16 ms·

Disapproval of FCC regulations a significant blow against privacy protection

313 points by crispyambulance 10y ago

mozumder 10y ago
But her emails?
j2bax 10y ago
Is there anything the average user can do to protect their data/privacy from their ISP?
- adrianN 10y ago
  Run everything over an encrypted channel.
- 0xcafecafe 10y ago
  vpn?
- somebehemoth 10y ago
  VPN is a solution but requires trust in VPN provider. OpenVPN on a VPS can help. Also, consider DNS traffic can leak information, but I've not read of a fool proof way to fully protect DNS queries.
  - M_Grey 10y ago
    Good VPNs have DNS leak protection now, and frankly, I recommend avoiding one that doesn't.
  - deleted 10y ago
    [deleted]
  - edraferi 10y ago
    I use a VPN, but I have to turn it on for each device. Is there a good way to set up my router to automatically push all traffic through a VPN? I'd probably need to make exceptions for stuff like video traffic.
    - barryfandango 10y ago
      You can install Tomato (http://www.polarcloud.com/tomato http://www.polarcloud.com/tomato) on a compatible router. It has a bunch of options for routing all/some/groups of devices through various VPN's. This might be a feature in newer stock router firmware too.
- M_Grey 10y ago
  Encrypted VPN that doesn't keep records (I like NordVPN, but have had good experiences with others like IPV and PIA), uMatrix, uBlock Origin, and don't forget to turn on your user agent spoofing options.
  - davidiach 10y ago
    I'm afraid that the problem is bigger than that, most people have a number of devices that connect to the internet, not all of which work with VPN.
    - M_Grey 10y ago
      That's where a decent router that can support your VPN comes in. Look, I grant you this is not perfect, and there is no perfect enduser solution, but if you want to stop the bleeding, that's how.
  - eric_h 10y ago
    I second NordVPN, plus their interface is adorable.
- maccam912 10y ago
  Yes VPN is a good answer here, but another idea to make the data they collect and sell less useful would be something like https://github.com/WhiteBeachStudios/cyberflare https://github.com/WhiteBeachStudios/cyberflare to hide your real usage habits among a bunch of artificially generated traffic.
  - somebehemoth 10y ago
    CyberFlare looks interesting, thank you for sharing. If anyone knows of similar tools or a guide on using CyberFlare I would greatly appreciate the information.
  - snowpanda 10y ago
    How would one use cyberflare? Any easier tools?
- mhaymo 10y ago
  Use Tor.
- thomnottom 10y ago
  Start with not using their DNS servers (OpenDNS https://www.opendns.com https://www.opendns.com) Install HTTPS Everywhere (https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere) Install uBlock Origin (Chrome - https://chrome.google.com/.../ublock-origin https://chrome.google.com/.../ublock-origin / Firefox https://addons.mozilla.org/addon/ublock-origin/ https://addons.mozilla.org/addon/ublock-origin/)
  - JumpCrisscross 10y ago
    Concur with your recommendations. Would throw some caution on the OpenDNS recommendation, though. They're U.S. based and owned by Cisco. Depending on your threat model, this may or may not be desirable.
    - thomnottom 10y ago
      I debated about the recommendation, but went with the simplest one to start.
  - fastest963 10y ago
    Just because you're not using their DNS servers doesn't mean they still don't see the DNS requests as its sent through their pipes and log them.
    - thomnottom 10y ago
      Correct, but it is a start.
good_sir_ant 10y ago
The article's main argument is that the ISPs are selling something that doesn't belong to them, but to the consumer. I don't like the idea of my personal information being sold, but how could you state this as fact? Shouldn't it be up to the consumer to choose to do business with a company that sells your personal info vs a company that does not?
- somebehemoth 10y ago
  Via precedent set by protecting phone calls: "For decades, in both Republican and Democratic administrations, federal rules have protected the privacy of the information in a telephone call. In 2016, the F.C.C., which I led as chairman under President Barack Obama, extended those same protections to the internet."
  - wu-ikkyu 10y ago
    Wasn't much of a precedent: https://www.theguardian.com/world/2013/jun/06/nsa-phone-records-verizon-court-order https://www.theguardian.com/world/2013/jun/06/nsa-phone-reco...
- gbrown 10y ago
  That would be great, but privacy policies are unreadable and ISPs tend to be total or partial geographic monopolies anyway. This is a classic case for regulation.
- Asdfbla 10y ago
  You say that as if everyone had the ability to changes ISPs freely. Consumer choice is irrelevant if there's nothing to choose from.
  - fosco 10y ago
    I have a single altenative ISP that offers over 15 mbs, there is no fiber in my area. I live in New York. not the city, and I do not live 'upstate'. as the above pointed out to your comment, it is very difficult to chane ISP's I am not happy with mine and I do not have an alternative. my unhappiness came way before this bill.
gbrown 10y ago
This is like FedEx or a privatized USPS being able to open your packages and read your mail without telling you. I pay you to carry my damn packets, keep your filthy hands off my data.
- jvandonsel 10y ago
  A better analogy would be FedEx selling your incoming and outgoing addresses and package weights to third parties, not necessarily the contents of your packages.
  - fowlerpower 10y ago
    Why not the contents? What happens when most content is not over a secure connection such e.g. Over HTTP? Could they not inspect the content? It sure seems like they could. For most people most of the internet is still insecure.
    - pythonaut_16 10y ago
      I know for me personally I already assume anything over a non-HTTPS or non-secured protocol will be received and possibly read by anyone and everyone.
      - falcolas 10y ago
        You forgot "and changed". Injected ads, injected JavaScript, replaced ads... This has been occurring, and without protections against it, it will continue to occur.
    - mbel 10y ago
      Yeah, the closer analogy would be FedEx selling information about content of your packages unless they are shipped in some kind of locked strong box.
    - gregmac 10y ago
      Why not HTTPS? There are ways to do MITM proxing that re-encrypt traffic. As a customer, you just need to install their CA certificate. Or slightly worse, they could get browser vendors to include their CA (or pass legislation to force this). What prevents this from happening? In mobile, where the carrier controls everything (the network, the OS) it's not unlikely this is already happening.
acomjean 10y ago
In case people don't know, the author, Tom Wheeler was the previous chairman of the Federal Communications Commission. With the administration changed he no longer is in government. also formerly a lobyist for the cable and wireless industry, which gives him some insight into the industry. https://en.wikipedia.org/wiki/Tom_Wheeler https://en.wikipedia.org/wiki/Tom_Wheeler
Asdfbla 10y ago
At least consumers still have https going for them I suppose? Or maybe ISPs are now more motivated to man-in-the-middle those connections to get to the data, under the guise of security or something?
- notheguyouthink 10y ago
  Yea that was my main question during this. What can we do. I thought https made this near impossible unless they MITM it, which would be difficult no? Or is it easy? This is all the more reason we need to start encrypting all communication. All my hand built services (home bots, etc) need to start using tls for everything.
  - cjcampbell 10y ago
    Three problems here. First being that the ISP is a permanent MITM. Second is that TLS will not protect the hostnames, which are sent in the clear so that servers can identify the correct certificate for a given connection. Likewise, DNS is not encrypted (though companies like OpenDNS do provide alternatives here).
    - notheguyouthink 10y ago
      Regarding the MITM, more specifically i meant able to compromise HTTPS. If i sit between you and your https site, can i read all of your traffic? I know very little about the nitty gritty of HTTPS, so forgive my ignorance, but i thought the most i could do was try to pass off a custom key (ie, spoof the key authority), but then the signing done from the https site (say, https://google.com https://google.com) wouldn't be valid based on my bad key. How common is it to read full https data if you're a MITM?
      - cjcampbell 10y ago
        It's not likely that they would attempt active attacks to decrypt your TLS web traffic. I'd assume they won't be able to read the full contents of those sessions. STARTTLS on mail is a slightly different story, though I'm going to assume that most of the established compaines are smart enough fo avoid email snooping. You might, however, be surprised at how much you give away via the metadata associated with your web browsing.
jonjohn84 10y ago
I feel like this isn't going to go anywhere but I'm still tempted to contribute: https://www.gofundme.com/BuyCongressData https://www.gofundme.com/BuyCongressData
- deleted 10y ago
  [deleted]
- SonicSoul 10y ago
  im conflicted about this. hate to hand over millions to ISP's just to prove a point. I'd rather put the money towards starting a competing anonymized ISP.
- ericd 10y ago
  Why on Earth would this be set at $500M, and why on Earth would people trust a random person on the internet with that?
joe_momma 10y ago
good thing this will create jobs jobs jobs! aka just ordinary bull shit.
cryoshon 10y ago
