5 ms·

As shocking as this sounds, virtually nothing has changed about the privacy of the average American’s connection to the Internet as a result of this action by C

by a_imho 10y ago

As shocking as this sounds, virtually nothing has changed about the privacy of the average American’s connection to the Internet as a result of this action by Congress, except perhaps a greater awareness that ISP customers don’t really have many privacy protections by default.

mirimir 10y ago
Whether anything changed substantially is arguable. But there's no doubt that ISP customers are sitting ducks. VPNs took off after Snowden leaked. And they're taking off again now. So sure, maybe nothing changed. But as you say, it's a wakeup call.
- a_imho 10y ago
  It is the article saying before going into discussing VPNs fwiw. I'm not sure about having a definite opinion on this, for now I feel this is blown out of proportion a bit and there are plenty of other privacy invasions that should be discussed instead (though I have to admit my biased view is from a non American pov)
  - mirimir 10y ago
    > there are plenty of other privacy invasions that should be discussed instead I agree with all but the last word. There are other issues to consider, for sure. But not instead of uplink security.
- devoply 10y ago
  If you use mostly SSL services is not all that you are leaking to your ISP is the domain name/ip of the site you are visiting? You are leaking the same thing to Google if you use their DNS server, and they are free to do with that info whatever they like... or any other DNS provider for that matter.
  - zaroth 10y ago
    An interesting example of this is the alleged Trump tower server communicating secretly with Russia was all based on DNS logs. Where did these logs come from and how/why were they shared...? [1] - https://news.ycombinator.com/item?id=12841288 https://news.ycombinator.com/item?id=12841288
  - no_wizard 10y ago
    This is true. There are lots of reasons not to use google's DNS servers. I will say though, assuming these things to be absolutely true, they really don't log anything that any DNS server would log, save random lifetime request record spot checks perhaps. According to their privacy policy: "Google Public DNS stores two sets of logs: temporary and permanent. The temporary logs store the full IP address of the machine you're using. We have to do this so that we can spot potentially bad things like DDoS attacks and so we can fix problems, such as particular domains not showing up for specific users. We delete these temporary logs within 24 to 48 hours. In the permanent logs, we don't keep personally identifiable information or IP information. We do keep some location information (at the city/metro level) so that we can conduct debugging, analyze abuse phenomena. After keeping this data for two weeks, we randomly sample a small subset for permanent storage. We don't correlate or combine information" They also state they gather this information as well: "- Request domain name, e.g. www.google.com - Request type, e.g. A (which stands for IPv4 record), AAAA (IPv6 record), NS, MX, TXT, etc. - Transport protocol on which the request arrived, i.e. TCP, UDP, or HTTPS - Client's AS (autonomous system or ISP), e.g. AS15169 - User's geolocation information: i.e. geocode, region ID, city ID, and metro code - Response code sent, e.g. SUCCESS, SERVFAIL, NXDOMAIN, etc. - Whether the request hit our frontend cache - Whether the request hit a cache elsewhere in the system (but not in the frontend) - Absolute arrival time in seconds - Total time taken to process the request end-to-end, in seconds - Name of the Google machine that processed this request, e.g. machine101 - Google target IP to which this request was addressed, e.g. one of our anycast IP addresses (no relation to the user's IP)" [Google DNS Privacy Policy](https://developers.google.com/speed/public-dns/privacy?csw=1 https://developers.google.com/speed/public-dns/privacy?csw=1) I think, if you care about having this independently verified (i couldn't find anything myself, yet) you shouldn't use them though. Its impossible to say if thats really all they are gathering. I've seen no evidence either way thats concrete. I will note though, that if they are, and of course right now its a big if just collecting the information above (which I imagine most DNS servers people use do anyway) as long as you are using their DNS API you could achieve higher level privacy with your DNS traffic. From the Regional Internet Registry "If applications made use of services that would push local DNS query traffic into encrypted TLS sessions, such as the service being offered by Google, the result would be that much of today’s visible DNS would disappear from view. Not only that, but it would make the existing practices of selective local inspection and intervention in the DNS resolution process far more challenging, if not infeasible. It may be even better if authoritative name servers were to also support queries over TLS and DTLS allowing a local host to take over the resolution function and still use encrypted query traffic services" [Source](https://labs.ripe.net/Members/gih/dns-privacy https://labs.ripe.net/Members/gih/dns-privacy) They too note, however, privacy hasn't been independently validated on this front either. I would say if you care at all about privacy, not to use it, simply because its implications haven't been verified by a neutral 3rd party. At least, as far as I can tell. Personally, I recommend using your own DNS server (I recommend the fantastic [Unbound](https://www.unbound.net/ https://www.unbound.net/), and if you want to go 'full stack' you can pair it with [NSD](https://www.nlnetlabs.nl/projects/nsd/ https://www.nlnetlabs.nl/projects/nsd/) ). and [DNS-crypt](https://dnscrypt.org/ https://dnscrypt.org/). That will give you more flexibility, potentially most consistent performance, and certainly better privacy, in my opinion.
