8 ms·

I'm not American, so please correct me if I'm wrong but I have yet to see any proof of this whole 'sell your internet history' complaint that seems to be blaten

• curt15 10y ago
  >I also don't know how an ISP would get your actual internet history if the website uses HTTPS. Charge users extra fees for "premium service" unless they agree to let the ISP their traffic.
  • manigandham 10y ago
    How does that change how HTTPS works?
    • sqeaky 10y ago
      It doesn't, but the ISP still know what pages you went to. If they want to determine your political leanings your browsing history is enough.
      • manigandham 10y ago
        How would the ISP know what pages you went to over HTTPS? Only the domain name would be available, through SNI/DNS.
        • rocqua 10y ago
          They could just MITM all connections and say 'for compatibility reasons, please install this root certificate'. With a fee, this requirement could then be waived. Dystopian but technically possible.
          • narrowrail 10y ago
            This type of hypothetical drives me batty, and I was tempted to be snarky. I'm not sure how to respond to the idea that there will ever be a time your ISP requires root cert installation for service, but I will be finding a way to launch a WISP of my own at that point.
            • rocqua 10y ago
              My original was already snark. Though I don't think its impossible that a small amount of non-technical people might actually be convinced to do this.
            • pdkl95 10y ago
              It's only slightly hypothetical. http://www.csoonline.com/article/2865806/cloud-security/gogo-inflight-internet-serves-up-man-in-the-middle-with-fake-ssl.html http://www.csoonline.com/article/2865806/cloud-security/gogo... Gogo didn't require installing a root cert, but they DID issue forged certificates to MitM connections to *.google.com (and others). Also, remember "Superfish"? Their root cert was pre-installed by Lenovo.
        • ufo 10y ago
          Just the domain names is already a lot of information...
• tps5 10y ago
  > I also don't know how an ISP would get your actual internet history if the website uses HTTPS. Your ISP can (and likely does) monitor your DNS queries, which (as far as I know) are not encrypted. Personally I think the net neutrality stuff is a tad overblown. I'd vote for maintaining it, but I've never been particularly convinced by the whole "surveillance state/beyond-orwellian/ISP censoring your speech" arguments that get thrown around on HN, among other places. I think the problems with ISPs are more practical: they overcharge, provide shitty service, have no incentive to upgrade their infrastructure, and clearly collude with one another. Therefore they need to be regulated.
  • bhauer 10y ago
    > I think the problems with ISPs are more practical: they overcharge, provide shitty service, have no incentive to upgrade their infrastructure, and clearly collude with one another. Therefore they need to be regulated. Agreed. Though I would prefer that we do whatever we can to identify and implement mechanisms to increase competition. I want new ISP options, and several of them, rather than just marginally better behavior from the one or two ISPs I have in my neighborhood. I'd prefer regulation that increases competition (even if that hurts the incumbents) rather than regulation that assumes the incumbents are fixed and therefore just manages how they conduct their business. The prior is designed to create new ISP options, the latter tends to serve to decrease the incidence rate of new options. I've always been a voracious Internet consumer. For all of its faults, I really enjoyed the regulatory framework of the Communications Act of 1996 that allowed competitive ISPs to lease physical wires.
    • inyorgroove 10y ago
      How about forcing ISPs to lease the last mile to help bolster competition, they did something similar in the UK [1]. Not quite sure how that worked out for them. [1] https://en.wikipedia.org/wiki/Local-loop_unbundling#United_Kingdom https://en.wikipedia.org/wiki/Local-loop_unbundling#United_K...
