Subject: [Add] Telecom Ad Networks

From: Rob Sayre <[email-masked]>
Date: Sat, 17 Aug 2019 18:11:52 -0700

Hi!

I thought it might be good to point out that self-identified "operators"
may have many lines of business.

For example:
"AT&T Advertising & Analytics Lays Foundation of a Premium TV and Video Ad
Marketplace Fueled By Data, Technology, Premium Content and Distribution"
<https://about.att.com/story/2018/att_appnexus.html>

or

"ANY WAY YOUR AUDIENCE WATCHES: CONSIDER THEM FOUND"
<https://www.comcastspotlight.com>

I'm sure there are other telephone companies that do similar things--these
are just two examples. I think this is all fine, actually. It's
nevertheless a good data point.

And, of course, any data point along these lines must take this context
into account:

"Ever since Congress voted to repeal the FCC's broadband privacy
protections due to come into force later this year - which would have
prevented internet service providers like AT&T, Comcast, Time Warner,
Sprint and Verizon from selling personal data like web browsing history
without prior consent..."
<
https://www.forbes.com/sites/thomasbrewster/2017/03/30/fcc-privacy-rules-how-isps-will-actually-sell-your-data/#3402e4c621d1

I have to say, I don't really like anyone tracking me (including Google),
but I don't see the IETF performing a useful role here. It often seems like
the goal is to write an RFC that weakens encryption so more companies can
have ad networks.

thanks,
Rob

---

From: Dominique Lazanski <[email-masked]>
Date: Sun, 18 Aug 2019 06:57:45 +0100

> On 18 Aug 2019, at 02:11, Rob Sayre <[email-masked]> wrote:
> 
> Hi!
> 
> I thought it might be good to point out that self-identified "operators" may have many lines of business.
> 
> For example:
> "AT&T Advertising & Analytics Lays Foundation of a Premium TV and Video Ad Marketplace Fueled By Data, Technology, Premium Content and Distribution"
> I'm sure there are other telephone companies that do similar things--these are just two examples. I think this is all fine, actually. It's nevertheless a good data point.
> 
> And, of course, any data point along these lines must take this context into account:
> 
> "Ever since Congress voted to repeal the FCC's broadband privacy protections due to come into force later this year - which would have prevented internet service providers like AT&T, Comcast, Time Warner, Sprint and Verizon from selling personal data like web browsing history without prior consent..."
> <https://www.forbes.com/sites/thomasbrewster/2017/03/30/fcc-privacy-rules-how-isps-will-actually-sell-your-data/#3402e4c621d1>
> 
> I have to say, I don't really like anyone tracking me (including Google), but I don't see the IETF performing a useful role here. It often seems like the goal is to write an RFC that weakens encryption so more companies can have ad networks.
> 

But this is just the two biggest operators in the US and isn’t true globally. According to the GSMA the top five largest operators globally aren’t American and don’t run ad networks though they do have services like mobile money. (China Mobile, Vodafone, Telefonica...)

Your point reflects a very American mindset, but we really need to think globally about this. 

-dml

> thanks,
> Rob
> -- 
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add

---

From: Rob Sayre <[email-masked]>
Date: Sun, 18 Aug 2019 00:07:12 -0700

On Sat, Aug 17, 2019 at 10:57 PM Dominique Lazanski <[email-masked]>
wrote:

> But this is just the two biggest operators in the US and isn’t true
> globally. According to the GSMA the top five largest operators globally
> aren’t American and don’t run ad networks though they do have services like
> mobile money. (China Mobile, Vodafone, Telefonica...)
>

Oh, this is a wonderful point. I think it's great to have ITU
participants[1] from outside of the US bring their perspectives.

I did find that this issue has actually been straightforwardly used as a
bargaining tool in the past, though:

"Digicel’s announcement explicitly refers to adblocking as a tool to force
'companies like Google, Yahoo and Facebook to enter into revenue sharing
agreements'. The UK ISPs are understandably also attracted to the idea of
using adblocking on their networks as a new bargaining chip with which to
force Google and other advertising companies to share revenue with them"
<
https://pagefair.com/blog/2015/despite-the-hype-isp-adblocking-is-a-no-go-in-europe/

As I said before, I think that's all fair, but I don't think the IETF
should get in the middle of it.

thanks,
Rob

[1]
https://www.itu.int/en/ITU-T/Workshops-and-Seminars/201606/Pages/LAZANSKI-Dominique.aspx

---

From: Mikael Abrahamsson <[email-masked]>
Date: Sun, 18 Aug 2019 09:32:09 +0200 (CEST)

> should get in the middle of it.

Where do you think people working at operators and browser vendors should 
exchange views and opinions on this topic? Do you have a better venue in 
mind?

Just because we're discussing things here and producing documents to sum 
up the discussions doesn't mean IETF has to prescribe anything in those 
documents.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Rob Sayre <[email-masked]>
Date: Sun, 18 Aug 2019 00:48:20 -0700

> exchange views and opinions on this topic? Do you have a better venue in

It's a fair question. Using your construction, I don't think the browser
vendors need to consult the operators.

Of course, some browser vendors are operators, and some operators are
browser vendors, so it's not that simple.