- e12e 10y ago
  Think how much fun it is running the intelligence-agency run VPN front companies now! You get paid to log the traffic of users worried about their privacy!
  - fencepost 10y ago
    There's a big difference between being surveilled by a state actor and being surveilled for marketing and advertising profiles, not least being the kind of steps you'd need to take to counter that surveillance.
  - mirimir 10y ago
    So which VPNs do you think are run by TLAs? Can you cite any actual evidence? I know one: Anonymizer. It's a CIA operation. But arguably the target was Chinese users, not American revolutionaries. We know that HideMyAss complied with a UK court order, triggered by an FBI request. But we also know that PIA, which is US based, told a US court that they don't retain logs. Still, it is a reasonable concern. But you can distribute trust, rather like Tor does, by routing traffic through a nested chain of VPNs.
    - e12e 10y ago
      I would think that intelligence services not doing such an obvious thing would be considered negligent. Just like they would sponsor and run email mixmaster remailers in the 90s and run tor exit nodes today.
      - mirimir 10y ago
        Sure. But for Chinese dissidents, trusting an NSA-run VPN would arguably be preferable to trusting a Chinese ISP.
        e12e 10y ago
        Is life really better when you're blackmailed into being a CIA asset than when you're jailed by Chinese authorities?
JustSomeNobody 10y ago
Of course things have not changed. All the negative media needs to play out, then a period of time needs to pass so people forget, then you'll see the changes.
mattnewton 10y ago
The next implication, that my ISP should be competing with google and facebook, and that it would somehow level the playing field is at it's face ridiculous. I suppose the postal service should want to read our mail and the same isp's should need to listen to our phone calls; after all, it's only fair if Google or Facebook get to see the information we send to them. We either need to somehow incentivize more ISPs so the free market can fix these problems, or just regulate the hell out of them as a public good. Pretending they aren't a monopoly and don't need regulation because they exist in the free market today is incredibly anti-consumer.
- rayiner 10y ago
  If we're using market power as a justification for regulating privacy policies (which I think is perfectly reasonable), it makes no sense to draw a magic line with ISPs. With ISPs, we're basically talking about de facto as opposed to de jure monopolies (which distinguishes them from the Post Office, which retains certain monopoly protections in law). But lots of companies have tremendous de facto market power. Nearly the whole market is encompassed by just two desktop operating systems, two mobile operating systems, two search engines, and one social media platform. Sure, I could use Google+ and convince all my aunts and uncles in Bangladesh to use that so I can share photos of my daughter with them, but I could also subscribe to any of a number of satellite or DSL providers for broadband. If we are talking about viable, interchangeable alternatives, the reality is that there is very little choice in any of these markets. High barriers to entry limit those choices in broadband, and networking effects limit those choices in the area of search engines, social networking, etc. If market power is the justification for regulation, it makes no sense to not regulate any entity that has sufficient market power to implicate privacy concerns. Or, how about we just make it illegal to use private information for marketing purposes? Wouldn't that be simplest? Why do we need to engage in all this hair splitting?
  - mattnewton 10y ago
    There is a precedent in regulating these isps, regarding the phone lines. There is also greater public interest - the public helped many of the isp's lay those lines. Regarding monopolies de jur, while it is technically different in practice many isps are legally the only incumbents because you cannot dig to lay more lines, and the municipalities have signed agreements to that effect barring anyone, including themselves, from offering replacement. I think it's completely disengenious to compare Facebook to my isp. I use Facebook rarely and it alone makes up a tiny portion of my digital life, with no access to to my search history, emails, bank portal, video watching history, etc. The market power there is of a different kind alone, and there is enormous friction to switching an isp. People have no problem sending photos over Snapchat these days and completely bypassing Facebook. People have no viable alternative to their isp. This is all to say, I'm not against more privacy regulations for Google and Facebook. But it doesn't factor in when comparing it to an ISP for me: they should not be called competitors, because it would not at all be a competition for data. The ISP just has all of it. This is not some slippery slope to socalizing everything with market power. This is fixing a clearly and presently broken system.

