American Airlines Lawsuit Suggests It Too Thinks GoGo In-Flight Broadband Sucks

from the monopolies-lecturing-monopolies dept

Over the last five years GoGo has effectively cornered about 80% of the in-flight broadband market, allowing the company to lag a little bit when it comes to giving a damn about customer satisfaction. And while the 3 Mbps per plane is starting to grow a little long in the tooth, the company has been raising prices for the service slowly but dramatically (though filters, throttling, and fake SSL certs are still free of charge).

That's something GoGo CEO Micheal wasn't all that apologetic for last year when fielding complaints that GoGo had effectively mutated into "Comcast at 35,000 feet":

“We’re starting to have millions of users, so it’s getting more and more congested, and we have raised prices, which you typically do when you have more demand than you have supply,” he said. “There’s nothing to apologize for. We have trouble finding a business in America that does anything differently.”

Apparently American Airlines, no stranger to not apologizing for awful service, thinks there's definitely something to apologize for. The airline has filed a lawsuit in Texas (pdf) stating the company will be making use of a contract clause to switch to a better in-flight broadband alternative. The full lawsuit offers a few reasons for the shift, most notably that customers paying an arm and a leg to share 3 Mbps of bandwidth aren't particularly happy about it. Some new satellite-based alternatives are emerging, which American thinks would be a better fit for customers who want the Internet to work:

In contrast with Gogo’s legacy air-to-ground system that uses cell towers, many of these new competitors offer faster and cheaper in-flight connectivity services using satellite-based technology. Whereas Gogo’s system provides 3 Mbps (or at most, 10 Mbps) of bandwidth shared among all users on a flight, and blocks most video content, these new satellite-based services offer 12 Mbps per device—more than enough for passengers to stream music, movies, and television. Also, with antennas facing up to satellites, instead of down to cell towers, these competitors can offer gate-to-gate WiFi access for customers, even over oceans.

Granted some of this is just the laws of physics; delivering a consistent, quality broadband signal at 30,000 feet isn't exactly cheap or easy, and in-flight services regardless of technology will always be relatively expensive and throttled. Still, it's pretty clear there's some captive-market apathy at play for GoGo, which is facing a 2014 class action for violating antitrust law (pdf), and recently settled another class action accusing the company of repeatedly billing customers who thought they were only signing up for one month of service.

American claims this new lawsuit was necessary after GoGo effectively ignored the company's previous notices that it wanted to switch operators. A GoGo SEC filing suggests the company doesn't deny the contract clause exists, but insists the company is working on its own, 2ku-based satellite broadband platform (which should offer closer to 70 Mbps per plane):

Earlier this month, American notified Gogo that it considers a competitor’s connectivity service to offer a material improvement over our early generation air to ground service with respect to a portion of American’s fleet representing approximately 200 aircraft. We plan to submit a competing proposal to install our latest satellite technology - 2Ku - on this fleet. We believe that 2Ku is the best performing technology in the market and look forward to discussing our offer with American.

In other words, however the lawsuit ends, customers should hopefully see better GoGo service -- just not without a lot of kicking and screaming first. While we wait, we can just enjoy the irony of one of the least liked companies in one of the most despised industries giving lectures on captive market innovation and competition.

Filed Under: airplane internet, satellite, wifi in the sky
Companies: american airlines, gogo

Gogo Inflight Wifi Service Goes Man-In-The-Middle, Issues Fake Google SSL Certificates

from the 'trusted-partner,'-my-ass dept

When you're flying, your internet connection is completely in the hands of a single company. There's no searching around for another signal. So, however the provider decides to handle your connection, that's what you're stuck with. A captive audience usually results in fun things like high prices and connection throttling. And, if you're Gogo Inflight, it means compromising the security of every traveler who chooses to use the service, just because you can.

Gogo Inflight Internet seems to believe that they are justified in performing a man-in-the-middle attack on their users. Adrienne Porter Felt, an engineer that is a part of the Google Chrome security team, discovered while on a flight that she was being served SSL certificates from Gogo when she was requesting Google sites. Looking at the issuer of the certificate, rather than being issued by Google, it was being issued by Gogo.

The bogus certificate was captured in a screenshot tweeted out by Felt.

hey @Gogo, why are you issuing *.google.com certificates on your planes? pic.twitter.com/UmpIQ2pDaU

— Adrienne Porter Felt (@__apf__) January 2, 2015

Now, Gogo Inflight likely has several reasons why it would perform a MITM attack on its users, but none of them justify stripping away previously existing security layers. The company loves to datamine and it definitely makes an effort to "shape" traffic by curtailing use of data-heavy sites. It also, as Steven Johns at Neowin points out, is an enthusiastic participant in law enforcement and investigative activities, going above and beyond what's actually required of service providers.

In designing its existing network, Gogo worked closely with law enforcement to incorporate functionalities and protections that would serve public safety and national security interests. Gogo’s network is fully compliant with the Communications Assistance for Law Enforcement Act (“CALEA”). The Commission’s ATG rules do not require licensees to implement capabilities to support law enforcement beyond those outlined in CALEA. Nevertheless, Gogo worked with federal agencies to reach agreement regarding a set of additional capabilities to accommodate law enforcement interests. Gogo then implemented those functionalities into its system design.

So, whatever its myriad reasons for compromising the security of travelers, it's likely the law enforcement angle that has the most to do with its fake SSL certificates. Every communication utilizing its service is fully exposed. Gogo keeping tabs on its users for itself (data mining) and law enforcement also exposes them to anyone else on the plane who wishes to do the same. Nowhere has it stated upfront that it will remove the security from previously secure websites and services. In fact, it says exactly the opposite in its Privacy Policy.

The airlines on whose planes the Services are available do not collect any information through your use of the Services, but we may share certain types of information with such airlines, as described below. Please remember that this policy only covers your activities while on the Gogo Domains; to the extent you visit third party websites, including the websites of our airline partners, the privacy policies of those websites will govern.

Except that those policies can't govern, not when their underlying security has been compromised by fake Gogo SSL certificates.

The solution for travelers is to skip the service entirely, or run everything through a VPN. Gogo welcomes the use of VPNs for greater security, but even this wording is at odds with what it's actually doing.

Gogo does support secure Virtual Private Network (VPN) and Secure Shell (SSH) access. If you have VPN, Gogo recommends that you use secure VPN protocols for greater security. SSL-encrypted websites or pages, typically indicated by “https” in the address field and a “lock” icon, can also generally be accessed through the Gogo Services. You should be aware, however, that data packets from un-encrypted Wi-Fi connections can be captured by technically advanced means when they are transmitted between a user’s Device and the Wi-Fi access point. You should therefore take precautions to lower your security risks.

Again, precautions are moot if Gogo deliberately inserts itself into the transmission with bogus certificates.

Gogo has yet to respond to this, but I would imagine its answer will involve pointing to the mess of contradictions it calls a Privacy Policy. Gogo can run its service however it wants to, but with its upcoming move into providing text messaging and voicemail access, it should really revamp the way it handles its customers' connections.

Filed Under: fake certs, mitm, security, ssl, wifi in the sky
Companies: gogo