Major League Baseball Knows Where You Live! - ' Page 2 ' (
Page 2 of 2 )
It turns out what they are doing is much less accurate and threatening than they indicate. I asked Major League Baseball Advanced Media how they went about determining ZIP codes of users based on IP addresses. They didnt respond after several days, but Im pretty sure I know what they are doing. It appears to be a technique similar to that used by Malaysian software company Hexa Software Development Center (HSDC).
Click the link just above and on the home page in a yellow box and you will see an attempt to tell you where you are. Sometimes its frighteningly accurate, sometimes bewilderingly wrong. But it all makes sense. The product is a database of IP addresses and physical locations of ISP POPs, network concentrators and similar facilities that are IP-addressable. Im guessing that they also have a database of IP client address ranges associated with those ISP facilities because it works too quickly for them to be performing a tracert.
The ISPs dont report to Major League Baseball (at least not yet), and the addresses of such devices and their assigned client ranges can easily change as ISPs add and remove points of presence and perform other maintenance. For this reason HSDC must update the product and the database periodically.
The end result is that the location you see on the HSDC Web page, and likely the location that MLB.TV thinks youre viewing from, is actually the location of your ISPs point of presence. Im in north Jersey, but HSDC says Im in New York City (where my ISPs DSL POP is). When Im connected through a VPN service I use HSDC thinks Im in Portland, Maine!
Check out eWEEKs Mobile & Wireless Center at http://wireless.eweek.com for the latest news, reviews and analysis.
There are even better stories. A friend of mine in northeast Pennsylvania has a satellite connection for Internet access, and HSDC puts him in Virginia (where his satellite companys network operations center is). And of course if youre behind a corporate gateway of some kind, your location will likely be that of the gateway, so if youre at a branch office your location could be that of headquarters. To be fair, Ive also seen examples where people in Anytown, USA, were told they were in Anytown, USA.
As a final test I tried to view a Yankees-Mets game (6/27/2004) on both my ISP and VPN connections. As my theory predicted, I was blacked out on my ISP connection but let through on my VPN connection.
I think its fair to say that MLB.TV is overselling their capabilities. They have a specific list of ZIP codes for each teams blackout, and they simply cant know whether youre in one of those ZIP codes. On top of the inexactness Ive described so far, consider the possibility that you live in a border area for the blackout. How can the location detection know if youre on the right side of the line?
Imagine what would be possible with accurate physical location techniques. At the very least a certain amount of surreptitious marketing could happen, but so what? Is it really a scary thing at all? Maybe not. At the worst they would know your ZIP code or some level similarly granular. If theyre a commerce site, they already know it. If someone can tell me why I should be scared of this please do so.
Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983.
Check out eWEEK.coms Security Center at http://security.eweek.com for security news, views and analysis.
Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page: 
More from Larry Seltzer
