Hacker News Reader

Comment by gruez | Hacker News Reader

1. Is this an issue with other records that are subject to FOIA? For instance can people use FOIA to get hold of police reports from rape victims?

2. Why can't the municipal ISPs just... not keep records? I'm not sure why ISPs should be keeping logs of browsing history in the first place.

View on HN

Records are useful for running operations and debugging issues. You can shorten the retention of them, but eliminating them altogether would significantly degrade the quality of service over long periods of time.

However, there is a major misunderstanding about the kinds of records ISPs can keep. They cannot store your browsing data for most major websites, because they don't have it. Widespread use of SSL/TLS along with the rollout of eSNI and DNS over HTTPS means the most interesting details of your browsing are encrypted. "Customer A sent 57 and received 94 packets to/from IP W.X.Y.Z on YYYY-MM-DD" is certainly not full anonymity but it's not hardly the detailed breakdown that "browsing history" implies.

>Records are useful for running operations and debugging issues.

What type of sensitive logs would you want to keep for "running operations and debugging issues"?

>Widespread use of SSL/TLS along with the rollout of eSNI and DNS over HTTPS means the most interesting details of your browsing are encrypted.

What's the adoption rate for eSNI? My impression is that most sites still don't use it.

>"Customer A sent 57 and received 94 packets to/from IP W.X.Y.Z on YYYY-MM-DD" is certainly not full anonymity but it's not hardly the detailed breakdown that "browsing history" implies.

It could be pretty bad if it's shows you as using grindr.com or whatever.

Yes, especially without eSNI (which is probably not that widely used, though I can't find good data one way or another), you can generally figure out that an IP address correlates with a specific website, but that's it. You don't know what they did on that website, you can't break their pseudonymity, etc.

> which is probably not that widely used, though I can't find good data one way or another

Which is exactly to be expected. If you could tell how widely it's actually used that's a problem. Encrypted Client Hello (the successor which was actually deployed) is GREASEd so that a client which could do ECH and a client which is doing ECH look the same to outsiders. The server knows which is which, but of course the server already knows that it enabled (or did not) ECH.

You're assuming this information has to be collected by the ISPs, but it's very easily collected by browser makers (via telemetry) or by CDN/sites themselves. If either end of the TLS connection is collecting the data, there won't be the issue that you described.

That's correct. Either of them could collect telemetry on this. But, to what end?

I expect that at some point one of the CDNs will want to advertise that this is a thing they offer. Once upon a time CDNs got a lot of blast for disliking the practice of claiming in TLS that you want some.ordinary.example as a way to conceal the reality that your HTTP transaction is for Host: censored.or.prohibited.example. One purpose of ECH is to enable them to deliver the same functionality but without all the technical problems.

Now of course if they actually love censorship and so on, they'll do nothing, but it seems to me several big CDNs want to do this once they have a fix for the technical problems, which ECH gives them.

I did not know about ECH, but that makes sense. Glad to hear there's a better solution getting real adoption.

> Records are useful for running operations and debugging issues

I don't buy that for a moment. My ISP collects a lot of low-level information, but they don't need and don't collect the sort of information we're discussing here.

The individual users have actual hard links (or very rarely, some sort of radio) to somewhere and for that I agree you want diagnostics. "Sorry Ma'am I see your fibre went dark 18 minutes and 47 seconds ago, we'll have a technician out to investigate tomorrow morning". But the IP stuff is just bits, "You use Netflix a lot" isn't "useful for running operations" it's marketable information, it's collected because you can make money.

Even if a municipal ISP isn't trying to make money, deciding what infrastructure to run and how much of it needs data. "30% of all traffic is coming from Netflix" (which I think was true for a short while) is an input to the decision to install a Netflix CDN cache box closer to the end users.

ASN/IP block level based aggregation will provide the information needed without requiring traffic data on a ip/site level. Moreover, there's no reason to keep any of this information on a per-customer basis.

In the era of virtual servers, cloud infrastructure, CDNs, etc., ASNs and IP blocks are not necessarily that helpful. Which is kind of back to my original point: it's not 2005 anymore.

Start with a problem you actually have, rather than beginning with the destination "We're going to snoop on all the customers" and then trying to think of a reason why that's a good idea.

Maybe you'll get to the same destination but I very much doubt it. Of course, if your starting goal was to snoop on the customers and you were just looking for an excuse...

> In the era of virtual servers, cloud infrastructure, CDNs, etc., ASNs and IP blocks are not necessarily that helpful.

The above statement makes no sense at all. The whole Internet is built on connections between autonomous systems and all traffic is IP based. There is nothing but ASNs and IPs and information about them and the flows between them is extremely helpful in operating an ISP.

Taken out of context, sure. An ASN identifies an autonomous system and is used for routing in the core of the Internet. But if you have the ASN of an AWS data center, knowing it tells you nothing about the client of AWS that the traffic you're routing belongs to (though AWS recently added BYOASN). Ditto, by and large, CIDR blocks of publicly allocated address space. Individual IPs are more informative, and domain names even more informative than that.

I also don't disagree about the usefulness of this kind of information, my argument is that ISPs can't always get by on coarsely aggregated data alone.

"They cannot store your browsing data for most major websites"

That "most" is doing a hell of a lot of work there.

I don't think it is; I think "major" is doing the work.

Damn near all major websites are using TLS now. Support for eSNI is probably a lot lower though (see sibling comment).

Okay then, why focus on major sites? Surely we should care about minor sites as well..?

Because that accounts for 99% of Internet traffic? If you're doing something outside of the norm, and you don't want others to know about it, you should probably exercise good browsing hygiene, regardless of whether your ISP is commercial or municipal.

Does it though? You weren't able to find statistics of the adoptions you mentioned ;)

Sure, WE can exercise good browsing hygiene... but what about someone who's the victim of domestic violence and don't have that option? Or kids who aren't technical and need to raise a major issue. Or an older grandma who hasn't owned a computer in years.

It's very easy to say "just do X, just do Y" when you're not in their shoes and only talking in these abstract "EHHH, 99% is good enough." terms

I hope some day you can see where I'm coming here, but I'm not holding my breath. Good day.

For the vast majority of Internet traffic, ISPs will not have access to encrypted information, which includes everything except the IP address and domain name. With the additional technologies which I said upfront aren't as common, they wouldn't even have the domain name except by guessing. If you think TLS adoption is low across the Internet in 2024 then I think the burden of proof is on you.

Your whole premise is that some other person's data may be released under a FOIA request with data surfaced in error, yet you demand rigor from commenters responding to you when you provide no evidence yourself of the potential issue.

I'm not sure what your comment is digging at. Are you asking me to give you examples where the wrong data was leaked through FOIA? Because if so, --

https://mchap.io/that-time-the-city-of-seattle-accidentally-...

It's not even an uncommon issue. I'm currently dealing with a large local police department who released to me thousands of peoples' SSNs, finger print hash, tattoos, etc etc from ALPR data in a FOIA lawsuit where I was co-plaintiff. They saw no problem with it and asked us if we expected them to redact the info.

So yeah, I fully expect somebody to fuck up at some point.

It's not that your concerns about FOIA are invalid as such, it's just that the data any ISP, as we understand the term in the West, can collect is quite limited. On-device history, browser telemetry, leaks from websites themselves, etc are all richer targets for monitoring and deanonymization.

1. Yes, you can. See: https://mchap.io/that-time-the-city-of-seattle-accidentally-... (I'm the author)

2. You're joking, right?

Reply on news.ycombinator.com