Hacker News new | past | comments | ask | show | jobs | submit login
Comcast uses MITM JavaScript injection to serve account related information (privateinternetaccess.com)
219 points by Deinos on Jan 29, 2017 | hide | past | favorite | 56 comments



If this was another ISP, I might be irritated, or even angry. But I can't work up the effort.

I mean, this is Comcast we're talking about. Even by the very low standards of ISPs, they're pretty nasty and generally unpleasant. What did you expect?


I love to bag on Comcast/Xfinity as much as the next guy, but, honestly, I would lump all of the cable and DSL companies together at the bottom of a latrine as far as customer service and 'value' go.

However, I'd be willing to bet that in most areas Comcast is probably your most reliable and fastest choice- unless you can get fiber, then always do that.

I was spoiled in Portland for years with Verizon (then later Frontier) fiber. When I moved to Seattle I was shocked that the best I could do was Comcast.

After 5 years with them I had one incident that involved an actually shitty customer experience that was saved by one of the best customer support experiences I've ever gotten anywhere (thanks Joe in Seattle Comcast Tier 3 tech support).

I've been using my own modem since before it was cool, so I never got hit by the monthly rate hikes or the 'free wifi' hotspot you can't disable.

If I didn't have fiber in my area now I'd begrudgingly get Comcast (if only just for internet) as my next choice.


You know there's a certain irony that I would never ever use a modem that I can't turn off the XFinity wifi crap, but I absolutely love having the ability to use other people's XFinity wifi. I pretty much have access to free wifi everywhere because of it, even spent two weeks in my new apartment mooching off someone else's wifi until I could get fiber installed.


I know if I were a comcast engineer having to read these posts continually I'd likely end up having a coronary.

You do understand the "XFinity wifi crap" has absolutely zero affect on you whatsoever, with the exception of the 50mw or whatever power draw that extra SSID takes right?

If so, why do you hate it so much? It's an amazing idea - on Comcast owned CPE create a network-wide wifi network before you hand off to the customer. It affects that customer's traffic in absolutely no what whatsoever any more than anyone else on the neighborhood cable segment would. In exchange for $.50 worth of power a year, I now gain access to a city-wide network of rather surprising density. I fail to see a downside.

I'm very curious why you think this is remotely a problem. I hate on Comcast more than the average guy, but the absolutely incorrect FUD they get on this product even on HN where folks should know better is beyond puzzling to me.


> If so, why do you hate it so much? It's an amazing idea - on Comcast owned CPE create a network-wide wifi network before you hand off to the customer. It affects that customer's traffic in absolutely no what whatsoever any more than anyone else on the neighborhood cable segment would.

> I'm very curious why you think this is remotely a problem. I hate on Comcast more than the average guy, but the absolutely incorrect FUD they get on this product even on HN where folks should know better is beyond puzzling to me.

Have you ever lived in an apartment complex?

1) The interference from a block of 20 units is now doubled and massively overlapping.

2) The people in the common area by the pool by those units are now drawing on the wifi rather than using cellular. So, yeah, it has a net effect of adding people to the "neighborhood" that would not otherwise be there.

Comcast pretty much rendered Wifi completely unusable in the last apartment I lived in. (i.e. Sub ~5mbps speeds on a 75mbps connection that used to serve wifi at 20mbps+)


> 1) The interference from a block of 20 units is now doubled and massively overlapping.

Not true. It's a second "virtual" SSID, not a second physical AP. If it has no clients, you're just getting an extra periodic advertisement packet.

Of course your second point stands. But that interference scales with # of connected users, not # of APs.


1) is simply untrue - someone else here posted why. It's a virtual SSID, same as you creating a second private network on your Ubiquiti AP or whatnot. It does not increase spectrum usage.

I understand that this could have created access points in apartments that didn't previously have them, but that was likely to happen either way. I also understand most folks are not used to living in extreme wifi density, so it's a shock at what you have to do to get good coverage. Welcome to the unlicensed band - in many areas you have to have a AP within visual range of you to get decent performance and this has nothing to do with Comcast. I actually just finished installing an AP-per-room in my place, due to the sheer number of neighbor APs. Only a few of which were Xfinity - I am quite used to living in high density environments.

The days of naively tossing up the latest and greatest AP+router combo with the highest gain antenna possible is largely over, at least for anything resembling an urban environment. You see many companies in the space realizing this and you'll see even more products based around the need. It's far better to have lots of small lower power APs within LoS, and will be the only way forward as the unlicensed band gets more and more utilized (e.g. verizon LTE potentially using it).

2) Perhaps. It is plausible (but relatively unlikely) that a neighborhood segment is already overloaded, and the intermittent wifi usage of passing-through customers increases that contention. I have no data, but I would be surprised if this was a material concern. I know I only connect to it when I absolutely need it, since it's "roaming" without the app is such a giant pita.


