5 ms·

Records are useful for running operations and debugging issues. You can shorten the retention of them, but eliminating them altogether would significantly degra

Records are useful for running operations and debugging issues. You can shorten the retention of them, but eliminating them altogether would significantly degrade the quality of service over long periods of time. However, there is a major misunderstanding about the kinds of records ISPs can keep. They cannot store your browsing data for most major websites, because they don't have it. Widespread use of SSL/TLS along with the rollout of eSNI and DNS over HTTPS means the most interesting details of your browsing are encrypted. "Customer A sent 57 and received 94 packets to/from IP W.X.Y.Z on YYYY-MM-DD" is certainly not full anonymity but it's not hardly the detailed breakdown that "browsing history" implies.

chaps 2y ago
"They cannot store your browsing data for most major websites" That "most" is doing a hell of a lot of work there.
- kbolino 2y ago
  I don't think it is; I think "major" is doing the work. Damn near all major websites are using TLS now. Support for eSNI is probably a lot lower though (see sibling comment).
  - chaps 2y ago
    Okay then, why focus on major sites? Surely we should care about minor sites as well..?
    - kbolino 2y ago
      Because that accounts for 99% of Internet traffic? If you're doing something outside of the norm, and you don't want others to know about it, you should probably exercise good browsing hygiene, regardless of whether your ISP is commercial or municipal.
      - chaps 2y ago
        Does it though? You weren't able to find statistics of the adoptions you mentioned ;) Sure, WE can exercise good browsing hygiene... but what about someone who's the victim of domestic violence and don't have that option? Or kids who aren't technical and need to raise a major issue. Or an older grandma who hasn't owned a computer in years. It's very easy to say "just do X, just do Y" when you're not in their shoes and only talking in these abstract "EHHH, 99% is good enough." terms I hope some day you can see where I'm coming here, but I'm not holding my breath. Good day.
        hiatus 2y ago
        Your whole premise is that some other person's data may be released under a FOIA request with data surfaced in error, yet you demand rigor from commenters responding to you when you provide no evidence yourself of the potential issue.
        chaps 2y ago
        I'm not sure what your comment is digging at. Are you asking me to give you examples where the wrong data was leaked through FOIA? Because if so, -- https://mchap.io/that-time-the-city-of-seattle-accidentally-gave-me-32m-emails-for-40-dollars4997.html https://mchap.io/that-time-the-city-of-seattle-accidentally-... It's not even an uncommon issue. I'm currently dealing with a large local police department who released to me thousands of peoples' SSNs, finger print hash, tattoos, etc etc from ALPR data in a FOIA lawsuit where I was co-plaintiff. They saw no problem with it and asked us if we expected them to redact the info. So yeah, I fully expect somebody to fuck up at some point.
        deleted 2y ago
        [deleted]
        kbolino 2y ago
        It's not that your concerns about FOIA are invalid as such, it's just that the data any ISP, as we understand the term in the West, can collect is quite limited. On-device history, browser telemetry, leaks from websites themselves, etc are all richer targets for monitoring and deanonymization.
gruez 2y ago
>Records are useful for running operations and debugging issues. What type of sensitive logs would you want to keep for "running operations and debugging issues"? >Widespread use of SSL/TLS along with the rollout of eSNI and DNS over HTTPS means the most interesting details of your browsing are encrypted. What's the adoption rate for eSNI? My impression is that most sites still don't use it. >"Customer A sent 57 and received 94 packets to/from IP W.X.Y.Z on YYYY-MM-DD" is certainly not full anonymity but it's not hardly the detailed breakdown that "browsing history" implies. It could be pretty bad if it's shows you as using grindr.com or whatever.
- kbolino 2y ago
  Yes, especially without eSNI (which is probably not that widely used, though I can't find good data one way or another), you can generally figure out that an IP address correlates with a specific website, but that's it. You don't know what they did on that website, you can't break their pseudonymity, etc.
  - tialaramex 2y ago
    > which is probably not that widely used, though I can't find good data one way or another Which is exactly to be expected. If you could tell how widely it's actually used that's a problem. Encrypted Client Hello (the successor which was actually deployed) is GREASEd so that a client which could do ECH and a client which is doing ECH look the same to outsiders. The server knows which is which, but of course the server already knows that it enabled (or did not) ECH.
    - kbolino 2y ago
      I did not know about ECH, but that makes sense. Glad to hear there's a better solution getting real adoption.
    - gruez 2y ago
      You're assuming this information has to be collected by the ISPs, but it's very easily collected by browser makers (via telemetry) or by CDN/sites themselves. If either end of the TLS connection is collecting the data, there won't be the issue that you described.
tialaramex 2y ago
> Records are useful for running operations and debugging issues I don't buy that for a moment. My ISP collects a lot of low-level information, but they don't need and don't collect the sort of information we're discussing here. The individual users have actual hard links (or very rarely, some sort of radio) to somewhere and for that I agree you want diagnostics. "Sorry Ma'am I see your fibre went dark 18 minutes and 47 seconds ago, we'll have a technician out to investigate tomorrow morning". But the IP stuff is just bits, "You use Netflix a lot" isn't "useful for running operations" it's marketable information, it's collected because you can make money.
- kbolino 2y ago
  Even if a municipal ISP isn't trying to make money, deciding what infrastructure to run and how much of it needs data. "30% of all traffic is coming from Netflix" (which I think was true for a short while) is an input to the decision to install a Netflix CDN cache box closer to the end users.
  - gruez 2y ago
    ASN/IP block level based aggregation will provide the information needed without requiring traffic data on a ip/site level. Moreover, there's no reason to keep any of this information on a per-customer basis.
    - kbolino 2y ago
      In the era of virtual servers, cloud infrastructure, CDNs, etc., ASNs and IP blocks are not necessarily that helpful. Which is kind of back to my original point: it's not 2005 anymore.
      - tialaramex 2y ago
        Start with a problem you actually have, rather than beginning with the destination "We're going to snoop on all the customers" and then trying to think of a reason why that's a good idea. Maybe you'll get to the same destination but I very much doubt it. Of course, if your starting goal was to snoop on the customers and you were just looking for an excuse...

