TalkTalk tracking you, phorm?

Originally Posted by Stuart

The way the system appears to be working at the moment is that it is just recording the URLs visited by Talk Talk customers. The system will then visit those URLs itself. Based purely on what Talk Talk have said, I would suggest it will then check the site for malware, but (at this stage) do nothing else.

I suspect (again this is speculation) that in the future, TT will use the system to either warn visitors to those sites, or stop them visiting the site totally.

The arguments against it are that it possibly violates our right to privacy along with various EU regulations (the same ones that Phorm violated), and that it could violate the webmaster's copyright.

My own opinion on the system is that *if* it works as I state, it *could* be a good thing in the fight against Malware.

However, I am rather concerned that Talk Talk have not been a lot more open about this. The fact they haven't suggests to me that they are either worried about the reaction in the light of the Phorm PR disaster or they are planning something they aren't telling us.

Planning what? What could they do that would be so awful? That would get them into trouble with their customers? Or Ofcom?

[Rchivist]

I suppose one question that is worth pursuing is - what other ways are there of achieving the same ends? How do the AV companies do it? How do the other 3rd party "parental control" companies do it? (eg: the ones that service schools and libraries etc.)? How do the BT parental controls get their site info? How were the Chinese planning to do it with their "Green" website blocking thingy? How do IWF do it? (receiving reports from others AFAICS) Are TT proposing to do it better? Is their service needed? Or is it a means to an end? Finally - which is the more important task - finding and neutralising all the zombied machines on your network? Or adding to the whitelist/blacklist systems already out there already?

[Stuart]

Originally Posted by Maggy J

Planning what? What could they do that would be so awful? That would get them into trouble with their customers? Or Ofcom?

I can think of several possibilities. The nicest of which is profiling our browsing habits for advertising.

[Ignitionnet]

Originally Posted by Stuart

I can think of several possibilities. The nicest of which is profiling our browsing habits for advertising.

The system does not, by any account, profile the browsing habits of users.

If that were TalkTalk's plan their existing DPI equipment, through which 100% of their customer base are routed, would be more than capable. It would also be totally transparent.

[bluecar1]

Originally Posted by Maggy J

What would this system do to my set up against nasty trojans and virii?

What rights?

And you are losing me again in the last two paragraphs...Complete and utter thicko about such matters.

IF you did not have upto date anti-virus it would provide limited protection from dodgy web sites (but crucially not dodgy emails)

there are many people who view AV as an expensive opten so don't bother with it

as to the last two paragraph

the obvious place to put this system would be on a transparent proxy (a computer that all web traffic passes through covertly) then so long as the processing takes place on the fly purely to detect viruses and malware it should be ok

think pf a cache / proxy server as your local wh smiths, it keeps a stock of common books, but odd books it will have to order in

the same with a cache / proxy,

if you make a request for a web page (bbc news home page) it will go and get (order in that page) if the next person makes the same request the cache / proxy will say i already have a copy of that on the shelf here it is i do not have to go and order / get another copy from the internet

so a cache / proxy speed up and make the internet seem faster for common sites / pages

and as with wh smiths the cache has a limited amount of space to store pages so when a page is no longer popular it gets dropped from the cache / shelf

problem is to do this in real time the amount of computing power is prohibatively high, hence i think they have gone for the off line / after the visit option which causes its own potential problems, as many web pages are now what is known as dynamic so they are created on the fly as a one off page then dumped once viewed and the TT system could never scan them

dynamic pages hmm how best to give an analogy

mail merge in aword processor you have a template and a list of items in a standard format

same with dynamic content, a lot of shop type websites are dynamic, they have a database of products ( picture, title ,product description, rating etc) but you do not want to be sat writing a web page for every product, so you have a template page which when you request information on the new toaster for the kitchen it fills in the blanks with the picture etc and also based on products you have viewed or bought before adds suggestions for other products

still confused?

Originally Posted by Stuart

I can think of several possibilities. The nicest of which is profiling our browsing habits for advertising.

Well I hate adverts BUT they are everywhere already.Without them TV viewing would cost a lot more in fact many things are more affordable due to ads.
I use Google search or Bing search and I get ads. I use Gmail and the ads give me a free 7GB inbox.

Maybe Talk,Talk will be able to offer a better cheaper service because of the ads?

[Stuart]

Originally Posted by R Jones

I suppose one question that is worth pursuing is - what other ways are there of achieving the same ends? How do the AV companies do it? How do the other 3rd party "parental control" companies do it? (eg: the ones that service schools and libraries etc.)? How do the BT parental controls get their site info? How were the Chinese planning to do it with their "Green" website blocking thingy? How do IWF do it? (receiving reports from others AFAICS) Are TT proposing to do it better? Is their service needed? Or is it a means to an end? Finally - which is the more important task - finding and neutralising all the zombied machines on your network? Or adding to the whitelist/blacklist systems already out there already?

While they both use White/Blacklists, BT's Parental Control system, and the IWF are looking more for objectionable content rather than Malware. This is not easy for machines to detect and categorise (text is relatively easy, images are not and won't be without a massive advance in image recognition), so these list have to be maintained largely by humans.

There's also the problem that some of today's lists require that people report infected sites. Something that people may not be willing to do (even assuming they can).

I don't know whether TT's system will be better or not, but we are still getting increasing amounts of PCs affected by Malware so clearly someone needs to do something different in an attempt to reduce the problem.

