4 ms·

> If you're not going to see what people did on a site, what's the point? Because you are not a unique and special snowflake. If you regularly go to /r/The_Don

by m0nty 10y ago

> If you're not going to see what people did on a site, what's the point? Because you are not a unique and special snowflake. If you regularly go to /r/The_Donald, it says something specific about your politics (probably). Same for /r/LateStageCapitalism or /r/trees. It might not say much, but it adds up to a profile of who you are and what you think about. If you are emailing certain people, or tweeting them or whatever, GCHQ can build a social graph of people you know, who they know, etc. If you are the friend (or friend of a friend) of a person of interest, you're more likely to be of interest yourself. There are not many criminals like the una-bomber working entirely on their own - most of us need encouragement and/or provocation, and nowadays much of that happens online. If your search phrases include things like "how to make a bomb", you're probably going to be on a database somewhere. There have been numerous serious court cases (e.g. murder trials) where the prosecution have presented evidence that the accused's search history included phrases like "how to dispose of a body" or "how to poison someone". In other cases, jurors have been dismissed for using Google to research the background to the case they are serving on. I wonder where the information about these searches came from? Metadata is important for identifying "interesting" people. When you have found them, you "zoom in" and start hoovering up all the information you can find, not just the metadata. It's the greatest spying tool ever, and a way to implement highly repressive government too - just start monitoring people with different lifestyles or "way out" opinions. http://ghanadailies.com/2016/11/22/uk-government-plans-porn-user-database/ http://ghanadailies.com/2016/11/22/uk-government-plans-porn-... https://www.theguardian.com/commentisfree/2016/nov/23/niche-porn-sites-sex-spanking-website-videos-pornography https://www.theguardian.com/commentisfree/2016/nov/23/niche-...

paulajohnson 10y ago
This illustrates how slippery the distinction between communications data and metadata really is. The examples in the first paragraph would all just record that you had been to www.reddit.com.
- petra 10y ago
  It's quite to look at your history and determine that you visited /r/The_Donald often, with good likelihood, automatically.
  - ForHackernews 10y ago
    Seriously, nobody at GCHQ cares that you support Donald Trump.
    - m0nty 10y ago
      It was my slightly flippant example. I'm sure everyone knows that.
    - austinjp 10y ago
      SELECT * FROM dudes_with_doubleplusbad_opinions; It's about profiling, how that profile is determined, and who accesses it under what circumstances.
lordnacho 10y ago
Doesn't that social graph require them to know what you're doing on a given site? I suppose they already have that power, otherwise we wouldn't have what you describe. But the article says they're only gathering connection metadata, this law anyway. I guess they're already doing even more intrusive things, at least as a way to know who to get "legit" evidence on.
oakesm9 10y ago
> Because you are not a unique and special snowflake. If you regularly go to /r/The_Donald, it says something specific about your politics (probably). Same for /r/LateStageCapitalism or /r/trees. It might not say much, but it adds up to a profile of who you are and what you think about. They won't be collecting that information though. They'll only see that you visited reddit.com in all those cases.
- dictum 10y ago
  Bad news for https://howtoopenanumberedaccount.com https://howtoopenanumberedaccount.com visitors (Host header in plaintext) and people who click on links to http://ponies.net http://ponies.net from https://reddit.com/r/LaunderYourCash https://reddit.com/r/LaunderYourCash (Referer header in plaintext)
  - m0nty 10y ago
    Presumably the non-https assets which get pulled in when the main request is fulfilled could also act as a "fingerprint" of the page you are visiting?
  - bkor 10y ago
    AFAIK browsers will not provide a referrer if the previous page in case you go from https to http. Firefox has an option to disable https to https referer sharing btw.
- J-dawg 10y ago
  Excuse my ignorance but won't they have access to the whole URL?
  - pants123 10y ago
    As long as the site uses https (reddit does), then the path is encrypted, the only part of the URL thing they'll have access to is the host.
  - tgfgvc 10y ago
    For http sites they have access to whole url and everything that is submitted, for example all commments you write. For https sites (green lock icon) they only know domain name, for example reddit.com
J-dawg 10y ago
> I wonder where the information about these searches came from? I've also wondered about that. Presumably it could simply be from the browser history of a seized computer. But now, who knows? Will it become standard practice to look up the internet history of anyone accused of any crime? Who decides whether this stuff is admissible as evidence?
grey-area 10y ago
a way to implement highly repressive government too - just start monitoring people with different lifestyles or "way out" opinions. Or even better start using it to monitor opponents and discover their weak points and alliances. If you wanted a recipe for tyranny when a vindictive leader comes to power, this is it. This is really a legalisation of the law-breaking that has been going on for decades from GCHQ, and the expansion of their data out to a huge number of government departments. There will be abuse of this system at all levels.
rayiner 10y ago
> If your search phrases include things like "how to make a bomb", you're probably going to be on a database somewhere. There have been numerous serious court cases (e.g. murder trials) where the prosecution have presented evidence that the accused's search history included phrases like "how to dispose of a body" or "how to poison someone". In other cases, jurors have been dismissed for using Google to research the background to the case they are serving on. I wonder where the information about these searches came from Google tracks it.
- noir_lord 10y ago
  And you can get that straight out the history on the browser of the suspect as well, someone daft enough to google something that incriminating from a machine they own on a connection they own is possibly daft enough to not delete the damn search history. It's amazing how bad some people are with computers, like astoundingly bad, It's easy to forget as techies/developers that not everyone even understands crudely how a computer works.
yagga 10y ago
As everything else, it takes step at a time... first they will record a website address, the people will calm down and get used to it, ISPs will implement the storage. Then they will find a reason to implement another law that will require to record what we do on the websites. There is no coming back. It will evolve as everything else humans touch.