by a_imho 10y ago

mirimir 10y ago

Whether anything changed substantially is arguable. But there's no doubt that ISP customers are sitting ducks. VPNs took off after Snowden leaked. And they're taking off again now. So sure, maybe nothing changed. But as you say, it's a wakeup call.

a_imho 10y ago
It is the article saying before going into discussing VPNs fwiw. I'm not sure about having a definite opinion on this, for now I feel this is blown out of proportion a bit and there are plenty of other privacy invasions that should be discussed instead (though I have to admit my biased view is from a non American pov)
- mirimir 10y ago
  > there are plenty of other privacy invasions that should be discussed instead I agree with all but the last word. There are other issues to consider, for sure. But not instead of uplink security.
devoply 10y ago
If you use mostly SSL services is not all that you are leaking to your ISP is the domain name/ip of the site you are visiting? You are leaking the same thing to Google if you use their DNS server, and they are free to do with that info whatever they like... or any other DNS provider for that matter.
- zaroth 10y ago
  An interesting example of this is the alleged Trump tower server communicating secretly with Russia was all based on DNS logs. Where did these logs come from and how/why were they shared...? [1] - https://news.ycombinator.com/item?id=12841288 https://news.ycombinator.com/item?id=12841288
- no_wizard 10y ago
  This is true. There are lots of reasons not to use google's DNS servers. I will say though, assuming these things to be absolutely true, they really don't log anything that any DNS server would log, save random lifetime request record spot checks perhaps. According to their privacy policy: "Google Public DNS stores two sets of logs: temporary and permanent. The temporary logs store the full IP address of the machine you're using. We have to do this so that we can spot potentially bad things like DDoS attacks and so we can fix problems, such as particular domains not showing up for specific users. We delete these temporary logs within 24 to 48 hours. In the permanent logs, we don't keep personally identifiable information or IP information. We do keep some location information (at the city/metro level) so that we can conduct debugging, analyze abuse phenomena. After keeping this data for two weeks, we randomly sample a small subset for permanent storage. We don't correlate or combine information" They also state they gather this information as well: "- Request domain name, e.g. www.google.com - Request type, e.g. A (which stands for IPv4 record), AAAA (IPv6 record), NS, MX, TXT, etc. - Transport protocol on which the request arrived, i.e. TCP, UDP, or HTTPS - Client's AS (autonomous system or ISP), e.g. AS15169 - User's geolocation information: i.e. geocode, region ID, city ID, and metro code - Response code sent, e.g. SUCCESS, SERVFAIL, NXDOMAIN, etc. - Whether the request hit our frontend cache - Whether the request hit a cache elsewhere in the system (but not in the frontend) - Absolute arrival time in seconds - Total time taken to process the request end-to-end, in seconds - Name of the Google machine that processed this request, e.g. machine101 - Google target IP to which this request was addressed, e.g. one of our anycast IP addresses (no relation to the user's IP)" [Google DNS Privacy Policy](https://developers.google.com/speed/public-dns/privacy?csw=1 https://developers.google.com/speed/public-dns/privacy?csw=1) I think, if you care about having this independently verified (i couldn't find anything myself, yet) you shouldn't use them though. Its impossible to say if thats really all they are gathering. I've seen no evidence either way thats concrete. I will note though, that if they are, and of course right now its a big if just collecting the information above (which I imagine most DNS servers people use do anyway) as long as you are using their DNS API you could achieve higher level privacy with your DNS traffic. From the Regional Internet Registry "If applications made use of services that would push local DNS query traffic into encrypted TLS sessions, such as the service being offered by Google, the result would be that much of today’s visible DNS would disappear from view. Not only that, but it would make the existing practices of selective local inspection and intervention in the DNS resolution process far more challenging, if not infeasible. It may be even better if authoritative name servers were to also support queries over TLS and DTLS allowing a local host to take over the resolution function and still use encrypted query traffic services" [Source](https://labs.ripe.net/Members/gih/dns-privacy https://labs.ripe.net/Members/gih/dns-privacy) They too note, however, privacy hasn't been independently validated on this front either. I would say if you care at all about privacy, not to use it, simply because its implications haven't been verified by a neutral 3rd party. At least, as far as I can tell. Personally, I recommend using your own DNS server (I recommend the fantastic [Unbound](https://www.unbound.net/ https://www.unbound.net/), and if you want to go 'full stack' you can pair it with [NSD](https://www.nlnetlabs.nl/projects/nsd/ https://www.nlnetlabs.nl/projects/nsd/) ). and [DNS-crypt](https://dnscrypt.org/ https://dnscrypt.org/). That will give you more flexibility, potentially most consistent performance, and certainly better privacy, in my opinion.
e12e 10y ago
Think how much fun it is running the intelligence-agency run VPN front companies now! You get paid to log the traffic of users worried about their privacy!
- fencepost 10y ago
  There's a big difference between being surveilled by a state actor and being surveilled for marketing and advertising profiles, not least being the kind of steps you'd need to take to counter that surveillance.
- mirimir 10y ago
  So which VPNs do you think are run by TLAs? Can you cite any actual evidence? I know one: Anonymizer. It's a CIA operation. But arguably the target was Chinese users, not American revolutionaries. We know that HideMyAss complied with a UK court order, triggered by an FBI request. But we also know that PIA, which is US based, told a US court that they don't retain logs. Still, it is a reasonable concern. But you can distribute trust, rather like Tor does, by routing traffic through a nested chain of VPNs.
  - e12e 10y ago
    I would think that intelligence services not doing such an obvious thing would be considered negligent. Just like they would sponsor and run email mixmaster remailers in the 90s and run tor exit nodes today.
    - mirimir 10y ago
      Sure. But for Chinese dissidents, trusting an NSA-run VPN would arguably be preferable to trusting a Chinese ISP.
      - e12e 10y ago
        Is life really better when you're blackmailed into being a CIA asset than when you're jailed by Chinese authorities?

