<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	>
<channel>
	<title>Comments on: Stealing Phorm Cookies</title>
	<atom:link href="http://www.lightbluetouchpaper.org/2008/04/22/stealing-phorm-cookies/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.lightbluetouchpaper.org/2008/04/22/stealing-phorm-cookies/</link>
	<description>Security Research, Computer Laboratory, University of Cambridge</description>
	<pubDate>Fri, 16 May 2008 10:50:19 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.5.1</generator>
		<item>
		<title>By: Mel</title>
		<link>http://www.lightbluetouchpaper.org/2008/04/22/stealing-phorm-cookies/#comment-29115</link>
		<dc:creator>Mel</dc:creator>
		<pubDate>Thu, 01 May 2008 14:54:57 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=319#comment-29115</guid>
		<description>@Pete Austin, When you navigate to a website, Phorm's system will redirect your browser to webwise.net (unless it has already  forged a tracking cookie in that website's domain).

Webwise.net is also used to ask if you want to opt-in or "opt-out".

So if you block webwise.net in the hosts file, when you attempt to visit any website your browser will try to open 127.0.0.1, and report an error. 

See Richard Clayton's account of how phorm works- &lt;a href="http://www.lightbluetouchpaper.org/2008/04/04/the-phorm-webwise-system/" rel="nofollow"&gt;The phorm webwise system&lt;/a&gt;

I'm no artist (far from it in fact), but I've previously had a stab at drawing a diagram in an attempt to show how webwise works - 
&lt;a href="http://lh4.ggpht.com/pathogenrush/SBXGNjvwj-I/AAAAAAAAAFI/yst_kUw4zGY/s800/phorming.png" rel="nofollow"&gt;Phorm Webwise Diagram&lt;/a&gt; if it is of any help.


I'm also not convinced that using public proxies as a work around is a good idea. There's no guarantee the proxy/exit node isn't using Phorm. In fact one of the forum posts that appeared to have been corrupted with javascript as a result of the early sysip.net tests had "I.PUBLICPROXY" as the ISP variable.

(my appologies for the O/T post.)</description>
		<content:encoded><![CDATA[<p>@Pete Austin, When you navigate to a website, Phorm&#8217;s system will redirect your browser to webwise.net (unless it has already  forged a tracking cookie in that website&#8217;s domain).</p>
<p>Webwise.net is also used to ask if you want to opt-in or &#8220;opt-out&#8221;.</p>
<p>So if you block webwise.net in the hosts file, when you attempt to visit any website your browser will try to open 127.0.0.1, and report an error. </p>
<p>See Richard Clayton&#8217;s account of how phorm works- <a href="http://www.lightbluetouchpaper.org/2008/04/04/the-phorm-webwise-system/" rel="nofollow">The phorm webwise system</a></p>
<p>I&#8217;m no artist (far from it in fact), but I&#8217;ve previously had a stab at drawing a diagram in an attempt to show how webwise works -<br />
<a href="http://lh4.ggpht.com/pathogenrush/SBXGNjvwj-I/AAAAAAAAAFI/yst_kUw4zGY/s800/phorming.png" rel="nofollow">Phorm Webwise Diagram</a> if it is of any help.</p>
<p>I&#8217;m also not convinced that using public proxies as a work around is a good idea. There&#8217;s no guarantee the proxy/exit node isn&#8217;t using Phorm. In fact one of the forum posts that appeared to have been corrupted with javascript as a result of the early sysip.net tests had &#8220;I.PUBLICPROXY&#8221; as the ISP variable.</p>
<p>(my appologies for the O/T post.)</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Pete Austin</title>
		<link>http://www.lightbluetouchpaper.org/2008/04/22/stealing-phorm-cookies/#comment-29103</link>
		<dc:creator>Pete Austin</dc:creator>
		<pubDate>Tue, 29 Apr 2008 16:11:09 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=319#comment-29103</guid>
		<description>@richard
At home I use a hosts file that maps literally thousands of domains to 127.0.0.1 with no obvious bad effects. I think it speeds up my browsing. Here's one example:
http://www.mvps.org/winhelp2002/hosts.htm