> up the discussions doesn't mean IETF has to prescribe anything in those

That's true, and the IETF does produce a large amount of useless documents.
This isn't a bad thing--it's good that ideas get documented and tried. But
if someone points out that a proposed work area might solely produce
useless documents, the IETF should consider that it may harm the reputation
of the IETF itself.

thanks,
Rob

---

From: Mikael Abrahamsson <[email-masked]>
Date: Sun, 18 Aug 2019 09:52:19 +0200 (CEST)

> vendors need to consult the operators.

Care to elaborate on this?

At first reading, my first thought was just "wow".

---

From: Rob Sayre <[email-masked]>
Date: Sun, 18 Aug 2019 00:56:24 -0700

> At first reading, my first thought was just "wow".

Sure. There are only four or five companies that can provide a browser.

There are lots of networking companies, and none of them can afford to
break any of the browsers.

I don't work for either side, but it seems pretty obvious to me.

thanks,
Rob

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 18 Aug 2019 15:43:36 +0200

It's certainly not the case that DNS modification and surveillance is
limited to the US, although it may not be for the purposes of advertising.
Here's a good place to start to see the extent of DNS-based tampering:

https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-liu_0.pdf

It's of course possible that some of this is being done by enterprises and
the like, not ISPs, but, for instance, the authors find that China Mobile,
which you site above, intercepts DNS (see S 5.1).

-Ekr

---

From: Bret Jordan <[email-masked]>
Date: Mon, 19 Aug 2019 06:52:19 -0600

What harms the IETF is when standards are written without fully understanding the use cases and documenting all of the ramifications that will come from implementing those standards.

We need to encourage more people with different views to join and attend the IETF to keep us from having myopic views. We also need to not marginalize them by saying “ITU People”.  It is not us and them, not ITU people, IEEE people, W3C people, OASIS people, etc. 

While some here may only work in the IETF, some work across many SDOs.

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> 
> 
> That's true, and the IETF does produce a large amount of useless documents. This isn't a bad thing--it's good that ideas get documented and tried. But if someone points out that a proposed work area might solely produce useless documents, the IETF should consider that it may harm the reputation of the IETF itself.
> 
> thanks,
> Rob

---

From: Bret Jordan <[email-masked]>
Date: Mon, 19 Aug 2019 07:11:41 -0600

I do not believe that DoH is somehow going to universally stop that. This reminds me of the oft stated and incorrect view that TLS 1.3 is going to prevent middle boxes.

Two easy options to prevent DoH are:

1) Mine the internet for DoH servers and block them via ACLs at the NAP routers or at the IPS/Firewalls. This kind of mining is done all of the time.  Just look at Shodan.  I would not be surprised if a flag for NMAP will be made available soon. 

2) Do a full TLS 1.3 proxy at the edge and rewrite or redirect the DoH queries. But you say, users will get an error message about broken certificates.  Yes they will, if they do not have a root CA stored in their client.  However, most users will click “connect me anyways”.  Only the real tech savvy people will notice or care, and most of them will use VPN or TOR like services anyway. 

Thanks,
Bret

> On Aug 18, 2019, at 7:43 AM, Eric Rescorla <[email-masked]> wrote:
> 
> It's certainly not the case that DNS modification and surveillance is limited to the US, although it may not be for the purposes of advertising.  Here's a good place to start to see the extent of DNS-based tampering:
> 
> https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-liu_0.pdf <https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-liu_0.pdf>
> 
> It's of course possible that some of this is being done by enterprises and the like, not ISPs, but, for instance, the authors find that China Mobile, which you site above, intercepts DNS (see S 5.1).
> 
> -Ekr
> 
> 
> On Sun, Aug 18, 2019 at 7:58 AM Dominique Lazanski <[email-masked] <mailto:[email-masked]>> wrote:
> 
> 
> On 18 Aug 2019, at 02:11, Rob Sayre <[email-masked] <mailto:[email-masked]>> wrote:
> 
>> Hi!
>> 
>> <https://about.att.com/story/2018/att_appnexus.html <https://about.att.com/story/2018/att_appnexus.html>>
>> 
>> or
>> 
>> <https://www.comcastspotlight.com <https://www.comcastspotlight.com/>>
>> 
>> <https://www.forbes.com/sites/thomasbrewster/2017/03/30/fcc-privacy-rules-how-isps-will-actually-sell-your-data/#3402e4c621d1 <https://www..forbes.com/sites/thomasbrewster/2017/03/30/fcc-privacy-rules-how-isps-will-actually-sell-your-data/#3402e4c621d1>>
>> 
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/add <https://www.ietf.org/mailman/listinfo/add>
> -- 
> Add mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/add <https://www.ietf.org/mailman/listinfo/add>
> -- 
> Add mailing list
> [email-masked]

---

From: Daniel Stenberg <[email-masked]>
Date: Mon, 19 Aug 2019 15:51:31 +0200 (CEST)

On Mon, 19 Aug 2019, Bret Jordan wrote:

> 1) Mine the internet for DoH servers and block them via ACLs at the NAP 
> routers or at the IPS/Firewalls. This kind of mining is done all of the 
> time.  Just look at Shodan.  I would not be surprised if a flag for NMAP 
> will be made available soon.

You can only "easily map" them like that if you know their correct URLs (since 
some DoH servers are cohosted with regular web content on the same IPs) or at 
least names (for SNI etc) and they're not requiring authentication. That will 
not be universally true. So it takes a little more than just a flag for nmap.

-- 

  / daniel.haxx.se