by m0nty 10y ago

paulajohnson 10y ago

This illustrates how slippery the distinction between communications data and metadata really is. The examples in the first paragraph would all just record that you had been to www.reddit.com.

petra 10y ago
It's quite to look at your history and determine that you visited /r/The_Donald often, with good likelihood, automatically.
- ForHackernews 10y ago
  Seriously, nobody at GCHQ cares that you support Donald Trump.
  - m0nty 10y ago
    It was my slightly flippant example. I'm sure everyone knows that.
  - austinjp 10y ago
    SELECT * FROM dudes_with_doubleplusbad_opinions; It's about profiling, how that profile is determined, and who accesses it under what circumstances.

lordnacho 10y ago

Doesn't that social graph require them to know what you're doing on a given site? I suppose they already have that power, otherwise we wouldn't have what you describe. But the article says they're only gathering connection metadata, this law anyway. I guess they're already doing even more intrusive things, at least as a way to know who to get "legit" evidence on.

oakesm9 10y ago

> Because you are not a unique and special snowflake. If you regularly go to /r/The_Donald, it says something specific about your politics (probably). Same for /r/LateStageCapitalism or /r/trees. It might not say much, but it adds up to a profile of who you are and what you think about. They won't be collecting that information though. They'll only see that you visited reddit.com in all those cases.

dictum 10y ago
Bad news for https://howtoopenanumberedaccount.com https://howtoopenanumberedaccount.com visitors (Host header in plaintext) and people who click on links to http://ponies.net http://ponies.net from https://reddit.com/r/LaunderYourCash https://reddit.com/r/LaunderYourCash (Referer header in plaintext)
- m0nty 10y ago
  Presumably the non-https assets which get pulled in when the main request is fulfilled could also act as a "fingerprint" of the page you are visiting?
- bkor 10y ago
  AFAIK browsers will not provide a referrer if the previous page in case you go from https to http. Firefox has an option to disable https to https referer sharing btw.
J-dawg 10y ago
Excuse my ignorance but won't they have access to the whole URL?
- pants123 10y ago
  As long as the site uses https (reddit does), then the path is encrypted, the only part of the URL thing they'll have access to is the host.
- tgfgvc 10y ago
  For http sites they have access to whole url and everything that is submitted, for example all commments you write. For https sites (green lock icon) they only know domain name, for example reddit.com

J-dawg 10y ago

> I wonder where the information about these searches came from? I've also wondered about that. Presumably it could simply be from the browser history of a seized computer. But now, who knows? Will it become standard practice to look up the internet history of anyone accused of any crime? Who decides whether this stuff is admissible as evidence?

grey-area 10y ago

a way to implement highly repressive government too - just start monitoring people with different lifestyles or "way out" opinions. Or even better start using it to monitor opponents and discover their weak points and alliances. If you wanted a recipe for tyranny when a vindictive leader comes to power, this is it. This is really a legalisation of the law-breaking that has been going on for decades from GCHQ, and the expansion of their data out to a huge number of government departments. There will be abuse of this system at all levels.

rayiner 10y ago

> If your search phrases include things like "how to make a bomb", you're probably going to be on a database somewhere. There have been numerous serious court cases (e.g. murder trials) where the prosecution have presented evidence that the accused's search history included phrases like "how to dispose of a body" or "how to poison someone". In other cases, jurors have been dismissed for using Google to research the background to the case they are serving on. I wonder where the information about these searches came from Google tracks it.

noir_lord 10y ago
And you can get that straight out the history on the browser of the suspect as well, someone daft enough to google something that incriminating from a machine they own on a connection they own is possibly daft enough to not delete the damn search history. It's amazing how bad some people are with computers, like astoundingly bad, It's easy to forget as techies/developers that not everyone even understands crudely how a computer works.

yagga 10y ago

As everything else, it takes step at a time... first they will record a website address, the people will calm down and get used to it, ISPs will implement the storage. Then they will find a reason to implement another law that will require to record what we do on the websites. There is no coming back. It will evolve as everything else humans touch.