5 ms·

Uh, Google and Mozilla and a handful of organizations are converting all web traffic to HTTPS through subtle manipulation of standards and user interface. They

Uh, Google and Mozilla and a handful of organizations are converting all web traffic to HTTPS through subtle manipulation of standards and user interface. They even proxy mobile traffic from their search engine. ISPs can't even see what IP you're visiting because it's all fronted by CloudFlare. Even your DNS is being hidden by an HTTPS tunnel in the browser. Your ISP soon won't be able to see anything you do online. But Google will see it all.

lallysingh 9y ago
There's still SNI in TLS. Hopefully that changes in 1.3, but I don't know how prevalent that is yet.
- dancek 9y ago
  Well, you can use a browser that doesn't support SNI (IE8) or one that makes it configurable (I don't know if any do). But a large amount of sites won't work without it. It's very common to run multiple sites on same ip/port. Not sure if it's technically possible to make that work without SNI or a similar technology.
  - dancek 9y ago
    On re-reading the grandparent I have to admit I missed the point. Considering CloudFlare offers to do SSL on their end, it'd be technically viable to only tell CF which domain you want.
- exikyut 9y ago
  Wait. Wait a minute. I was planning literally this month to figure out how to implement domain traffic analytics on my LAN by using SNI via libpcap or similar (something tiny). Will I have to configure a root cert and build a full DPI proxy to make this futureproof? >_<
  - lallysingh 9y ago
    It'll be coming, and yes you will. On the bright side, nobody else without a root cert on your box can do it.
    - exikyut 9y ago
      Argh. But thanks for the honest headsup. Time to go learn how to do DPI...
- paulryanrogers 9y ago
  Even without SNI the ISP could just check the destination IP themselves to find out what domain resides there.
  - SXX 9y ago
    Considering almost all websites except for largest one are behind one CDN / load balancer or another this is no longer relevant.
drawkbox 9y ago
You don't think ISPs inject ads/tracking into requests after the page is rendered on subsequent requests and override ad networks? [1] > For years, Comcast and other large telecommunication companies around the world have injected javascript into your web browsing experience to serve advertisements and account notices. Their ability to do this stems from their upstream position as your Internet Service Provider (ISP). While Comcast is only currently using their javascript injection ability to serve customer account related information, the same message sending vector could be used to serve phishing expeditions, or other types of attacks. Not to mention that whoever your ISP is has access to your browsing history, your search history, your entire internet history unless you use a VPN. Some, like AT&T, even brazenly sold parts of this information for advertising profit unless you explicitly paid them not to – a pay-for-privacy scheme. Why do you think ISPs like Comcast lobbied so hard to bribe their way into the ad/tracking market instead of winning it on the market with products people want? Do you think they did that so that to waste profits? Or to gain them? We pay ISPs for secure and private internet access, not to also sell off our private data. Google and Facebook are ad/marketing companies, you expect tracking and they use your data and give you a free service in exchange. ISPs we pay for internet access and privacy, noone expects ISPs to be selling your data or would call them ad networks, though that is what they want to be and are building with this privacy law change. [1] https://www.privateinternetaccess.com/blog/2016/12/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/2016/12/comcast-s...
- eric24234 9y ago
  Can they inject javascript even in an https connection ?
  - drawkbox 9y ago
    The link I provided [1] has coinmarketcap.com that is forced HTTPS but not sure if that was or not. There's some discussion of known Comcast injection here: https://news.ycombinator.com/item?id=15890551 https://news.ycombinator.com/item?id=15890551 The response from Comcast was [2]: > This is our web notification system, documented in RFC 6108 https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108, which has been in place for many years now. It presents an overlay service message on non-TLS-based HTTP sessions. If you click the X box or otherwise acknowledge the notice it should immediately go away. If that is not the case let me know and we'll have a look at what may be happening. [2] But ultimately no, however there may be some possibilities: - ISP offered 'apps'. Get people to agree to an install of some monitoring app for some [insert random marketing benefit] from ISP. Maybe if you install the app you get more data cap space etc and they can monitor browser access. Further, install this in known apps or as add-ons on setup for other apps. - ISP offered 'VPN client' that again, gives some cheaper monetary benefit like more data cap space or more speed 'free', strips out other advertising or tracking as a benefit. - ISP offered 'email client' that does all of the above. - Check for subsequent request after page loads to known ad networks and replace with their own in HTTPS - ISP level proxy MITM, modem customization for 'fast lanes' that are actually slow lanes. - DNS level data collection not to inject but to sell marketing profiles via metadata and correlate with other data from apps. First one is the most probable but as of right now HTTPS injection is obviously hard to do if not impossible without some social or security hole. Nobody in here would probably fall for these attempts but most would considering the outrage that they didn't know friend harvesting was happening on Facebook. If whatever they try lowers their monthly data caps or limits then majority of people will do it. Since ISPs are your 'gateway' to the internet and you