3 ms·
I guess there are feasible attacks if the ISP is sufficiently motivated. They can't read the data transmitted, but they know how many bytes is in it, and with a
by amarant 5y ago
I guess there are feasible attacks if the ISP is sufficiently motivated. They can't read the data transmitted, but they know how many bytes is in it, and with a cross reference on page sizes in the domain you're on, they might be able to narrow it down considerably.(maybe even to 1 possible page)
A more far-fetched attack is a sort of timing attack: if you first visit arstechnica.com and then shortly afterwards visit Amazon.com, one could look for links to Amazon on arstechnica and from there have a decent guess what product you viewed on Amazon. This becomes a lot more feasible when paired with the first attack mentioned above.
- foobiekr 5y agoThese are all smart thoughts but you’ve clearly never worked for or with an ISP. As business entities in general they don’t have that kind of technical sophistication. They are more on the level of “we have to hire these vendor consultant groups to install VMs for us” than “we build a crawler so that we can use domain plus byte count to drink-anonymize visited pages.”
- deleted 5y ago[deleted]
- Pick-A-Hill2019 5y agoBT (a UK ISP) were up to hijinks in 2008 - "BT and Phorm: how an online privacy scandal unfolded" https://www.telegraph.co.uk/technology/news/8438461/BT-and-Phorm-how-an-online-privacy-scandal-unfolded.html https://www.telegraph.co.uk/technology/news/8438461/BT-and-P...
- foobiekr 5y agoYes. The problem for them is that times have changed.
- geraneum 5y agoIt doesn’t matter that most of them might not be that capable. They just hoard this data and sell it to the people with the means and resources.
- foobiekr 5y agoIt's not that easy to hoard when you have less than one competent engineer in the company and have to contract out to some vendor to build the data lake where they can hoard it. Hoarding itself is beyond the sophistication of most service providers in the present day.