Originally Posted by bluecar1

IF you did not have upto date anti-virus it would provide limited protection from dodgy web sites (but crucially not dodgy emails)

there are many people who view AV as an expensive opten so don't bother with it

as to the last two paragraph

think pf a cache / proxy server as your local wh smiths, it keeps a stock of common books, but odd books it will have to order in

the same with a cache / proxy,

if you make a request for a web page (bbc news home page) it will go and get (order in that page) if the next person makes the same request the cache / proxy will say i already have a copy of that on the shelf here it is i do not have to go and order / get another copy from the internet

so a cache / proxy speed up and make the internet seem faster for common sites / pages

and as with wh smiths the cache has a limited amount of space to store pages so when a page is no longer popular it gets dropped from the cache / shelf


dynamic pages hmm how best to give an analogy

mail merge in aword processor you have a template and a list of items in a standard format

same with dynamic content, a lot of shop type websites are dynamic, they have a database of products ( picture, title ,product description, rating etc) but you do not want to be sat writing a web page for every product, so you have a template page which when you request information on the new toaster for the kitchen it fills in the blanks with the picture etc and also based on products you have viewed or bought before adds suggestions for other products

still confused?

Thank you for the explanation..Hopefully it will be helpful for the others who have no clue like me.

However it seems to me that all of that is a 'good ' thing because it makes things faster and more convenient.

As for the people who don't protect their PCs well they deserve everything they get for not doing he research or asking questions.

[bluecar1]

Originally Posted by Stuart

I can think of several possibilities. The nicest of which is profiling our browsing habits for advertising.

which when combined with the fact huawei have systems patented that categorise webpages, and the fact the IP address used intiailly to follow people was the radius servers what more do you want?

and yes ignitionnet i am aware you can have multiple machine share the same IP so long as they do not share the same port id, but in my experience it would be odd to have something like a radius server nat'ed behind a firewall etc

I nearly forgot.The question of copyright on webspaces..Isn't that open to abuse by everyone visiting a site.Surely the only way to stop it is to watermark images OR put nothing on a website that you do not want to be copied?

[Stuart]

Originally Posted by Maggy J

Well I hate adverts BUT they are everywhere already.Without them TV viewing would cost a lot more in fact many things are more affordable due to ads.
I use Google search or Bing search and I get ads. I use Gmail and the ads give me a free 7GB inbox.

Maybe Talk,Talk will be able to offer a better cheaper service because of the ads?

I have to admit, the ads don't really bother me. I can block them if I wish. The paper Igni linked to about says that the system does not store any personal data. However, they said that about Phorm, and it later turned out that Phorm was a lot more personal than they said.

Is that a problem? It depends. If you are happy that your entire browsing history is accessible to your ISP who may use it for whatever reason, then it's not a problem.

[bluecar1]

Originally Posted by Maggy J

Thank you for the explanation..Hopefully it will be helpful for the others who have no clue like me.

However it seems to me that all of that is a 'good ' thing because it makes things faster and more convenient.

As for the people who don't protect their PCs well they deserve everything they get for not doing he research or asking questions.

yep caching is a good thing, but the TT system is not working by caching, they are stripping the URL from your web page request and passing it to another system which then replays it to see if there are any nasties on the page, a bit late if you are the first visitor to that page, and it can't cope with those pesky dynamic pages

i am also very synical about TT's motives

the cost of this project will have to be paid for somewhere, TT are saying it will be a free opt in service for its customers (but not websites)

so where is the payback?

this has to be a front for something else (advertising anyone?) or a system to establish a loophole they (and other ISP's) can exploit later after the system(loophole) is established

Originally Posted by Stuart

I have to admit, the ads don't really bother me. I can block them if I wish. The paper Igni linked to about says that the system does not store any personal data. However, they said that about Phorm, and it later turned out that Phorm was a lot more personal than they said.

Is that a problem? It depends. If you are happy that your entire browsing history is accessible to your ISP who may use it for whatever reason, then it's not a problem.

but why would my ISP do anything underhand that I would get upset about with the info..It's not in their best interest to upset me as a customer especially when it comes to my personal data..

---------- Post added 08-09-2010 at 00:05 ---------- Previous post was 07-09-2010 at 23:57 ----------

Anyway fun as this has been I need to get some sleep..Thank you for your patience..

[Stuart]

If they are doing anything dodgy, they'll know that some will find out about it and get upset enough to leave or attempt other action. They may, however, gamble that enough customers will either not know, or not be bothered enough about something that any profit the ISP makes will outweigh customer losses.

I have seen no evidence that suggests the system is even capable of this. Even if it is, the concern I have isn't so much that the ISP is logging where I am going. This isn't any different to the phone company logging who I call, apart from one massive difference. The logs the phone company keeps of who I call are protected by UK law. While the ISP logs of which site I visit are protected by EU directive, they are not protected by UK law.

[bluecar1]

Originally Posted by Stuart

If they are doing anything dodgy, they'll know that some will find out about it and get upset enough to leave or attempt other action. They may, however, gamble that enough customers will either not know, or not be bothered enough about something that any profit the ISP makes will outweigh customer losses.

I have seen no evidence that suggests the system is even capable of this. Even if it is, the concern I have isn't so much that the ISP is logging where I am going. This isn't any different to the phone company logging who I call, apart from one massive difference. The logs the phone company keeps of who I call are protected by UK law. While the ISP logs of which site I visit are protected by EU directive, they are not protected by UK law.

there is no direct evidence, but there is circumstantial evidence

this needs to be shown , so that TT are aware they are being watched and people have noticed a possibility of the system being "adapted" or "extended" towards an advertising platform or some other revenue generating system

if it is and they are then categorising webpages visited by their customers then we are again in the website terms of use and copyright issues we were in with phorm

as i say no direct evidence to support the above, but if it was to head towards a data gather for advertising they will find more brown stuff heading for the rotating blades