chaps 2y ago

"They cannot store your browsing data for most major websites" That "most" is doing a hell of a lot of work there.

kbolino 2y ago
I don't think it is; I think "major" is doing the work. Damn near all major websites are using TLS now. Support for eSNI is probably a lot lower though (see sibling comment).
- chaps 2y ago
  Okay then, why focus on major sites? Surely we should care about minor sites as well..?
  - kbolino 2y ago
    Because that accounts for 99% of Internet traffic? If you're doing something outside of the norm, and you don't want others to know about it, you should probably exercise good browsing hygiene, regardless of whether your ISP is commercial or municipal.
    - chaps 2y ago
      Does it though? You weren't able to find statistics of the adoptions you mentioned ;) Sure, WE can exercise good browsing hygiene... but what about someone who's the victim of domestic violence and don't have that option? Or kids who aren't technical and need to raise a major issue. Or an older grandma who hasn't owned a computer in years. It's very easy to say "just do X, just do Y" when you're not in their shoes and only talking in these abstract "EHHH, 99% is good enough." terms I hope some day you can see where I'm coming here, but I'm not holding my breath. Good day.
      - hiatus 2y ago
        Your whole premise is that some other person's data may be released under a FOIA request with data surfaced in error, yet you demand rigor from commenters responding to you when you provide no evidence yourself of the potential issue.
        chaps 2y ago
        I'm not sure what your comment is digging at. Are you asking me to give you examples where the wrong data was leaked through FOIA? Because if so, -- https://mchap.io/that-time-the-city-of-seattle-accidentally-gave-me-32m-emails-for-40-dollars4997.html https://mchap.io/that-time-the-city-of-seattle-accidentally-... It's not even an uncommon issue. I'm currently dealing with a large local police department who released to me thousands of peoples' SSNs, finger print hash, tattoos, etc etc from ALPR data in a FOIA lawsuit where I was co-plaintiff. They saw no problem with it and asked us if we expected them to redact the info. So yeah, I fully expect somebody to fuck up at some point.
        deleted 2y ago
        [deleted]
        kbolino 2y ago
        It's not that your concerns about FOIA are invalid as such, it's just that the data any ISP, as we understand the term in the West, can collect is quite limited. On-device history, browser telemetry, leaks from websites themselves, etc are all richer targets for monitoring and deanonymization.

