6 ms·

I do most of my browsing in private mode anyway. I'm usually pretty careful to never put things onto websites that I don't want people to find publicly as well.

I do most of my browsing in private mode anyway. I'm usually pretty careful to never put things onto websites that I don't want people to find publicly as well. The US has no strong privacy protections, so you should just assume that nobody has your best interest in mind. This includes HN, Reddit, and the FAANG giants. Although Apple is probably the only one that isn't strongly incentivized to violate your privacy.

TheAdamAndChe 6y ago
The data collected is collected en masse at the ISP level. Using incognito mode won't do anything for these searches.
- brenden2 6y ago
  This doesn't work so well when you a) disallow tracking cookies and b) don't use your ISP's DNS servers. I used to work directly with these big ISPs, and I can assure you they aren't very sophisticated. Even if they log every IP you send a packet to, and they know every domain that points to each of those IPs, they can't know exactly what you requested or which particular website you visited provided these websites use HTTPS.
  - snazz 6y ago
    If you're not using DNS over HTTPS, then they're still tracking your DNS queries regardless of which server you use.
    - brenden2 6y ago
      This is true, but it requires deep packet inspection, and that's something which usually isn't on by default. They might enable it for specific clients under some circumstances, but I haven't heard of ISPs logging that level of detail permanently. I suppose the could run a service that just inspects DNS packets, pulls out the domains, and correlates them with each client, but I haven't heard of that being deployed in the wild (although perhaps that's changed). Their DNS severs, however, and definitely doing this, and they sell that data to 3rd parties. TLS SNI also leaks the domain name, but again that would require deep packet inspection to extract and correlate with the clients. Definitely possible, but probably not deployed.
      - fullstop 6y ago
        DPI is available on inexpensive routers now and has been an option on Cisco/Fortigate/Palo Alto/Ubiquiti gear for ages. I have no doubt that it is heavily used at most IPSs.
        brenden2 6y ago
        There's a big different between the data being available vs. being put to use. ISPs have no incentive to put a bunch of effort into collecting data from the 1% or less of their customers which don't use their DNS servers. Thus, it's extremely unlikely they run packet inspection on every packet just so that they can collect browsing history from people who are privacy conscious.
      - tialaramex 6y ago
        DNS blocking is an affordable technology deployed in many countries. For example in the UK if you use the sort of large ISP advertised on TV it has DNS blocking. With DNS blocking if you try to look up a "forbidden" FQDN you get back either a bogus NXDOMAIN or A records chosen by the blocker. DoH bypasses DNS blocking pretty cheaply. DNSSEC would detect it and stop but doesn't bypass it. Tor bypasses it but at considerable cost. The (eventually indefinitely delayed) UK government plans to institute mandatory censorship of the Internet relied on DNS blocking as their backstop. The idea was if anybody anywhere in the world didn't voluntarily agree to obey censorship rules, they'd be blocked in the UK. The government would just accept that some proportion of users would install Tor to bypass that restriction. DoH means "some proportion of users" potentially becomes "everybody with a modern browser" and that was not palatable.
    - fullstop 6y ago
      I wonder how big a hosts file could get before it degraded performance? You can still do DNS over VPN. That is, I could set up an unbound cache on a VPS and secure my traffic to that server using wireguard or openvpn. This just pushes the eyeballs out of my home and into someone else's datacenter, though.
      - snazz 6y ago
        I'm guessing that the time required to open the hosts file for reading would eclipse the amount of time required to parse it and do a linear search on the entries. I would think that the file would have to be measured in the hundreds of megabytes for performance to be a significant consideration, but I haven't benchmarked it.
      - kortex 6y ago
        Just set up a pihole/dnsmasq. You'll need to point that at your desired DNS (I use 1.1.1.1, but if I were more paranoid I'd tunnel it)
  - 34679 6y ago
    I'm curious about a case like duckduckgo, which uses https, but puts your search term in the url.
    - brenden2 6y ago
      The path and query string are only transmitted over TLS, so it should be fine so long as you never use HTTP without TLS.
      - tialaramex 6y ago
        Indeed, let's break it down: The scheme (https) is implied but isn't transmitted anywhere. An adversary can infer you used HTTPS because it was port 443 and looks like TLS traffic. The hostname (www.duckduckgo.com) is somewhat implied by the destination IP address on the connection, and is also transmitted in the clear as part of TLS Server Name Indication so that the receiving server knows which service you wanted. In TLS 1.2 and earlier the site's certificate is also transmitted in the clear (but this is fixed in TLS 1.3). Encrypting SNI is a work-in-progress. The path and query string are encrypted. An adversary can't discover what they are, nor can they tamper with them successfully. The total overall amount of data sent is not hidden, but clients can (though most do not) add padding to hide exactly how much of this was "real". The fragment identifier (#foo) is not transmitted anywhere it remains only on the client (web browser). Headers, body and so on of both request and response are encrypted, and the same caveat about an adversary knowing how much data was transmitted and when applies.