      • disgruntledphd2 10y ago
• sinap 10y ago
  >I also don't know how an ISP would get your actual internet history if the website uses HTTPS. The ISP could monitor your DNS requests or the SNI[1] in the TLS handshake. 1. https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
• ckozlowski 10y ago
  It's a fair question to ask! I wrote my representative on this issue actually. I'll let you read for yourself: "On October 27, 2016, the Federal Communications Commission (FCC) issued a proposed rule that seeks to expand its regulatory jurisdiction, create a two-tiered privacy regime for different types of Internet companies, and impose data restrictions on Internet service providers. These types of regulations have traditionally been under the jurisdiction of the Federal Trade Commission (FTC), which already has in place a regulatory regime to protect consumers. Full implementation of this proposed rule would have, among other things, given consumers a false sense of protection and privacy. As a bipartisan group of representatives stated in a 2016 letter to the FCC in response to its notice of proposed rulemaking: -We had hoped the FCC would focus on those protections that have traditionally guarded consumers from unfair or deceptive data practices by ISPs and the other companies in the Internet services market. But, based on the [FCC’s] Notice of Proposed Rulemaking, we remain increasingly concerned that the Commission intends to go well beyond such a framework and ill-serve consumers who seek and expect consistency in how their personal data is protected. If different rules apply to the online practices of only selected entities, consumers may wrongly assume that the new rules apply to all of their activities in the Internet. But when they discover otherwise, the inconsistent treatment of consumer data could actually undermine consumers’ confidence in their use of the Internet due to uncertainty regarding the protections that apply to their online activities.- In response to these actions, the House and Senate introduced legislation in March to disapprove of this proposed FCC rule. The House version of this legislation, H.J.Res.86, was introduced by Rep. Marsha Blackburn (R – TN) on March 8, 2017. The measure seeks to block the proposed FCC rule. On March 28, 2017, the House passed the Senate version, S.J.Res.34, with my support, and the measure now heads to the president’s desk for signature. Again, it must be noted that recent actions in Congress have not changed the status quo in terms of privacy-protection standards for consumers." That's what they attest. And the Washington Post had a good editorial (which I'm currently at pains to find) explaining how, under Commissioner Wheeler, the FCC pushed for broadband privacy rules, but ran roughshod over the FTC in the process. While it was a win in the sense that a legal gap was closed (more on that in a minute), it wasn't good in that it weakened the definitions between the FTC and FCC, which bother have governance roles to play. While it might sound like needless bureaucracy, firm and clear rules are the underpinnings of strong court rulings, which are essential to good governance. Except, now that gap still exists. While it's claimed that the FTC will now fill in the gap, the problem is that it couldn't effectively in the first place. WP explains: "Can't the FTC go after Internet providers with its rules? At the moment, not really. The reason has to do with the FCC's rules on net neutrality. When the FCC passed those rules, it branded all Internet providers as “common carriers,” essentially a fancy legal term to describe traditional phone companies. The problem is that the FTC is bound by something called the “common carrier exemption.” The agency isn't allowed to take action against companies that have been labeled common carriers by the FCC. (The idea behind the exemption is to prevent both agencies from going after the same companies twice for the same infraction.) So if the House vote succeeds and Trump signs the measure, that releases Internet providers from the FCC's privacy regulation but does not do anything to apply the FTC's own privacy guidelines to the industry. The FCC can still sue companies after they have allegedly violated consumer privacy, industry groups say. So can state attorneys general. But the FCC will be unable to write regulations that preemptively bar privacy violations, meaning that Internet providers will be subject to less oversight as a result of the congressional measure." (From: https://www.washingtonpost.com/news/the-switch/wp/2017/03/28/republicans-are-poised-to-roll-back-landmark-fcc-privacy-rules-heres-what-you-need-to-know/ https://www.washingtonpost.com/news/the-switch/wp/2017/03/28...) So, with regards to selling data. Is it anonymized? Probably. To an extent. People get assigned an advertising ID, which is a random number in place of your legal name, and your profile is built under that. But you and I both know that it's not really anonymous, and it's trivial to then do a correlation between your, say, name and address, and then your advertising ID and address, and suddenly you have a full profile on someone. That's an issue when other businesses and services begin to take advantage of your health, interests, associations, etc, to charge you more or deny service based on these indicators. ISPs feel they've been at a disadvantage compared to online services like Facebook. Remember, that they do not want to be "just a bit provider". There's a very powerful profit factor if they can use their lock-in to be your content provider as well. Anyways, hope that helps!
• bmelton 10y ago
  The common response to this is that ISPs have access to everything you do (which is true), and that they could sell that (which is false). The regulations being overturned here are ones that have only recently taken effect, and non-anonymized, non-aggregate selling of ISP data is still outlawed by the Cable Communications Act of 1984, which protects subscriber privacy is 47USC § 551[1]. Put simply, neither the most recent executive order, nor a reversal on Net Neutrality overturns that law on the federal register. Of course, if Congress were to draft a bill that does so, the current fears would be well justified. https://www.law.cornell.edu/uscode/text/47/551 https://www.law.cornell.edu/uscode/text/47/551
  • Rebelgecko 10y ago
    Legally, is there a minimum requirement for what it takes for data to be considered "anonymized"? Just because the customers' billing info isn't included doesn't mean you can't figure out who is responsible for traffic.