pay them, most people assume trust and privacy, most don't know they bribed their way into the tracking/ad business, many didn't know cable tv modems had mics either. With that assumption of trust since people are paying them, they'll more easily fall for any of the possible attack/tracking vectors listed and more probably. With the ISP privacy protections removed [3], my guess is most ISPs, due to lack of competition, end up more like hotel wifi where tracking/injection is the norm [4] as it is completely legal now. With the removal of privacy protections and net neutrality, we have killed the pristine, non tracked, private gateways to the internet we cherish. [1] https://www.privateinternetaccess.com/blog/2016/12/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/2016/12/comcast-s... [2] http://forums.xfinity.com/t5/Customer-Service/Are-you-aware/td-p/3009551 http://forums.xfinity.com/t5/Customer-Service/Are-you-aware/... [3] https://www.flake.senate.gov/public/index.cfm/2017/3/flake-introduces-resolution-to-protect-consumers-from-overreaching-internet-regulation https://www.flake.senate.gov/public/index.cfm/2017/3/flake-i... [4] https://medium.com/@nicklum/my-hotel-wifi-injects-ads-does-yours-6356710fa180 https://medium.com/@nicklum/my-hotel-wifi-injects-ads-does-y...
drawkbox 9y ago
Do you trust the EFF? > The number one creepiest thing on our list of privacy-invasive practices comes courtesy of Verizon (and AT&T, which quickly killed a similar program after Verizon started getting blowback). > Snooping through your traffic and inserting ads Which ISPs did it before? AT&T, Charter, CMA > Hijacking your searches Which ISPs did it before? Charter, Cogent, DirecPC, Frontier, Wide Open West All of these areas are going to be tried again by the ISPs with this law. [1] https://www.eff.org/deeplinks/2017/03/five-creepy-things-your-isp-could-do-if-congress-repeals-fccs-privacy-protections https://www.eff.org/deeplinks/2017/03/five-creepy-things-you...
- peterwwillis 9y ago
  > Snooping through your traffic and inserting ads Ok, so Google doesn't inject ads into your web traffic. But they inject ads into websites using AdSense, and into search results, and their products, and any technology linked to their ad platform (which is basically all technology related to the web). To increase ad revenue, they snoop on any personal data you store with Google. And they use their ads to collect more info about where you go on the web. > Hijacking your searches So, Google doesn't need to hijack your search, because they are most people's preferred search engine. But they do proxy your browser's connection when you click on a search result from a mobile browser (AMP). They're starting to do this with your e-mail, too. And they sometimes do this with your DNS records, so they know every site you load, period. I would call that connection hijacking, tracking, and snooping. Re: the other points in that article, they already sell your data to marketers, all their software is already pre-installed on your phone/tablet/chromebook/desktop/laptop, and they definitely track you with cookies. Google has a competitive advantage in that they have a walled-off platform where nobody else can make money off of you. The ISPs want a shot at making money off you, too. Since both are doing virtually the same thing, I don't see a big difference. Just the means by which they do them. Google has been reshaping the entire internet and web just to maximize the way they can profit off my personal information. I don't see the ISPs doing that. What I'm curious about is, why is the EFF so upset about what ISPs do, but not upset about what Google does, when Google's actions are literally affecting an entire industry and most of the world, and not just its own customers?
cxseven 9y ago
Next from Comcast: You must install this privacy-busting add-on to "optimize your experience".
- saagarjha 9y ago
  Or, more likely: a discount for installing it.
  - Quenty 9y ago
    And an increased price hike to go with the “discount”
kevin_thibedeau 9y ago
They still see every DNS request.
- peterwwillis 9y ago
  Not if your browser sends it over HTTPS. Mozilla implementing it: https://www.ghacks.net/2018/03/20/firefox-dns-over-https-and-a-worrying-shield-study/ https://www.ghacks.net/2018/03/20/firefox-dns-over-https-and... Google's: https://developers.google.com/speed/public-dns/docs/dns-over-https https://developers.google.com/speed/public-dns/docs/dns-over... Apparently Chrome uses this over QUIC, and Chrome's Data Saver also uses it IETF charter: https://datatracker.ietf.org/wg/doh/about/ https://datatracker.ietf.org/wg/doh/about/ The unfortunate side-effect of preventing your OS from doing DNS queries is DNS-based ad blockers and privacy proxies no longer work.
  - sempron64 9y ago
    Can't the ISP still have reverse dns on whatever IPs you connect to?
    - tgragnato 9y ago
      I logged my own traffic for a while in order to have an insight about this. It came out that in a world of reverse proxies, ddos protection and large tech conglomerates, reverse dns is not a big deal (depends on you behaviour too, smaller websites with a dedicated IP are easier to catch). But traffic analysis may be a big deal, and the risk of this kind of exposure is not something you can evaluate by yourself. Mix networks are a mitigation.
  - tgragnato 9y ago
    DNS over HTTPS is great for the average Joe/Jane, but if you're technical and care about dns leaks ... I'd suggests a DNS over TLS (unbound) + filter setup. This way your dns traffic is still encrypted, and you retain the capability to block/proxy.
    - 9y ago
TuringNYC 9y ago
I just searched for "privacy" and Google sent me to address: https://www.google.com/search?source=hp&q=privacy&oq=privacy https://www.google.com/search?source=hp&q=privacy&oq=privacy Note, that URL (and search term as GET parameter) is visible to your ISP.
- earthboundkid 9y ago
  URL paths are not visible over HTTPS. All they can get is the host name.