        kortex 6y ago
        This is a really good summary! A few months back I was hunting for an answer as to whether url/query parameters were encrypted with HTTPS. The answer space was strangely sparse for something so critical.
        tialaramex 6y ago
        The answer is obvious† to somebody who knows how it works, so it's probably in a category of questions where there's not a lot of overlap between people who might ask and people who might be in a position to answer. I remember when I answered a Stack Overflow question about how Domain Validation for certificates in the Web PKI work thinking that just a year or two earlier the answer would be hazy and probably get marked unsatisfactory even though it was true - because it was so vague and few people would be in a position to confirm it. As it happened they'd asked after the Ten Blessed Methods were formally required and so those are the answer, written down in black and white in a document I could offer as a reference for anyone to look at. † The hostname part is less obvious than the rest it's fair to say because HTTP's Host header is just a header and thus encrypted, and you need extra insight to realise SNI needs to exist.
  - anticensor 6y ago
    Come here to Turkey, we have very sophisticated multilevel tracking and censorship infrastructure (deployed but not used in full potential).
teddyh 6y ago
> I do most of my browsing in private mode anyway. What do you think “private mode” is, exactly? I’ll tell you what it is: It’s a mode where your local web browser doesn’t save its history, which only means that people who has physical access to your device cannot see this saved history. Your ISP can still see everything of consequence, and your DoH provider can see most of it.
- b3kart 6y ago
  Same with Google. It's naive to think that if you are "logged out" in "private mode" they aren't saving your queries. It's not difficult to know who's searching if you have access to an IP address and browser fingerprint information.
- brenden2 6y ago
  I think you may be overestimating the technical proficiency of the government. When they talk about browsing history, they're probably quite literally referring to looking at your web browser history. Yes, they might also subpoena your ISP for data, but if the ISP isn't collecting it in a way that is 100% correlated with your computer and browser (which is pretty hard with a NAT), then they only have a weak case at best. It probably wouldn't hold up in court.
  - gnulinux 6y ago
    I don't think you understand what's going on. Private browser has no visible difference to server or the party listening to your communication in the middle. The only effect it has is that it doesn't persist your browser history upon closing it.
    - brenden2 6y ago
      There's a big difference between what's possible in theory and the reality of current practices. I think many people in this thread are missing that point.
      - 6y ago
NikolaeVarius 6y ago
All private mode does is prevent family friends from knowing what porn you watch. It's useless for real "privacy"
- the_af 6y ago
  Indeed. Even worse, Chrome calls this "incognito mode", which is even less accurate. This isn't incognito. The joke about calling it "porn mode" was way more honest.
  - shadowgovt 6y ago
    It's about as incognito as throwing on the hat and glasses the icon shows is. i.e. "works until someone actually cares enough to take active measures to track you."
    - jgwil2 6y ago
      To be fair, right below said icon it gives a pretty clear explanation of what it does and who could still track your activity.
- tialaramex 6y ago
  Systems intended to "learn" your preferences won't accumulate preferences in the private window. Could they? Probably yeah, but they don't, and that's valuable. If someone asks me about a sovereign citizen video on Youtube I can watch it in a Private window without filling my YT suggestions with sov cit crap for the next week. It's also really useful for testing. For example building my WebAuthn implementation I hit "Cancel" a lot. In your ordinary session the browser soon remembers this site tried a WebAuthn registration, the user hit "Cancel" so let's suppress that because it'd be annoying if sites harass you with such requests over and over. Subsequent attempts soon just silently fail - that makes it really annoying to debug the backend. Maybe a refresh will fix it? Maybe I should wait five minutes? Who knows. But the browser intentionally doesn't remember what happens in a Private window. I can hit Cancel to check that works as expected, then open a fresh Private window and registration still works fine there instead of silently failing. Likewise I had a Cookie bug, where a typo meant enduring session cookies that were supposed to be cleared sometimes weren't. Private windows don't preserve cookies, so I could walk through all the steps to reproduce from a "fresh start", try something, then just throw that Private window away and make a new one for the next experiment. None of this is impossible without Private windows of course, but it was more inconvenient when we didn't have them.
paulryanrogers 6y ago
> Although Apple is probably the only one that isn't strongly incentivized to violate your privacy. With their transition from selling widgets to services I wonder how much longer that will be true. And considering their attempt at iAds the privacy incentive is more historical accident than an unchangeable, core culture.
- brenden2 6y ago
  Yes it could certainly change. I for one am not interested in their services products, I stick to the hardware.

