Your ISP soon won't be able to see anything you do online. But Google will see it all.
> The number one creepiest thing on our list of privacy-invasive practices comes courtesy of Verizon (and AT&T, which quickly killed a similar program after Verizon started getting blowback).
> Snooping through your traffic and inserting ads Which ISPs did it before? AT&T, Charter, CMA
> Hijacking your searches Which ISPs did it before? Charter, Cogent, DirecPC, Frontier, Wide Open West
All of these areas are going to be tried again by the ISPs with this law.
[1] https://www.eff.org/deeplinks/2017/03/five-creepy-things-you...
Ok, so Google doesn't inject ads into your web traffic. But they inject ads into websites using AdSense, and into search results, and their products, and any technology linked to their ad platform (which is basically all technology related to the web). To increase ad revenue, they snoop on any personal data you store with Google. And they use their ads to collect more info about where you go on the web.
> Hijacking your searches
So, Google doesn't need to hijack your search, because they are most people's preferred search engine. But they do proxy your browser's connection when you click on a search result from a mobile browser (AMP). They're starting to do this with your e-mail, too. And they sometimes do this with your DNS records, so they know every site you load, period. I would call that connection hijacking, tracking, and snooping.
Re: the other points in that article, they already sell your data to marketers, all their software is already pre-installed on your phone/tablet/chromebook/desktop/laptop, and they definitely track you with cookies.
Google has a competitive advantage in that they have a walled-off platform where nobody else can make money off of you. The ISPs want a shot at making money off you, too. Since both are doing virtually the same thing, I don't see a big difference. Just the means by which they do them.
Google has been reshaping the entire internet and web just to maximize the way they can profit off my personal information. I don't see the ISPs doing that. What I'm curious about is, why is the EFF so upset about what ISPs do, but not upset about what Google does, when Google's actions are literally affecting an entire industry and most of the world, and not just its own customers?
- Do you want your ISP tracking you and selling your private data? Do you think that is the place of an ISP?
- Does it bother you you are PAYING your ISP and they are reselling your data as well?
- Do you trust Comcast and Verizon and like that you are paying them to sell your data when you just want to use them to get online and are ok with this?
I don't think anyone argues Google has power but they aren't your 'gateway' to the internet that you pay for privacy.
Your argument is basically that you think Google has overreach so you want ISPs to take that from them or also do that?
I am against Google Fiber ISP having access that ISPs just won with bribery over innovation/product offerings that people want.
If Facebook had an ISP I wouldn't want them doing it either via the ISP.
> What I'm curious about is, why is the EFF so upset about what ISPs do, but not upset about what Google does, when Google's actions are literally affecting an entire industry and most of the world, and not just its own customers?
Products built on top of the internet are way different than products that are the base of the network. You should not be tracked at the network/gateway level ever.
If ISPs 'want a shot at making money off you' then let them build a service such as a search engine, social network or maybe like Comcast is doing with Hulu. Don't give up your rights at the gateway of the web just because you have a grudge or bias against Google.
> Google has been reshaping the entire internet and web just to maximize the way they can profit off my personal information. I don't see the ISPs doing that.
Also your points about Google are rich considering you have a @gmail account in your HN profile. If they are so overpowering why do you use them and not your ISPs email system?
Since you have no issue with ISPs selling data that you are paying them to keep private, you would be fine with Google Fiber ISP also doing that? Careful what you wish for and freedoms you give up due to bias ...
I care a teeny bit about privacy, but I care a whole lot more about anticompetitive monopolistic practices. IMO, ISPs are absolutely guilty of those - but my point is, so is Google. I care when somebody changes the design of the entire web for their company's sole profit.
That's why I'm pointing out Google's practices, and how I think they're doing much worse things than ISPs. If you don't care about anticompetitive monopolistic practices, and only care about privacy, then I can see how you might not mind what Google is doing. But soon, Google will be doing to you what they're making impossible for the ISP to do.
- Do you want your ISP tracking you and selling your private data? Do you think that is the place of an ISP?
- Does it bother you you are PAYING your ISP and they are reselling your data as well?
- Do you trust Comcast and Verizon and like that you are paying them to sell your data when you just want to use them to get online and are ok with this?
- Since you have no issue with ISPs selling data that you are paying them to keep private, you would be fine with Google Fiber ISP also doing that?
I am against Google Fiber ISP having access that ISPs just won with bribery over innovation/product offerings that people want. This is about the level of privacy and access ISPs should have not about Google.
- The ISPs already charge too much and little of it is going towards innovations/network advancement, instead they want to be content creators and ad platforms instead of charging more to get to gigabit and beyond. ISPs need to get back to innovating on providing better/faster internet service, what they are are network providers.
- ISPs should not be involved in content/ads/selling private data as that leads to bias and throttling, we need to have a separation of power from ISPs, the network gateway to the internet, and content creators on top of the internet.
When is it a good idea to have content creators own the network outright? All that leads to is bias, preferential treatment and monopolies (furthering them).
We have made immense mistakes in 2017 allowing ISPs to sell your private data, remove privacy protections at the network level AND the removal of net neutrality.
Net neutrality makes the network provider neutral, simple as that. ISPs you pay to get access to the network which is a utility today and to keep your data private, not sell it.