if i dare to say that the republicans fucked us over i'll be banned for "partisan bickering", so: we just need to develop technological workarounds to the politicians. vpns are an okay start.
- notheguyouthink 10y ago
  It's actually interesting, now i feel like VPNs are going to get a huge spike in customers. On that note though, if all ISPs are doing this, what VPN choice do you have?
0xfeba 10y ago
> In 2016, the F.C.C., which I led as chairman under President Barack Obama, extended those same protections to the internet. Oh how nice of Tom Wheeler to play the good-guy now. It took a lot of public outcry for him to change his tune about Net Neutrality.
- chrisrhoden 10y ago
  He came around, and then was a reasonably good champion. Let's live in a world where people aren't permanently branded with temporary positions.
  - 0xfeba 10y ago
    I suppose you're right. But I will still remain suspicious of a former lobbyist turned head of FCC turned NN champion.
- deleted 10y ago
  [deleted]
- sbov 10y ago
  We need to laud people who change their positions for the better, not continue to becry them. It's harder for people to admit they are wrong than be right in the first place.
- tzs 10y ago
  > Oh how nice of Tom Wheeler to play the good-guy now. It took a lot of public outcry for him to change his tune about Net Neutrality. That's wrong. He was for net neutrality from day one at the FCC. You are probably thinking of the first net neutrality rule he proposed, which would have allowed for paid fast lanes, and interpreting that as somehow not being for net neutrality. When he proposed that rule that was about the strongest net neutrality rule possible without reclassifying ISPs as common carriers. Reclassification was a very risky approach, with probably at least an order of magnitude more chance of not surviving. He did state that he was open to that approach, if the comments on the first proposal indicated that there was enough support for reclassification.
ryanmarsh 10y ago
Begun the crypto wars have.
xienze 10y ago
So the only thing I don't understand as far as the fuss about this is concerned -- everything I've read indicates that this is undoing a protection put in place late last year. So essentially we've gone back in time six months ago or so. If ISPs weren't selling our info then when they could have, why does it logically follow that we're now in some uncharted territory of ISPs selling personal info? Or is this simply blowing the situation out of proportion because Republicans did it?
- Operyl 10y ago
  Because why the push to undo something if they weren't planning to do it, or weren't already? I know Verizon has an opt in program for it where they gave you deals and free data.
  - xienze 10y ago
    Can't argue with that, but again, the status quo for many, many years was that your ISP could have done this, but didn't. And the next time there's a changing of the guard the protections will be put back in place, so I can't see how ISPs are going to bet on selling this information as a viable long-term business strategy.
    - Latty 10y ago
      "We shouldn't blame the Republican's for repealing this protection pointlessly, because the Democrats will put it back when they get in power." Seriously? Free pass to do bad stuff because "it won't last". Come on.
      - xienze 10y ago
        I'm not giving them a free pass, I'd prefer the protections to be in place. But I'm just putting the situation in perspective. My observation is just that I'm perplexed about the amount of "sky is falling" reactions here when you couldn't find a peep about "which VPN do I use to keep my ISP from selling my data" on HN say, a year ago.
0wl3x 10y ago
Does anyone have a good VPN that they would recommend? This bill is totally fucked.
- jonathanwallace 10y ago
  https://github.com/trailofbits/algo https://github.com/trailofbits/algo
- needz 10y ago
  I use PIA (https://www.privateinternetaccess.com/ https://www.privateinternetaccess.com/) and don't have any complaints. They have apps for every OS, servers all over the place, and don't log anything. If you search around you can find a deal for 2 years for $60.
- andygriff1 10y ago
  I am using PureVPN (https://www.purevpn.com/ https://www.purevpn.com/) for quite a long time. There is no issue so far. The live chat support is commendable which can guide you about setup on various devices.
Clanan 10y ago
Tom Wheeler, former FCC chairman and cable/wireless lobbyist, fails to charitably address why his opponents did what they did. To Republicans and opponents of his FCC chairmanship, this was about regulatory authority, not "selling your data to ISPs". They believe the FTC, not the FCC, should be the main privacy regulator as it has in the past. They also contend that ISPs are already disallowed from scooping and selling data without consent, and that the FCC already has authority to prosecute, via sections 201, 202 and 222 of the Communications Act.
- dragonwriter 10y ago
  > They believe the FTC, not the FCC, should be the main privacy regulator as it has in the past. If they believed that, they would pass legislation to correct the law on which the court relied striking down FTC regulatory authority in this area and allow the FTC to actually do that; not doing that when reversing the FCC rules which mirrored the FTC rules which were struck down demonstrates that that is a pretext, not a genuine motivation.
  - JumpCrisscross 10y ago
    > they would pass legislation to correct the law on which the court relied striking down FTC regulatory authority in this area The FCC rule is being struck down using the Congressional Review Act [1]. CRA provides "an expedited legislative process" [2]. Giving the FTC authority in this area would require passing a real law. (That said, I agree with you regrind the explanation of motive.) [1] https://en.wikipedia.org/wiki/Congressional_Review_Act https://en.wikipedia.org/wiki/Congressional_Review_Act [2] https://web.archive.org/web/20150402230759/http://assets.opencrs.com/rpts/RL30116_20080508.pdf https://web.archive.org/web/20150402230759/http://assets.ope...
    - dragonwriter 10y ago
      > The FCC rule is being struck down using the Congressional Review Act [1]. CRA provides "an expedited legislative process" [2]. Giving the FTC authority in this area would require passing a real law. Right. But if the real basis of reversing the FCC action is not that the substance is wrong but the regulator is wrong, then you'd expect the fix to the law to allow the FTC to regulate to, at a minimum, be introduced first and highlighted in the debate over reversing the FCC action. (And, in fact, regular laws can be expedited as well, as was demonstrated procedurally with the AHCA, even if the votes were never there to follow through on the expedited process that was set up.)
earlyriser 10y ago
How difficult would be to create a DuckDuckGo of the ISPs? Both at national or local levels.
twsted 10y ago
This and the move to dismantle the Clean Power Plan. Sad.
zaroth 10y ago
Internet Provisers -- that's Google and Facebook, right? On a more serious note, people need to understand that every domain you visit, every query you search, every digital conversation you have, every number you call, every movie you watch or book you read, everything you buy, unless you take active measures to mask your identity that record is being retained by as many different people that can get their hands on it as possible. Let's be clear about what this bill is potentially changing -- not who is collecting the data but who can monetize it. Frankly, a bill that allows monetization of data already collected is not about privacy it's about deregulation. As long as the data is retained, privacy is already lost. I actually really like this bill because it exposes, well, how exposed we all are online. The more people understand how much tracking is going on, the more likely we can garner the will, the market, the demand for technological solutions which actually protect privacy rather than regulating monetization.
- M_Grey 10y ago
  More likely people will, without ever understanding any of this, become agitated and then over time... nothing they recognize will happen, nothing they can see will change. It will be even harder to get their attention next time...
  - tcfunk 10y ago
    It's the slow boil
- devmunchies 10y ago
  > ...is being retained by as many different people that can get their hands on it as possible. Which isn't a big deal as long as the data is only being used for internal use (e.g. UX purposes) to make the product better.
wu-ikkyu 10y ago
Sounds like it's time for an "AdNauseam" for browser history obfuscation. Does anyone know if such a tool already exists?
edraferi 10y ago
I want a privacy first router. Does such a product exist? Key features: - I pay a subscription for maintenance (so I'm not the product) say $10/mo - Automatically routes all traffic over a VPN. - Smart VPN bypass for performance-sensitive traffic like streaming video and gaming - Provides non-logging DNS service - Automatic advertisement blocking For VPN, DNS, and adblock I want the option to use servers & block lists maintained by the paid service, augment them with my own, or use my own exclusively. Bonus points for rotating requests between providers. Does such a product exist? I think I could hack together something similar using DD-WRT[1], but I'm confident the maintenance hassle will eventually outweigh my desire for privacy. #shutupandtakemymoney [1] http://www.dd-wrt.com/site/index http://www.dd-wrt.com/site/index
- twsted 10y ago
  > I'm confident the maintenance hassle will eventually outweigh my desire for privacy. Nothing should outweigh your right for privacy.
