Hacker News Reader

Comment by account-5 | Hacker News Reader

Can someone ELI5 how these operaters can track my websites if I'm using HTTPS and DoH? Sure they might see handshakes etc but what else can they see?

View on HN

The site operator asks Vodafone "what is the unique account ID for the machine accessing my site right now from 17.56.2.43:3452?", and Vodafone gives them an account ID. They can then use that account ID to correlate to previous interactions you had with their site, even if they were coming from different IPs.

Https and DoH don't protect you in any way from the site operator wanting to serve you ads, and Vodafone will always know what IP:port they assigned you personally (well, your phone).

Tor, VPN and proxy services can protect from this, since they decouple your original request from what the server receives. Of course, the latter two can also sell your information instead of Vodafone.

> Tor, VPN and proxy services can protect from this [...] Of course, the latter two can also sell your information instead of Vodafone.

This is a good point. However it's also worth pointing out that it's not a fruitless endeavour. There are very limited ISP options and none of them are transparent about logging but it's well known to happen. However with a VPN there are comparably limitless options.

They just need to be chosen carefully, and while you can never be sure it's better than the guaranteed invasion of privacy by your ISP.

Well what the article is saying is that the ISP would also hand out data on your previous interactions with any other websites. Which is completely insane of course.

Wow, I missed that point - thanks for pointing it out!

If you have the technical know-how, you could also rent a cheap vps and set up a VPN/proxy yourself. That way you know exactly what is being logged and who has access.

Well, that doesn't help too much, since that single VPS is going to be associated with a single person anyway. You would have to change the IP of the VPS to constantly to get any significant privacy benefit.

SNI for one ( https://www.cloudflare.com/en-gb/learning/ssl/what-is-sni/ ). The handshake contains endpoint IP addresses, and they likely know what sites are on what IPs from either crawling the web like search engines do, or buying that data from somewhere.

Size of packets. Number of packets. Size of response. If the site content is static, that could give a good idea which page was loaded. Packet frequency. Enough to say if it's probably a page load or a realtime chat or a download, etc.

There are probably enough details in the handshake endpoints to tell them whether you visited Facebook in a browser or opened the Facebook app, for example.

What time you went to the site, how often you go there, how long you stayed. Vodafone mobile would know which cell tower(s) you are connected to. They can probably narrow in on whether you work and roughly where you work (cell towers you connect to during the day vs. at night) and from the land use in those areas they could guess roughly what you do. They know your home address for billing, so how expensive your home is and how desirable the area is, they could also guess at that from which cell towers you connect to.

What times you visit sites, whether you usually busy on a Friday evening or using your phone, whether you are regularly on gambling sites or regularly on crypto sites or healthcare sites.

Yes they can't see that you typed "glasses" into a Google search, but they can see you visiting google.com then visiting zennioptical.com. They can see you visiting Reddit and then whether you load a lot of imgur pictures or a lot of video traffic or load some fashion blogs and inferr what kind of things you're interested in.

Mobile is likely behind carrier grade NAT. That is very large NAT. Now when you connect to web site you have your "private" ip address. And then GCNAT maps this to some public IP:Port pair it has available. And due to TCP and UDP work the web sites has to know this pair as that is where responses are send to. And then NAT simply replaces this with "private" IP:Port pair.

Now ISP can simply read the data of active mappings from GCNAT. That is which user has which IP:Port pair in use and provide it for a price to anyone asking like the web server where user has connected.

(There is also the web servers IP:Port 443 involved. But that makes things more fine grained.

Traffic analysis + IP addresses would be one way.

(But if the visited site is colluding with VF, your traffic is no longer protected from VF observation anyway)

They can't.

Not really. Based on the picture on the site[1], I can think of multiple ways of how that would work:

1. The site that wants visitor information makes a CORS/third party request to https://vodafone.example/api/GetSubscriberInfo, which then fetches the associated account information and returns it to the site

2. The site notes the IP + port + timestamp that was used for the HTTP connection, and then asks vodafone for the information.

[1] https://assets.simpleanalytics.com/blog/2022-Trustpid/vodafo...

Reply on news.ycombinator.com