Phorm are in the ad-serving business, and mapping domains in this way blocks adverts, so it's not surprising that they would not recommend it.</description>
		<content:encoded><![CDATA[<p>@richard<br />
At home I use a hosts file that maps literally thousands of domains to 127.0.0.1 with no obvious bad effects. I think it speeds up my browsing. Here&#8217;s one example:<br />
<a href="http://www.mvps.org/winhelp2002/hosts.htm" rel="nofollow">http://www.mvps.org/winhelp2002/hosts.htm</a></p>
<p>Phorm are in the ad-serving business, and mapping domains in this way blocks adverts, so it&#8217;s not surprising that they would not recommend it.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Richard Clayton</title>
		<link>http://www.lightbluetouchpaper.org/2008/04/22/stealing-phorm-cookies/#comment-29078</link>
		<dc:creator>Richard Clayton</dc:creator>
		<pubDate>Sat, 26 Apr 2008 14:53:12 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=319#comment-29078</guid>
		<description>@fred

a) your countermeasure using 127.0.0.1 is not recommended by Phorm, will slow down your browsing and BT claim (probably wrongly) will prevent you browsing at all.  It's also rather Windows specific

b) your other countermeasures will be more effective, but have little to do with the topic of this article.</description>
		<content:encoded><![CDATA[<p>@fred</p>
<p>a) your countermeasure using 127.0.0.1 is not recommended by Phorm, will slow down your browsing and BT claim (probably wrongly) will prevent you browsing at all.  It&#8217;s also rather Windows specific</p>
<p>b) your other countermeasures will be more effective, but have little to do with the topic of this article.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: fred</title>
		<link>http://www.lightbluetouchpaper.org/2008/04/22/stealing-phorm-cookies/#comment-29075</link>
		<dc:creator>fred</dc:creator>
		<pubDate>Sat, 26 Apr 2008 10:53:10 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=319#comment-29075</guid>
		<description>Phorm counter-measures

1)

Edit your 'Hosts' file...

Start --&#62; Run --&#62; Type:

notepad "c:\windows\system32\drivers\etc\hosts"

Add the following line to the bottom of the file:

127.0.0.1       oix.net
127.0.0.1       oix.com
127.0.0.1       phorm.com
127.0.0.1       webwise.net
127.0.0.1       webwise.com
127.0.0.1       sysip.net
127.0.0.1       qkilbdr.net
127.0.0.1       121media.com
127.0.0.1       openinternetalliance.com
127.0.0.1       openinternetalliance.net
127.0.0.1       youcanoptin.com
127.0.0.1       youcanoptin.net
127.0.0.1       youcanoptout.com
127.0.0.1       youcanoptout.net

File --&#62; Save

File --&#62; Exit

(You may, at first, have go into the file's temporary and untick the 'Read-only' box).

(HEY MOD! Have I got the first bit right, this time)?

2)

Visit http://www.dephormation.org.uk/ and Download the Dephormation v1.6 Firefox Add On.

"The Dephormation Add On ensures that your decision to permanently opt out of Phorm profiling cannot be undone in Firefox.

Optionally, the Add On can also alert you to sites using Phorm/ Webwise/ OIX profile based advertising.

With each page you view in your browser, a Phorm 'opt out' cookie is set automatically, and the Phorm UID cookie is randomised. Even if you delete all your cookies regularly".

3)

Visit http://www.torproject.org/ and install TorBrowser, a Windows Browser Bundle (Containing Tor, Torbutton, Polipo, and Firefox).</description>
		<content:encoded><![CDATA[<p>Phorm counter-measures</p>
<p>1)</p>
<p>Edit your &#8216;Hosts&#8217; file&#8230;</p>
<p>Start &#8211;&gt; Run &#8211;&gt; Type:</p>
<p>notepad &#8220;c:\windows\system32\drivers\etc\hosts&#8221;</p>
<p>Add the following line to the bottom of the file:</p>
<p>127.0.0.1       oix.net<br />
127.0.0.1       oix.com<br />
127.0.0.1       phorm.com<br />
127.0.0.1       webwise.net<br />
127.0.0.1       webwise.com<br />
127.0.0.1       sysip.net<br />
127.0.0.1       qkilbdr.net<br />
127.0.0.1       121media.com<br />
127.0.0.1       openinternetalliance.com<br />
127.0.0.1       openinternetalliance.net<br />
127.0.0.1       youcanoptin.com<br />
127.0.0.1       youcanoptin.net<br />
127.0.0.1       youcanoptout.com<br />
127.0.0.1       youcanoptout.net</p>
<p>File &#8211;&gt; Save</p>
<p>File &#8211;&gt; Exit</p>
<p>(You may, at first, have go into the file&#8217;s temporary and untick the &#8216;Read-only&#8217; box).</p>
<p>(HEY MOD! Have I got the first bit right, this time)?</p>
<p>2)</p>
<p>Visit <a href="http://www.dephormation.org.uk/" rel="nofollow">http://www.dephormation.org.uk/</a> and Download the Dephormation v1.6 Firefox Add On.</p>
<p>&#8220;The Dephormation Add On ensures that your decision to permanently opt out of Phorm profiling cannot be undone in Firefox.</p>
<p>Optionally, the Add On can also alert you to sites using Phorm/ Webwise/ OIX profile based advertising.</p>
<p>With each page you view in your browser, a Phorm &#8216;opt out&#8217; cookie is set automatically, and the Phorm UID cookie is randomised. Even if you delete all your cookies regularly&#8221;.</p>
<p>3)</p>
<p>Visit <a href="http://www.torproject.org/" rel="nofollow">http://www.torproject.org/</a> and install TorBrowser, a Windows Browser Bundle (Containing Tor, Torbutton, Polipo, and Firefox).</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Dennis Jackson</title>
		<link>http://www.lightbluetouchpaper.org/2008/04/22/stealing-phorm-cookies/#comment-29055</link>
		<dc:creator>Dennis Jackson</dc:creator>
		<pubDate>Thu, 24 Apr 2008 16:59:42 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=319#comment-29055</guid>
		<description>Have I missed something?

