Page 2

 
 
By Larry Seltzer  |  Posted 2004-06-28 Print this article Print
 
 
 
 
 
 
 


It turns out what they are doing is much less accurate and threatening than they indicate. I asked Major League Baseball Advanced Media how they went about determining ZIP codes of users based on IP addresses. They didnt respond after several days, but Im pretty sure I know what they are doing. It appears to be a technique similar to that used by Malaysian software company Hexa Software Development Center (HSDC).

Click the link just above and on the home page in a yellow box and you will see an attempt to tell you where you are. Sometimes its frighteningly accurate, sometimes bewilderingly wrong. But it all makes sense. The product is a database of IP addresses and physical locations of ISP POPs, network concentrators and similar facilities that are IP-addressable. Im guessing that they also have a database of IP client address ranges associated with those ISP facilities because it works too quickly for them to be performing a tracert.

The ISPs dont report to Major League Baseball (at least not yet), and the addresses of such devices and their assigned client ranges can easily change as ISPs add and remove points of presence and perform other maintenance. For this reason HSDC must update the product and the database periodically.

The end result is that the location you see on the HSDC Web page, and likely the location that MLB.TV thinks youre viewing from, is actually the location of your ISPs point of presence. Im in north Jersey, but HSDC says Im in New York City (where my ISPs DSL POP is). When Im connected through a VPN service I use HSDC thinks Im in Portland, Maine!

Check out eWEEKs Mobile & Wireless Center at http://wireless.eweek.com for the latest news, reviews and analysis. There are even better stories. A friend of mine in northeast Pennsylvania has a satellite connection for Internet access, and HSDC puts him in Virginia (where his satellite companys network operations center is). And of course if youre behind a corporate gateway of some kind, your location will likely be that of the gateway, so if youre at a branch office your location could be that of headquarters. To be fair, Ive also seen examples where people in Anytown, USA, were told they were in Anytown, USA.

As a final test I tried to view a Yankees-Mets game (6/27/2004) on both my ISP and VPN connections. As my theory predicted, I was blacked out on my ISP connection but let through on my VPN connection.

I think its fair to say that MLB.TV is overselling their capabilities. They have a specific list of ZIP codes for each teams blackout, and they simply cant know whether youre in one of those ZIP codes. On top of the inexactness Ive described so far, consider the possibility that you live in a border area for the blackout. How can the location detection know if youre on the right side of the line?

Imagine what would be possible with accurate physical location techniques. At the very least a certain amount of surreptitious marketing could happen, but so what? Is it really a scary thing at all? Maybe not. At the worst they would know your ZIP code or some level similarly granular. If theyre a commerce site, they already know it. If someone can tell me why I should be scared of this please do so.

Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. Check out eWEEK.coms Security Center at http://security.eweek.com for security news, views and analysis.
Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:   More from Larry Seltzer


 
 
 
 
Larry Seltzer has been writing software for and English about computers ever since—,much to his own amazement—,he graduated from the University of Pennsylvania in 1983.

He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.

For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.

In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.

Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...
 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Rocket Fuel