4 ms·

I'm confused about what data the ISPs actually have access to. It seems over 90% of my online activity is now https. That means they have access to very littl

I'm confused about what data the ISPs actually have access to. It seems over 90% of my online activity is now https. That means they have access to very little that can be useful to an advertiser. (I suppose they have my DNS lookups, but it's trivial to change DNS to a company you trust.) It's interesting how universally hated ISPs are. Google and Facebook, from a technical standpoint, are much scarier in what they know about everyone on the internet. Yet few people seem to care that they use our browsing and search data to target us to advertisers.

advisedwang 10y ago
Thanks to SNI the hostname you are connecting to is usually visible to a snoop.
openasocket 10y ago
> I suppose they have my DNS lookups, but it's trivial to change DNS to a company you trust That won't solve it, there's still what's called "passive DNS". With passive DNS someone between you and the internet (in this case your ISP) simply tags and stores all DNS packets it sees before forwarding them to wherever they're supposed to go. From that they can determine which domains you are resolving even if you aren't using their resolver. They can also block DNS requests, and even send you their own responses. That last part doesn't matter as much as you'd think: they can't just redirect you to an Ad server because they wouldn't be able to authenticate the SSL connection. I should also add that this DNS snooping has legitimate and ethical uses. A big reason to do this is to deal with malware. Often malware uses certain domain names as their command and control server. If this malware has spread far and wide and could affect a lot of your customers, you can black hole the domain name so that, if you have the malware and it tries to resolve mycommandandcontrolserver.biz, the ISP intercepts the request and send back an NXDOMAIN, or have it resolve to 0.0.0.0, or resolve it to a particular server that simply closes every connection it gets so you can figure out which customers are affected and contact them. They can also get the hostname for https connections the initial SSL connection sends the hostname in plaintext (called SNI). But getting that requires reconstructing the TCP stream for connections in real time, and that's just not very practical at ISP scale.
jp_rider 10y ago
Even with https it's a lot. Saw this post the [other day](https://www.reddit.com/r/WarOnComcast/comments/65547r/as_if_there_wasnt_enough_reasons_to_hate_comcast/ https://www.reddit.com/r/WarOnComcast/comments/65547r/as_if_...), but I can't find a cached version.

advisedwang 10y ago

Thanks to SNI the hostname you are connecting to is usually visible to a snoop.

openasocket 10y ago

> I suppose they have my DNS lookups, but it's trivial to change DNS to a company you trust That won't solve it, there's still what's called "passive DNS". With passive DNS someone between you and the internet (in this case your ISP) simply tags and stores all DNS packets it sees before forwarding them to wherever they're supposed to go. From that they can determine which domains you are resolving even if you aren't using their resolver. They can also block DNS requests, and even send you their own responses. That last part doesn't matter as much as you'd think: they can't just redirect you to an Ad server because they wouldn't be able to authenticate the SSL connection. I should also add that this DNS snooping has legitimate and ethical uses. A big reason to do this is to deal with malware. Often malware uses certain domain names as their command and control server. If this malware has spread far and wide and could affect a lot of your customers, you can black hole the domain name so that, if you have the malware and it tries to resolve mycommandandcontrolserver.biz, the ISP intercepts the request and send back an NXDOMAIN, or have it resolve to 0.0.0.0, or resolve it to a particular server that simply closes every connection it gets so you can figure out which customers are affected and contact them. They can also get the hostname for https connections the initial SSL connection sends the hostname in plaintext (called SNI). But getting that requires reconstructing the TCP stream for connections in real time, and that's just not very practical at ISP scale.

jp_rider 10y ago

Even with https it's a lot. Saw this post the [other day](https://www.reddit.com/r/WarOnComcast/comments/65547r/as_if_there_wasnt_enough_reasons_to_hate_comcast/ https://www.reddit.com/r/WarOnComcast/comments/65547r/as_if_...), but I can't find a cached version.