Hacker News Reader

> Because you are not a unique and special snowflake. If you regularly go to /r/The_Donald, it says something specific about your politics (probably). Same for /r/LateStageCapitalism or /r/trees. It might not say much, but it adds up to a profile of who you are and what you think about.

They won't be collecting that information though. They'll only see that you visited reddit.com in all those cases.

Bad news for https://howtoopenanumberedaccount.com visitors (Host header in plaintext) and people who click on links to http://ponies.net from https://reddit.com/r/LaunderYourCash (Referer header in plaintext)

Presumably the non-https assets which get pulled in when the main request is fulfilled could also act as a "fingerprint" of the page you are visiting?

AFAIK browsers will not provide a referrer if the previous page in case you go from https to http. Firefox has an option to disable https to https referer sharing btw.

Excuse my ignorance but won't they have access to the whole URL?

As long as the site uses https (reddit does), then the path is encrypted, the only part of the URL thing they'll have access to is the host.

For http sites they have access to whole url and everything that is submitted, for example all commments you write.

For https sites (green lock icon) they only know domain name, for example reddit.com

From the article: "Those ICRs in effect serve as a full list of every website that people have visited, rather than collecting which specific pages are visited or what's done on them."

And from another site on the same issue: "When you visit a website you usually start at the websites homepage such as www.bigbrotherwatch.org.uk/ the Government define this part of a website address (the part before the first forward slash) as communications data which they consider to be non-intrusive information." (https://www.bigbrotherwatch.org.uk/wp-content/uploads/2016/0...)

In fairness the law mandates they record the domain, it doesn't say anything about capturing more it just sets a standard for the minimum.

Given that the ISP's have now been given cart blanche to collect data that is very commercially valuable I can see some of them doing it with the hope they can sell it later.

Doesn't that social graph require them to know what you're doing on a given site?

I suppose they already have that power, otherwise we wouldn't have what you describe.

But the article says they're only gathering connection metadata, this law anyway. I guess they're already doing even more intrusive things, at least as a way to know who to get "legit" evidence on.

This illustrates how slippery the distinction between communications data and metadata really is. The examples in the first paragraph would all just record that you had been to www.reddit.com.

It's quite to look at your history and determine that you visited /r/The_Donald often, with good likelihood, automatically.

Seriously, nobody at GCHQ cares that you support Donald Trump.

It was my slightly flippant example. I'm sure everyone knows that.

SELECT * FROM dudes_with_doubleplusbad_opinions;

It's about profiling, how that profile is determined, and who accesses it under what circumstances.

> If your search phrases include things like "how to make a bomb", you're probably going to be on a database somewhere. There have been numerous serious court cases (e.g. murder trials) where the prosecution have presented evidence that the accused's search history included phrases like "how to dispose of a body" or "how to poison someone". In other cases, jurors have been dismissed for using Google to research the background to the case they are serving on. I wonder where the information about these searches came from

Google tracks it.

And you can get that straight out the history on the browser of the suspect as well, someone daft enough to google something that incriminating from a machine they own on a connection they own is possibly daft enough to not delete the damn search history.

It's amazing how bad some people are with computers, like astoundingly bad, It's easy to forget as techies/developers that not everyone even understands crudely how a computer works.

a way to implement highly repressive government too - just start monitoring people with different lifestyles or "way out" opinions.

Or even better start using it to monitor opponents and discover their weak points and alliances. If you wanted a recipe for tyranny when a vindictive leader comes to power, this is it.

This is really a legalisation of the law-breaking that has been going on for decades from GCHQ, and the expansion of their data out to a huge number of government departments. There will be abuse of this system at all levels.

As everything else, it takes step at a time... first they will record a website address, the people will calm down and get used to it, ISPs will implement the storage. Then they will find a reason to implement another law that will require to record what we do on the websites. There is no coming back. It will evolve as everything else humans touch.

> I wonder where the information about these searches came from?

I've also wondered about that. Presumably it could simply be from the browser history of a seized computer. But now, who knows?

Will it become standard practice to look up the internet history of anyone accused of any crime? Who decides whether this stuff is admissible as evidence?