lallysingh 9y ago

There's still SNI in TLS. Hopefully that changes in 1.3, but I don't know how prevalent that is yet.

dancek 9y ago
Well, you can use a browser that doesn't support SNI (IE8) or one that makes it configurable (I don't know if any do). But a large amount of sites won't work without it. It's very common to run multiple sites on same ip/port. Not sure if it's technically possible to make that work without SNI or a similar technology.
- dancek 9y ago
  On re-reading the grandparent I have to admit I missed the point. Considering CloudFlare offers to do SSL on their end, it'd be technically viable to only tell CF which domain you want.
exikyut 9y ago
Wait. Wait a minute. I was planning literally this month to figure out how to implement domain traffic analytics on my LAN by using SNI via libpcap or similar (something tiny). Will I have to configure a root cert and build a full DPI proxy to make this futureproof? >_<
- lallysingh 9y ago
  It'll be coming, and yes you will. On the bright side, nobody else without a root cert on your box can do it.
  - exikyut 9y ago
    Argh. But thanks for the honest headsup. Time to go learn how to do DPI...
paulryanrogers 9y ago
Even without SNI the ISP could just check the destination IP themselves to find out what domain resides there.
- SXX 9y ago
  Considering almost all websites except for largest one are behind one CDN / load balancer or another this is no longer relevant.

