Hacker News Reader

Comment by emehrkay | Hacker News Reader

Where exactly does Paul stand on issues of privacy like this? You'd think we is against it, but he is also okay with ISPs selling your browsing history.

https://arstechnica.com/tech-policy/2017/03/gop-senators-new...

View on HN

Whether or not you agree, there is a legitimate & legal distinction between a private corporation and a publicly-funded government organization.

So in my mind there are two parts to publicly funded projects. One is whether the spending of funds is worth it and another is whether the people have a choice.

We think that by definition that when private companies have programs, they're not spending public money but I'd argue (somewhat controversial I agree) that any tax break is public money. Also the second part of whether participation is mandatory. I'd say if an ISP has a de facto Monopoly in a market, then we could say participation is mandatory. I hope this part is less controversial.

Line gets fuzzy when ISPs, in most part, are government-backed monopolies (I'm "lucky" because both Verion and Comcast covers my area)

He is against them being government backed monopolies. According to him, and I agree, we should be able to switch ISP's at will. If we do not want an ISP selling our data we should have the freedom to move to one that doesn't.

This sounds great for N >> 1 ISPs. But most of us have N > 1 (and N <= 2) from which to choose.

You have that freedom now, you might just have to move to exercise it.

SSL should prevent that. Sadly, SNI leaks the domain name. Hacker News appears in favor of SNI though, because lack of IPv4 address space.

https://news.ycombinator.com/item?id=13639112

Oddly, HN is really worried about server privacy. If we shared a single certificate across 20 domains, then people could see all those domains are hosted in the same place.

My point? We are part of the problem.

SSL does not really keep the domain name private at all either way though. That is no good solution to this, because your ISP needs to know how to route your request, right? Or, am I misunderstanding your point?

>SSL does not really keep the domain name private at all either way though.

Sure it does. That's the whole point of SNI. SSL encrypts the request, including the domain name. If you share a single IP address with multiple vhosts, you have two options. SNI, which leaks the domain in the clear, or a certificate matching all the domains you vhost.

https://en.wikipedia.org/wiki/Server_Name_Indication

If a server hosts hillaryclintonisgreat.com and donaldtrumpisgreat.com, then SNI leaks the domain and lets the ISP know definitively which one you visited.

And in practice there will almost never be other domains on the same certificate that can cloak your actions. SNI takes a bit of metadata that is basically public and makes it fully public. If you want to hide the domain you need to use another method.

How exactly is one domain per IP better than SNI privacy wise?

If you run one domain per IP, then it's just as obvious who you're connecting to.

Reply on news.ycombinator.com