    • bmelton 10y ago
      There might be multiple options that the federal government would respect: * https://www.gpo.gov/fdsys/pkg/USCODE-2010-title5/html/USCODE-2010-title5-partI-chap5-subchapII-sec552a.htm https://www.gpo.gov/fdsys/pkg/USCODE-2010-title5/html/USCODE... * http://ws680.nist.gov/publication/get_pdf.cfm?pub_id=904990 http://ws680.nist.gov/publication/get_pdf.cfm?pub_id=904990 Legally, I can't think of a case where it's been tested that didn't lean the government's way, so who knows?
  • guelo 10y ago
    So you're saying this most recent regulation does absolutely nothing, even though it was the highest priority for the incoming industry friendly regulator. Seems doubtful that some 1984 law is going to protect our browsing data.
    • bmelton 10y ago
      I'm not saying it does nothing. I'm saying it doesn't do what people think it does. Repealing the Obama rule does mean that you can't opt out of data collection or sale. It does not mean that your individual browsing records are available to anyone with enough cash. Moreover, much of the rules Trump's executive order overturn had either very recently taken effect, or not yet taken effect. There may be much theoretical damage from overturning the regulations, but the practical effect here will be minimal, and limited because of the other laws that already exist to prevent exactly the doomsday scenario many are predicting. I'm not saying that Trump isn't after your privacy rights, but the surest test of that will be whether or not he goes after or seeks to circumvent the 1984 protections I referenced earlier.
• m_sahaf 10y ago
  > I also don't know how an ISP would get your actual internet history if the website uses HTTPS. Until the world switches to DNSCrypt, DNS-over-HTTPS, or DNS-over-TLS and while most Internet users are using ISP provided DNS resolvers, recent research shows it is possible to narrow down what pages the user browsed based on their DNS queries. [1] https://www.theregister.co.uk/2017/03/21/dns_records_more_revealing_than_you_think_says_german_boffin/ https://www.theregister.co.uk/2017/03/21/dns_records_more_re...
• shawnee_ 10y ago
  I have yet to see any proof of this whole 'sell your internet history' complaint What the bill stripping Broadband Privacy rules does is make it nearly impossible for the law to set a precedent for what should be considered illegal to sell when it comes to users' data. What may have happened if broadband privacy rules were enacted as intended here[https://www.nytimes.com/2016/10/28/technology/fcc-tightens-privacy-rules-for-broadband-providers.html?_r=0 https://www.nytimes.com/2016/10/28/technology/fcc-tightens-p...] ... someday somebody who didn't "opt out" would have discovered their [medical, financial, insert whatever] data had been sold to their detriment. Lawsuit. Legal scrutiny. Precedent == Baseline for what is acceptable and what is not for people who don't opt out. Now, with no consumer privacy rights by default on broadband, and no neutral delivery system (net neutrality), and with provisions the GOP inserted into the Broadband Privacy rollback explicitly to make it harder to sue entities who sell your data, the default situation is already stacked badly against the average person.
• accountyaccount 10y ago
  If someone really wanted to, couldn't they buy that anonymized data and then make a series of inferences on which data is yours based on cross-referencing various information? (please correct me if this is wrong) Like say I run hackernews — couldn't I just cross-reference my own logs with that "anonymized" data and get a pretty good idea of what a specific users' traffic was? Based on some of the tools Uber has used to pinpoint specific users like, government officials, it doesn't seem too far beyond the realm of possibility.
  • chiefalchemist 10y ago
    Exactly. Gather a could sources - as is already happening - and with a graph DB and not even grad level algorithms you could get a pretty accurate picture of enough people, given enough data.
• criddell 10y ago
  Back in the 1980's, Robert Bork's video rental history was disclosed during his supreme court nomination. As a result, the Video Privacy Protection Act was passed. Why shouldn't there be similar provisions to protect my browsing history?
• deleted 10y ago
  [deleted]
• mmanfrin 10y ago
  You can't really anonymize data: https://en.wikipedia.org/wiki/AOL_search_data_leak https://en.wikipedia.org/wiki/AOL_search_data_leak