Mostly because I don't trust that the software they (Comcast et al.) are using to enable this is going to actually:

- Always and correctly not be seen as MY traffic

- Prevent a jump from the public to my private LAN

- Not leave me exposed in some previously unimagined way

- Slow down my personal internet experience

In the past the Comcast WiFi hardware was particularly prone to not handling a lot of WiFi clients very well.

Additionally, I don't want to run their WiFi, I have Ubiquiti gear I'd rather use.

Also, I don't want to pay them $x a month to rent the hardware.

Finally, even if I feel the probability is near zero and I've got nothing to hide, I still don't want to add just one more way I can possibly get screwed.


One thing that's kind of selfish but could be seen as a con is that the xfinity wifi takes up some of the spectrum. That's kind of a cop out though, it's not your spectrum in the first place, even in your own property.

What's nice about it is that you can increase your speed if you have a router capable of load balancing by having one interface be the typical WAN and the other interface being the xfinity wifi.


Nice try, Comcast Engineer!


The xfinitywifi access points I've come across (just about everywhere I go) are unsecured but not free. You need an account before they'll handle your traffic. IOW, useful to Comcast customers but nobody else.


That is sort of the whole point, for Comcast.


Of course you can turn it off. Just wrap your modem in tin foil.


I know- I used to do the exact same. There was a twinge of cognitive dissonance but in the end it was usually outweighed by my 'need' for internet.

Though it did actually save my butt in a couple work situations.


> I was shocked that the best I could do was Comcast.

I can't help but feel that all of the providers are at this point happy to not compete with each other. It's expensive to build out infrastructure, and where they don't compete, they can charge more. This feels like there should be a monopoly case against all of them for effectively being in league with each other, even if there has been no explicit agreement.

On top of that, states like Tennessee blocking cities from expanding their own networks to help reach those who only have one provider? And the providers trying to argue that 10mbits is broadband?!

I'd like to see that where this is barely competition, municipalities take over. But, that doesn't necessarily mean much as in SF we've passed two resolutions for city wide wifi, and it's basically a sham.


Because TimeWarner and Cox are just as bad on customer service, and AT&T/Verizon are losing marketshare fast and may become obsolete. (DSL being behind the curve on bandwidth and fiber not available in 99% of areas)

At this point I'm starting to think the best shot we've got is if Tesla swoops in and saves the day with very-low-earth-orbit satellite internet service. Even that's not a guarantee because who knows how they'd operate as an ISP, maybe no better than what we've already got. Add onto that the fact that attempts at net neutrality are being rolled back and we may face the prospect of internet slow lanes, and the picture may be getting very bleak.


ATT is deploying FTTH in some areas where Google Fiber is at. I know here in Austin their 1Gbit fiber is available in quite a number of apartments (including mine). Verizon isn't really expanding FIOS anymore. But overall, ATT and Verizon are selling off their legacy DSL lines and are focusing on fixed "5G" being the next step in home broadband. And then of course both have their wireless subsidiaries where they are pushing people to so they can charge $$$ per GB.


Comcast is still better than any of the other isps I've dealt with. Admittedly, that's not a high bar - the other option in this area is Time Warner, which makes Comcast seem like fine wine next to Colt 45.


So basically you're saying that once an ISP gets enough, you stop complaining? Giving every other service provider an incentive to reach the convenient place of no expectations.


This is just what we've come to expect from them at this point. I'll still complain, but I can't really work up the energy to get seriously mad about it.


I have no love for Comcast.

But I don't see how Century Link is any better.


I made a special javascript for website operators to implement and take advantage of this a while back:

https://github.com/spaceribs/unjector


Why target just one javascript hack with a counter-hack when you can just use HTTPS and stop any of these shenanigans?


I'm not disagreeing, but this modal doesn't disappear until you've actually hit the close button. It will continue to attempt injection at any page which is not encrypted unless you acknowledge it.


It's really annoying when they inject warnings of the "You downloaded so and so TV show illegally".

Comcast, all my p2p traffic is encrypted. How do you know what it is? What're you trying to tell me about the safety of using your pipes for encrypted communication?

Switching to https makes the warnings go away. At least there's that.

(before anyone gets up in arms, I pay for cable as part of my subscription, I just don't have a TV to plug said cable into and I don't like broadcast TV, so i download)


> Comcast, all my p2p traffic is encrypted. How do you know what it is?

1. You start torrenting (over an encrypted connection) a pirated movie

2. A movie studio is connected to the same swarm, advertising chunks of that movie

3. Your client connects to the movie studio's server, giving them your IP address

4. They send a letter to your ISP

Encrypting P2P traffic is pretty much a waste of time. This scenario goes away if you download over a VPN, since the movie studio can't send your ISP the letter.


