11 ms·

ISPs can see a lot, but it does have limits. As long as we're using SSL (and I suppose, assuming it hasn't been cracked), the ISP really only knows what domains

ISPs can see a lot, but it does have limits. As long as we're using SSL (and I suppose, assuming it hasn't been cracked), the ISP really only knows what domains I'm visiting. So they might know that I'm going to WebMD, but they don't necessarily know that I'm reading up on treatment options for nose fungus. They also don't necessarily know exactly which member of my household is going to that website, nor can they link it up with any browsing I do from the coffee shop. Browser-based tracking, on the other hand, can see just about everything, because it's looking at the state of the data after it's been decrypted. And it can, with a reasonable degree of confidence, individually identify people, even when more than one person shares an internet connection, and even when one person uses more than one device or connects to the Internet from more than one location. The higher fidelity of that signal does imply that it's a greater privacy threat.

agumonkey 5y ago
do we need randomized dom nodes ?
- catillac 5y ago
  No.
- mumblemumble 5y ago
  I guess I'd have to hear more details to know exactly what you're thinking, but my first instinct is to say that doing something like that would break CSS and accessibility without actually offering any significant impediment to tracking.
  - 0des 5y ago
    The cohort concerned about tracking, one would think, would not be deterred by broken CSS considering they already live in a JS-free world and might be used to some visual-compromise when browsing.
  - agumonkey 5y ago
    I was mostly wondering about privacy up to the dom layer (if that's even possible)
amarant 5y ago
I guess there are feasible attacks if the ISP is sufficiently motivated. They can't read the data transmitted, but they know how many bytes is in it, and with a cross reference on page sizes in the domain you're on, they might be able to narrow it down considerably.(maybe even to 1 possible page) A more far-fetched attack is a sort of timing attack: if you first visit arstechnica.com and then shortly afterwards visit Amazon.com, one could look for links to Amazon on arstechnica and from there have a decent guess what product you viewed on Amazon. This becomes a lot more feasible when paired with the first attack mentioned above.
- foobiekr 5y ago
  These are all smart thoughts but you’ve clearly never worked for or with an ISP. As business entities in general they don’t have that kind of technical sophistication. They are more on the level of “we have to hire these vendor consultant groups to install VMs for us” than “we build a crawler so that we can use domain plus byte count to drink-anonymize visited pages.”
  - deleted 5y ago
    [deleted]
  - Pick-A-Hill2019 5y ago
    BT (a UK ISP) were up to hijinks in 2008 - "BT and Phorm: how an online privacy scandal unfolded" https://www.telegraph.co.uk/technology/news/8438461/BT-and-Phorm-how-an-online-privacy-scandal-unfolded.html https://www.telegraph.co.uk/technology/news/8438461/BT-and-P...
    - foobiekr 5y ago
      Yes. The problem for them is that times have changed.
  - geraneum 5y ago
    It doesn’t matter that most of them might not be that capable. They just hoard this data and sell it to the people with the means and resources.
carlosf 5y ago
ISPs do not know as much as Google/FB thanks to SSL, but they know a lot more than you'd think by analyzing connection metadata. Also many ISPs are also carriers, which makes things worse. Source: worked for telecos, have seen a lot of shady stuff myself.
morelisp 5y ago
ISPs have perfect knowledge of your IP, so if they can get even basic traffic logs from _anything else_ can reconstruct your browsing history more accurately than any other third-party. Since you are probably visiting your ISP's site regularly to pay your bill, there are also a lot of possibilities for them to regularly associate third-party cookies with your login. They also have the highest-quality ambient location data (outside of explicit app permissions) to link with all of that.
- raxxorrax 5y ago
  ISPs didn't even want to log IP data until 70+ year old people forced them to collect that info. Sorry for the rant against older gents, but this is the current reality. Now they might think differently because there is a market for info. Thank you government...
anunay03 5y ago
Oh not to mention, this might soon change as eSNI/ECH is adopted! Then the only information being leaked would be the IP address of the server. And with widespread use of CDNs nowadays would make the information collected pretty useless. Ofcourse that is if your DNS queries are not leaking everything. (which they are! Use DNS-over-HTTPs guys!)

agumonkey 5y ago

do we need randomized dom nodes ?

catillac 5y ago
No.
mumblemumble 5y ago
I guess I'd have to hear more details to know exactly what you're thinking, but my first instinct is to say that doing something like that would break CSS and accessibility without actually offering any significant impediment to tracking.
- 0des 5y ago
  The cohort concerned about tracking, one would think, would not be deterred by broken CSS considering they already live in a JS-free world and might be used to some visual-compromise when browsing.
- agumonkey 5y ago
  I was mostly wondering about privacy up to the dom layer (if that's even possible)

amarant 5y ago

I guess there are feasible attacks if the ISP is sufficiently motivated. They can't read the data transmitted, but they know how many bytes is in it, and with a cross reference on page sizes in the domain you're on, they might be able to narrow it down considerably.(maybe even to 1 possible page) A more far-fetched attack is a sort of timing attack: if you first visit arstechnica.com and then shortly afterwards visit Amazon.com, one could look for links to Amazon on arstechnica and from there have a decent guess what product you viewed on Amazon. This becomes a lot more feasible when paired with the first attack mentioned above.

foobiekr 5y ago
These are all smart thoughts but you’ve clearly never worked for or with an ISP. As business entities in general they don’t have that kind of technical sophistication. They are more on the level of “we have to hire these vendor consultant groups to install VMs for us” than “we build a crawler so that we can use domain plus byte count to drink-anonymize visited pages.”
- deleted 5y ago
  [deleted]
- Pick-A-Hill2019 5y ago
  BT (a UK ISP) were up to hijinks in 2008 - "BT and Phorm: how an online privacy scandal unfolded" https://www.telegraph.co.uk/technology/news/8438461/BT-and-Phorm-how-an-online-privacy-scandal-unfolded.html https://www.telegraph.co.uk/technology/news/8438461/BT-and-P...
  - foobiekr 5y ago
    Yes. The problem for them is that times have changed.
- geraneum 5y ago
  It doesn’t matter that most of them might not be that capable. They just hoard this data and sell it to the people with the means and resources.

carlosf 5y ago

ISPs do not know as much as Google/FB thanks to SSL, but they know a lot more than you'd think by analyzing connection metadata. Also many ISPs are also carriers, which makes things worse. Source: worked for telecos, have seen a lot of shady stuff myself.

morelisp 5y ago

ISPs have perfect knowledge of your IP, so if they can get even basic traffic logs from _anything else_ can reconstruct your browsing history more accurately than any other third-party. Since you are probably visiting your ISP's site regularly to pay your bill, there are also a lot of possibilities for them to regularly associate third-party cookies with your login. They also have the highest-quality ambient location data (outside of explicit app permissions) to link with all of that.

raxxorrax 5y ago
ISPs didn't even want to log IP data until 70+ year old people forced them to collect that info. Sorry for the rant against older gents, but this is the current reality. Now they might think differently because there is a market for info. Thank you government...

anunay03 5y ago

Oh not to mention, this might soon change as eSNI/ECH is adopted! Then the only information being leaked would be the IP address of the server. And with widespread use of CDNs nowadays would make the information collected pretty useless. Ofcourse that is if your DNS queries are not leaking everything. (which they are! Use DNS-over-HTTPs guys!)