if a malicious actor compromises Comcast's servers and serves exploits to users? It is no surprise that Comcast is capable of doing this---they know the IP address of the customer, so they are able to intercept traffic and alter it in transit. But the fact that they _can_ do this demonstrates something far more important: _that they have spent the money on the infrastructure to do so_! Comcast isn't the only ISP to have betrayed users by injecting data. One year ago, it was discovered that [Verizon was injecting "perma-cookies" into requests to track users][verizon]. This is only one example of the insidious abuses that unchecked ISPs can take. So what can you do to protect yourself? What Comcast is doing is called a [man-in-the-middle (MITM) attack][mitm]: Comcast sits in the middle of you and your connection to the website that you are visiting, proxying your request. Before relaying the website's response to you, it modifies it. In order to do this, Comcast needs to be able to read your communications, and must be able to modify them: the request must be read in order to determine how the JavaScript should be injected and what request it should be injected into; and it must be modified to perform the injection. It cannot (given a properly configured web server) do so if your connection is encrypted. In the case of web traffic, `https` URLs with the little lock icon in your web browser generally indicates that your communications are encrypted, making MITM attacks unlikely. (We're assuming that Comcast won't ask you to install a root CA so that they can decrypt your traffic! But that would certainly be noticed, if they did so on a large enough scale.) Not all websites use SSL. Another method is to use encrypted proxies, VPNs, or services like like [Tor][tor]. This way, Comcast will not be able to read or modify the communications. See also: [HackerNews discussion][hn]; [original Reddit discussion][reddit]. [js]: https://gist.github.com/Jarred-Sumner/90362639f96807b8315b [verizon]: https://www.eff.org/deeplinks/2014/11/verizon-x-uidh [mitm]: https://en.wikipedia.org/wiki/Man-in-the-middle_attack [hn]: https://news.ycombinator.com/item?id=10592775 [reddit]: https://www.reddit.com/r/HuntsvilleAlabama/comments/35v4sn/comcast_is_injecting_bad_javascript_to_your/ [tor]: https://tor.org/
0 files changed, 0 insertions, 0 deletions