6 ms·

Couple devil's advocate points on what ISPs can do to get encrypted traffic, since they are your network gateway there is more instilled trust: - ISP offered '

Couple devil's advocate points on what ISPs can do to get encrypted traffic, since they are your network gateway there is more instilled trust: - ISP offered 'apps'. Get people to agree to an install of some monitoring app for some [insert random marketing benefit] from ISP. Maybe if you install the app you get more data cap space etc and they can monitor browser access. Further, install this in known apps or as add-ons on setup for other apps. - ISP offered 'VPN client' that again, gives some cheaper monetary benefit like more data cap space or more speed 'free', strips out other advertising or tracking as a benefit. - ISP offered 'email client' that does all of the above. - Check for subsequent request after page loads to known ad networks and replace with their own in HTTPS - ISPs like you said may start throttling encrypted content down, or charging extra to allow it. - ISP level proxy MITM, modem customization for 'fast lanes' that are actually slow lanes. - DNS level data collection not to inject but to sell marketing profiles via metadata and correlate with other data from apps. Since ISPs are your 'gateway' to the internet and you pay them, most people assume trust and privacy, most don't know they bribed their way into the tracking/ad business, many didn't know cable tv modems had mics either. With that assumption of trust since people are paying them, they'll more easily fall for any of the possible attack/tracking vectors listed and more probably. With the ISP privacy protections removed [1], my guess is most ISPs, due to lack of competition, end up more like hotel wifi where tracking/injection is the norm [2] as it is completely legal now. With the removal of privacy protections and net neutrality, we have killed the pristine, non tracked, private gateways to the internet we cherish. [1] https://www.flake.senate.gov/public/index.cfm/2017/3/flake-introduces-resolution-to-protect-consumers-from-overreaching-internet-regulation https://www.flake.senate.gov/public/index.cfm/2017/3/flake-i... [2] https://medium.com/@nicklum/my-hotel-wifi-injects-ads-does-yours-6356710fa180 https://medium.com/@nicklum/my-hotel-wifi-injects-ads-does-y...

ereyes01 9y ago
This makes sense, though I don't see how various "carrots" like faux-value-add spyware will penetrate the market significantly, since they likely can't beat Google/Facebook in actual delivered value. Also, spyware / crapware already has a pretty bad rep, and will likely be flagged by system scanning tools on traditional PCs (maybe not mobile devices though). Your other points about how they can (ab)use their position as the gateway to chip away the effect of encryption by laying various roadblocks (I guess the proverbial "stick" in the "carrot/stick" trope) seems like it could have some teeth if the ISPs really doubled down on this strategy. I expect they will have to overcome significant controversy in order to be successful on a mass scale (but we'll see I guess). Encryption has gotten much easier and more widespread in recent years, and is growing. If the ISPs had really focused on attacking it a few years ago, they could've nipped their surveillance competition in the bud, but now it's a harder problem for them to deal with. Not 100% insurmountable, as parent explained.
- drawkbox 9y ago
  > Encryption has gotten much easier and more widespread in recent years, and is growing. When you only have a handful of large ISPs where AT&T has been known to split your data to share with the NSA and authorities, that is dangerous thinking [1]. > Room 641A is a telecommunication interception facility operated by AT&T for the U.S. National Security Agency that commenced operations in 2003 and was exposed in 2006 That was over a decade ago, I am sure by now they have privilege to lots of that data and technology. There was a #deletefacebook movement which proves that you can get rid of Facebook and people use it by choice. There cannot be a #deleteISP movement as that is the 'trusted' network gateway you can't route around. All it takes is scaring people who use ISPs to allow in more monitoring 'for your safety' or 'more data cap space' or 'faster internet' or 'lower costs', they can legally sell that data now so there is an incentive to do these things. There is a reason they lobbied for this right and removal of net neutrality, it wasn't to play nice. Hotel wifi like ISPs here we come. [1] https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A

ereyes01 9y ago

This makes sense, though I don't see how various "carrots" like faux-value-add spyware will penetrate the market significantly, since they likely can't beat Google/Facebook in actual delivered value. Also, spyware / crapware already has a pretty bad rep, and will likely be flagged by system scanning tools on traditional PCs (maybe not mobile devices though). Your other points about how they can (ab)use their position as the gateway to chip away the effect of encryption by laying various roadblocks (I guess the proverbial "stick" in the "carrot/stick" trope) seems like it could have some teeth if the ISPs really doubled down on this strategy. I expect they will have to overcome significant controversy in order to be successful on a mass scale (but we'll see I guess). Encryption has gotten much easier and more widespread in recent years, and is growing. If the ISPs had really focused on attacking it a few years ago, they could've nipped their surveillance competition in the bud, but now it's a harder problem for them to deal with. Not 100% insurmountable, as parent explained.

drawkbox 9y ago
> Encryption has gotten much easier and more widespread in recent years, and is growing. When you only have a handful of large ISPs where AT&T has been known to split your data to share with the NSA and authorities, that is dangerous thinking [1]. > Room 641A is a telecommunication interception facility operated by AT&T for the U.S. National Security Agency that commenced operations in 2003 and was exposed in 2006 That was over a decade ago, I am sure by now they have privilege to lots of that data and technology. There was a #deletefacebook movement which proves that you can get rid of Facebook and people use it by choice. There cannot be a #deleteISP movement as that is the 'trusted' network gateway you can't route around. All it takes is scaring people who use ISPs to allow in more monitoring 'for your safety' or 'more data cap space' or 'faster internet' or 'lower costs', they can legally sell that data now so there is an incentive to do these things. There is a reason they lobbied for this right and removal of net neutrality, it wasn't to play nice. Hotel wifi like ISPs here we come. [1] https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A