TheAdamAndChe 6y ago

The data collected is collected en masse at the ISP level. Using incognito mode won't do anything for these searches.

brenden2 6y ago
This doesn't work so well when you a) disallow tracking cookies and b) don't use your ISP's DNS servers. I used to work directly with these big ISPs, and I can assure you they aren't very sophisticated. Even if they log every IP you send a packet to, and they know every domain that points to each of those IPs, they can't know exactly what you requested or which particular website you visited provided these websites use HTTPS.
- snazz 6y ago
  If you're not using DNS over HTTPS, then they're still tracking your DNS queries regardless of which server you use.
  - brenden2 6y ago
    This is true, but it requires deep packet inspection, and that's something which usually isn't on by default. They might enable it for specific clients under some circumstances, but I haven't heard of ISPs logging that level of detail permanently. I suppose the could run a service that just inspects DNS packets, pulls out the domains, and correlates them with each client, but I haven't heard of that being deployed in the wild (although perhaps that's changed). Their DNS severs, however, and definitely doing this, and they sell that data to 3rd parties. TLS SNI also leaks the domain name, but again that would require deep packet inspection to extract and correlate with the clients. Definitely possible, but probably not deployed.
    - fullstop 6y ago
      DPI is available on inexpensive routers now and has been an option on Cisco/Fortigate/Palo Alto/Ubiquiti gear for ages. I have no doubt that it is heavily used at most IPSs.
      - brenden2 6y ago
        There's a big different between the data being available vs. being put to use. ISPs have no incentive to put a bunch of effort into collecting data from the 1% or less of their customers which don't use their DNS servers. Thus, it's extremely unlikely they run packet inspection on every packet just so that they can collect browsing history from people who are privacy conscious.
    - tialaramex 6y ago
      DNS blocking is an affordable technology deployed in many countries. For example in the UK if you use the sort of large ISP advertised on TV it has DNS blocking. With DNS blocking if you try to look up a "forbidden" FQDN you get back either a bogus NXDOMAIN or A records chosen by the blocker. DoH bypasses DNS blocking pretty cheaply. DNSSEC would detect it and stop but doesn't bypass it. Tor bypasses it but at considerable cost. The (eventually indefinitely delayed) UK government plans to institute mandatory censorship of the Internet relied on DNS blocking as their backstop. The idea was if anybody anywhere in the world didn't voluntarily agree to obey censorship rules, they'd be blocked in the UK. The government would just accept that some proportion of users would install Tor to bypass that restriction. DoH means "some proportion of users" potentially becomes "everybody with a modern browser" and that was not palatable.
  - fullstop 6y ago
    I wonder how big a hosts file could get before it degraded performance? You can still do DNS over VPN. That is, I could set up an unbound cache on a VPS and secure my traffic to that server using wireguard or openvpn. This just pushes the eyeballs out of my home and into someone else's datacenter, though.
    - snazz 6y ago
      I'm guessing that the time required to open the hosts file for reading would eclipse the amount of time required to parse it and do a linear search on the entries. I would think that the file would have to be measured in the hundreds of megabytes for performance to be a significant consideration, but I haven't benchmarked it.
    - kortex 6y ago
      Just set up a pihole/dnsmasq. You'll need to point that at your desired DNS (I use 1.1.1.1, but if I were more paranoid I'd tunnel it)
- 34679 6y ago
  I'm curious about a case like duckduckgo, which uses https, but puts your search term in the url.
  - brenden2 6y ago
    The path and query string are only transmitted over TLS, so it should be fine so long as you never use HTTP without TLS.
    - tialaramex 6y ago
      Indeed, let's break it down: The scheme (https) is implied but isn't transmitted anywhere. An adversary can infer you used HTTPS because it was port 443 and looks like TLS traffic. The hostname (www.duckduckgo.com) is somewhat implied by the destination IP address on the connection, and is also transmitted in the clear as part of TLS Server Name Indication so that the receiving server knows which service you wanted. In TLS 1.2 and earlier the site's certificate is also transmitted in the clear (but this is fixed in TLS 1.3). Encrypting SNI is a work-in-progress. The path and query string are encrypted. An adversary can't discover what they are, nor can they tamper with them successfully. The total overall amount of data sent is not hidden, but clients can (though most do not) add padding to hide exactly how much of this was "real". The fragment identifier (#foo) is not transmitted anywhere it remains only on the client (web browser). Headers, body and so on of both request and response are encrypted, and the same caveat about an adversary knowing how much data was transmitted and when applies.
      - kortex 6y ago
        This is a really good summary! A few months back I was hunting for an answer as to whether url/query parameters were encrypted with HTTPS. The answer space was strangely sparse for something so critical.
        tialaramex 6y ago
        The answer is obvious† to somebody who knows how it works, so it's probably in a category of questions where there's not a lot of overlap between people who might ask and people who might be in a position to answer. I remember when I answered a Stack Overflow question about how Domain Validation for certificates in the Web PKI work thinking that just a year or two earlier the answer would be hazy and probably get marked unsatisfactory even though it was true - because it was so vague and few people would be in a position to confirm it. As it happened they'd asked after the Ten Blessed Methods were formally required and so those are the answer, written down in black and white in a document I could offer as a reference for anyone to look at. † The hostname part is less obvious than the rest it's fair to say because HTTP's Host header is just a header and thus encrypted, and you need extra insight to realise SNI needs to exist.
- anticensor 6y ago
  Come here to Turkey, we have very sophisticated multilevel tracking and censorship infrastructure (deployed but not used in full potential).

