Re: Comcast man-in-the-middle attack

[J Edgar Hoover <zorch () totally righteous net>]

On 8 Feb 2002, jon schatz wrote:

> > Whether the device is performing correctly is not the question. The
> > question is whether the device is appropriate at all in this context.
>
> It certainly is. Comcast (like all ISPS) sells alot more bandwidth than
> they actually have. Without some type of caching system, their network
> performance would suffer greatly.

***Caching wasn't turned on!***

Besides, your argument is that user privacy should be sacrificed to save a
few cents each in bandwidth costs?

> But you're not sending just any packet. you're sending an http request.
> We dealt with this issue at my previous employer, and non-http requests
> on port 80 were just passed through without any interference.

This implimentation grabs everything going to port 80, anywhere,
regardless of higher level protocol.

Also, I may not be sending "just any packet", but i'm also NOT sending it
to a comcast server. It's not theirs.

> I truly don't buy it. No offense, but your level of paranoia seems to
> match your email handle. I mean, if they really wanted to track all

I *catch* them snarfing my traffic, and I'm paranoid?