  - edraferi 10y ago
    Sure, but there's a cost to exercise that right. Right now, the cost of protecting myself from my ISP is quite high. I need to maintain DNS and VPN settings for every device in my home... many of which are personal devices of other family members with little patience for such techno-babble. I want a product that reduces the cost of exercising my right to privacy, and allows me to pay that cost with money instead of time.
    - baumandm 10y ago
      There are commercially-available routers which support running all traffic through a VPN. That should handle all the devices in your house.
      - icebraining 10y ago
        A VPN doesn't actually provide more privacy, it just changes who can snoop on your data.
djoldman 10y ago
The fact that this law has passed raises an interesting question: can a private citizen request and receive any and all information from a government entity about the users of that government's various assets? For instance: 1. Detailed data on the number, character, weight, etc. of every car that passes on a government road. (cameras record license plates, traffic videos exist, weigh stations are sometimes required for trucks, etc.) 2. Power companies bill the owning address for every power meter connected to the grid - therefore it should be possible to compile detailed historical data on power use. (watt-hours used, at least in monthly time-slices, possibly with geo-locating data, etc.) 3. Same as above for water use. It seems to me that if the government is going to make it legal for a provider of services that run on government owned property (telephone/internet lines, which if not in all cases outright owned by the federal government, ARE deeply regulated by it), then why not all the databases concerning all gov. property?
- deleted 10y ago
  [deleted]
eternalban 10y ago
This is basically like having your mailman/postoffice sell the list of your to/from addresses. Isn't it possible to challenge this on constitutional grounds?
- deong 10y ago
  I really doubt it. First, the Constitution places limits on the government; not so much on contractual agreements between private parties. What you and Comcast agree to just has to avoid depriving you of basic human rights (i.e., you can't sell yourself into slavery). Even ignoring that, you give up most constitutional privacy claims if you start disclosing the information to third parties. The ISP is a permanent and necessary third party here. If you tell your ISP that you want to go to ihaveherpes.com or whatever (by asking them to route your traffic there), then I'm not sure you have any claim to privacy as it pertains to a conversation between you and the herpes people. You willingly gave the ISP the information. That's why we need legal protections like the prior FCC rules. Because by necessity, you need something above any bare constitutional protection.
- deleted 10y ago
  [deleted]
milesf 10y ago
Time to roll up our sleeves and get to work. I've watched the tech community battle back many times: PGP, SCO Unix vs Linux, WebStandards.org, etc. How do we fight this using software? Remember that many of the innovations came from single individuals. Is there a way to have a fully private, fast communication between two computers when we know everything we do is being saved and analyzed? Because that's all the Internet really is, whether one of those computers is a web server and the other a browser or any other infinite combination.
- deleted 10y ago
  [deleted]
jaySmith 10y ago
One idea that I have been running through my head for awhile is a Tor like onion router that could be funded by a special cryptocurrency. This would mean each relay would get some amount of money for passing a packet on to the next relay. Ultimately this would solve two problems with Tor: speed (as it is paid there would likely be more relays with faster connection) and issues with spam (DOS over the network would cost a lot more.) Obviously it would suffer from some anonymity issues that would need to be solved as you are paying and it could be traced. I don't know if this idea would solve the issue in this case but I figured I would mention it.
serafinlion 10y ago
It's a repeal of the regulation put in place by the FCC last year October prohibiting ISPs (such as Verizon, AT&T) to sell their customers' data. This shows how strong the lobbyist groups are if this very recent item was taken on this quickly -- which makes sense if you think about that it's a $156+ billion industry in the US alone. The regulation from last October required to ask for expressive consent to sell the following: - Precise geo-location - Children’s information - Health Information - Financial Information - Social Security Numbers (wait, they actually sold those?!) - Web Browsing History - App Usage History - The content of communication With the new regulation, passing all of these information on is fair game again. Which is absolute fucking shocking! Btw, for anyone interested, I wrote a blog post about the implications of the new regulation for ISPs when it was first passed -- just make sure to read it as the opposite of what I wrote: https://blog.datawallet.io/broad-band-providers-take-a-hit-by-the-fcc-why-should-we-care-5b565c960d74 https://blog.datawallet.io/broad-band-providers-take-a-hit-b...
greedyliberal 10y ago
Just because you call it a right, doesn't make it a right. For instance: I have a right to only be upvoted! Should I call the ACLU on everyone who downvotes this? Recognizing the costs of providing internet service, and then making a suggestion to pay a higher premium for additional service (i.e. privacy) is the logical way to resolve this.
- Delmania 10y ago
  Well, I was going to respond to this, but it's an account that less than an hour old. Seems the trolls are picking up on tactics from Reddit.
  - dmix 10y ago
    What part of saying privacy/security comes at cost is trolling? It does. Whether you pay money directly or for lost access to features like persistent geolocation, using closed source internet-connect applications, etc, etc. Unless I'm missing something bad the OP said.
    - Delmania 10y ago
      The Supreme Court recognized on multiple occasions that we have a right to privacy. In this specific instance, protecting privacy comes at no cost to an ISP, as they simply do not collect or sell your data. They literally have to do nothing, as setting up the systems to collect and opening the channels to sell takes work. This nothnig more than money grab.
      - dmix 10y ago
        > The Supreme Court recognized on multiple occasions that we have a right to privacy. The right to privacy... from the government, not private businesses. There are privacy regulations which affect private business such as HIPAA. But these are not 'rights'. And just because they are regulated doesn't mean they are effective at the intended or worth the significant costs of implementation - which is the critique here. So unlike government where the risks are a certainty (because we give the state a monopoly on violence and other powers), the risks of private companies selling data are not nearly in the same league, regardless if you believe regulations are the way to go. I personally would like to be able to invest money so we don't have to worry about ISPs selling data. TLS/VPNs are a solved problem. Same with the opportunity to use adblockers... ad companies collect as much data and that is entirely unregulated. No one seems to care. We just say 'use an ad-blocker'... a private solution. 'Do not track' regulations were a total failure.
pragone 10y ago
Since this isn't posted in this thread yet, here it is: https://github.com/jlund/streisand https://github.com/jlund/streisand Unless someone can point out why it's not what it's cracked up to be? Seems like a rather easy-to-setup solution, somewhere between straight up paying a service and rolling everything yourself (I do pay PIA, but I've found that, not infrequently, my speeds are drastically throttled. I'll be actively downloading a file while connected at 400kb/s, cancel the download, disconnect from them, restart the same file, and be at 10mbit/s. I have no doubt some of that is due to the nature of the VPN, but I can't imagine all of it is. But, I'm not not a network engineer.)
- snowpanda 10y ago
  My concern is that if you connect to a VPN server in the US that your traffic will still be sold because the VPN provider technically also an ISP. I could be wrong though.
Spoom 10y ago
I'm curious if this will result in ISPs requiring the installation of an SSL root CA on customers' devices -- they can't track SSL traffic without it.
- croon 10y ago
  They know where you connect to. That's still plenty of information.
Brendinooo 10y ago
