4 ms·

As a UK resident: I know that I can only avoid logging traffic by using a vpn. But the domain logging part bothers me the most. Does anyone here know how they

by dx034 10y ago

As a UK resident: I know that I can only avoid logging traffic by using a vpn. But the domain logging part bothers me the most. Does anyone here know how they will do it? Could I just use another dns server? Or will they intercept http header? If I'm not mistaken, they could still extract the domain names from https traffic but no exact history? Anyway, a reason more to use https everywhere, reduces sharply what they can see.

jwtadvice 10y ago
VPN has been thoroughly defeated. China, UK and US state law enforcement monitor VPN use. (Snowden documents, for example, revealed that VPN traffic can be readily decrypted.) ISPs and police will use every mechanism including DNS, HTTP, IP addresses, CRL behavior, ad tracking markers embedded in pages and more to determine your browsing behavior and history. The best way to defend yourself against this is to lie down and comply.
- thomasahle 10y ago
  Do you have a link to the "VPN has been defeated" documents? Didn't Snowden say exactly, that the only thing to trust is strong encryption? > ISPs and police will use every mechanism including DNS, HTTP, IP addresses Surely VPN will protect you from all of that? My main concern is police/isp's logging all VPN traffic, and then when they want to use some of it, they subpoena your VPN provider for the keys. Though, maybe forward security fixes this? They could also secretly force every provider to log everything at all time? But surely there are enough providers that some would have leaked it?
  - jwtadvice 10y ago
    I was going to write up a dossier, but found one created by Der Speigel here: http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-tor-a-1010525.html http://www.spiegel.de/international/world/nsa-documents-atta... Yes, trust strong encryption. VPN isn't strong encryption. Or rather, VPN is not necessarily strong encryption as most of the VPN standards and implementations have either been backdoored or weren't designed for strength against state actors.
    - tobltobs 10y ago
      > most of the VPN standards What VPN standards are you talking about?
      - jwtadvice 10y ago
        IPSEC, IKE.
        thomasahle 10y ago
        From the (excellent list of) papers you listed, it seems the weaknesses are not so much that the encryption can be broken, but that you can do all kinds of man in the middle and timing attacks. Does this mean, that as long as you are not being actively attacked, the security is acceptable? That is, if you are only trying to avoid passive logging? I guess in either case, it would be better to just go with openvpn. I really don't understand why it isn't natively supported in Android, OSX etc.
- nthcolumn 10y ago
  No.
  - jwtadvice 10y ago