JustSomeNobody 10y ago

Of course things have not changed. All the negative media needs to play out, then a period of time needs to pass so people forget, then you'll see the changes.

mattnewton 10y ago

The next implication, that my ISP should be competing with google and facebook, and that it would somehow level the playing field is at it's face ridiculous. I suppose the postal service should want to read our mail and the same isp's should need to listen to our phone calls; after all, it's only fair if Google or Facebook get to see the information we send to them. We either need to somehow incentivize more ISPs so the free market can fix these problems, or just regulate the hell out of them as a public good. Pretending they aren't a monopoly and don't need regulation because they exist in the free market today is incredibly anti-consumer.

rayiner 10y ago
If we're using market power as a justification for regulating privacy policies (which I think is perfectly reasonable), it makes no sense to draw a magic line with ISPs. With ISPs, we're basically talking about de facto as opposed to de jure monopolies (which distinguishes them from the Post Office, which retains certain monopoly protections in law). But lots of companies have tremendous de facto market power. Nearly the whole market is encompassed by just two desktop operating systems, two mobile operating systems, two search engines, and one social media platform. Sure, I could use Google+ and convince all my aunts and uncles in Bangladesh to use that so I can share photos of my daughter with them, but I could also subscribe to any of a number of satellite or DSL providers for broadband. If we are talking about viable, interchangeable alternatives, the reality is that there is very little choice in any of these markets. High barriers to entry limit those choices in broadband, and networking effects limit those choices in the area of search engines, social networking, etc. If market power is the justification for regulation, it makes no sense to not regulate any entity that has sufficient market power to implicate privacy concerns. Or, how about we just make it illegal to use private information for marketing purposes? Wouldn't that be simplest? Why do we need to engage in all this hair splitting?
- mattnewton 10y ago
  There is a precedent in regulating these isps, regarding the phone lines. There is also greater public interest - the public helped many of the isp's lay those lines. Regarding monopolies de jur, while it is technically different in practice many isps are legally the only incumbents because you cannot dig to lay more lines, and the municipalities have signed agreements to that effect barring anyone, including themselves, from offering replacement. I think it's completely disengenious to compare Facebook to my isp. I use Facebook rarely and it alone makes up a tiny portion of my digital life, with no access to to my search history, emails, bank portal, video watching history, etc. The market power there is of a different kind alone, and there is enormous friction to switching an isp. People have no problem sending photos over Snapchat these days and completely bypassing Facebook. People have no viable alternative to their isp. This is all to say, I'm not against more privacy regulations for Google and Facebook. But it doesn't factor in when comparing it to an ISP for me: they should not be called competitors, because it would not at all be a competition for data. The ISP just has all of it. This is not some slippery slope to socalizing everything with market power. This is fixing a clearly and presently broken system.