I am a strong advocate for privacy, please understand that before you continue reading this. I don't want ISPs to sell my browsing history, and I am continually disappointed in the Republican opposition to net neutrality and online privacy. I'm even working on an open source project involving cryptography and secret protection, so I have skin in the game. However, this headline is patently false, right? Congress didn't sell anything. They removed protections that were put into place late last year and hadn't gone into effect as far as I know. Just because companies are legally capable of selling your browsing data doesn't mean that they absolutely will. As far as I know, my browsing history hasn't been sold by my ISP yet, and the regulations that were rolled back were not the reason why this is true. Maybe I'm just posting because I like being a contrarian, but I do expect a more sober-minded commentary on this site than I've been getting on some recent news items. If you're interested in the FCC's response, here is a primary source[0]. I don't buy most of it - I know that this is a lot of spin doctoring, particularly that second paragraph. But it provides insight to how the FCC is viewing this, something I haven't seen a lot of in this coverage. Here[1] is some coverage from 2015 on the FCC/FTC issue that the third paragraph in that presser talks about. Also worth noting is this HN thread[2] from two years ago, where the top comment is a thoughtful critique of putting the hopes of an open Internet in the hands of a bureaucracy. People didn't agree, but that's the sort of commentary that keeps me coming back to Hacker News. [0]: http://transition.fcc.gov/Daily_Releases/Daily_Business/2017/db0328/DOC-344116A1.pdf http://transition.fcc.gov/Daily_Releases/Daily_Business/2017... [1]: https://iapp.org/news/a/ftc-officials-concerned-about-jurisdiction-after-fcc-net-neutrality-order/ https://iapp.org/news/a/ftc-officials-concerned-about-jurisd... [2]: https://news.ycombinator.com/item?id=9191007 https://news.ycombinator.com/item?id=9191007
- lilbobbytables 10y ago
  Don't have a moment to read your sources at the moment. But weren't the protections only put into place last year because they weren't needed until then? In other words, they were under the jurisdiction of the FTC previously, so this particular legislation a moot point, because the FTC could just say "hey, you can't do that. case closed." Now because of the "common carrier exemption" I don't think that would hold up. This was useful in some quick tidbits about FTC + FCC relationship, previous responsibilities, and current. https://www.ftc.gov/system/files/documents/public_statements/893473/151204plispeech1.pdf https://www.ftc.gov/system/files/documents/public_statements... Funny enough, they talk about how the FCC handles data/privacy breaches, and how they came down really hard on a minor breach that affected a few cox subscribers, nothing with payment data or even any actual damages. This seemingly means that the FTC takes privacy seriously. But congress won't let them.
dfar1 10y ago
What is the name of the bill? And where can I read it? Thanks.
- tzs 10y ago
  Here: https://www.congress.gov/bill/115th-congress/senate-joint-resolution/34/text https://www.congress.gov/bill/115th-congress/senate-joint-re... Here's the full text: > Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Federal Communications Commission relating to “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services”. > Resolved by the Senate and House of Representatives of the United States of America in Congress assembled, That Congress disapproves the rule submitted by the Federal Communications Commission relating to “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services” (81 Fed. Reg. 87274 (December 2, 2016)), and such rule shall have no force or effect.
- programmarchy 10y ago
  S.J.Res. 34: A joint resolution providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Federal Communications Commission relating to “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services”. https://www.govtrack.us/congress/bills/115/sjres34 https://www.govtrack.us/congress/bills/115/sjres34
peregrine 10y ago
The Hacker News mods should comment why this post has been 'bumped' from the top spot and why it's title is no longer the original title of the article. From the https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html: > Otherwise please use the original title, unless it is misleading or linkbait. The title is the original, it wasn't misleading and it isn't 'linkbait'. Its the premise of the article and it's the truth. dang please help me out here.
- Brendinooo 10y ago
  The headline isn't true. Congress voted to remove regulations, they didn't complete a financial transaction with ISPs.
  - peregrine 10y ago
    Because none of them received donations or were lobbied?
    - snowpanda 10y ago
      You're reaching..
      - peregrine 10y ago
        I did one google search and found https://www.theverge.com/2017/3/29/15100620/congress-fcc-isp-web-browsing-privacy-fire-sale https://www.theverge.com/2017/3/29/15100620/congress-fcc-isp... and is fully sourced by generally reputable data. I'd be just as pissed if Democrats sold us down the river, which I am about Obamacare several years ago.
  - state_less 10y ago
    s/regulations/privacy/
- sctb 10y ago
  A moderator replaced the original title (which was absolutely as linkbait as they come) with a representative phrase from the article. This topic has been discussed extensively already, so this article received many user flags as well as the standard penalty for follow-on posts. Related discussions: https://news.ycombinator.com/item?id=13942345 https://news.ycombinator.com/item?id=13942345 https://news.ycombinator.com/item?id=13981184 https://news.ycombinator.com/item?id=13981184 https://news.ycombinator.com/item?id=13951347 https://news.ycombinator.com/item?id=13951347 https://news.ycombinator.com/item?id=13967955 https://news.ycombinator.com/item?id=13967955 https://news.ycombinator.com/item?id=13983235 https://news.ycombinator.com/item?id=13983235 https://news.ycombinator.com/item?id=13973727 https://news.ycombinator.com/item?id=13973727
bubblethink 10y ago
Why was the title of this post changed retroactively on HN ? The article is an op-ed with the title "How the Republicans Sold Your Privacy to Internet Providers".
xori 10y ago
I'm curious, does this mean that an ISP can sell non-anonymized data collected between last October and now?
valine 10y ago
What I want is a way to tie my own VPN to something like my Apple id and have it auto configured anytime I move to a different device. Right maintaining VPN clients on a range of devices is a pretty big hassle. I'm not saying I want Apple to run vpn services, I just want an easy way to manage vpn configurations on personal devices.
- lloyd-christmas 10y ago
  https://betterspot.com/ https://betterspot.com/ was a Kickstarter project I funded. They haven't shipped yet, but look to be this month.
singularity2001 10y ago
This can't be repeated often enough: If you have some ssh server somewhere (who hasn't), you can very easily create a 'VPN over ssh' by calling: sshuttle -r user@remote_host 0.0.0.0/0 --dns
JohnLeTigre 10y ago
Great, now everyone will use Tor and torrent over I2P. I wonder if these technologies can handle the extra bandwidth.
Thrymr 10y ago
I am curious whether any companies are concerned about this for employees who work from home. Can ISPs resell business espionage to the highest bidder? Not all employers are savvy enough to provide and require VPNs.
dsr_ 10y ago
If engineers would refuse to implement privacy invasions, they wouldn't happen. Do you work for Comcast, Verizon, AT&T, Time-Warner, CenturyLink, Charter, Cox, Frontier? Don't implement these things. Don't do deep packet inspection, don't log things that shouldn't be logged, don't put in MITM proxies and don't insert cookies in traffic that your customers expected to have unmolested. Explain your decision, and explain it to your coworkers. Some of you will lose your jobs. I'm sorry. However, you're in high demand. And maybe you can make a difference.
- Chaebixi 10y ago
  > If engineers would refuse to implement privacy invasions, they wouldn't happen. That'll never work, as long as it's just a personal ethical thing. There's always someone who would rather take the money. Now, if there was a professional organization or union with some teeth, which could enforce some kind of ethical code, then maybe "engineers" could do something about stuff like this. I'm not sure how it would work in detail, but it might involve pickets/walkouts of entire organizations engaged in unethical projects or expelling members who work on them in a way that negatively affects their future job prospects.
  - voidlogic 10y ago
    >That'll never work, as long as it's just a personal ethical thing. There's always someone who would rather take the money. So true >Now, if there was a professional organization or union with some teeth, which could enforce some kind of ethical code, then maybe "engineers" could do something about stuff like this. That won't work either. A few years ago most of the "programmers/developers/computer scientists" I worked with (we weren't pretending to be engineers yet), all had C-S degrees (either C-S undergrad or math/physics undergrad with C-S masters+). And by and large these people were usually members of the ACM or IEEE. Now with the rise of the "self tough (software) engineer", these professional organizations are weaker than ever before. My cube make is not only likely to be a boot camp graduate, they are likely to not know what the ACM is, never mind any ethical standards its has and of course have no concern for being kicked out. Now I am not saying all this is good or bad, democratization of technology has pros and cons. But its a shift that makes depending on professional orgs more worthless than ever before. (some of this is also coast vs inland US, the west coast as always had more self-tough vs academia tought programmers).
erdojo 10y ago
Might be an ignorant question, but could individual websites do more to prevent an ISP from seeing your activity on the site? I know HTTPS should be able to help (?), but ISPs can still see the domain you're visiting and get metadata on the encrypted traffic, which can be revealing. Are there architectural or tech stack decisions a company could make that would basically lock an ISP from knowing anything except the root domains you visited?
davidgerard 10y ago
Fake title. Actual title: "How the Republicans Sold Your Privacy to Internet Providers"

