4 ms·

What truly terrifies me about this is how little control most users have over the websites they "visit". This law requires ISPs to log the domain name of websit

What truly terrifies me about this is how little control most users have over the websites they "visit". This law requires ISPs to log the domain name of websites users connect to. All it takes is one dodgy advert on an otherwise ordinary website to incriminate you. Worse, you might not even know this has happened, as the ad itself might be completely innocuous. But by virtue of being hosted on a website the government considers suspect, you find yourself on a list. I don't know if this actually happens in practice, but I have heard stories of bad actors using adverts to distribute malware - it doesn't take a stretch of the imagination to see the same bad actors using adverts to generate false positives to the authorities. Ad blockers are going to become more important than ever.

treerock 10y ago
Yeah I was curious about what level of detail will be recorded. According to the article: "The law forces internet service providers to keep a record of all the websites – not the actual pages – you visit for up to a year." If they aren't recording the pages, I'd doubt they've be recording the ads embedded on the page. But who knows, I imagine it's down to how the ISPs implement the legislation.
- doc_holliday 10y ago
  From my interpretation they are logging the IP address and ports data transfered from. So theoretically if you transfer data from insert bad orgs IP address here from within another innocent website you'd be logged for that.
- redcalx 10y ago
  They can't record the pages if the request is over https, as per most web sites these days. The IP address is known because it's necessary for routing traffic, but the content of each HTTP request and response is encrypted, and that's where the rest of the URL lives.
  - Warp__ 10y ago
    Gov't can easily MITM HTTPS connections.
    - martin-adams 10y ago
      I did not know this. How do they do that?
      - Warp__ 10y ago
        http://security.stackexchange.com/questions/143387/is-there-such-a-thing-as-a-black-box-that-decrypts-internet-traffic http://security.stackexchange.com/questions/143387/is-there-... That's pretty clear. It does depend of what level/technology is used in the Encryption, but broadly, against nation state actors with full virtual and physical hardware access, you are to put it bluntly, stuffed.
        herge 10y ago
        To anyone reading this, the link says: "It is unclear whether such rules would apply to companies which don't operate directly in the UK", so it is literally not pretty clear.
        Warp__ 10y ago
        The _legality_ isn't clear. The technical methodology is quite clear.
    - redcalx 10y ago
      True. Anyone know if this new IP law allows the gov to do this? I.e. if they tried to prosecute and it came to light that the logs were obtained using a MITM attack, would the evidence be nullified?
      - Warp__ 10y ago
        I don't know. I imagine that MITM on a large scale is par for the course for GCHQ.
- nicktelford 10y ago
  They're logging the hostname of every "site visited". However, an ISP won't be able to distinguish between a URL you entered in the address bar, and a URL requested by an iframe, img or script tag embedded on a page. They'll just know that you visited the host.
planetjones 10y ago
A dodgy advert, an image embedded in an online forum, a malicious link on reddit. I agree this sounds worrying.
- nicktelford 10y ago
  Wow that's a good point: in the era of false news, getting someone to visit a site that covertly logs them as having visited suspicious domains would be pretty trivial. Just publish some really divisive fake news about Brexit and that'll rack up the UK hits on Facebook. Christ, it's even worse than I thought.
  - SomeStupidPoint 10y ago
    It's so disgustingly trivially easy, I don't feel comfortable making even basic comments about how Id do that. But I am going to try a few PoC ones later today. (On a private network, using all domains and computers I control.) I... View a lot of use of digital records as the witchtrials of the modern era (eg, cases where people got charged for child porn because a coworker used their machine, but the logs say it was them!). The conclusions don't logically hold up, but reveal something about our reverance for technology (and assuming it worked right).
  - dualogy 10y ago
    > in the era of false news How did we get here? Many folks have surfed the web for 20 years, even more for 15, most for 10 --- now in 2016, surprise surprise, fake news abound! /s Almost as if coinciding with the calls for (or introductions of) related legislation..
    - grzm 10y ago
      The number of people online, the level of engagement, and the money being made in online advertising, is unprecedented. I don't know what impact it had on the election, but it was definitely something that has attracted more attention due to the campaigns. It's not unusual for a problem that has existed for a relatively long-time to suddenly come to the attention of the legislature when it rises in prominence.
ischm 10y ago
Lets face it: in the end, mass surveillance like this is a tool of terror, not of gaining knowledge. It's about injecting fear into society. And it already starts to work, obviously.

