3 ms·

FTC Report – A Look at What ISPs Know About You [pdf]

45 points by KoftaBob 5y ago

jvilalta 5y ago
Conclusion: The findings from our report show that many of the ISPs in our study amass large pools of sensitive data, and that their uses of such data could lead to significant harms, particularly when consumers are classified by demographic characteristics, such as race, ethnicity, gender, or sexuality. Although several of the ISPs in our study purported to offer consumers access to their data and choices as to their use and deletion, those choices were largely illusory, and sometimes even nudged consumers toward more data sharing. This further demonstrates the importance of restricting the collection and uses of data, rather than allowing ISPs to dictate how consumers’ information is used by obscuring how they will use their information. Unfortunately, these data practices and abuses mirror problems across other industries, including significantly, edge providers.
gigel82 5y ago
I'm using a PiHole that does DNS queries over a VPN, but unfortunately with almost no-one supporting ESNI I still leak all the domains in plain-text (so it doesn't help with privacy from ISP snooping, just with blocking many ad-domains at the DNS level). Not sure what can be done here, I don't want to VPN all my traffic. It's a losing battle, this needs support from the other side; break up ISPs and pass legislation to outlaw this kind of intrusive data collection.
- egberts1 5y ago
  that’s why you WireGuard your DNS at the home router and forward your DNS queries to your VPS’s nameserver. Completely bypasses ISP sniffers.
  - gigel82 5y ago
    It bypasses the DNS requests, yes (which is what I'm doing with PiHole over VPN already). But later when your browser actually connects to the IP address PiHole DNS gave it, it will send the domain name in plain-text (look up SNI and the proposed fix to that, ESNI).
    - egberts1 5y ago
      Feh
    - LinuxBender 5y ago
      In this particular case, use the VPN or ssh forwarding to route your web traffic out of a VM or rented server. Then 100% of your traffic is invisible to your ISP. If using an open source VPN like tinc [1] that does user-space dynamic mesh routing you can even route out of a different node than the one you are talking to making correlation attacks less easy. This can also be done with multiple ssh forwarding tunnels. SSH tunnels should work from your PiHole. [1] - https://www.tinc-vpn.org/ https://www.tinc-vpn.org/

45 points by KoftaBob 5y ago

Conclusion: The findings from our report show that many of the ISPs in our study amass large pools of sensitive data, and that their uses of such data could lead to significant harms, particularly when consumers are classified by demographic characteristics, such as race, ethnicity, gender, or sexuality. Although several of the ISPs in our study purported to offer consumers access to their data and choices as to their use and deletion, those choices were largely illusory, and sometimes even nudged consumers toward more data sharing. This further demonstrates the importance of restricting the collection and uses of data, rather than allowing ISPs to dictate how consumers’ information is used by obscuring how they will use their information. Unfortunately, these data practices and abuses mirror problems across other industries, including significantly, edge providers.

gigel82 5y ago

I'm using a PiHole that does DNS queries over a VPN, but unfortunately with almost no-one supporting ESNI I still leak all the domains in plain-text (so it doesn't help with privacy from ISP snooping, just with blocking many ad-domains at the DNS level). Not sure what can be done here, I don't want to VPN all my traffic. It's a losing battle, this needs support from the other side; break up ISPs and pass legislation to outlaw this kind of intrusive data collection.

egberts1 5y ago
that’s why you WireGuard your DNS at the home router and forward your DNS queries to your VPS’s nameserver. Completely bypasses ISP sniffers.
- gigel82 5y ago
  It bypasses the DNS requests, yes (which is what I'm doing with PiHole over VPN already). But later when your browser actually connects to the IP address PiHole DNS gave it, it will send the domain name in plain-text (look up SNI and the proposed fix to that, ESNI).
  - egberts1 5y ago
    Feh
  - LinuxBender 5y ago
    In this particular case, use the VPN or ssh forwarding to route your web traffic out of a VM or rented server. Then 100% of your traffic is invisible to your ISP. If using an open source VPN like tinc [1] that does user-space dynamic mesh routing you can even route out of a different node than the one you are talking to making correlation attacks less easy. This can also be done with multiple ssh forwarding tunnels. SSH tunnels should work from your PiHole. [1] - https://www.tinc-vpn.org/ https://www.tinc-vpn.org/