AT&T Hotspots: Now with Advertising Injection

150 点作者 jeo1234超过 9 年前

19 条评论

Animats超过 9 年前

Does this violate the "exceeds authorized access" provision of the Computer Fraud and Abuse Act? AT&T is not acting as a regulated carrier in this instance, and does not have the immunities of a carrier. Also, their terms of service[1] do not permit them to modify the web pages of others. They can block URLs, ask for a payment, or show an ad at connection time as an alternative to a payment. But they did not disclose that they would modify existing pages.The requirement for arbitration in the AT&T terms does not apply, because the Computer Fraud and Abuse Act is a criminal law. [2][1] <a href="http://www.att.com/legal/terms.wiFiServices.html" rel="nofollow">http://www.att.com/legal/terms.wiFiServices.html</a> [2] <a href="http://apps.americanbar.org/litigation/committees/criminal/articles/summer2013-1013-glitches-within-cfaas-exceeds-authorized-access-language.html" rel="nofollow">http://apps.americanbar.org/litigation/committees/criminal/a...</a>

评论 #10119878 未加载

edwhitesell超过 9 年前

It's easy to get drawn into doing this kind of intrusive advertising when you have a captive audience on a WiFi network. It's an idea I've discussed or been involved in "testing" a number of times. (background: I've been building/operating wireless/WiFi/Hotspot networks since 2001)The reality is AT&T probably has no idea how bad this is, and likely would not care. Somewhere, someone sees the potential dollars on the upside and that's the only factor that matters.There are better ways to monetize free WiFi today. Advertising is a piece of that puzzle, but there are others too.

评论 #10119838 未加载

评论 #10119851 未加载

Someone1234超过 9 年前

Individual websites may be able to protect yourselves by:- Using HTTPS directly, in particular with HSTS set (optimal).- Use a third party like CloudFlare to add HTTPS via their proxy.- Alternatively: HTTP with Content Security Policy set (since it will reject their scripts and CSS running as it isn't in the whitelist). This is only a short term solution since they can alter the CSP header, but it will work if you're stuck on HTTP for now. We bounce a lot of advertisers and malware off of our site this way.Ultimately this is yet another "Use HTTPS!" broken record. But the CSP solution works until they get wise to it.

评论 #10119677 未加载

评论 #10120318 未加载

mp3geek超过 9 年前

Now blocked in easylist.<a href="https://hg.adblockplus.org/easylist/rev/881423eab157" rel="nofollow">https://hg.adblockplus.org/easylist/rev/881423eab157</a>

0x0超过 9 年前

I've seen this on the "xfinitywifi" SSID even when logged in with a valid comcast subscriber ID... :(Wonder how it handles apps that expect json, or jquery/ajax calls that works with html fragments. Or even someone authoring a wordpress blog post?

评论 #10119688 未加载

ejdyksen超过 9 年前

I have just stopped connecting to most wifi hotspots altogether unless I'm going to be somewhere for a few days (hotel, conference, etc). LTE is just faster and more reliable, and tethering is dead simple these days.

评论 #10119665 未加载

评论 #10120654 未加载

评论 #10119656 未加载

pavel_lishin超过 9 年前

I've seen this happen on a commercial ISP. I used to work for a web dev firm, and our ISP decided to start injecting ads.Ads that immediately broke all of our javascript that we were testing on QA sites.It took us an hour to realize what was going on, and that it wasn't our code that was breaking, and another 30 minutes of angry phone yelling before they backed down and turned that shit off.

makecheck超过 9 年前

You know, I could stomach inserted ads a lot more if they were honest about doing them; something like "the contents of this box were placed by the owners of the free Wifi network you are using".The infuriating part is that these ads are typically folded into original content as if the original page had the extra garbage in it. When you see an obnoxious ad, you're not thinking "well I guess I won't use this wifi again"; you think "well I guess I'm not going to this site ever again".We desperately need a way to strongly sign each part of a page so that it is impossible to display a web site with any third-party content that wasn't explicitly added by the site owner (e.g. such as an authorized "Like" button). This naturally means removing i-frames and all other similar mechanisms from browsers, or at least making them a hell of a lot more obvious.

ChuckMcM超过 9 年前

which is why, by default on my laptop, I use an ssh tunnel with a SOCKS proxy to get to the web. Truly sad, nothing you could do with your phone or tablet though.Not that I begrudge them trying to get some money out of their "free" service, and I choose not to use such services.Of course you will then get MITM routers which link to the free WiFi, offer their own free WiFi on a different channel, and then swap the 'customer id' on the ads going through to send them the money. Or something like that. I'm sure there is a RasPi build to do something like this.

评论 #10119787 未加载

评论 #10119798 未加载

评论 #10122613 未加载

jtokoph超过 9 年前

I'm pretty sure all AT&T iPhones pull carrier configurations that set attwifi hotspots as a trusted auto-joined wifi network.I reset my iPhone the other day without restoring any backup. Later that day I found my phone connected to attwifi without any instructions from me.

dmitrygr超过 9 年前

Holy shit!They log pretty much ALL of the traffic too. Not just CAN LOG. They DO LOG.-See <a href="http://www.ragapa.com" rel="nofollow">http://www.ragapa.com</a> "analytics" tab:Here are some of the analytics RaGaPa device collect:Geographical LocationMac Address/Cookie TrackingUser AgentUser BrowserDestination URLAd/Message ImpressionsAd/Message ClicksUser Activity with Time

评论 #10120023 未加载

jeo1234超过 9 年前

AT&T seems to really not care about their customers trusting them.

评论 #10119680 未加载

droopybuns超过 9 年前

It is 2015. If you're not running your own VPN on aws or if you're not using solutions like Cloak, you get what you get.<a href="https://www.getcloak.com/" rel="nofollow">https://www.getcloak.com/</a>I would prefer that carriers didn't do this kind of nonsense, but I'd also prefer that companies like Facebook & Google didn't have the core of their business built around the same function. We live in a world where people expect miraculous technology for "free."It's trivial to get around this.

评论 #10120062 未加载

评论 #10119732 未加载

评论 #10119899 未加载

JoshM33k超过 9 年前

A smaller ISP near me (Bright House) does a similar thing with their hotspots. There are no ad injections, but they inject a little popup with their logo, that says something along the lines of "hotspot provided by Bright House networks".The funny thing is, this network requires you to log in with your Bright House username and password, so anyone seeing that little "provided by" intrusion is already a paying customer.

laurentoget超过 9 年前

What I do not get is why the airport would allow that sort of things. I can understand that providing wifi is a cost that should be mitigated for someone like McDonalds who is running razor thin margins, but considering the cost of operating an airport trying to monetize wifi will probably never make an impact on your bottom line while annoying your users certainly will. It just seem like a foolish move to me.What am I missing?

JustSomeNobody超过 9 年前

"Next, it injects a backup advertisement, in case a browser doesn’t support JavaScript."Ha! They do a better job of degradation than most web sites!

hinkley超过 9 年前

There are a bunch of contract renewals coming up in a couple months (including mine, which I've been on the fence about, and now I have an excuse to switch carriers).I wonder whose bright idea it was to roll this out now.

bsder超过 9 年前

So, basically https and NoScript will block this.Well, I guess if websites don't want ads crapping all over their stuff, they'd better get on the stick.

r00fus超过 9 年前

I wonder how AT&T's ad injection will fare with iOS9's content blocking capabilities...