gruez 2y ago

>Records are useful for running operations and debugging issues. What type of sensitive logs would you want to keep for "running operations and debugging issues"? >Widespread use of SSL/TLS along with the rollout of eSNI and DNS over HTTPS means the most interesting details of your browsing are encrypted. What's the adoption rate for eSNI? My impression is that most sites still don't use it. >"Customer A sent 57 and received 94 packets to/from IP W.X.Y.Z on YYYY-MM-DD" is certainly not full anonymity but it's not hardly the detailed breakdown that "browsing history" implies. It could be pretty bad if it's shows you as using grindr.com or whatever.

kbolino 2y ago
Yes, especially without eSNI (which is probably not that widely used, though I can't find good data one way or another), you can generally figure out that an IP address correlates with a specific website, but that's it. You don't know what they did on that website, you can't break their pseudonymity, etc.
- tialaramex 2y ago
  > which is probably not that widely used, though I can't find good data one way or another Which is exactly to be expected. If you could tell how widely it's actually used that's a problem. Encrypted Client Hello (the successor which was actually deployed) is GREASEd so that a client which could do ECH and a client which is doing ECH look the same to outsiders. The server knows which is which, but of course the server already knows that it enabled (or did not) ECH.
  - kbolino 2y ago
    I did not know about ECH, but that makes sense. Glad to hear there's a better solution getting real adoption.
  - gruez 2y ago
    You're assuming this information has to be collected by the ISPs, but it's very easily collected by browser makers (via telemetry) or by CDN/sites themselves. If either end of the TLS connection is collecting the data, there won't be the issue that you described.

tialaramex 2y ago

> Records are useful for running operations and debugging issues I don't buy that for a moment. My ISP collects a lot of low-level information, but they don't need and don't collect the sort of information we're discussing here. The individual users have actual hard links (or very rarely, some sort of radio) to somewhere and for that I agree you want diagnostics. "Sorry Ma'am I see your fibre went dark 18 minutes and 47 seconds ago, we'll have a technician out to investigate tomorrow morning". But the IP stuff is just bits, "You use Netflix a lot" isn't "useful for running operations" it's marketable information, it's collected because you can make money.

kbolino 2y ago
Even if a municipal ISP isn't trying to make money, deciding what infrastructure to run and how much of it needs data. "30% of all traffic is coming from Netflix" (which I think was true for a short while) is an input to the decision to install a Netflix CDN cache box closer to the end users.
- gruez 2y ago
  ASN/IP block level based aggregation will provide the information needed without requiring traffic data on a ip/site level. Moreover, there's no reason to keep any of this information on a per-customer basis.
  - kbolino 2y ago
    In the era of virtual servers, cloud infrastructure, CDNs, etc., ASNs and IP blocks are not necessarily that helpful. Which is kind of back to my original point: it's not 2005 anymore.
    - tialaramex 2y ago
      Start with a problem you actually have, rather than beginning with the destination "We're going to snoop on all the customers" and then trying to think of a reason why that's a good idea. Maybe you'll get to the same destination but I very much doubt it. Of course, if your starting goal was to snoop on the customers and you were just looking for an excuse...