5 ms·

Why didn't they just do what the US Gov did? Snoop but not tell anyone. Certainly would have saved them some grief. https://en.wikipedia.org/wiki/NSA_warrantle

Why didn't they just do what the US Gov did? Snoop but not tell anyone. Certainly would have saved them some grief. https://en.wikipedia.org/wiki/NSA_warrantless_surveillance_(2001%E2%80%932007) https://en.wikipedia.org/wiki/NSA_warrantless_surveillance_(...

nostromo 6y ago
And then lie about it to congress. Repeatedly. https://www.youtube.com/watch?v=QwiUVUJmGjs https://www.youtube.com/watch?v=QwiUVUJmGjs https://www.youtube.com/watch?v=oYNXVgYhPOc https://www.youtube.com/watch?v=oYNXVgYhPOc And then lying about lying about it. https://youtu.be/2d03yjXRPtI?t=262 https://youtu.be/2d03yjXRPtI?t=262
- ianlevesque 6y ago
  Congress then really outdid themselves by focusing all legislation on telephone calls (as if anyone younger than 60 even cares about that part) and leaving the internet snooping untouched. Really fantastic misdirection.
  - IAmGraydon 6y ago
    People always ask me about misdirection, It's fantastic. Let me tell you about misdirection. I do very well with misdirection. I love misdirection. No one loves misdirection more than me, BELIEVE ME. Misdirection loves me. We're going to have so many misdirections you are going to get sick of misdirection. The misdirection just got 10 feet higher. I have the best misdirection.
  - gumby 6y ago
    Ahh, but it’s actually very clever: young terrorists use phone calls to communicate figuring all the normal means are being spied upon whereas nobody uses the phone anyway so it won’t be spied on. Diabolical!
    - dylan604 6y ago
      right, so just put surveilance on anyone ordering new land line phone service. problem solved
- lettergram 6y ago
  For as much as many dislike the guy, Trump actually fired all these people... course they now work at CNN and the like.
- amscanne 6y ago
  (Relevant bit starts at ~6:00 in the first video)
deleted 6y ago
[deleted]
tokai 6y ago
If you want to bust people for petty crimes and not 'terror' it makes more sense with a publicly mandated system I guess.
- barbacoa 6y ago
  The americans used warrantless wiretapping for petty crimes too. In fact i don't think they even used it for "terrorism". https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intelligence-laundering https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...
incompatible 6y ago
The article says they are trying: "The IPAct effectively prohibits ISPs from talking about much of this, which makes it difficult to verify the details" I'm not sure if the "URL" column in a table in the article is supposed to contain URLs. In the example it only has domain names. I don't think full URLs can be obtained from SSL/TLS connections.
- tialaramex 6y ago
  I assume it's because to lay people don't distinguish a domain name, an FQDN, eTLD+1, URL, "web address", URI, etc. and I'm sure that it's just as frustrating in any other discipline with a complicated vocabulary. When your browser tries to display https://www.example.com/some/directory?someParameter=Value#Appendix https://www.example.com/some/directory?someParameter=Value#A... :: #Appendix isn't sent anywhere, your browser only needs that locally The path /some/directory and the query ?someParameter=Value are encrypted using keys which should be known only to the browser and server, today in most cases the keys are random and will be forgotten soon afterwards The scheme https is implied by your browser's connection to an HTTPS web server. Modern browsers also explicitly transmit ALPN requesting h2 (HTTP/2) if available in their ClientHello, this will not be encrypted today. The server name www.example.com is somewhat implied by your browser's connection to an IP address for this server. Any browser that still works in 2021 explicitly transmits the SNI requesting this name, so as to enable Virtual Hosting which offers multiple distinct web servers on a single IP address. SNI is also in the ClientHello and thus not encrypted. The full server name will also be looked up by the browser in DNS. In many cases this means an unencrypted UDP query for that name, and this may in turn trigger a query for example.com, and in theory at least, com itself because DNS is hierarchical and the hierarchy may need to be discovered. You can secure some of this last step by using any of the DPRIVE technologies, including DNS over HTTPS (DoH) or DNS over TLS (DoT) and some day DNS over QUIC (DoQ). Eventually DPRIVE might also secure the recursion, but even today if snoopers can see that Google's DNS service asked about example.com that does not pin down who wanted them to do that, let alone why. If you've secured DNS, this will pave the way for ECH, a forthcoming standard to Encrypt the ClientHello. It is likely that popular browsers will begin just doing ECH (silently enabling it for at least some users) in the next year or so, but right now it isn't quite finished. Even with an Encrypted ClientHello, the IP gives away roughly who you connected to. The Internet Archive, the Fox News web site, and Wikipedia have no interest in sharing IP addresses with Porn Hub so as to throw off snoopers who are wondering roughly what you're doing. On the other hand, Encrypted ClientHello would hide whether you're looking at the German Wiktionary or the English Wikipedia page about the Hitler Youth, and it would mean there was no longer a privacy advantage to a site using directory prefixes to categorise things versus using server names.
DanBC 6y ago
Because we, unlike the Americans, have article 8 protections.
- dylan604 6y ago
  You have a piece of paper, America has a piece of paper, but neither of them are worth anything if the protections to declare are not upheld. The repurcussions for violating those protections are more trivial than traffic violations.
  - DanBC 6y ago
    The protections are routinely upheld in UK courts.
- danShumway 6y ago
  The US has laws that should have prevented people from lying to Congress about PRISM, but it happened anyway. Your Article 8 protections only matter as much as they're enforced and respected by the government. If Article 8 was the defense you imagine it to be, then the Investigatory Powers Bill wouldn't have passed in the first place. It's very hard for me to square the text of Article 8 with a bill that allows warrantless access of every single IP address you visit. If that's consistent with the government's interpretation of the text, then it doesn't sound to me like the text is doing its job.