mozumder 10y ago

But her emails?

j2bax 10y ago

Is there anything the average user can do to protect their data/privacy from their ISP?

adrianN 10y ago
Run everything over an encrypted channel.
0xcafecafe 10y ago
vpn?
somebehemoth 10y ago
VPN is a solution but requires trust in VPN provider. OpenVPN on a VPS can help. Also, consider DNS traffic can leak information, but I've not read of a fool proof way to fully protect DNS queries.
- M_Grey 10y ago
  Good VPNs have DNS leak protection now, and frankly, I recommend avoiding one that doesn't.
- deleted 10y ago
  [deleted]
- edraferi 10y ago
  I use a VPN, but I have to turn it on for each device. Is there a good way to set up my router to automatically push all traffic through a VPN? I'd probably need to make exceptions for stuff like video traffic.
  - barryfandango 10y ago
    You can install Tomato (http://www.polarcloud.com/tomato http://www.polarcloud.com/tomato) on a compatible router. It has a bunch of options for routing all/some/groups of devices through various VPN's. This might be a feature in newer stock router firmware too.
M_Grey 10y ago
Encrypted VPN that doesn't keep records (I like NordVPN, but have had good experiences with others like IPV and PIA), uMatrix, uBlock Origin, and don't forget to turn on your user agent spoofing options.
- davidiach 10y ago
  I'm afraid that the problem is bigger than that, most people have a number of devices that connect to the internet, not all of which work with VPN.
  - M_Grey 10y ago
    That's where a decent router that can support your VPN comes in. Look, I grant you this is not perfect, and there is no perfect enduser solution, but if you want to stop the bleeding, that's how.
- eric_h 10y ago
  I second NordVPN, plus their interface is adorable.
maccam912 10y ago
Yes VPN is a good answer here, but another idea to make the data they collect and sell less useful would be something like https://github.com/WhiteBeachStudios/cyberflare https://github.com/WhiteBeachStudios/cyberflare to hide your real usage habits among a bunch of artificially generated traffic.
- somebehemoth 10y ago
  CyberFlare looks interesting, thank you for sharing. If anyone knows of similar tools or a guide on using CyberFlare I would greatly appreciate the information.
- snowpanda 10y ago
  How would one use cyberflare? Any easier tools?
mhaymo 10y ago
Use Tor.
thomnottom 10y ago
Start with not using their DNS servers (OpenDNS https://www.opendns.com https://www.opendns.com) Install HTTPS Everywhere (https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere) Install uBlock Origin (Chrome - https://chrome.google.com/.../ublock-origin https://chrome.google.com/.../ublock-origin / Firefox https://addons.mozilla.org/addon/ublock-origin/ https://addons.mozilla.org/addon/ublock-origin/)
- JumpCrisscross 10y ago
  Concur with your recommendations. Would throw some caution on the OpenDNS recommendation, though. They're U.S. based and owned by Cisco. Depending on your threat model, this may or may not be desirable.
  - thomnottom 10y ago
    I debated about the recommendation, but went with the simplest one to start.
- fastest963 10y ago
  Just because you're not using their DNS servers doesn't mean they still don't see the DNS requests as its sent through their pipes and log them.
  - thomnottom 10y ago
    Correct, but it is a start.

good_sir_ant 10y ago

The article's main argument is that the ISPs are selling something that doesn't belong to them, but to the consumer. I don't like the idea of my personal information being sold, but how could you state this as fact? Shouldn't it be up to the consumer to choose to do business with a company that sells your personal info vs a company that does not?

somebehemoth 10y ago
Via precedent set by protecting phone calls: "For decades, in both Republican and Democratic administrations, federal rules have protected the privacy of the information in a telephone call. In 2016, the F.C.C., which I led as chairman under President Barack Obama, extended those same protections to the internet."
- wu-ikkyu 10y ago
  Wasn't much of a precedent: https://www.theguardian.com/world/2013/jun/06/nsa-phone-records-verizon-court-order https://www.theguardian.com/world/2013/jun/06/nsa-phone-reco...
gbrown 10y ago
That would be great, but privacy policies are unreadable and ISPs tend to be total or partial geographic monopolies anyway. This is a classic case for regulation.
Asdfbla 10y ago
You say that as if everyone had the ability to changes ISPs freely. Consumer choice is irrelevant if there's nothing to choose from.
- fosco 10y ago
  I have a single altenative ISP that offers over 15 mbs, there is no fiber in my area. I live in New York. not the city, and I do not live 'upstate'. as the above pointed out to your comment, it is very difficult to chane ISP's I am not happy with mine and I do not have an alternative. my unhappiness came way before this bill.

gbrown 10y ago

This is like FedEx or a privatized USPS being able to open your packages and read your mail without telling you. I pay you to carry my damn packets, keep your filthy hands off my data.

jvandonsel 10y ago
A better analogy would be FedEx selling your incoming and outgoing addresses and package weights to third parties, not necessarily the contents of your packages.
- fowlerpower 10y ago
  Why not the contents? What happens when most content is not over a secure connection such e.g. Over HTTP? Could they not inspect the content? It sure seems like they could. For most people most of the internet is still insecure.
  - pythonaut_16 10y ago
    I know for me personally I already assume anything over a non-HTTPS or non-secured protocol will be received and possibly read by anyone and everyone.
    - falcolas 10y ago
      You forgot "and changed". Injected ads, injected JavaScript, replaced ads... This has been occurring, and without protections against it, it will continue to occur.
  - mbel 10y ago
    Yeah, the closer analogy would be FedEx selling information about content of your packages unless they are shipped in some kind of locked strong box.
  - gregmac 10y ago
    Why not HTTPS? There are ways to do MITM proxing that re-encrypt traffic. As a customer, you just need to install their CA certificate. Or slightly worse, they could get browser vendors to include their CA (or pass legislation to force this). What prevents this from happening? In mobile, where the carrier controls everything (the network, the OS) it's not unlikely this is already happening.

acomjean 10y ago

In case people don't know, the author, Tom Wheeler was the previous chairman of the Federal Communications Commission. With the administration changed he no longer is in government. also formerly a lobyist for the cable and wireless industry, which gives him some insight into the industry. https://en.wikipedia.org/wiki/Tom_Wheeler https://en.wikipedia.org/wiki/Tom_Wheeler

Asdfbla 10y ago

At least consumers still have https going for them I suppose? Or maybe ISPs are now more motivated to man-in-the-middle those connections to get to the data, under the guise of security or something?

notheguyouthink 10y ago
Yea that was my main question during this. What can we do. I thought https made this near impossible unless they MITM it, which would be difficult no? Or is it easy? This is all the more reason we need to start encrypting all communication. All my hand built services (home bots, etc) need to start using tls for everything.
- cjcampbell 10y ago
  Three problems here. First being that the ISP is a permanent MITM. Second is that TLS will not protect the hostnames, which are sent in the clear so that servers can identify the correct certificate for a given connection. Likewise, DNS is not encrypted (though companies like OpenDNS do provide alternatives here).
  - notheguyouthink 10y ago
    Regarding the MITM, more specifically i meant able to compromise HTTPS. If i sit between you and your https site, can i read all of your traffic? I know very little about the nitty gritty of HTTPS, so forgive my ignorance, but i thought the most i could do was try to pass off a custom key (ie, spoof the key authority), but then the signing done from the https site (say, https://google.com https://google.com) wouldn't be valid based on my bad key. How common is it to read full https data if you're a MITM?
    - cjcampbell 10y ago
      It's not likely that they would attempt active attacks to decrypt your TLS web traffic. I'd assume they won't be able to read the full contents of those sessions. STARTTLS on mail is a slightly different story, though I'm going to assume that most of the established compaines are smart enough fo avoid email snooping. You might, however, be surprised at how much you give away via the metadata associated with your web browsing.

jonjohn84 10y ago

I feel like this isn't going to go anywhere but I'm still tempted to contribute: https://www.gofundme.com/BuyCongressData https://www.gofundme.com/BuyCongressData

deleted 10y ago
[deleted]
SonicSoul 10y ago
im conflicted about this. hate to hand over millions to ISP's just to prove a point. I'd rather put the money towards starting a competing anonymized ISP.
ericd 10y ago
Why on Earth would this be set at $500M, and why on Earth would people trust a random person on the internet with that?

joe_momma 10y ago

good thing this will create jobs jobs jobs! aka just ordinary bull shit.

cryoshon 10y ago

if i dare to say that the republicans fucked us over i'll be banned for "partisan bickering", so: we just need to develop technological workarounds to the politicians. vpns are an okay start.

notheguyouthink 10y ago
It's actually interesting, now i feel like VPNs are going to get a huge spike in customers. On that note though, if all ISPs are doing this, what VPN choice do you have?