    For effectiveness, here are links to Snowden documents indicating that VPN has thoroughly been defeated. The links are all hosted on the German media outlet that helped to process the documents from Snowden's whistleblowing. http://www.spiegel.de/media/media-35513.pdf http://www.spiegel.de/media/media-35513.pdf http://www.spiegel.de/media/media-35514.pdf http://www.spiegel.de/media/media-35514.pdf http://www.spiegel.de/media/media-35515.pdf http://www.spiegel.de/media/media-35515.pdf http://www.spiegel.de/media/media-35516.pdf http://www.spiegel.de/media/media-35516.pdf http://www.spiegel.de/media/media-35517.pdf http://www.spiegel.de/media/media-35517.pdf http://www.spiegel.de/media/media-35518.pdf http://www.spiegel.de/media/media-35518.pdf http://www.spiegel.de/media/media-35519.pdf http://www.spiegel.de/media/media-35519.pdf http://www.spiegel.de/media/media-35520.pdf http://www.spiegel.de/media/media-35520.pdf http://www.spiegel.de/media/media-35521.pdf http://www.spiegel.de/media/media-35521.pdf http://www.spiegel.de/media/media-35522.pdf http://www.spiegel.de/media/media-35522.pdf http://www.spiegel.de/media/media-35523.pdf http://www.spiegel.de/media/media-35523.pdf http://www.spiegel.de/media/media-35524.pdf http://www.spiegel.de/media/media-35524.pdf http://www.spiegel.de/media/media-35525.pdf http://www.spiegel.de/media/media-35525.pdf http://www.spiegel.de/media/media-35526.pdf http://www.spiegel.de/media/media-35526.pdf http://www.spiegel.de/media/media-35527.pdf http://www.spiegel.de/media/media-35527.pdf http://www.spiegel.de/media/media-35528.pdf http://www.spiegel.de/media/media-35528.pdf http://www.spiegel.de/media/media-35529.pdf http://www.spiegel.de/media/media-35529.pdf With the original site linking there here: http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-tor-a-1010525.html http://www.spiegel.de/international/world/nsa-documents-atta... Namely, do not let stubborn insistence endanger your wellbeing. If you need something in a life threatening situation VPN isn't going to be enough alone to help you.
posterboy 10y ago
>I know that I can ... avoid logging traffic by using a vpn. Are you sure? I'd expect you be hard pressed to explain how that would be the case. Hint: how do you facilitate secure key exchange with an untrusted man in the middle? I know public key exchange is a thing, but I don't know much about it, just that I wouldn't trust it. Do you? Check this link, for example: https://www.ietf.org/mail-archive/web/ietf/current/msg93416.html https://www.ietf.org/mail-archive/web/ietf/current/msg93416....
- dx034 10y ago
  We have to remember that this law still forces ISPs to do something that costs them money. They won't do more than requested in the law, especially if it means buying more servers just for that. Agencies can of course do that, but that's independent of the law.
  - posterboy 10y ago
    Why would it cost them money, when the tax payer can afford it?
slgeorge 10y ago
Most of the negative comments on this story are in the context of stopping a state actor whose specifically targeting you. The rest of this comment is covering the "drag net" effect of this legislation - any one individual is not being targeted, it's a situation where everything is caught up. If you change nothing then your provider will be able to track your DNS traffic (site you're going to) and unprotected traffic (non-HTTPS). You can't use another DNS server because the protocol is in the clear so they could just track that even if it's not on their network - though it would be real work and they might not bother to do so. Using a VPN will protect all your network traffic which means both DNS looking up the domain and traffic to/from the sites you're going to. Note that the VPN provider should be outside the UK jurisdiction - from there decide on your level of paranoia.