nostromo 6y ago

And then lie about it to congress. Repeatedly. https://www.youtube.com/watch?v=QwiUVUJmGjs https://www.youtube.com/watch?v=QwiUVUJmGjs https://www.youtube.com/watch?v=oYNXVgYhPOc https://www.youtube.com/watch?v=oYNXVgYhPOc And then lying about lying about it. https://youtu.be/2d03yjXRPtI?t=262 https://youtu.be/2d03yjXRPtI?t=262

ianlevesque 6y ago
Congress then really outdid themselves by focusing all legislation on telephone calls (as if anyone younger than 60 even cares about that part) and leaving the internet snooping untouched. Really fantastic misdirection.
- IAmGraydon 6y ago
  People always ask me about misdirection, It's fantastic. Let me tell you about misdirection. I do very well with misdirection. I love misdirection. No one loves misdirection more than me, BELIEVE ME. Misdirection loves me. We're going to have so many misdirections you are going to get sick of misdirection. The misdirection just got 10 feet higher. I have the best misdirection.
- gumby 6y ago
  Ahh, but it’s actually very clever: young terrorists use phone calls to communicate figuring all the normal means are being spied upon whereas nobody uses the phone anyway so it won’t be spied on. Diabolical!
  - dylan604 6y ago
    right, so just put surveilance on anyone ordering new land line phone service. problem solved
lettergram 6y ago
For as much as many dislike the guy, Trump actually fired all these people... course they now work at CNN and the like.
amscanne 6y ago
(Relevant bit starts at ~6:00 in the first video)

deleted 6y ago

[deleted]

tokai 6y ago

If you want to bust people for petty crimes and not 'terror' it makes more sense with a publicly mandated system I guess.

barbacoa 6y ago
The americans used warrantless wiretapping for petty crimes too. In fact i don't think they even used it for "terrorism". https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intelligence-laundering https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...

incompatible 6y ago

The article says they are trying: "The IPAct effectively prohibits ISPs from talking about much of this, which makes it difficult to verify the details" I'm not sure if the "URL" column in a table in the article is supposed to contain URLs. In the example it only has domain names. I don't think full URLs can be obtained from SSL/TLS connections.

tialaramex 6y ago
I assume it's because to lay people don't distinguish a domain name, an FQDN, eTLD+1, URL, "web address", URI, etc. and I'm sure that it's just as frustrating in any other discipline with a complicated vocabulary. When your browser tries to display https://www.example.com/some/directory?someParameter=Value#Appendix https://www.example.com/some/directory?someParameter=Value#A... :: #Appendix isn't sent anywhere, your browser only needs that locally The path /some/directory and the query ?someParameter=Value are encrypted using keys which should be known only to the browser and server, today in most cases the keys are random and will be forgotten soon afterwards The scheme https is implied by your browser's connection to an HTTPS web server. Modern browsers also explicitly transmit ALPN requesting h2 (HTTP/2) if available in their ClientHello, this will not be encrypted today. The server name www.example.com is somewhat implied by your browser's connection to an IP address for this server. Any browser that still works in 2021 explicitly transmits the SNI requesting this name, so as to enable Virtual Hosting which offers multiple distinct web servers on a single IP address. SNI is also in the ClientHello and thus not encrypted. The full server name will also be looked up by the browser in DNS. In many cases this means an unencrypted UDP query for that name, and this may in turn trigger a query for example.com, and in theory at least, com itself because DNS is hierarchical and the hierarchy may need to be discovered. You can secure some of this last step by using any of the DPRIVE technologies, including DNS over HTTPS (DoH) or DNS over TLS (DoT) and some day DNS over QUIC (DoQ). Eventually DPRIVE might also secure the recursion, but even today if snoopers can see that Google's DNS service asked about example.com that does not pin down who wanted them to do that, let alone why. If you've secured DNS, this will pave the way for ECH, a forthcoming standard to Encrypt the ClientHello. It is likely that popular browsers will begin just doing ECH (silently enabling it for at least some users) in the next year or so, but right now it isn't quite finished. Even with an Encrypted ClientHello, the IP gives away roughly who you connected to. The Internet Archive, the Fox News web site, and Wikipedia have no interest in sharing IP addresses with Porn Hub so as to throw off snoopers who are wondering roughly what you're doing. On the other hand, Encrypted ClientHello would hide whether you're looking at the German Wiktionary or the English Wikipedia page about the Hitler Youth, and it would mean there was no longer a privacy advantage to a site using directory prefixes to categorise things versus using server names.

DanBC 6y ago

Because we, unlike the Americans, have article 8 protections.

dylan604 6y ago
You have a piece of paper, America has a piece of paper, but neither of them are worth anything if the protections to declare are not upheld. The repurcussions for violating those protections are more trivial than traffic violations.
- DanBC 6y ago
  The protections are routinely upheld in UK courts.
danShumway 6y ago
The US has laws that should have prevented people from lying to Congress about PRISM, but it happened anyway. Your Article 8 protections only matter as much as they're enforced and respected by the government. If Article 8 was the defense you imagine it to be, then the Investigatory Powers Bill wouldn't have passed in the first place. It's very hard for me to square the text of Article 8 with a bill that allows warrantless access of every single IP address you visit. If that's consistent with the government's interpretation of the text, then it doesn't sound to me like the text is doing its job.