3 ms·

"They cannot store your browsing data for most major websites" That "most" is doing a hell of a lot of work there.

by chaps 2y ago

kbolino 2y ago
I don't think it is; I think "major" is doing the work. Damn near all major websites are using TLS now. Support for eSNI is probably a lot lower though (see sibling comment).
- chaps 2y ago
  Okay then, why focus on major sites? Surely we should care about minor sites as well..?
  - kbolino 2y ago
    Because that accounts for 99% of Internet traffic? If you're doing something outside of the norm, and you don't want others to know about it, you should probably exercise good browsing hygiene, regardless of whether your ISP is commercial or municipal.
    - chaps 2y ago
      Does it though? You weren't able to find statistics of the adoptions you mentioned ;) Sure, WE can exercise good browsing hygiene... but what about someone who's the victim of domestic violence and don't have that option? Or kids who aren't technical and need to raise a major issue. Or an older grandma who hasn't owned a computer in years. It's very easy to say "just do X, just do Y" when you're not in their shoes and only talking in these abstract "EHHH, 99% is good enough." terms I hope some day you can see where I'm coming here, but I'm not holding my breath. Good day.
      - hiatus 2y ago
        Your whole premise is that some other person's data may be released under a FOIA request with data surfaced in error, yet you demand rigor from commenters responding to you when you provide no evidence yourself of the potential issue.
        chaps 2y ago
        I'm not sure what your comment is digging at. Are you asking me to give you examples where the wrong data was leaked through FOIA? Because if so, -- https://mchap.io/that-time-the-city-of-seattle-accidentally-gave-me-32m-emails-for-40-dollars4997.html https://mchap.io/that-time-the-city-of-seattle-accidentally-... It's not even an uncommon issue. I'm currently dealing with a large local police department who released to me thousands of peoples' SSNs, finger print hash, tattoos, etc etc from ALPR data in a FOIA lawsuit where I was co-plaintiff. They saw no problem with it and asked us if we expected them to redact the info. So yeah, I fully expect somebody to fuck up at some point.
        deleted 2y ago
        [deleted]
        kbolino 2y ago
        It's not that your concerns about FOIA are invalid as such, it's just that the data any ISP, as we understand the term in the West, can collect is quite limited. On-device history, browser telemetry, leaks from websites themselves, etc are all richer targets for monitoring and deanonymization.
      - kbolino 2y ago
        For the vast majority of Internet traffic, ISPs will not have access to encrypted information, which includes everything except the IP address and domain name. With the additional technologies which I said upfront aren't as common, they wouldn't even have the domain name except by guessing. If you think TLS adoption is low across the Internet in 2024 then I think the burden of proof is on you.

"They cannot store your browsing data for most major websites" That "most" is doing a hell of a lot of work there.

by chaps 2y ago

"They cannot store your browsing data for most major websites" That "most" is doing a hell of a lot of work there.

I don't think it is; I think "major" is doing the work. Damn near all major websites are using TLS now. Support for eSNI is probably a lot lower though (see sibling comment).

chaps 2y ago
Okay then, why focus on major sites? Surely we should care about minor sites as well..?
- kbolino 2y ago
  Because that accounts for 99% of Internet traffic? If you're doing something outside of the norm, and you don't want others to know about it, you should probably exercise good browsing hygiene, regardless of whether your ISP is commercial or municipal.
  - chaps 2y ago
    Does it though? You weren't able to find statistics of the adoptions you mentioned ;) Sure, WE can exercise good browsing hygiene... but what about someone who's the victim of domestic violence and don't have that option? Or kids who aren't technical and need to raise a major issue. Or an older grandma who hasn't owned a computer in years. It's very easy to say "just do X, just do Y" when you're not in their shoes and only talking in these abstract "EHHH, 99% is good enough." terms I hope some day you can see where I'm coming here, but I'm not holding my breath. Good day.
    - hiatus 2y ago
      Your whole premise is that some other person's data may be released under a FOIA request with data surfaced in error, yet you demand rigor from commenters responding to you when you provide no evidence yourself of the potential issue.
      - chaps 2y ago
        I'm not sure what your comment is digging at. Are you asking me to give you examples where the wrong data was leaked through FOIA? Because if so, -- https://mchap.io/that-time-the-city-of-seattle-accidentally-gave-me-32m-emails-for-40-dollars4997.html https://mchap.io/that-time-the-city-of-seattle-accidentally-... It's not even an uncommon issue. I'm currently dealing with a large local police department who released to me thousands of peoples' SSNs, finger print hash, tattoos, etc etc from ALPR data in a FOIA lawsuit where I was co-plaintiff. They saw no problem with it and asked us if we expected them to redact the info. So yeah, I fully expect somebody to fuck up at some point.
        deleted 2y ago
        [deleted]
        kbolino 2y ago
        It's not that your concerns about FOIA are invalid as such, it's just that the data any ISP, as we understand the term in the West, can collect is quite limited. On-device history, browser telemetry, leaks from websites themselves, etc are all richer targets for monitoring and deanonymization.
    - kbolino 2y ago
      For the vast majority of Internet traffic, ISPs will not have access to encrypted information, which includes everything except the IP address and domain name. With the additional technologies which I said upfront aren't as common, they wouldn't even have the domain name except by guessing. If you think TLS adoption is low across the Internet in 2024 then I think the burden of proof is on you.