by dx034 10y ago

jwtadvice 10y ago

VPN has been thoroughly defeated. China, UK and US state law enforcement monitor VPN use. (Snowden documents, for example, revealed that VPN traffic can be readily decrypted.) ISPs and police will use every mechanism including DNS, HTTP, IP addresses, CRL behavior, ad tracking markers embedded in pages and more to determine your browsing behavior and history. The best way to defend yourself against this is to lie down and comply.

thomasahle 10y ago
Do you have a link to the "VPN has been defeated" documents? Didn't Snowden say exactly, that the only thing to trust is strong encryption? > ISPs and police will use every mechanism including DNS, HTTP, IP addresses Surely VPN will protect you from all of that? My main concern is police/isp's logging all VPN traffic, and then when they want to use some of it, they subpoena your VPN provider for the keys. Though, maybe forward security fixes this? They could also secretly force every provider to log everything at all time? But surely there are enough providers that some would have leaked it?
- jwtadvice 10y ago
  I was going to write up a dossier, but found one created by Der Speigel here: http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-tor-a-1010525.html http://www.spiegel.de/international/world/nsa-documents-atta... Yes, trust strong encryption. VPN isn't strong encryption. Or rather, VPN is not necessarily strong encryption as most of the VPN standards and implementations have either been backdoored or weren't designed for strength against state actors.
  - tobltobs 10y ago
    > most of the VPN standards What VPN standards are you talking about?
    - jwtadvice 10y ago
      IPSEC, IKE.
      - thomasahle 10y ago
        From the (excellent list of) papers you listed, it seems the weaknesses are not so much that the encryption can be broken, but that you can do all kinds of man in the middle and timing attacks. Does this mean, that as long as you are not being actively attacked, the security is acceptable? That is, if you are only trying to avoid passive logging? I guess in either case, it would be better to just go with openvpn. I really don't understand why it isn't natively supported in Android, OSX etc.
nthcolumn 10y ago
No.
- jwtadvice 10y ago
  For effectiveness, here are links to Snowden documents indicating that VPN has thoroughly been defeated. The links are all hosted on the German media outlet that helped to process the documents from Snowden's whistleblowing. http://www.spiegel.de/media/media-35513.pdf http://www.spiegel.de/media/media-35513.pdf http://www.spiegel.de/media/media-35514.pdf http://www.spiegel.de/media/media-35514.pdf http://www.spiegel.de/media/media-35515.pdf http://www.spiegel.de/media/media-35515.pdf http://www.spiegel.de/media/media-35516.pdf http://www.spiegel.de/media/media-35516.pdf http://www.spiegel.de/media/media-35517.pdf http://www.spiegel.de/media/media-35517.pdf http://www.spiegel.de/media/media-35518.pdf http://www.spiegel.de/media/media-35518.pdf http://www.spiegel.de/media/media-35519.pdf http://www.spiegel.de/media/media-35519.pdf http://www.spiegel.de/media/media-35520.pdf http://www.spiegel.de/media/media-35520.pdf http://www.spiegel.de/media/media-35521.pdf http://www.spiegel.de/media/media-35521.pdf http://www.spiegel.de/media/media-35522.pdf http://www.spiegel.de/media/media-35522.pdf http://www.spiegel.de/media/media-35523.pdf http://www.spiegel.de/media/media-35523.pdf http://www.spiegel.de/media/media-35524.pdf http://www.spiegel.de/media/media-35524.pdf http://www.spiegel.de/media/media-35525.pdf http://www.spiegel.de/media/media-35525.pdf http://www.spiegel.de/media/media-35526.pdf http://www.spiegel.de/media/media-35526.pdf http://www.spiegel.de/media/media-35527.pdf http://www.spiegel.de/media/media-35527.pdf http://www.spiegel.de/media/media-35528.pdf http://www.spiegel.de/media/media-35528.pdf http://www.spiegel.de/media/media-35529.pdf http://www.spiegel.de/media/media-35529.pdf With the original site linking there here: http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-tor-a-1010525.html http://www.spiegel.de/international/world/nsa-documents-atta... Namely, do not let stubborn insistence endanger your wellbeing. If you need something in a life threatening situation VPN isn't going to be enough alone to help you.

posterboy 10y ago

>I know that I can ... avoid logging traffic by using a vpn. Are you sure? I'd expect you be hard pressed to explain how that would be the case. Hint: how do you facilitate secure key exchange with an untrusted man in the middle? I know public key exchange is a thing, but I don't know much about it, just that I wouldn't trust it. Do you? Check this link, for example: https://www.ietf.org/mail-archive/web/ietf/current/msg93416.html https://www.ietf.org/mail-archive/web/ietf/current/msg93416....

dx034 10y ago
We have to remember that this law still forces ISPs to do something that costs them money. They won't do more than requested in the law, especially if it means buying more servers just for that. Agencies can of course do that, but that's independent of the law.
- posterboy 10y ago
  Why would it cost them money, when the tax payer can afford it?

slgeorge 10y ago

Most of the negative comments on this story are in the context of stopping a state actor whose specifically targeting you. The rest of this comment is covering the "drag net" effect of this legislation - any one individual is not being targeted, it's a situation where everything is caught up. If you change nothing then your provider will be able to track your DNS traffic (site you're going to) and unprotected traffic (non-HTTPS). You can't use another DNS server because the protocol is in the clear so they could just track that even if it's not on their network - though it would be real work and they might not bother to do so. Using a VPN will protect all your network traffic which means both DNS looking up the domain and traffic to/from the sites you're going to. Note that the VPN provider should be outside the UK jurisdiction - from there decide on your level of paranoia.