Looking at the technical description, the Phorm system could easily block me from browsing any web sites. At step 15, my firewall (or content filter such as SurfControl) may not allow access to webwise.net. If my firewall blocks webwise.net then the redirected request will never happen and my attempt to visit www.cnn.com will fail. I can only get to desired web sites by changing my firewall to also allow access to webwise.net.

There are many organisations that implement a whitelist to limit sites that can be browsed at work. Vendors (such as SurfControl) supply dynamic blacklists and whitelists of sites. What is the incentive to include webwise.net in any whitelist?

Unless I add webwise.net to the whielist in my firewall my access to the Internet is blocked. Transparent - no. Friendly - no. Trivial change to T&#38;C - no.</description>
		<content:encoded><![CDATA[<p>Have I missed something?</p>
<p>Looking at the technical description, the Phorm system could easily block me from browsing any web sites. At step 15, my firewall (or content filter such as SurfControl) may not allow access to webwise.net. If my firewall blocks webwise.net then the redirected request will never happen and my attempt to visit <a href="http://www.cnn.com" rel="nofollow">http://www.cnn.com</a> will fail. I can only get to desired web sites by changing my firewall to also allow access to webwise.net.</p>
<p>There are many organisations that implement a whitelist to limit sites that can be browsed at work. Vendors (such as SurfControl) supply dynamic blacklists and whitelists of sites. What is the incentive to include webwise.net in any whitelist?</p>
<p>Unless I add webwise.net to the whielist in my firewall my access to the Internet is blocked. Transparent - no. Friendly - no. Trivial change to T&amp;C - no.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Barrie Dempster</title>
		<link>http://www.lightbluetouchpaper.org/2008/04/22/stealing-phorm-cookies/#comment-29052</link>
		<dc:creator>Barrie Dempster</dc:creator>
		<pubDate>Thu, 24 Apr 2008 08:53:01 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=319#comment-29052</guid>
		<description>I don't see how encrypting the cookie would help, unless it was encrypted on-the-fly for each request which would probably be quite impractical.

Tracking this information in cookies effectively injected into another domains cookie space is riddled with problems. There's just no way Phorm can control the requests and prevent the 3rd parties gathering information.