treerock 10y ago

Yeah I was curious about what level of detail will be recorded. According to the article: "The law forces internet service providers to keep a record of all the websites – not the actual pages – you visit for up to a year." If they aren't recording the pages, I'd doubt they've be recording the ads embedded on the page. But who knows, I imagine it's down to how the ISPs implement the legislation.

doc_holliday 10y ago
From my interpretation they are logging the IP address and ports data transfered from. So theoretically if you transfer data from insert bad orgs IP address here from within another innocent website you'd be logged for that.
redcalx 10y ago
They can't record the pages if the request is over https, as per most web sites these days. The IP address is known because it's necessary for routing traffic, but the content of each HTTP request and response is encrypted, and that's where the rest of the URL lives.
- Warp__ 10y ago
  Gov't can easily MITM HTTPS connections.
  - martin-adams 10y ago
    I did not know this. How do they do that?
    - Warp__ 10y ago
      http://security.stackexchange.com/questions/143387/is-there-such-a-thing-as-a-black-box-that-decrypts-internet-traffic http://security.stackexchange.com/questions/143387/is-there-... That's pretty clear. It does depend of what level/technology is used in the Encryption, but broadly, against nation state actors with full virtual and physical hardware access, you are to put it bluntly, stuffed.
      - herge 10y ago
        To anyone reading this, the link says: "It is unclear whether such rules would apply to companies which don't operate directly in the UK", so it is literally not pretty clear.
        Warp__ 10y ago
        The _legality_ isn't clear. The technical methodology is quite clear.
  - redcalx 10y ago
    True. Anyone know if this new IP law allows the gov to do this? I.e. if they tried to prosecute and it came to light that the logs were obtained using a MITM attack, would the evidence be nullified?
    - Warp__ 10y ago
      I don't know. I imagine that MITM on a large scale is par for the course for GCHQ.
nicktelford 10y ago
They're logging the hostname of every "site visited". However, an ISP won't be able to distinguish between a URL you entered in the address bar, and a URL requested by an iframe, img or script tag embedded on a page. They'll just know that you visited the host.

planetjones 10y ago

A dodgy advert, an image embedded in an online forum, a malicious link on reddit. I agree this sounds worrying.

nicktelford 10y ago
Wow that's a good point: in the era of false news, getting someone to visit a site that covertly logs them as having visited suspicious domains would be pretty trivial. Just publish some really divisive fake news about Brexit and that'll rack up the UK hits on Facebook. Christ, it's even worse than I thought.
- SomeStupidPoint 10y ago
  It's so disgustingly trivially easy, I don't feel comfortable making even basic comments about how Id do that. But I am going to try a few PoC ones later today. (On a private network, using all domains and computers I control.) I... View a lot of use of digital records as the witchtrials of the modern era (eg, cases where people got charged for child porn because a coworker used their machine, but the logs say it was them!). The conclusions don't logically hold up, but reveal something about our reverance for technology (and assuming it worked right).
- dualogy 10y ago
  > in the era of false news How did we get here? Many folks have surfed the web for 20 years, even more for 15, most for 10 --- now in 2016, surprise surprise, fake news abound! /s Almost as if coinciding with the calls for (or introductions of) related legislation..
  - grzm 10y ago
    The number of people online, the level of engagement, and the money being made in online advertising, is unprecedented. I don't know what impact it had on the election, but it was definitely something that has attracted more attention due to the campaigns. It's not unusual for a problem that has existed for a relatively long-time to suddenly come to the attention of the legislature when it rises in prominence.

ischm 10y ago

Lets face it: in the end, mass surveillance like this is a tool of terror, not of gaining knowledge. It's about injecting fear into society. And it already starts to work, obviously.