4 ms·

What is the actual plan? To harvest DNS requests?

• drdaeman 10y ago
  That, and NetFlow (or similar) records. While that's just "metadata"-level stuff it can basically reveal a lot about anyone's daily habits. If a network really wants to dig into the traffic, L7 protocol analyzers (plain HTTP requests, SNI from TLS handshakes, etc) can be quite close (not exactly, but given some statistical tricks - very close) to what someone may see standing behind one's shoulder. And I've heard some ISPs are really into the foul game, and were caught injecting their own JS into non-authenticated traffic. That was to inject some warnings or ads or whatever (I've read that, like, an year ago and forgot the details), but it could also be spyware^W telemetry, diagnostics and analytics service.