0xfeba 10y ago

> In 2016, the F.C.C., which I led as chairman under President Barack Obama, extended those same protections to the internet. Oh how nice of Tom Wheeler to play the good-guy now. It took a lot of public outcry for him to change his tune about Net Neutrality.

chrisrhoden 10y ago
He came around, and then was a reasonably good champion. Let's live in a world where people aren't permanently branded with temporary positions.
- 0xfeba 10y ago
  I suppose you're right. But I will still remain suspicious of a former lobbyist turned head of FCC turned NN champion.
deleted 10y ago
[deleted]
sbov 10y ago
We need to laud people who change their positions for the better, not continue to becry them. It's harder for people to admit they are wrong than be right in the first place.
tzs 10y ago
> Oh how nice of Tom Wheeler to play the good-guy now. It took a lot of public outcry for him to change his tune about Net Neutrality. That's wrong. He was for net neutrality from day one at the FCC. You are probably thinking of the first net neutrality rule he proposed, which would have allowed for paid fast lanes, and interpreting that as somehow not being for net neutrality. When he proposed that rule that was about the strongest net neutrality rule possible without reclassifying ISPs as common carriers. Reclassification was a very risky approach, with probably at least an order of magnitude more chance of not surviving. He did state that he was open to that approach, if the comments on the first proposal indicated that there was enough support for reclassification.

ryanmarsh 10y ago

Begun the crypto wars have.

xienze 10y ago

So the only thing I don't understand as far as the fuss about this is concerned -- everything I've read indicates that this is undoing a protection put in place late last year. So essentially we've gone back in time six months ago or so. If ISPs weren't selling our info then when they could have, why does it logically follow that we're now in some uncharted territory of ISPs selling personal info? Or is this simply blowing the situation out of proportion because Republicans did it?

Operyl 10y ago
Because why the push to undo something if they weren't planning to do it, or weren't already? I know Verizon has an opt in program for it where they gave you deals and free data.
- xienze 10y ago
  Can't argue with that, but again, the status quo for many, many years was that your ISP could have done this, but didn't. And the next time there's a changing of the guard the protections will be put back in place, so I can't see how ISPs are going to bet on selling this information as a viable long-term business strategy.
  - Latty 10y ago
    "We shouldn't blame the Republican's for repealing this protection pointlessly, because the Democrats will put it back when they get in power." Seriously? Free pass to do bad stuff because "it won't last". Come on.
    - xienze 10y ago
      I'm not giving them a free pass, I'd prefer the protections to be in place. But I'm just putting the situation in perspective. My observation is just that I'm perplexed about the amount of "sky is falling" reactions here when you couldn't find a peep about "which VPN do I use to keep my ISP from selling my data" on HN say, a year ago.

0wl3x 10y ago

Does anyone have a good VPN that they would recommend? This bill is totally fucked.

jonathanwallace 10y ago
https://github.com/trailofbits/algo https://github.com/trailofbits/algo
needz 10y ago
I use PIA (https://www.privateinternetaccess.com/ https://www.privateinternetaccess.com/) and don't have any complaints. They have apps for every OS, servers all over the place, and don't log anything. If you search around you can find a deal for 2 years for $60.
andygriff1 10y ago
I am using PureVPN (https://www.purevpn.com/ https://www.purevpn.com/) for quite a long time. There is no issue so far. The live chat support is commendable which can guide you about setup on various devices.

Clanan 10y ago

Tom Wheeler, former FCC chairman and cable/wireless lobbyist, fails to charitably address why his opponents did what they did. To Republicans and opponents of his FCC chairmanship, this was about regulatory authority, not "selling your data to ISPs". They believe the FTC, not the FCC, should be the main privacy regulator as it has in the past. They also contend that ISPs are already disallowed from scooping and selling data without consent, and that the FCC already has authority to prosecute, via sections 201, 202 and 222 of the Communications Act.

dragonwriter 10y ago
> They believe the FTC, not the FCC, should be the main privacy regulator as it has in the past. If they believed that, they would pass legislation to correct the law on which the court relied striking down FTC regulatory authority in this area and allow the FTC to actually do that; not doing that when reversing the FCC rules which mirrored the FTC rules which were struck down demonstrates that that is a pretext, not a genuine motivation.
- JumpCrisscross 10y ago
  > they would pass legislation to correct the law on which the court relied striking down FTC regulatory authority in this area The FCC rule is being struck down using the Congressional Review Act [1]. CRA provides "an expedited legislative process" [2]. Giving the FTC authority in this area would require passing a real law. (That said, I agree with you regrind the explanation of motive.) [1] https://en.wikipedia.org/wiki/Congressional_Review_Act https://en.wikipedia.org/wiki/Congressional_Review_Act [2] https://web.archive.org/web/20150402230759/http://assets.opencrs.com/rpts/RL30116_20080508.pdf https://web.archive.org/web/20150402230759/http://assets.ope...
  - dragonwriter 10y ago
    > The FCC rule is being struck down using the Congressional Review Act [1]. CRA provides "an expedited legislative process" [2]. Giving the FTC authority in this area would require passing a real law. Right. But if the real basis of reversing the FCC action is not that the substance is wrong but the regulator is wrong, then you'd expect the fix to the law to allow the FTC to regulate to, at a minimum, be introduced first and highlighted in the debate over reversing the FCC action. (And, in fact, regular laws can be expedited as well, as was demonstrated procedurally with the AHCA, even if the votes were never there to follow through on the expedited process that was set up.)

earlyriser 10y ago

How difficult would be to create a DuckDuckGo of the ISPs? Both at national or local levels.

twsted 10y ago

This and the move to dismantle the Clean Power Plan. Sad.

zaroth 10y ago

Internet Provisers -- that's Google and Facebook, right? On a more serious note, people need to understand that every domain you visit, every query you search, every digital conversation you have, every number you call, every movie you watch or book you read, everything you buy, unless you take active measures to mask your identity that record is being retained by as many different people that can get their hands on it as possible. Let's be clear about what this bill is potentially changing -- not who is collecting the data but who can monetize it. Frankly, a bill that allows monetization of data already collected is not about privacy it's about deregulation. As long as the data is retained, privacy is already lost. I actually really like this bill because it exposes, well, how exposed we all are online. The more people understand how much tracking is going on, the more likely we can garner the will, the market, the demand for technological solutions which actually protect privacy rather than regulating monetization.

