Hacker News Reader

Comment by nicktelford | Hacker News Reader

What truly terrifies me about this is how little control most users have over the websites they "visit". This law requires ISPs to log the domain name of websites users connect to. All it takes is one dodgy advert on an otherwise ordinary website to incriminate you. Worse, you might not even know this has happened, as the ad itself might be completely innocuous. But by virtue of being hosted on a website the government considers suspect, you find yourself on a list.

I don't know if this actually happens in practice, but I have heard stories of bad actors using adverts to distribute malware - it doesn't take a stretch of the imagination to see the same bad actors using adverts to generate false positives to the authorities.

Ad blockers are going to become more important than ever.

View on HN

A dodgy advert, an image embedded in an online forum, a malicious link on reddit. I agree this sounds worrying.

Wow that's a good point: in the era of false news, getting someone to visit a site that covertly logs them as having visited suspicious domains would be pretty trivial.

Just publish some really divisive fake news about Brexit and that'll rack up the UK hits on Facebook.

Christ, it's even worse than I thought.

It's so disgustingly trivially easy, I don't feel comfortable making even basic comments about how Id do that.

But I am going to try a few PoC ones later today. (On a private network, using all domains and computers I control.)

I... View a lot of use of digital records as the witchtrials of the modern era (eg, cases where people got charged for child porn because a coworker used their machine, but the logs say it was them!). The conclusions don't logically hold up, but reveal something about our reverance for technology (and assuming it worked right).

> in the era of false news

How did we get here? Many folks have surfed the web for 20 years, even more for 15, most for 10 --- now in 2016, surprise surprise, fake news abound! /s Almost as if coinciding with the calls for (or introductions of) related legislation..

The number of people online, the level of engagement, and the money being made in online advertising, is unprecedented. I don't know what impact it had on the election, but it was definitely something that has attracted more attention due to the campaigns. It's not unusual for a problem that has existed for a relatively long-time to suddenly come to the attention of the legislature when it rises in prominence.

Just a narrative being peddled [0]. The mainstream media lost their grip on "the people" so now need to brand anything that isn't themselves as "fake news". Google Trends shows how blatantly obvious the narrative crafting is. It's only suddenly an issue because the MSM needs it to be. So within a very short amount of time you see MSM like the NYT or WaPo posting articles about 'Fake News' and getting everyone to start talking about it.

[0] http://i.imgur.com/lWjnRqt.png

Sure. Exactly. I just added a /s to my post.. ;)

Fake news started spiking in Google Trends around the election because that is when fake news became profitable.

We are talking about blatant spam sites in which the owners openly admitted to making up stories out of whole cloth.

Fake news became profitable right around the time when a major candidate ran on a platform that peddled conspiracy theories. What a surprise!

Fakenews/webspam has been profitable for years. I've seen articles with titles like "Martin Sheen dead!" for a lot longer than the 2016 US Presidential campaign (which, granted, seemed like it lasted forever)

DNS or html bowser prefetching... oh my

Lets face it: in the end, mass surveillance like this is a tool of terror, not of gaining knowledge. It's about injecting fear into society. And it already starts to work, obviously.

Yeah I was curious about what level of detail will be recorded. According to the article: "The law forces internet service providers to keep a record of all the websites – not the actual pages – you visit for up to a year."

If they aren't recording the pages, I'd doubt they've be recording the ads embedded on the page.

But who knows, I imagine it's down to how the ISPs implement the legislation.

From my interpretation they are logging the IP address and ports data transfered from.

So theoretically if you transfer data from insert bad orgs IP address here from within another innocent website you'd be logged for that.

They can't record the pages if the request is over https, as per most web sites these days. The IP address is known because it's necessary for routing traffic, but the content of each HTTP request and response is encrypted, and that's where the rest of the URL lives.

Gov't can easily MITM HTTPS connections.

I did not know this. How do they do that?

http://security.stackexchange.com/questions/143387/is-there-...

That's pretty clear. It does depend of what level/technology is used in the Encryption, but broadly, against nation state actors with full virtual and physical hardware access, you are to put it bluntly, stuffed.

To anyone reading this, the link says: "It is unclear whether such rules would apply to companies which don't operate directly in the UK", so it is literally not pretty clear.

The _legality_ isn't clear. The technical methodology is quite clear.

True. Anyone know if this new IP law allows the gov to do this? I.e. if they tried to prosecute and it came to light that the logs were obtained using a MITM attack, would the evidence be nullified?

I don't know.

I imagine that MITM on a large scale is par for the course for GCHQ.

Sure, but can data obtained by that be used in a court of law. I /think/ those are two different things (but not sure).

It would probably come under the "Equipment Interference" section, which legalises hacking of devices.

They can (usually) extract the hostname of the site though, TLS includes it in plaintext.

They're logging the hostname of every "site visited". However, an ISP won't be able to distinguish between a URL you entered in the address bar, and a URL requested by an iframe, img or script tag embedded on a page.

They'll just know that you visited the host.

Reply on news.ycombinator.com