Barrie</description>
		<content:encoded><![CDATA[<p>I don&#8217;t see how encrypting the cookie would help, unless it was encrypted on-the-fly for each request which would probably be quite impractical.</p>
<p>Tracking this information in cookies effectively injected into another domains cookie space is riddled with problems. There&#8217;s just no way Phorm can control the requests and prevent the 3rd parties gathering information.</p>
<p>Barrie</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: david M</title>
		<link>http://www.lightbluetouchpaper.org/2008/04/22/stealing-phorm-cookies/#comment-29047</link>
		<dc:creator>david M</dc:creator>
		<pubDate>Wed, 23 Apr 2008 16:00:46 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=319#comment-29047</guid>
		<description>http://www.openrightsgroup.org/2008/04/23/fipr-calls-on-home-office-to-withdraw-misleading-advice-on-phorm/
FIPR calls on Home Office to withdraw misleading advice on Phorm
Posted by Becky in Computer Law, Data Protection, Net Neutrality, Privacy, Regulation of Investigatory Powers Act at April 23rd, 2008</description>
		<content:encoded><![CDATA[<p><a href="http://www.openrightsgroup.org/2008/04/23/fipr-calls-on-home-office-to-withdraw-misleading-advice-on-phorm/" rel="nofollow">http://www.openrightsgroup.org/2008/04/23/fipr-calls-on-home-office-to-withdraw-misleading-advice-on-phorm/</a><br />
FIPR calls on Home Office to withdraw misleading advice on Phorm<br />
Posted by Becky in Computer Law, Data Protection, Net Neutrality, Privacy, Regulation of Investigatory Powers Act at April 23rd, 2008</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Jamie Hunter</title>
		<link>http://www.lightbluetouchpaper.org/2008/04/22/stealing-phorm-cookies/#comment-29042</link>
		<dc:creator>Jamie Hunter</dc:creator>
		<pubDate>Wed, 23 Apr 2008 08:28:10 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=319#comment-29042</guid>
		<description>Hi RIchard,

Thanks for your work on Phorm and for speaking at the public meeting on Tuesday night.  I note that 80/20 Thinking have yet to provide any video footage of the event despite it being over a week since the public meeting.

I was able to film four of the speeches, including yours and have posted these unedited at http://tobymeres.net</description>
		<content:encoded><![CDATA[<p>Hi RIchard,</p>
<p>Thanks for your work on Phorm and for speaking at the public meeting on Tuesday night.  I note that 80/20 Thinking have yet to provide any video footage of the event despite it being over a week since the public meeting.</p>
<p>I was able to film four of the speeches, including yours and have posted these unedited at <a href="http://tobymeres.net" rel="nofollow">http://tobymeres.net</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: david M</title>
		<link>http://www.lightbluetouchpaper.org/2008/04/22/stealing-phorm-cookies/#comment-29041</link>
		<dc:creator>david M</dc:creator>
		<pubDate>Wed, 23 Apr 2008 07:09:50 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=319#comment-29041</guid>
		<description>BTW Richard did you see Alexander's post yet 

http://www.cableforum.co.uk/board/12/33628733-virgin-media-phorm-webwise-adverts-updated-page-299.html#post34535819

"Kent turned up late"...

"He said (and I quote) "he [Richard Clayton] thinks Phorm is the best thing to ever happen with online advertising" (I kid you not).""</description>
		<content:encoded><![CDATA[<p>BTW Richard did you see Alexander&#8217;s post yet </p>
<p><a href="http://www.cableforum.co.uk/board/12/33628733-virgin-media-phorm-webwise-adverts-updated-page-299.html#post34535819" rel="nofollow">http://www.cableforum.co.uk/board/12/33628733-virgin-media-phorm-webwise-adverts-updated-page-299.html#post34535819</a></p>
<p>&#8220;Kent turned up late&#8221;&#8230;</p>
<p>&#8220;He said (and I quote) &#8220;he [Richard Clayton] thinks Phorm is the best thing to ever happen with online advertising&#8221; (I kid you not).&#8221;"</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Mel</title>
		<link>http://www.lightbluetouchpaper.org/2008/04/22/stealing-phorm-cookies/#comment-29038</link>
		<dc:creator>Mel</dc:creator>
		<pubDate>Wed, 23 Apr 2008 00:20:28 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/?p=319#comment-29038</guid>
		<description>Incidently a full-stop has got into your my slides url   &lt;a href="http://www.cl.cam.ac.uk/~rnc1/talks/080415-phorm.pdf" rel="nofollow"&gt;my slides here&lt;/a&gt; 

And I messed up my own URL :o)

&lt;a href="http://pathogenrush.blogspot.com/2008/04/webwise-phorming-opinion_4818.html" rel="nofollow"&gt;Phorm-bugs?&lt;/a&gt;</description>
		<content:encoded><![CDATA[<p>Incidently a full-stop has got into your my slides url   <a href="http://www.cl.cam.ac.uk/~rnc1/talks/080415-phorm.pdf" rel="nofollow">my slides here</a> </p>
<p>And I messed up my own URL :o)</p>
<p><a href="http://pathogenrush.blogspot.com/2008/04/webwise-phorming-opinion_4818.html" rel="nofollow">Phorm-bugs?</a></p>
]]></content:encoded>
	</item>
</channel>
</rss>