M_Grey 10y ago
More likely people will, without ever understanding any of this, become agitated and then over time... nothing they recognize will happen, nothing they can see will change. It will be even harder to get their attention next time...
- tcfunk 10y ago
  It's the slow boil
devmunchies 10y ago
> ...is being retained by as many different people that can get their hands on it as possible. Which isn't a big deal as long as the data is only being used for internal use (e.g. UX purposes) to make the product better.

wu-ikkyu 10y ago

Sounds like it's time for an "AdNauseam" for browser history obfuscation. Does anyone know if such a tool already exists?

edraferi 10y ago

I want a privacy first router. Does such a product exist? Key features: - I pay a subscription for maintenance (so I'm not the product) say $10/mo - Automatically routes all traffic over a VPN. - Smart VPN bypass for performance-sensitive traffic like streaming video and gaming - Provides non-logging DNS service - Automatic advertisement blocking For VPN, DNS, and adblock I want the option to use servers & block lists maintained by the paid service, augment them with my own, or use my own exclusively. Bonus points for rotating requests between providers. Does such a product exist? I think I could hack together something similar using DD-WRT[1], but I'm confident the maintenance hassle will eventually outweigh my desire for privacy. #shutupandtakemymoney [1] http://www.dd-wrt.com/site/index http://www.dd-wrt.com/site/index

twsted 10y ago
> I'm confident the maintenance hassle will eventually outweigh my desire for privacy. Nothing should outweigh your right for privacy.
- edraferi 10y ago
  Sure, but there's a cost to exercise that right. Right now, the cost of protecting myself from my ISP is quite high. I need to maintain DNS and VPN settings for every device in my home... many of which are personal devices of other family members with little patience for such techno-babble. I want a product that reduces the cost of exercising my right to privacy, and allows me to pay that cost with money instead of time.
  - baumandm 10y ago
    There are commercially-available routers which support running all traffic through a VPN. That should handle all the devices in your house.
    - icebraining 10y ago
      A VPN doesn't actually provide more privacy, it just changes who can snoop on your data.

djoldman 10y ago

The fact that this law has passed raises an interesting question: can a private citizen request and receive any and all information from a government entity about the users of that government's various assets? For instance: 1. Detailed data on the number, character, weight, etc. of every car that passes on a government road. (cameras record license plates, traffic videos exist, weigh stations are sometimes required for trucks, etc.) 2. Power companies bill the owning address for every power meter connected to the grid - therefore it should be possible to compile detailed historical data on power use. (watt-hours used, at least in monthly time-slices, possibly with geo-locating data, etc.) 3. Same as above for water use. It seems to me that if the government is going to make it legal for a provider of services that run on government owned property (telephone/internet lines, which if not in all cases outright owned by the federal government, ARE deeply regulated by it), then why not all the databases concerning all gov. property?

deleted 10y ago
[deleted]

eternalban 10y ago

This is basically like having your mailman/postoffice sell the list of your to/from addresses. Isn't it possible to challenge this on constitutional grounds?

deong 10y ago
I really doubt it. First, the Constitution places limits on the government; not so much on contractual agreements between private parties. What you and Comcast agree to just has to avoid depriving you of basic human rights (i.e., you can't sell yourself into slavery). Even ignoring that, you give up most constitutional privacy claims if you start disclosing the information to third parties. The ISP is a permanent and necessary third party here. If you tell your ISP that you want to go to ihaveherpes.com or whatever (by asking them to route your traffic there), then I'm not sure you have any claim to privacy as it pertains to a conversation between you and the herpes people. You willingly gave the ISP the information. That's why we need legal protections like the prior FCC rules. Because by necessity, you need something above any bare constitutional protection.
deleted 10y ago
[deleted]

milesf 10y ago

Time to roll up our sleeves and get to work. I've watched the tech community battle back many times: PGP, SCO Unix vs Linux, WebStandards.org, etc. How do we fight this using software? Remember that many of the innovations came from single individuals. Is there a way to have a fully private, fast communication between two computers when we know everything we do is being saved and analyzed? Because that's all the Internet really is, whether one of those computers is a web server and the other a browser or any other infinite combination.

deleted 10y ago
[deleted]

jaySmith 10y ago

One idea that I have been running through my head for awhile is a Tor like onion router that could be funded by a special cryptocurrency. This would mean each relay would get some amount of money for passing a packet on to the next relay. Ultimately this would solve two problems with Tor: speed (as it is paid there would likely be more relays with faster connection) and issues with spam (DOS over the network would cost a lot more.) Obviously it would suffer from some anonymity issues that would need to be solved as you are paying and it could be traced. I don't know if this idea would solve the issue in this case but I figured I would mention it.

serafinlion 10y ago

It's a repeal of the regulation put in place by the FCC last year October prohibiting ISPs (such as Verizon, AT&T) to sell their customers' data. This shows how strong the lobbyist groups are if this very recent item was taken on this quickly -- which makes sense if you think about that it's a $156+ billion industry in the US alone. The regulation from last October required to ask for expressive consent to sell the following: - Precise geo-location - Children’s information - Health Information - Financial Information - Social Security Numbers (wait, they actually sold those?!) - Web Browsing History - App Usage History - The content of communication With the new regulation, passing all of these information on is fair game again. Which is absolute fucking shocking! Btw, for anyone interested, I wrote a blog post about the implications of the new regulation for ISPs when it was first passed -- just make sure to read it as the opposite of what I wrote: https://blog.datawallet.io/broad-band-providers-take-a-hit-by-the-fcc-why-should-we-care-5b565c960d74 https://blog.datawallet.io/broad-band-providers-take-a-hit-b...

greedyliberal 10y ago

Just because you call it a right, doesn't make it a right. For instance: I have a right to only be upvoted! Should I call the ACLU on everyone who downvotes this? Recognizing the costs of providing internet service, and then making a suggestion to pay a higher premium for additional service (i.e. privacy) is the logical way to resolve this.

Delmania 10y ago
Well, I was going to respond to this, but it's an account that less than an hour old. Seems the trolls are picking up on tactics from Reddit.
- dmix 10y ago
  What part of saying privacy/security comes at cost is trolling? It does. Whether you pay money directly or for lost access to features like persistent geolocation, using closed source internet-connect applications, etc, etc. Unless I'm missing something bad the OP said.
  - Delmania 10y ago
    The Supreme Court recognized on multiple occasions that we have a right to privacy. In this specific instance, protecting privacy comes at no cost to an ISP, as they simply do not collect or sell your data. They literally have to do nothing, as setting up the systems to collect and opening the channels to sell takes work. This nothnig more than money grab.
    - dmix 10y ago
      > The Supreme Court recognized on multiple occasions that we have a right to privacy. The right to privacy... from the government, not private businesses. There are privacy regulations which affect private business such as HIPAA. But these are not 'rights'. And just because they are regulated doesn't mean they are effective at the intended or worth the significant costs of implementation - which is the critique here. So unlike government where the risks are a certainty (because we give the state a monopoly on violence and other powers), the risks of private companies selling data are not nearly in the same league, regardless if you believe regulations are the way to go. I personally would like to be able to invest money so we don't have to worry about ISPs selling data. TLS/VPNs are a solved problem. Same with the opportunity to use adblockers... ad companies collect as much data and that is entirely unregulated. No one seems to care. We just say 'use an ad-blocker'... a private solution. 'Do not track' regulations were a total failure.

pragone 10y ago

Since this isn't posted in this thread yet, here it is: https://github.com/jlund/streisand https://github.com/jlund/streisand Unless someone can point out why it's not what it's cracked up to be? Seems like a rather easy-to-setup solution, somewhere between straight up paying a service and rolling everything yourself (I do pay PIA, but I've found that, not infrequently, my speeds are drastically throttled. I'll be actively downloading a file while connected at 400kb/s, cancel the download, disconnect from them, restart the same file, and be at 10mbit/s. I have no doubt some of that is due to the nature of the VPN, but I can't imagine all of it is. But, I'm not not a network engineer.)

snowpanda 10y ago
My concern is that if you connect to a VPN server in the US that your traffic will still be sold because the VPN provider technically also an ISP. I could be wrong though.

Spoom 10y ago

I'm curious if this will result in ISPs requiring the installation of an SSL root CA on customers' devices -- they can't track SSL traffic without it.

croon 10y ago
They know where you connect to. That's still plenty of information.