drawkbox 9y ago

You don't think ISPs inject ads/tracking into requests after the page is rendered on subsequent requests and override ad networks? [1] > For years, Comcast and other large telecommunication companies around the world have injected javascript into your web browsing experience to serve advertisements and account notices. Their ability to do this stems from their upstream position as your Internet Service Provider (ISP). While Comcast is only currently using their javascript injection ability to serve customer account related information, the same message sending vector could be used to serve phishing expeditions, or other types of attacks. Not to mention that whoever your ISP is has access to your browsing history, your search history, your entire internet history unless you use a VPN. Some, like AT&T, even brazenly sold parts of this information for advertising profit unless you explicitly paid them not to – a pay-for-privacy scheme. Why do you think ISPs like Comcast lobbied so hard to bribe their way into the ad/tracking market instead of winning it on the market with products people want? Do you think they did that so that to waste profits? Or to gain them? We pay ISPs for secure and private internet access, not to also sell off our private data. Google and Facebook are ad/marketing companies, you expect tracking and they use your data and give you a free service in exchange. ISPs we pay for internet access and privacy, noone expects ISPs to be selling your data or would call them ad networks, though that is what they want to be and are building with this privacy law change. [1] https://www.privateinternetaccess.com/blog/2016/12/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/2016/12/comcast-s...

eric24234 9y ago
Can they inject javascript even in an https connection ?
- drawkbox 9y ago
  The link I provided [1] has coinmarketcap.com that is forced HTTPS but not sure if that was or not. There's some discussion of known Comcast injection here: https://news.ycombinator.com/item?id=15890551 https://news.ycombinator.com/item?id=15890551 The response from Comcast was [2]: > This is our web notification system, documented in RFC 6108 https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108, which has been in place for many years now. It presents an overlay service message on non-TLS-based HTTP sessions. If you click the X box or otherwise acknowledge the notice it should immediately go away. If that is not the case let me know and we'll have a look at what may be happening. [2] But ultimately no, however there may be some possibilities: - ISP offered 'apps'. Get people to agree to an install of some monitoring app for some [insert random marketing benefit] from ISP. Maybe if you install the app you get more data cap space etc and they can monitor browser access. Further, install this in known apps or as add-ons on setup for other apps. - ISP offered 'VPN client' that again, gives some cheaper monetary benefit like more data cap space or more speed 'free', strips out other advertising or tracking as a benefit. - ISP offered 'email client' that does all of the above. - Check for subsequent request after page loads to known ad networks and replace with their own in HTTPS - ISP level proxy MITM, modem customization for 'fast lanes' that are actually slow lanes. - DNS level data collection not to inject but to sell marketing profiles via metadata and correlate with other data from apps. First one is the most probable but as of right now HTTPS injection is obviously hard to do if not impossible without some social or security hole. Nobody in here would probably fall for these attempts but most would considering the outrage that they didn't know friend harvesting was happening on Facebook. If whatever they try lowers their monthly data caps or limits then majority of people will do it. Since ISPs are your 'gateway' to the internet and you pay them, most people assume trust and privacy, most don't know they bribed their way into the tracking/ad business, many didn't know cable tv modems had mics either. With that assumption of trust since people are paying them, they'll more easily fall for any of the possible attack/tracking vectors listed and more probably. With the ISP privacy protections removed [3], my guess is most ISPs, due to lack of competition, end up more like hotel wifi where tracking/injection is the norm [4] as it is completely legal now. With the removal of privacy protections and net neutrality, we have killed the pristine, non tracked, private gateways to the internet we cherish. [1] https://www.privateinternetaccess.com/blog/2016/12/comcast-still-uses-mitm-javascript-injection-serve-unwanted-ads-messages/ https://www.privateinternetaccess.com/blog/2016/12/comcast-s... [2] http://forums.xfinity.com/t5/Customer-Service/Are-you-aware/td-p/3009551 http://forums.xfinity.com/t5/Customer-Service/Are-you-aware/... [3] https://www.flake.senate.gov/public/index.cfm/2017/3/flake-introduces-resolution-to-protect-consumers-from-overreaching-internet-regulation https://www.flake.senate.gov/public/index.cfm/2017/3/flake-i... [4] https://medium.com/@nicklum/my-hotel-wifi-injects-ads-does-yours-6356710fa180 https://medium.com/@nicklum/my-hotel-wifi-injects-ads-does-y...

