Comcast, AT&T and Verizon pose a greater surveillance risk than Facebook

Today. But in terms of risk moving forward, I think ISPs are way worse. Two reasons:

1) I really can choose not to use Google/Facebook. There exist very solid, privacy-respecting alternatives for every service these two companies offer. It's a matter of consumer choice.

This is not the case for ISPs. If my (one) local "high-speed" ISP demands that I install a new root cert so they can MITM all my traffic, my choices are to a) capitulate, or b) find a way to live with very low-speed DSL/dial-up.

Monopoly power backed up by a vast network of cables has way more staying power than monopoly power backed up by social network effects (FB) or superior software offerings (Gmail).

2) You might argue that history demonstrates we don't have to worry about ISPs demanding to MITM customer traffic. But Historically, ISPs weren't incentivized to snoop because of regulatory barriers that prevented collection/use of data for advertising purposes. In the case of US ISPs, changes in regulator landscape suggest that past behavior doesn't guarantee future behavior.

- ISP offered 'apps'. Get people to agree to an install of some monitoring app for some [insert random marketing benefit] from ISP. Maybe if you install the app you get more data cap space etc and they can monitor browser access. Further, install this in known apps or as add-ons on setup for other apps.

- ISP offered 'VPN client' that again, gives some cheaper monetary benefit like more data cap space or more speed 'free', strips out other advertising or tracking as a benefit.

- ISP offered 'email client' that does all of the above.

- Check for subsequent request after page loads to known ad networks and replace with their own in HTTPS

- ISPs like you said may start throttling encrypted content down, or charging extra to allow it.

- ISP level proxy MITM, modem customization for 'fast lanes' that are actually slow lanes.

- DNS level data collection not to inject but to sell marketing profiles via metadata and correlate with other data from apps.

Since ISPs are your 'gateway' to the internet and you pay them, most people assume trust and privacy, most don't know they bribed their way into the tracking/ad business, many didn't know cable tv modems had mics either. With that assumption of trust since people are paying them, they'll more easily fall for any of the possible attack/tracking vectors listed and more probably.

With the ISP privacy protections removed [1], my guess is most ISPs, due to lack of competition, end up more like hotel wifi where tracking/injection is the norm [2] as it is completely legal now. With the removal of privacy protections and net neutrality, we have killed the pristine, non tracked, private gateways to the internet we cherish.

[1] https://www.flake.senate.gov/public/index.cfm/2017/3/flake-i...

[2] https://medium.com/@nicklum/my-hotel-wifi-injects-ads-does-y...

A surprising number of sites (and/or assets, images, etc) still don't use TLS, and so for those it's also possible for an ISP to understand what the user was reading/accessing.

Even for sites which do support TLS, if the ISP hypothetically had a partnership with a single data broker / advertiser which was also on the page, it's likely not hard to have a pretty precise idea of their interests/viewing.

You're right that Google and Facebook will continue to have very narrow and precise information about people's daily lives; it's simultaneously true that ISPs will continue to have broad & ongoing profiling information across any touchpoints as people use the internet.

Bank vault analogues for private data do exist: iCloud, Dropbox, Crashplan, etc. If “your data” needs to leave your physical possession, that’s the sort of service it should go to.

We, the ones that they'll have to spend undue effort to sniff out a profile about, are not targets to them. We are much too resistant to it that we have gone all through the effort of setting up a private VPN with good encryption.

I think if the article was written in the spirit of "watch out for the ISPs too" instead of "the ISPs are so much worse" I would have been more onboard.

I think it's a bit apples and oranges: all my traffic with low resolution or just my social traffic in high resolution. I don't clearly see one being far more dangerous/valuable than the other.

Most hotspot providers are probably tracking your physical locations by MAC address, which can be linked with other data. It looks like Peet's recently started doing that as well.

Is it _your_ data, or is it _their_ data? I'm asking in both the literal (based on terms of service, etc) and the more abstract way? Obviously, for the latter, it is a combination. I wish the narrative was discussed with that in mind. Most of what I tend to see is a widespread assumption that the user owns the data, and has given companies like Facebook very limited powers, and that somehow Facebook is breaking that trust. That narrative is, IMO, rubbish. We gave them very broad powers, and the users should accept the consequences.

>However, Google/Facebook break all the security layers because we explicitly _trust_ them with all our data.

If we explicitly _trust_ them, then are they _breaking_ anything? It just seems silly when we explicitly say (as many of my friends have said in the past) "I don't care what Facebook does with my information" and then we talk about it as if they are doing something wrong (using words like "break").

When I give my bank all my money with the understanding that they can hold it, as well as lend it, we don't refer to it as "breaking" anything.

Google and Facebook have detailed social graph and search query, but your ISP could piece together a lot of that information by tracking your DNS queries, unencrypted HTTP traffic, email if you use their mail servers, and offline information.

Given enough opposition, Verizon, Comcast, etc, could strongly embrace personal data privacy and still continue as companies. Yes, they'd lose a business opportunity, but they still make a lot of money selling you internet access and that wouldn't go away. The same is not really true of companies like Google or Facebook. Collecting and making money off your personal data is the foundation of their business. Strongly protecting your privacy would require them to change their entire way of making money.

I think you could argue either way whether Google or Verizon has more ability to spy on you, but Google absolutely has a stronger business motivation to collect your data than Verizon does.

Encryption doesn't matter.

Automated deep packet and encrypted packet inspection is burgeoning with advances that put the single-actor work-arounds to shame.

1). Your ISP knows your traffic is encrypted. It knows what cipher and protocol you're using, and its routing is not protocol-agnostic.

2). Your ISP knows beyond "mostly confident" the type of files your packets contain. If you don't keep your connection open and use any of the public encryption methods, your ISP will know exactly what you've downloaded to a reasonable degree.

3). HTTPS is only as good as all the different pieces combined (browser, root CA, server, site, client). And if one of those goes bad, it's worthless.

4). If you use encryption heavily, you're already flagged.

5). If you don't use your ISP's CDN, you're already flagged.

6). If you connect to any other site besides Google, YouTube, Reddit, Twitter, Facebook, Wikipedia, or Instagram your aggregate data will be quickly analyzed and compared with a threat table, and appropriately flagged.

7). Traffic analysis is trivial when you're the one routing the traffic.

Google is Dunning Kruger evil. ISPs are "pick up that can" evil. The lack of serious developments in HTTPS are "see no evil" stupid. The thought that HTTPS is anything but a red hearing is "Ivan the Fool" stupid.

It's easily blockable for people who care, but still many don't, and for those people it makes all the pretty transport encrytpion a sham.

Seriously, companies afford third parties JavaScript execution on pages where they expect me to enter CC or other sensitive info. Half of the web at this point is a joke when it comes to security and privacy.

The others can follow you everywhere. They know where you live. They know who you phone. They know who phones you.

It's even. Death by drowning, or death by car crash is still death.

The fact that Uncle Sam isn't concerned about the intrusions tells us whose side he's on.

Outside of the telecom industry itself there was quite a bit of resistance to this sort of thing, and we had to go before the US Congress to explain what we were up to. Profiling for the sake of profiling was not smooth sailing, but if it was for the purpose of "security" then it was more or less a free pass. The forcus of our DPI technology turned to the task of network-based threat detection as its primary raison d'être, with customer profiling being an opt-in service by which users could obtain the security service in exchange for targeted ads.

In the years since, I don't expect that Telecom's desire to be much more than a "dumb pipe" has diminished in the least. They view the traffic they carry on their networks to be their property, in a way. They feel entitled to inspect it, throttle it, slice and dice it any conceivable way they can to maximise their profits. Its one of the reasons I quit.

Imagine the US postal service steaming open every letter and opening every package that went through their system, so they could plug your mailbox with targeted special offers or increase the delivery fees for certain things. Its all similar BS with ISPs, but it's all techie stuff and heavily lobbied so the public gets bamboozled.

You raise a really good point about wide-spread encryption being an impediment to ISP profiling. But there is a LOT you can surmise from user traffic even if you don't know the exact content of the encrypted payloads. Just analyzing IP addresses and times can reveal a ton of information about a person. My first patent [US20100161795] was in fact a NAT session detection and tracking technique to identify and track individual users within a household through TCP/IP analysis. Using this technique someone could get a pretty clear picture of how many people were in a household, their ages, genders, interests and patterns of activity, even without delving into the http payload of the packets. We didn't, but this kind of thing is most definitely possible, and I wouldn't trust other shady entities not to do it.

They are worse because you are forced to use an ISP if you wish to access the internet.

>However, Google/Facebook break all the security layers because we explicitly _trust_ them with all our data.

Nobody informed who cares about their privacy ever entrusted Google or Facebook with any personal information.

I'm curious where you are located [if you don't mind sharing]?

If that isn’t enough, your next option is a VPN or Tor.

Don't worry, I'm not promoting DirectTV Now because it sucks balls. I have ad blocking at the router level at home and DirectTV basically won't work because of it. Even when it does work the picture quality is awful, you can't easily skip commercials, changing channels is painfully slow. And there are ads everywhere.

But, my main point is that a few weeks after getting it, I get a mailer from Charter asking me why would I want to pay for channel bundles (I get only internet from Charter)... the only way that mailer makes sense is if they were watching my traffic and seeing that I'm a subscriber to a channel package from their competitor. (I've never gotten a similar mailing and it doesn't make sense absent spying, otherwise they're kind of arguing against their own main cable service.)

It really made me want to get VPN setup whole-house.

`Monitoring and Recording. You agree that Comcast and its agents may monitor and record any telephone calls or other voice, data or image communications that are transmitted between: (1) Comcast and its agents and (2) you, your agents, any user of your Service(s) or Equipment, or any user of any phone numbers associated with your account.`

1. I don't think people have thought about it enough. I know I haven't. I think part of the reason is AT&T et. al. seem "inevitable" whereas Facebook is conveniently "quittable".

2. FB's lack of privacy has been discussed in the open and in the news recently, making it stand out.

3. (One of) FB's goals is to sell you to advertisers...

Do you think most people have actually thought about how their ISPs must track their every interaction with the web and read all of their unencrypted chats and traffic?

I think that what's needed is more awareness about what the ISPs are doing, but I really don't like headlines and articles like this one that try to minimize what Facebook and Google are doing.

The ISPs tracking may be more all-encompassing, but a large portion of the web, especially popular websites are becoming "dark" to them, as major sites adopt HTTPS encryption. Their next most valuable tracking tool besides HTTP is probably the DNS server. And to get people to change that you'll need raise a lot of awareness about it.

I guess Microsoft, Google, and Apple enabling their own DNS resolvers by default on their operating system would be a small improvement, but you're kind of moving the problem instead of solving it. And Google already does that with recent versions of Android, I believe.

[1] https://www.ft.com/content/d7c955ac-3213-11e8-ac48-10c6fdc22...

Because we choose to use AT&T and other ISPs. Facebook has enough beacons spread across millions of websites that even if you choose not to have a Facebook account, it's still monitoring you.

It's not obvious to me that ISPs would bother (except where required to do so by law). They could just route traffic and not inspect anything.

TLS limits what your ISP can see. So until they block encrypted traffic it doesn't scare me too much.

Can you elaborate on how Chrome and Firefox hide your traffic from your ISP, and what privacy advantages they have over IE, Safari or Opera?

It's always nice to see

https://letsencrypt.org/stats/#percent-pageloads

Everyone can do something to help increase this!

(On the other hand, there's still an information leakage from the volume and timing of communications, like inferring that two people are communicating with one another in real time because their traffic flows are correlated, or figuring out what page someone's reading on a site from that total volume of encrypted traffic downloaded.)