teddyh 6y ago

> I do most of my browsing in private mode anyway. What do you think “private mode” is, exactly? I’ll tell you what it is: It’s a mode where your local web browser doesn’t save its history, which only means that people who has physical access to your device cannot see this saved history. Your ISP can still see everything of consequence, and your DoH provider can see most of it.

b3kart 6y ago
Same with Google. It's naive to think that if you are "logged out" in "private mode" they aren't saving your queries. It's not difficult to know who's searching if you have access to an IP address and browser fingerprint information.
brenden2 6y ago
I think you may be overestimating the technical proficiency of the government. When they talk about browsing history, they're probably quite literally referring to looking at your web browser history. Yes, they might also subpoena your ISP for data, but if the ISP isn't collecting it in a way that is 100% correlated with your computer and browser (which is pretty hard with a NAT), then they only have a weak case at best. It probably wouldn't hold up in court.
- gnulinux 6y ago
  I don't think you understand what's going on. Private browser has no visible difference to server or the party listening to your communication in the middle. The only effect it has is that it doesn't persist your browser history upon closing it.
  - brenden2 6y ago
    There's a big difference between what's possible in theory and the reality of current practices. I think many people in this thread are missing that point.
    - 6y ago

NikolaeVarius 6y ago

All private mode does is prevent family friends from knowing what porn you watch. It's useless for real "privacy"

the_af 6y ago
Indeed. Even worse, Chrome calls this "incognito mode", which is even less accurate. This isn't incognito. The joke about calling it "porn mode" was way more honest.
- shadowgovt 6y ago
  It's about as incognito as throwing on the hat and glasses the icon shows is. i.e. "works until someone actually cares enough to take active measures to track you."
  - jgwil2 6y ago
    To be fair, right below said icon it gives a pretty clear explanation of what it does and who could still track your activity.
tialaramex 6y ago
Systems intended to "learn" your preferences won't accumulate preferences in the private window. Could they? Probably yeah, but they don't, and that's valuable. If someone asks me about a sovereign citizen video on Youtube I can watch it in a Private window without filling my YT suggestions with sov cit crap for the next week. It's also really useful for testing. For example building my WebAuthn implementation I hit "Cancel" a lot. In your ordinary session the browser soon remembers this site tried a WebAuthn registration, the user hit "Cancel" so let's suppress that because it'd be annoying if sites harass you with such requests over and over. Subsequent attempts soon just silently fail - that makes it really annoying to debug the backend. Maybe a refresh will fix it? Maybe I should wait five minutes? Who knows. But the browser intentionally doesn't remember what happens in a Private window. I can hit Cancel to check that works as expected, then open a fresh Private window and registration still works fine there instead of silently failing. Likewise I had a Cookie bug, where a typo meant enduring session cookies that were supposed to be cleared sometimes weren't. Private windows don't preserve cookies, so I could walk through all the steps to reproduce from a "fresh start", try something, then just throw that Private window away and make a new one for the next experiment. None of this is impossible without Private windows of course, but it was more inconvenient when we didn't have them.

paulryanrogers 6y ago

> Although Apple is probably the only one that isn't strongly incentivized to violate your privacy. With their transition from selling widgets to services I wonder how much longer that will be true. And considering their attempt at iAds the privacy incentive is more historical accident than an unchangeable, core culture.

brenden2 6y ago
Yes it could certainly change. I for one am not interested in their services products, I stick to the hardware.