5 ms·

Don't use VPN services: https://gist.github.com/joepie91/5a9909939e6ce7d09e29 https://gist.github.com/joepie91/5a9909939e6ce7d09e29

brobinson 6y ago
But, according to that link, you should be using one in this case: "You are on a known-hostile network (eg. a public airport WiFi access point, or an ISP that is known to use MITM), and you want to work around that." An internet connection from an ISP operating under a government that logs your browsing history is a "known-hostile network".
- judge2020 6y ago
  This law would almost certainly be exercised via Google and not the ISP, which can't see the contents of your browsing history anyways.
  - kitotik 6y ago
    But most ISPs will have DNS lookup records. Most users aren’t savvy enough to set their own DNS servers. I’m not sure on the current status of DNS over HTTPS, but I’d imagine .gov could just compel cloudflare or whoever to provide logs.
    - zajio1am 6y ago
      Do ISPs generally have DNS lookup past records? That seems like something that would be costly with little benefit. I run small ISP and only enable DNS logging when tracing some problem.
      - judge2020 6y ago
        Apparently AT&T charges to prevent them from selling your data[0], which almost certainly is DNS data and maybe SNI. 0: https://arstechnica.com/information-technology/2015/03/atts-plan-to-watch-your-web-browsing-and-what-you-can-do-about-it/ https://arstechnica.com/information-technology/2015/03/atts-...
      - kitotik 6y ago
        Large ones definitely do. There is lots of revenue generated from selling this data.
  - zajio1am 6y ago
    How could Google see the content of a browsing history? They can see searching history, but generally not browsing history (unless someone uses something like synchronizing browser history through Google account).
    - judge2020 6y ago
      Most users sync browsing history when using Chrome, but Google also both tracks the links you click on the search page, and tracks the pages you visit that load Ads (will show in myactivity.google.com).
- henryfjordan 6y ago
  You have to consider the threat through the whole request. You start on your computer and jump to the VPN instead of the destination website. Is the VPN hosted in a different country that refuses to work the US? Do you trust them to not do anything else shady? Do you trust that the encryption you are using will not be broken before your death, because the NSA is logging traffic to other countries, especially ones that won't cooperate with the US. Then you have to hop from the VPN to the destination website anyway, is that jump really more secure than the jump from your device directly to the destination? Is the destination site tracking you? VPNs are for moving your traffic off the airport network or Starbucks wifi, not defeating a nation state.
flatiron 6y ago
I use it for P2P and I work from home so I don’t want to be on any “naughty” P2P lists may employer might check on their VPN log (since they distribute media). That’s another use case of the VPN.
godelski 6y ago
This is dubious. While I agree VPNs oversell themselves, who do you trust more? Comcast or your VPN (Mullvad,PIA,whatever)? I think many of us have no trust for Comcast.

brobinson 6y ago

But, according to that link, you should be using one in this case: "You are on a known-hostile network (eg. a public airport WiFi access point, or an ISP that is known to use MITM), and you want to work around that." An internet connection from an ISP operating under a government that logs your browsing history is a "known-hostile network".

judge2020 6y ago
This law would almost certainly be exercised via Google and not the ISP, which can't see the contents of your browsing history anyways.
- kitotik 6y ago
  But most ISPs will have DNS lookup records. Most users aren’t savvy enough to set their own DNS servers. I’m not sure on the current status of DNS over HTTPS, but I’d imagine .gov could just compel cloudflare or whoever to provide logs.
  - zajio1am 6y ago
    Do ISPs generally have DNS lookup past records? That seems like something that would be costly with little benefit. I run small ISP and only enable DNS logging when tracing some problem.
    - judge2020 6y ago
      Apparently AT&T charges to prevent them from selling your data[0], which almost certainly is DNS data and maybe SNI. 0: https://arstechnica.com/information-technology/2015/03/atts-plan-to-watch-your-web-browsing-and-what-you-can-do-about-it/ https://arstechnica.com/information-technology/2015/03/atts-...
    - kitotik 6y ago
      Large ones definitely do. There is lots of revenue generated from selling this data.
- zajio1am 6y ago
  How could Google see the content of a browsing history? They can see searching history, but generally not browsing history (unless someone uses something like synchronizing browser history through Google account).
  - judge2020 6y ago
    Most users sync browsing history when using Chrome, but Google also both tracks the links you click on the search page, and tracks the pages you visit that load Ads (will show in myactivity.google.com).
henryfjordan 6y ago
You have to consider the threat through the whole request. You start on your computer and jump to the VPN instead of the destination website. Is the VPN hosted in a different country that refuses to work the US? Do you trust them to not do anything else shady? Do you trust that the encryption you are using will not be broken before your death, because the NSA is logging traffic to other countries, especially ones that won't cooperate with the US. Then you have to hop from the VPN to the destination website anyway, is that jump really more secure than the jump from your device directly to the destination? Is the destination site tracking you? VPNs are for moving your traffic off the airport network or Starbucks wifi, not defeating a nation state.

flatiron 6y ago

I use it for P2P and I work from home so I don’t want to be on any “naughty” P2P lists may employer might check on their VPN log (since they distribute media). That’s another use case of the VPN.

godelski 6y ago

This is dubious. While I agree VPNs oversell themselves, who do you trust more? Comcast or your VPN (Mullvad,PIA,whatever)? I think many of us have no trust for Comcast.