> For years, Comcast and other large telecommunication companies around the world have injected javascript into your web browsing experience to serve advertisements and account notices. Their ability to do this stems from their upstream position as your Internet Service Provider (ISP). While Comcast is only currently using their javascript injection ability to serve customer account related information, the same message sending vector could be used to serve phishing expeditions, or other types of attacks. Not to mention that whoever your ISP is has access to your browsing history, your search history, your entire internet history unless you use a VPN. Some, like AT&T, even brazenly sold parts of this information for advertising profit unless you explicitly paid them not to – a pay-for-privacy scheme.
Why do you think ISPs like Comcast lobbied so hard to bribe their way into the ad/tracking market instead of winning it on the market with products people want? Do you think they did that so that to waste profits? Or to gain them?
We pay ISPs for secure and private internet access, not to also sell off our private data.
Google and Facebook are ad/marketing companies, you expect tracking and they use your data and give you a free service in exchange.
ISPs we pay for internet access and privacy, noone expects ISPs to be selling your data or would call them ad networks, though that is what they want to be and are building with this privacy law change.
[1] https://www.privateinternetaccess.com/blog/2016/12/comcast-s...
There's some discussion of known Comcast injection here: https://news.ycombinator.com/item?id=15890551
The response from Comcast was [2]:
> This is our web notification system, documented in RFC 6108 https://tools.ietf.org/html/rfc6108, which has been in place for many years now. It presents an overlay service message on non-TLS-based HTTP sessions. If you click the X box or otherwise acknowledge the notice it should immediately go away. If that is not the case let me know and we'll have a look at what may be happening. [2]
But ultimately no, however there may be some possibilities:
- ISP offered 'apps'. Get people to agree to an install of some monitoring app for some [insert random marketing benefit] from ISP. Maybe if you install the app you get more data cap space etc and they can monitor browser access. Further, install this in known apps or as add-ons on setup for other apps.
- ISP offered 'VPN client' that again, gives some cheaper monetary benefit like more data cap space or more speed 'free', strips out other advertising or tracking as a benefit.
- ISP offered 'email client' that does all of the above.
- Check for subsequent request after page loads to known ad networks and replace with their own in HTTPS
- ISP level proxy MITM, modem customization for 'fast lanes' that are actually slow lanes.
- DNS level data collection not to inject but to sell marketing profiles via metadata and correlate with other data from apps.
First one is the most probable but as of right now HTTPS injection is obviously hard to do if not impossible without some social or security hole.
Nobody in here would probably fall for these attempts but most would considering the outrage that they didn't know friend harvesting was happening on Facebook. If whatever they try lowers their monthly data caps or limits then majority of people will do it.
Since ISPs are your 'gateway' to the internet and you pay them, most people assume trust and privacy, most don't know they bribed their way into the tracking/ad business, many didn't know cable tv modems had mics either. With that assumption of trust since people are paying them, they'll more easily fall for any of the possible attack/tracking vectors listed and more probably.
With the ISP privacy protections removed [3], my guess is most ISPs, due to lack of competition, end up more like hotel wifi where tracking/injection is the norm [4] as it is completely legal now. With the removal of privacy protections and net neutrality, we have killed the pristine, non tracked, private gateways to the internet we cherish.
[1] https://www.privateinternetaccess.com/blog/2016/12/comcast-s...
[2] http://forums.xfinity.com/t5/Customer-Service/Are-you-aware/...
[3] https://www.flake.senate.gov/public/index.cfm/2017/3/flake-i...
[4] https://medium.com/@nicklum/my-hotel-wifi-injects-ads-does-y...
I was planning literally this month to figure out how to implement domain traffic analytics on my LAN by using SNI via libpcap or similar (something tiny).
Will I have to configure a root cert and build a full DPI proxy to make this futureproof? >_<
Time to go learn how to do DPI...
But a large amount of sites won't work without it. It's very common to run multiple sites on same ip/port. Not sure if it's technically possible to make that work without SNI or a similar technology.
Considering CloudFlare offers to do SSL on their end, it'd be technically viable to only tell CF which domain you want.
Mozilla implementing it: https://www.ghacks.net/2018/03/20/firefox-dns-over-https-and...
Google's: https://developers.google.com/speed/public-dns/docs/dns-over... Apparently Chrome uses this over QUIC, and Chrome's Data Saver also uses it
IETF charter: https://datatracker.ietf.org/wg/doh/about/
The unfortunate side-effect of preventing your OS from doing DNS queries is DNS-based ad blockers and privacy proxies no longer work.
This way your dns traffic is still encrypted, and you retain the capability to block/proxy.
Only if you are smart enough to know the browser has its own resolver, and that you need to turn it off first. We may not be able to turn it off in the future, meaning if you want to have privacy you have to run a privacy-specific browser.
This may end up breaking traffic as Google shifts more and more of the web into its proprietary products. For example, Google owns the .DEV gTLD, and makes .DEV domains "completely closed for the sole use of Google". It may at some point buy some other gTLD (such as ".BLOG", which it was outbid for) and decide that the only way for you to access websites with domains using that gTLD is to use Google's DNS API. It may sound crazy, but if they already shut out everyone in the entire world from having a .DEV domain, this doesn't seem much crazier to me.
After all, DOH is mainly a technical answer to hijacks (and monitoring). Some ASes seem to have a policy on that... Once it's ready, if it's enforced, you'll have a way to provide a custom resolver you control.
It came out that in a world of reverse proxies, ddos protection and large tech conglomerates, reverse dns is not a big deal (depends on you behaviour too, smaller websites with a dedicated IP are easier to catch).
But traffic analysis may be a big deal, and the risk of this kind of exposure is not something you can evaluate by yourself. Mix networks are a mitigation.
Note, that URL (and search term as GET parameter) is visible to your ISP.