Brendinooo 10y ago

I am a strong advocate for privacy, please understand that before you continue reading this. I don't want ISPs to sell my browsing history, and I am continually disappointed in the Republican opposition to net neutrality and online privacy. I'm even working on an open source project involving cryptography and secret protection, so I have skin in the game. However, this headline is patently false, right? Congress didn't sell anything. They removed protections that were put into place late last year and hadn't gone into effect as far as I know. Just because companies are legally capable of selling your browsing data doesn't mean that they absolutely will. As far as I know, my browsing history hasn't been sold by my ISP yet, and the regulations that were rolled back were not the reason why this is true. Maybe I'm just posting because I like being a contrarian, but I do expect a more sober-minded commentary on this site than I've been getting on some recent news items. If you're interested in the FCC's response, here is a primary source[0]. I don't buy most of it - I know that this is a lot of spin doctoring, particularly that second paragraph. But it provides insight to how the FCC is viewing this, something I haven't seen a lot of in this coverage. Here[1] is some coverage from 2015 on the FCC/FTC issue that the third paragraph in that presser talks about. Also worth noting is this HN thread[2] from two years ago, where the top comment is a thoughtful critique of putting the hopes of an open Internet in the hands of a bureaucracy. People didn't agree, but that's the sort of commentary that keeps me coming back to Hacker News. [0]: http://transition.fcc.gov/Daily_Releases/Daily_Business/2017/db0328/DOC-344116A1.pdf http://transition.fcc.gov/Daily_Releases/Daily_Business/2017... [1]: https://iapp.org/news/a/ftc-officials-concerned-about-jurisdiction-after-fcc-net-neutrality-order/ https://iapp.org/news/a/ftc-officials-concerned-about-jurisd... [2]: https://news.ycombinator.com/item?id=9191007 https://news.ycombinator.com/item?id=9191007

lilbobbytables 10y ago
Don't have a moment to read your sources at the moment. But weren't the protections only put into place last year because they weren't needed until then? In other words, they were under the jurisdiction of the FTC previously, so this particular legislation a moot point, because the FTC could just say "hey, you can't do that. case closed." Now because of the "common carrier exemption" I don't think that would hold up. This was useful in some quick tidbits about FTC + FCC relationship, previous responsibilities, and current. https://www.ftc.gov/system/files/documents/public_statements/893473/151204plispeech1.pdf https://www.ftc.gov/system/files/documents/public_statements... Funny enough, they talk about how the FCC handles data/privacy breaches, and how they came down really hard on a minor breach that affected a few cox subscribers, nothing with payment data or even any actual damages. This seemingly means that the FTC takes privacy seriously. But congress won't let them.

dfar1 10y ago

What is the name of the bill? And where can I read it? Thanks.

tzs 10y ago
Here: https://www.congress.gov/bill/115th-congress/senate-joint-resolution/34/text https://www.congress.gov/bill/115th-congress/senate-joint-re... Here's the full text: > Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Federal Communications Commission relating to “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services”. > Resolved by the Senate and House of Representatives of the United States of America in Congress assembled, That Congress disapproves the rule submitted by the Federal Communications Commission relating to “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services” (81 Fed. Reg. 87274 (December 2, 2016)), and such rule shall have no force or effect.
programmarchy 10y ago
S.J.Res. 34: A joint resolution providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Federal Communications Commission relating to “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services”. https://www.govtrack.us/congress/bills/115/sjres34 https://www.govtrack.us/congress/bills/115/sjres34

peregrine 10y ago

The Hacker News mods should comment why this post has been 'bumped' from the top spot and why it's title is no longer the original title of the article. From the https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html: > Otherwise please use the original title, unless it is misleading or linkbait. The title is the original, it wasn't misleading and it isn't 'linkbait'. Its the premise of the article and it's the truth. dang please help me out here.

Brendinooo 10y ago
The headline isn't true. Congress voted to remove regulations, they didn't complete a financial transaction with ISPs.
- peregrine 10y ago
  Because none of them received donations or were lobbied?
  - snowpanda 10y ago
    You're reaching..
    - peregrine 10y ago
      I did one google search and found https://www.theverge.com/2017/3/29/15100620/congress-fcc-isp-web-browsing-privacy-fire-sale https://www.theverge.com/2017/3/29/15100620/congress-fcc-isp... and is fully sourced by generally reputable data. I'd be just as pissed if Democrats sold us down the river, which I am about Obamacare several years ago.
- state_less 10y ago
  s/regulations/privacy/
sctb 10y ago
A moderator replaced the original title (which was absolutely as linkbait as they come) with a representative phrase from the article. This topic has been discussed extensively already, so this article received many user flags as well as the standard penalty for follow-on posts. Related discussions: https://news.ycombinator.com/item?id=13942345 https://news.ycombinator.com/item?id=13942345 https://news.ycombinator.com/item?id=13981184 https://news.ycombinator.com/item?id=13981184 https://news.ycombinator.com/item?id=13951347 https://news.ycombinator.com/item?id=13951347 https://news.ycombinator.com/item?id=13967955 https://news.ycombinator.com/item?id=13967955 https://news.ycombinator.com/item?id=13983235 https://news.ycombinator.com/item?id=13983235 https://news.ycombinator.com/item?id=13973727 https://news.ycombinator.com/item?id=13973727

bubblethink 10y ago

Why was the title of this post changed retroactively on HN ? The article is an op-ed with the title "How the Republicans Sold Your Privacy to Internet Providers".

xori 10y ago

I'm curious, does this mean that an ISP can sell non-anonymized data collected between last October and now?

valine 10y ago

What I want is a way to tie my own VPN to something like my Apple id and have it auto configured anytime I move to a different device. Right maintaining VPN clients on a range of devices is a pretty big hassle. I'm not saying I want Apple to run vpn services, I just want an easy way to manage vpn configurations on personal devices.

lloyd-christmas 10y ago
https://betterspot.com/ https://betterspot.com/ was a Kickstarter project I funded. They haven't shipped yet, but look to be this month.

singularity2001 10y ago

This can't be repeated often enough: If you have some ssh server somewhere (who hasn't), you can very easily create a 'VPN over ssh' by calling: sshuttle -r user@remote_host 0.0.0.0/0 --dns

JohnLeTigre 10y ago

Great, now everyone will use Tor and torrent over I2P. I wonder if these technologies can handle the extra bandwidth.

Thrymr 10y ago

I am curious whether any companies are concerned about this for employees who work from home. Can ISPs resell business espionage to the highest bidder? Not all employers are savvy enough to provide and require VPNs.

dsr_ 10y ago

If engineers would refuse to implement privacy invasions, they wouldn't happen. Do you work for Comcast, Verizon, AT&T, Time-Warner, CenturyLink, Charter, Cox, Frontier? Don't implement these things. Don't do deep packet inspection, don't log things that shouldn't be logged, don't put in MITM proxies and don't insert cookies in traffic that your customers expected to have unmolested. Explain your decision, and explain it to your coworkers. Some of you will lose your jobs. I'm sorry. However, you're in high demand. And maybe you can make a difference.

Chaebixi 10y ago
> If engineers would refuse to implement privacy invasions, they wouldn't happen. That'll never work, as long as it's just a personal ethical thing. There's always someone who would rather take the money. Now, if there was a professional organization or union with some teeth, which could enforce some kind of ethical code, then maybe "engineers" could do something about stuff like this. I'm not sure how it would work in detail, but it might involve pickets/walkouts of entire organizations engaged in unethical projects or expelling members who work on them in a way that negatively affects their future job prospects.
- voidlogic 10y ago
  >That'll never work, as long as it's just a personal ethical thing. There's always someone who would rather take the money. So true >Now, if there was a professional organization or union with some teeth, which could enforce some kind of ethical code, then maybe "engineers" could do something about stuff like this. That won't work either. A few years ago most of the "programmers/developers/computer scientists" I worked with (we weren't pretending to be engineers yet), all had C-S degrees (either C-S undergrad or math/physics undergrad with C-S masters+). And by and large these people were usually members of the ACM or IEEE. Now with the rise of the "self tough (software) engineer", these professional organizations are weaker than ever before. My cube make is not only likely to be a boot camp graduate, they are likely to not know what the ACM is, never mind any ethical standards its has and of course have no concern for being kicked out. Now I am not saying all this is good or bad, democratization of technology has pros and cons. But its a shift that makes depending on professional orgs more worthless than ever before. (some of this is also coast vs inland US, the west coast as always had more self-tough vs academia tought programmers).

erdojo 10y ago

Might be an ignorant question, but could individual websites do more to prevent an ISP from seeing your activity on the site? I know HTTPS should be able to help (?), but ISPs can still see the domain you're visiting and get metadata on the encrypted traffic, which can be revealing. Are there architectural or tech stack decisions a company could make that would basically lock an ISP from knowing anything except the root domains you visited?

davidgerard 10y ago

Fake title. Actual title: "How the Republicans Sold Your Privacy to Internet Providers"