Or more simply, most trackers (even private ones) haven't picked up that using HTTPS for announce URLS is a good idea. A passive listener can discover what torrents your client is downloading and seeding if they're interested.


I hear people say their "so and so" traffic is encrypted all the time but that doesn't mean it's not trivial to know what you're doing with it. To me encrypting torrent traffic is like encrypting your SSH connection to a machine where everyone has root access. Your ISP might not know what you're doing on the machine, but another guy SSH'd into it can, and copyright enforcement companies will gladly login to find what you've been up to.


Comcast is not just an ISP but also a company that produces content - so they are probably extra motivated to stop content infringement.


They (the RIAA) have contractors that seed the torrents you've downloaded with permission from the copyright holders to do so.

Comcast is forwarding notices given to them by the RIAA.


> ... has access to your browsing history, your search history, your entire internet history ...

That's a bit over the top. They'll only have access to data that you already knew lots of people have access to anyway. Not HTTPS sites where they'll only have the domain name. So they won't have your Google search history but will for Bing which bizarrely defaults to HTTP.


Good guess but you're wrong. They also get meta data like size of page loads Wich is more than enough to find out what Wikipedia entry you are looking at [there's a paper].


Citation?



Then that means they are persistently logging everywhere you go on the web.


Use HTTPS when it is available


https://www.eff.org/HTTPS-EVERYWHERE is an absolute must-have browser extension for this.


I have this extension and Comcast. I didn't even notice they were injecting things


I don't have that extension, I do have Comcast, and I don't see injected Comcast content. Either uBO or another blocker (belt and suspenders) is blocking that, or they don't do it in my region, or my block, or whatever.


They only inject when you're on "xfinitywifi" networks and if you've pirated something and they want to inform you that you've been caught, iirc.


Not true. They've been injecting ads to my android phone which is served by a wireless device I own. And I haven't pirated anything. I had to switch to Firefox with ublock to fix it.


Unfortunately when hitting a data limit that causes these Comcast pop ups it breaks HTTPS connections. The only way to regain internet access is to visit a HTTP site such as example.com to get the pop up.


I've had this experience too. I complained to the FCC about it, and for my efforts got a likely-cookie-cutter mail response from comcast explaining that they provide these "rare, important messages" "for my own good".

edit: to clarify, I was complaining about the fact it broke all my connections, not that it was going on in the first place (which i'm also livid about)


In India it's done by Airtel, they apparently outsourced the job to a company from Dubai.


WOW does the same thing. Although you can opt-out, they still let you know they are there by hijacking requests to let you know about upcoming service outages. I guess they don't know about email.


I've blacklisted Xfinity WiFi on my phone. Just isn't worth it.


Android? I'm having a hard time preventing my iOS devices from connecting. Once connected it seems that it "remembers" even though I've deleted it from both the phone and my Mac.

I'm blaming cloud sync.


Is it just me or is it a GPL license notice that links to the LGPL?


This is done by dedicated hardware network box that can inspect HTTP with DPI like Allot, Sandvine or Procera. These boxes can inject a custom javascript in the http client page.


The largest ISP here in the Philippines does the same thing. Is this some sort of new feature with carrier grade routers?


Someone should start a campaign similar to wirecutters.

ABC - Anyone But Comcast


[dead]


I'm not doubting this but I've had Comcast internet for years and have never seen this happen. Perhaps because I don't use their DNS? Or because I use ad blockers (but only for the past couple of years). I supposed I might not have noticed if they were replacing ads, but I've never seen an account pop-up.


I believe the ad injection has to do purely with users of the xfinity wifi feature wherein you as a customer get to connect via other comcast customers wifi enabled routers which provide a paid guest network.


Click-bait title. The article itself even says "Comcast is only currently using their javascript injection ability to serve customer account related information". Also, Private Internet Access is far from a disinterested party here.

While we should all be outraged that AT&T, Comcast, Verizon and the like are MITMing our HTTP connections, nobody should be surprised at their ability to do so. In this post-privacy world, only strong end-to-end encryption can provide security. Also, don't forget that PIA and other VPNs are just as able to do this as Comcast.


"Post-privacy"; a little dramatic don't you think?

> The concept of universal individual privacy is a modern construct primarily associated with Western culture, British and North American in particular, and remained virtually unknown in some cultures until recent times. According to some researchers, this concept sets Anglo-American culture apart even from Western European cultures such as French or Italian. Most cultures, however, recognize the ability of individuals to withhold certain parts of their personal information from wider society—closing the door to one's home, for example.

> The distinction or overlap between secrecy and privacy is ontologically subtle, which is why the word "privacy" is an example of an untranslatable lexeme, and many languages do not have a specific word for "privacy".

https://en.m.wikipedia.org/wiki/Privacy


I think it'd be more fitting to call it "post-decency".




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: