Hacker News Reader

> So if that part of the article would have been adjusted to the present day situation that only thing that remains is that if these parties are your provider then they can indeed see which IP addresses you connect to

You're saying that like it's nothing. Whatever happened to "metadata is often more revealing than data"?

> As opposed to Facebook and Google being present on just about every webpage and gobbling up data about all the people on the planet that have internet access.

You can trivially install Privacy Badger, Ghostery or any other number of tracker blockers that are available for free. Firefox comes built-in with a tracker blocker that's pretty good too. Every person on the planet has the option to opt out from FB and Google tracking.

Using a VPN costs money. Some websites (eg. retailers, Netflix) aggressively block connections from VPN IPs which means you have to turn off your VPN and sacrifice your privacy to access those sites. Whereas I've never seen a site block you because you have Privacy Badger installed.

> Whatever happened to "metadata is often more revealing than data"?

That's true, but the article claims that the actual data is accessible which it isn't in most cases.

And it's a bit in the nature of being an ISP, after all the only thing they are supposed to do is to take your packets and deliver them elsewhere, if they didn't do that then they wouldn't be in business at all. To the extent that this raises awareness of how the internet works under the hood I'm all for it but it is designed that way, it is not as if AT&T, Comcast and Verizon have gone out of their way to get this ability by injecting their content into each and every web page.

> You can trivially install Privacy Badger, Ghostery or any other number of tracker blockers that are available for free.

Yes, and I do. And most people do not.

> Every person on the planet has the option to opt out from FB and Google tracking.

Yes, but only a small percentage actually does so. And Google is present in so many market segments that in practice you will be interacting with it whether you want it or not even if you have a blocklist a mile long. Because that email you just sent to that innocent looking domain is actually gmail masquerading as some other domain.

> Whereas I've never seen a site block you because you have Privacy Badger installed.

I see this several times per week actually, usually related to some over-eager adblocker detector.

> Yes, but only a small percentage actually does so.

But they can and its free to do so. Opting out of ISP tracking costs money, when I'm already paying my ISP money.

> it is not as if AT&T, Comcast and Verizon have gone out of their way to get this ability by injecting their content into each and every web page.

Not for lack of trying[1]. Also Verizon now owns Yahoo and AOL which have some pretty large ad networks of their own.

1. https://arstechnica.com/tech-policy/2014/09/why-comcasts-jav...

> Opting out of ISP tracking costs money, when I'm already paying my ISP money.

All you will end up doing is giving someone else the same capability that your ISP has today. A VPN solves exactly nothing.

> Not for lack of trying

Yes, that's true they did try that. But then again, so did some registrars by hijacking domain names that were not in use. (And sometimes even when they were in use).

But end-to-end encryption took care of that in a pretty definitive manner.

> A VPN solves exactly nothing.

Maybe, maybe not. US ISPs operate as virtual monopolies in many markets - even if an ISP was tracking and monetizing online activity most customers don't have any recourse.

In contrast, the VPN market is extremely competitive; there are dozens, maybe hundreds of providers. Privacy is one of the differentiating factors between them. It would be extremely risky for a VPN provider to claim "no logs" but actually store logs - a single data breach, rogue employee, or whistleblower could end their business.

I'm not claiming VPNs are a desirable solution. The desirable solution is that ISPs don't track or otherwise monetize their customers' online activity.

> they can indeed see which IP addresses you connect to

They can see the hostname, actually, because DNS isn't encrypted. And even if you run DNS over TLS, it doesn't matter because of SNI (https://en.wikipedia.org/wiki/Server_Name_Indication).

Ah right you are, so yes, they can get to that. Even so, that's just a host, which is a far cry from the full URL which is typically what Facebook and Google have access to through 'like' buttons and analytics.

> The last part is the important part: hardly anything is unencrypted these days (and if it isn't it really should get with the times).

It's always nice to see

https://letsencrypt.org/stats/#percent-pageloads

Everyone can do something to help increase this!

(On the other hand, there's still an information leakage from the volume and timing of communications, like inferring that two people are communicating with one another in real time because their traffic flows are correlated, or figuring out what page someone's reading on a site from that total volume of encrypted traffic downloaded.)

It's pretty hard for ISPs to do that on a large scale: ISPs are only regional monopolies, in the areas they are monopolies at all. There's likely a relatively small percentage of your communications where both ends of the communication are using the same ISP.

On the other hand, most people communicate most often with people in their own geographic region, and in the U.S. the "two people on the same ISP" probably happens pretty frequently with Comcast and AT&T (as well as national mobile carriers in the case of mobile data service, where you might not immediately realize that the carrier could learn that information in the way that it would if you were making a phone call or sending a text message).

With calls and texts, certainly, but with Internet traffic? Bear in mind as well, ISPs tend to be monopolies in more rural areas, where the distance between people is higher to begin with. And most of your communications on the Internet will go to or from a server, which is likely not local.

In this case, the ISP can correlate the timing of the communications activity in order to confirm that it involves two particular customers.

Give me an example, what kind of communication?

Like a Skype call. If user A calls user B (of the same regional ISP), the communications don't go directly from A to B (rather they go from A to Skype and Skype to B, and vice versa), but the timing and volume of the traffic flows are extremely well correlated.

Alright, I can grant that is true, although if you assume an ISP like Comcast has thousands (or more) simultaneous Skype calls, and they come and go often enough that it's likely you'll be dealing with many starting at close to the same time... there's a lot to track there. Also, bear in mind, you have to weed this out from all the unidirectional calls: Comcast to [other ISP] and [other ISP to Comcast] calls, so you can't even make one-to-one matches reliably.

And of course, when you compare to the tech industry alternative: Microsoft knows who is talking to who straight up (and on a global scale), whereas the ISP can only guess. And while the ISP's understanding of who is calling who ends at the household, Microsoft knows which user accounts made the call, which is much more likely to correlate to individual people.

MS has access to the payload as well.

> On the other hand, there's still an information leakage from the volume and timing of communications, like inferring that two people are communicating with one another in real time because their traffic flows are correlated

Yes, this is a problem. But it is also totally inherent to the role of being a provider. And as long as the internet is roughly structured the way it is today that will continue.

>They can't see what you watch on TV unless you configure your TV to tell them (or use a set-top box to choose your channels for you),

cable providers can legally encrypt all channels, even basic/OTA ones[1], which essentially makes set-top boxes mandatory.

[1] https://hometheaterreview.com/fcc-rules-to-make-it-harder-to...

> Comcast, AT&T and Verizon don't have a single bit of data on me, I'm not a customer.

That's likely incorrect. You're traveling across their networks in routine use of the US Internet and its services/sites. In addition to consumer services, they all have substantial business services. They probably have less data on you than Facebook & Google.

I highly doubt there is a recognizable profile for me on Comcast, AT&T or Verizon servers, I'm 100% sure there is a recognizable profile of me on FB's servers. And I'm not a customer of any one of them.

The worst that I can think of that AT&T would have is some traffic stats, and they wouldn't know that it was me, just that some traffic from some random EU IP made it through one of their choke points. That entirely does not worry me.

I think you're encrypted argument is falling prey to the common fallacy of "it's only metadata". Knowing when you interact with which sites is more important than 90% of what you're doing on those sites, in terms of profiling you and monetizing you with data brokers.

Yes, but it is far harder for my ISP do monetize that data than it is for the two largest ad networks on the planet.

My ISP is welcome to know what sites I connect to because I pay them to do exactly that. Facebook and Google inserting their riders everywhere I go is not part of something I consent to.

And that's the root of the problem, if I send an envelope with my return address on the back the postal services have access to the meta-data and it is my decision to let them.

But it is not my decision to let a bunch of unrelated third parties use the contents of the letters to build up profiles on me and my counterparty.

The irony is that with more and more sites wanting to be "portals", more traffic is centralized within a single domain and none of the lateral movements are visible to the ISP.

Then: You go to foxnews.com, then you go to pornhub.com. Based on hostnames we can make some inferences about you and your behaviors.

Now: You go to reddit.com(/thedonald), then you go to reddit.com(/twerkinggifs). Thanks to HTTPS, the specific subs you're visiting aren't visible to the ISP; all they can see is you going to reddit a bunch of times.

No. AT&T has DPI on all packets that traverse its network and it cross licenses and shares financials with an extremely large number of network, credit, and transportation firms. This includes their cell network which tracks users at GPS accuracy.

For your statement to be true you would have to go without credit, a vehicle, a house, an internet connection, a cable TV, a connection to a cell tower.

It is more likely that you are not familiar of the size and complexity of their data collection and aggregation system.

You're a small minority, when you include both cell phone and broadband the vast majority of the country is a customer of one of at least one of them.

It would be good to see data on the relative monopoly market concentrations between the cable/telcos vs Facebook/Google.

For the vast majority of customers, Comcast, AT&T, and Verizon know what sites you visit, what types of data you pass to them, every single DNS lookup you make, etc. Sorry, but this is FAR more intrusive than Facebook, which you CLAIM has lots of data on you even if you don't use their service. It's harder to avoid Google than it is to avoid Facebook, but again, it's doable.

> For the vast majority of customers, Comcast, AT&T, and Verizon know what sites you visit

They know which IP addresses you connect to. Many of those host large numbers of websites.

> what types of data you pass to them

What do you mean with 'what types of data'? They can't access the headers of encrypted traffic.

> every single DNS lookup you make

Yes, that's true. And you can cache those locally.

> etc. Sorry, but this is FAR more intrusive than Facebook, which you CLAIM has lots of data on you even if you don't use their service.

Shadow profiles are a thing.

> It's harder to avoid Google than it is to avoid Facebook, but again, it's doable.

It's just about impossible. Every other email you send ends up in a gmail inbox. So even if you don't use their services at all your data still ends up with them. Even if you don't have a smartphone enough people around you will have them that your social graph will end up with Google anyway. And so on.

> They know which IP addresses you connect to. Many of those host large numbers of websites.

And SNI reveals which one of the Web sites you are accessing.

It's well known, not the poster's personal claim:

https://boingboing.net/2017/11/08/involuntary-profiling.html

FB goes so far as to buy your data from others, which is why I block all trackers. I'm sure I still leak data to FB, even though I never joined, and never will.

Interesting! Thanks for the informative reply. This feels like the kind of thing I probably read about at some point but subsequently forgot.