drawkbox 9y ago

Do you trust the EFF? > The number one creepiest thing on our list of privacy-invasive practices comes courtesy of Verizon (and AT&T, which quickly killed a similar program after Verizon started getting blowback). > Snooping through your traffic and inserting ads Which ISPs did it before? AT&T, Charter, CMA > Hijacking your searches Which ISPs did it before? Charter, Cogent, DirecPC, Frontier, Wide Open West All of these areas are going to be tried again by the ISPs with this law. [1] https://www.eff.org/deeplinks/2017/03/five-creepy-things-your-isp-could-do-if-congress-repeals-fccs-privacy-protections https://www.eff.org/deeplinks/2017/03/five-creepy-things-you...

peterwwillis 9y ago
> Snooping through your traffic and inserting ads Ok, so Google doesn't inject ads into your web traffic. But they inject ads into websites using AdSense, and into search results, and their products, and any technology linked to their ad platform (which is basically all technology related to the web). To increase ad revenue, they snoop on any personal data you store with Google. And they use their ads to collect more info about where you go on the web. > Hijacking your searches So, Google doesn't need to hijack your search, because they are most people's preferred search engine. But they do proxy your browser's connection when you click on a search result from a mobile browser (AMP). They're starting to do this with your e-mail, too. And they sometimes do this with your DNS records, so they know every site you load, period. I would call that connection hijacking, tracking, and snooping. Re: the other points in that article, they already sell your data to marketers, all their software is already pre-installed on your phone/tablet/chromebook/desktop/laptop, and they definitely track you with cookies. Google has a competitive advantage in that they have a walled-off platform where nobody else can make money off of you. The ISPs want a shot at making money off you, too. Since both are doing virtually the same thing, I don't see a big difference. Just the means by which they do them. Google has been reshaping the entire internet and web just to maximize the way they can profit off my personal information. I don't see the ISPs doing that. What I'm curious about is, why is the EFF so upset about what ISPs do, but not upset about what Google does, when Google's actions are literally affecting an entire industry and most of the world, and not just its own customers?

cxseven 9y ago

Next from Comcast: You must install this privacy-busting add-on to "optimize your experience".

saagarjha 9y ago
Or, more likely: a discount for installing it.
- Quenty 9y ago
  And an increased price hike to go with the “discount”

kevin_thibedeau 9y ago

They still see every DNS request.

peterwwillis 9y ago
Not if your browser sends it over HTTPS. Mozilla implementing it: https://www.ghacks.net/2018/03/20/firefox-dns-over-https-and-a-worrying-shield-study/ https://www.ghacks.net/2018/03/20/firefox-dns-over-https-and... Google's: https://developers.google.com/speed/public-dns/docs/dns-over-https https://developers.google.com/speed/public-dns/docs/dns-over... Apparently Chrome uses this over QUIC, and Chrome's Data Saver also uses it IETF charter: https://datatracker.ietf.org/wg/doh/about/ https://datatracker.ietf.org/wg/doh/about/ The unfortunate side-effect of preventing your OS from doing DNS queries is DNS-based ad blockers and privacy proxies no longer work.
- sempron64 9y ago
  Can't the ISP still have reverse dns on whatever IPs you connect to?
  - tgragnato 9y ago
    I logged my own traffic for a while in order to have an insight about this. It came out that in a world of reverse proxies, ddos protection and large tech conglomerates, reverse dns is not a big deal (depends on you behaviour too, smaller websites with a dedicated IP are easier to catch). But traffic analysis may be a big deal, and the risk of this kind of exposure is not something you can evaluate by yourself. Mix networks are a mitigation.
- tgragnato 9y ago
  DNS over HTTPS is great for the average Joe/Jane, but if you're technical and care about dns leaks ... I'd suggests a DNS over TLS (unbound) + filter setup. This way your dns traffic is still encrypted, and you retain the capability to block/proxy.
  - 9y ago

TuringNYC 9y ago

I just searched for "privacy" and Google sent me to address: https://www.google.com/search?source=hp&q=privacy&oq=privacy https://www.google.com/search?source=hp&q=privacy&oq=privacy Note, that URL (and search term as GET parameter) is visible to your ISP.

earthboundkid 9y ago
URL paths are not visible over HTTPS. All they can get is the host name.