3 ms·

The way I look at it is that my ISP is very open about collecting and selling "anonymized" data based on users' internet usage. On the other hand, a reputable

The way I look at it is that my ISP is very open about collecting and selling "anonymized" data based on users' internet usage. On the other hand, a reputable VPN provider has everything to lose if word got out that they collect or sell information. The privacy calculus is: 100% chance vs some small chance.

GoofballJones 2y ago
Legit question: What can an ISP collect when most of the time I'm going to secure "https:" websites? I mean, they can only see the website I'm going to, but not what is going on there, right? Is just collecting where people are going that lucrative to sell?
- agieocean 2y ago
  That + other data can be used to build a behavorial profile so it's not what your ISP is doing necessarily but what the people they sell the data to are doing with it (or the people they sell to)
- lordofgibbons 2y ago
  There's what websites/apps you use, but also your behavior patterns. Are you a night owl? How often do you check some website or app. I'm sure there's a lot of other information they do gather based on the "metadata"
  - eviks 2y ago
    Vpns wouldn't hide the fact you're a night owl, though? The fact of traffic+time is still visible to the ISP?
    - wiseowise 2y ago
      VPN will hide what you’re doing at night, though.
- eptcyka 2y ago
  DNS records and net flow data. They can also inject JS in http sites, hijack domaijs to do the same, do traffic shaping. But I am biased, I work for a VPN company.
- 112233 2y ago
  Not what they can, what they MUST as required by law. Assuming US, see DTA aka CALEA - at any time little green men with a warrant can ask for tranparrent packet capture of ISP client's traffic. Also, in many places (Europa) there is collection and retention requirements for ISPs.
- Spooky23 2y ago
  The DNS data is super useful for developing a demographic profile. For example, they could pretty trivially assert with high confidence that a pregnant woman is in your home or that you’re shopping for a car. The tinfoil hat scenarios are interesting as well.
Salgat 2y ago
That's assuming the financial incentivize of an intelligence agency is not sufficient to cover the risk.
threecheese 2y ago
Even if the VPN provider is doing something naughty-ish, just decoupling netflow info from your IRL id/address/financials/probably TV habits info has value. Even if you can’t control the usage of behavior data by multiple organizations, you can try to “anonymize” it at the boundaries between them. Indirection, to minimize how much becomes associated with your identity. Really only valid for individual company adversaries though, depends on your threat model I guess. Edit: it’s sad that I need a threat model

GoofballJones 2y ago

Legit question: What can an ISP collect when most of the time I'm going to secure "https:" websites? I mean, they can only see the website I'm going to, but not what is going on there, right? Is just collecting where people are going that lucrative to sell?

agieocean 2y ago
That + other data can be used to build a behavorial profile so it's not what your ISP is doing necessarily but what the people they sell the data to are doing with it (or the people they sell to)
lordofgibbons 2y ago
There's what websites/apps you use, but also your behavior patterns. Are you a night owl? How often do you check some website or app. I'm sure there's a lot of other information they do gather based on the "metadata"
- eviks 2y ago
  Vpns wouldn't hide the fact you're a night owl, though? The fact of traffic+time is still visible to the ISP?
  - wiseowise 2y ago
    VPN will hide what you’re doing at night, though.
eptcyka 2y ago
DNS records and net flow data. They can also inject JS in http sites, hijack domaijs to do the same, do traffic shaping. But I am biased, I work for a VPN company.
112233 2y ago
Not what they can, what they MUST as required by law. Assuming US, see DTA aka CALEA - at any time little green men with a warrant can ask for tranparrent packet capture of ISP client's traffic. Also, in many places (Europa) there is collection and retention requirements for ISPs.
Spooky23 2y ago
The DNS data is super useful for developing a demographic profile. For example, they could pretty trivially assert with high confidence that a pregnant woman is in your home or that you’re shopping for a car. The tinfoil hat scenarios are interesting as well.

Salgat 2y ago

That's assuming the financial incentivize of an intelligence agency is not sufficient to cover the risk.

threecheese 2y ago

Even if the VPN provider is doing something naughty-ish, just decoupling netflow info from your IRL id/address/financials/probably TV habits info has value. Even if you can’t control the usage of behavior data by multiple organizations, you can try to “anonymize” it at the boundaries between them. Indirection, to minimize how much becomes associated with your identity. Really only valid for individual company adversaries though, depends on your threat model I guess. Edit: it’s sad that I need a threat model