They can see the hostname, actually, because DNS isn't encrypted. And even if you run DNS over TLS, it doesn't matter because of SNI (https://en.wikipedia.org/wiki/Server_Name_Indication).

cable providers can legally encrypt all channels, even basic/OTA ones[1], which essentially makes set-top boxes mandatory.

[1] https://hometheaterreview.com/fcc-rules-to-make-it-harder-to...

That's likely incorrect. You're traveling across their networks in routine use of the US Internet and its services/sites. In addition to consumer services, they all have substantial business services. They probably have less data on you than Facebook & Google.

You're saying that like it's nothing. Whatever happened to "metadata is often more revealing than data"?

> As opposed to Facebook and Google being present on just about every webpage and gobbling up data about all the people on the planet that have internet access.

You can trivially install Privacy Badger, Ghostery or any other number of tracker blockers that are available for free. Firefox comes built-in with a tracker blocker that's pretty good too. Every person on the planet has the option to opt out from FB and Google tracking.

Using a VPN costs money. Some websites (eg. retailers, Netflix) aggressively block connections from VPN IPs which means you have to turn off your VPN and sacrifice your privacy to access those sites. Whereas I've never seen a site block you because you have Privacy Badger installed.

It would be good to see data on the relative monopoly market concentrations between the cable/telcos vs Facebook/Google.

For your statement to be true you would have to go without credit, a vehicle, a house, an internet connection, a cable TV, a connection to a cell tower.

It is more likely that you are not familiar of the size and complexity of their data collection and aggregation system.

That's exactly the opposite of how corporations work. Especially corporations in monopoly/duopoly markets.

In fact, US ISPs lobbied heavily for the right to do exactly that, without user permission, and got their way.

> Thirdly ISPs in most countries are required by law to support the police with surveillance information. That is done in transparent way (you can read the laws and ask your politicians).

But that's not what this is about.

Please, everyone, stop saying things like this. Just because you pay a company money for a service does not mean you magically have a perfectly balanced relationship with them. They are in a position of extreme power and will not stop caring about aggregating what you do in a machine readable format in fine detail, all the while doing so behind a veil of legalese opt-out style tactics.

Beyond the lobbying for more relaxed data collection / monetization laws, ISPs have been fined in the past for injecting tracking cookies to keep better record of your browsing habits. They’ve been caught selling IP identification api’s. No, they don’t care about delivering advertising to you, they just want to broker your data to companies who will.

Access to TLS certs is plenty enough to sell. You hit pornhub.com at 2AM, or expecting-parents.com at 9am, or foxnews.com at midday? Each tells a significant story. I dare you to take a month of time stamped DNS requests and share with the internet.

> Secondly an ISP charges you a subscription and that is their revenue model. They are not incentivised to build an elaborate profile on your in order to deliver advertisement.

Are you trying to claim that a for-profit enterprise who has an opportunity to increase revenues using their current business model will decide against it, because it might be a bit of work? Explain to me who was responsible for the law change allowing ISPs to sell customer data? It sure wasn’t the customers.

> Thirdly ISPs in most countries are required by law to support the police with surveillance information. That is done in transparent way (you can read the laws and ask your politicians

LEA access is not what this article was about.

And beyond that, we're so centralized these days that most websites people spend time on are generic. For example, you have no idea what someone's interests are because they connect to Reddit, Google, Facebook, Twitter, and YouTube, nor who they might be communicating with over those domains.

Can you link me to what Cambridge Analytica actually did with the data? I've been really curious about it but I can't find anything concrete.

What makes you think they aren't? They have influencers in Washington, just like any political group does.

The only difference between what the ISPs did and CA did is that the ISPs sell the data, whereas CA stole it. Your data still gets transferred.

It is the great circle of life. The incumbents love to be privacy-centric, but as soon as they become big enough, they realize that they can make a shitload of money with data//metadata now that they got a captive set of customers

Some of the points an FB employee said about the situation around a week ago: "Well the ISPs are worse" "Imagine if it was them instead of us, we do a better job" "Net Neutrality is the real problem".

They think of everything as a PR problem unfortunately, and would rather go this route than dealing with the problems they have.