13 ms·

The solution here shouldn't be technical; it should be legal. If we rely on the technical path, Comcast can achieve the same by how many active IPv6 addresses

• dylan604 1y ago
  What if I left my device at home?
  • aspenmayer 1y ago
    With enough signals, gait recognition for example is possible, and those same signals could be corroborated with presence or absence of concomitant device signals to determine if your device is moving with your person, and if not, to then flag this for enhanced monitoring if evasion is suspected.
    • landl0rd 1y ago
      The point is every single thing I own should be "on my side". My car should not store my location history. My wifi router should not track presence and movement. My printer should not add any watermarks or telltale dots. My stuff should actively make it difficult or impossible for hackers, advertisers, or law enforcement to recover any useful information. This means, respectively: ensure personal info is stored securely so hackers can recover little. Don't transmit info to remote servers to limit what advertisers get. And just store as little as possible in the first place because this is the legal means to have little to subpoena or discover. Useful info, when absolutely necessary, should be locked behind a password, as constitutional rights preclude law enforcement from making someone disclose it.
      • aspenmayer 1y ago
        This is magical thinking, because it’s using the legal system to solve a technical and social problem. It’s probably possible to create standards that don’t leak PII and other forms of metadata that are unique. That is probably the only solution going forward to reduce possible interdiction by extralegal third parties. However, Comcast can only be enjoined from doing this legally, and will likely not do anything that isn’t implemented by standards bodies, such as WiFi standards. The fact that these capabilities are available to Comcast corporate is because OEMs that make set top cable receivers and combination cable modem WiFi routers provide these capabilities. I’m not sure if these features are standard or require a special order. Once Comcast has the data, it is available to law enforcement via the Third Party Doctrine, which isn’t going away anytime soon.
        • dylan604 1y ago
          These companies are so big now, and more importantly their lobbyists are, that it is unlikely any regulations would ever come that would limit their abilities to make money off of your PII.
          • aspenmayer 1y ago
            All these already existing dragnets make oldies like the Clipper Chip seem like a weekend hackathon project. The irony is that all of these metadata leaks and correlation attacks etc were theoretical at the time these technologies were created and developed, unless you’re NSA level compute power, both human and silicon. Now, any script kid has enough info to try to build an array of SDRs to do the same thing, and no one will care when they do besides the feds who cry foul about their turf being stepped on by plebeians. The public will never care because their eyes will already have glazed over once you mention MAC addresses and SSIDs.
            • fc417fc802 1y ago
              > any script kid has enough info to try to build an array of SDRs to do the same thing It doesn't particularly matter what hobbyists get up to. It matters what's available at scale on the mass market, what's widely deployed, what data is legally permissible to collect on a large scale, and what data is legal to sell. Law enforcement can't subpoena that which does not exist. The best defense to these sorts of things is often to place legal limits on collection, retention, and sale. Your take is both alarmist and defeatist.
    • dylan604 1y ago
      when I'm at home, my device is just sitting on the desk. rarely is it in my actual hand being carried with me. also i'm old, so i don't have it in my hand while sitting on the couch or in bed either. that's why my laptop is for. something with a real keyboard and screen and not something that's going to give me scoliosis for hunching over to read all the damn time
  • matthew-wegner 1y ago
    It would work even better. From the linked support page: "Motion is detected based on the amount of signal disruption taking place between the Xfinity Gateway and your selected WiFi-connected devices, so motion from small pets (around 40 pounds or less) can be filtered out while keeping you notified of large movements more likely to be caused by humans."
• baggachipz 1y ago
  > I can't imagine a world where Congress could actually achieve something that widely helpful for regular citizens. "Best we can do is letting all the AI companies hoover up your data too"
• timewizard 1y ago
  It doesn't require IPv6. The modem is just as aware of all the private IPv4 addresses on your network as well as all the public IPv6 ones. Unless you put your own gateway (layer 3 switch, wifi ap, linux router) in front of it.
  • frollogaston 1y ago
    That would require Comcast to have access to your router, or more precisely, the NAT.
    • nemomarx 1y ago
      Comcast sells a router gateway combination device that's probably required for this motion sensing anyway. If you have that they could already check device counts and in fact their Xfinity app lists connected devices in detail.
    • timewizard 1y ago
      For most people their Comcast modem _is_ their router.
      • frollogaston 1y ago
        The point of the comment about ipv6 is that if you don't use a Comcast modem/router or they're prohibited by law from snooping on that, Comcast can still sorta understand the number of users from the outside by looking at your ipv6 addresses.
        • timewizard 1y ago
          I understand they can do traffic analytics but with privacy extensions and the proliferation of IoT devices I don't think that level of analysis is going to be very fine. Probably just enough to bin houses into different size groups. There are a multitude of pre-existing ways of achieving the same result. One would be simply looking at the ft^2 listed on the public tax documents for the given address. So I was really assuming any useful analysis would require them to be the actual man in the middle by owning and controlling your router. In which case address family does not matter.
• Aurornis 1y ago
  > The solution here shouldn't be technical; it should be legal. The parent commenter was highlighting that law enforcement can compel them to provide the data. The customer has to opt-in to WiFi motion sensing to have the data tracked. If you see something appear in an app, you should assume law enforcement can compel the company to provide that data. It's not really a surprise. > If we rely on legal protection, then not only Comcast, but all ISPs will be prohibited from spying on their customers. To be clear, the headline on HN is editorialized. The linked article is instructions for opting in to WiFi motion sensing and going through the setup and calibration. It's a feature they provide for customers to enable and use for themselves.
  • tehwebguy 1y ago
    > The customer has to opt-in to WiFi motion sensing to have the data tracked. Not for long, there’s money to be made by adding this to the cops’ customer lookup portal.
    • bigbuppo 1y ago
      There's money to be made by selling this to advertisers.
  • jonhohle 1y ago
    “Please accept our new terms of service to continue using your internet connection” Your honor, they clearly opted in to us spying on absolutely everything they do or think.
  • godelski 1y ago
    > The customer has to opt-in to WiFi motion sensing to have the data tracked. - Is this true if Law Enforcement gets a subpoena? - Is this true if Law Enforcement asks "nicely"? - Can Xfinity activate it without the user knowing? - Does it explicitly notify the user when the setting has been changed? (e.g. done by LE, hacker, or an abusive partner) - Is this a promise and a promise that by default it will stay off? - Is the code to perform this feature pre-installed and able to be trivially (or even non-trivially) activated by hackers? Idk, there's a lot of questionable things here and Xfinity doesn't have the best track record that gives me a lot of confidence that we should trust them. This seems like an easily abused system that can do a lot of harm while provides very little utility to the vast majority of people.
• frollogaston 1y ago
  Ipv6? I ain't enabling that anyway
• oliwarner 1y ago
  > The solution here shouldn't be technical; it should be legal Technical solutions tend to last longer. Legal solutions have a habit of being ignored when they become inconvenient. The legal default should be that collecting this sort of data should always be illegal without informed consent and never used beyond the remit of that consent. As inconvenient as it sometimes is, the world needs GDPR.
• armchairhacker 1y ago
  > The solution here shouldn't be technical; it should be legal. I disagree. Solutions should be technical whenever possible, because in practice, laws tend to be abused and/or not enforced. Laws also need resources and cooperation to be enforced, and some laws are hard to enforce without creating backdoors or compromising other rights. "ISPs will be prohibited from spying on their customers" doesn't mean ISPs won't spy on their customers.
  • account42 1y ago
    The legal part should be requiring a technical solution. E.g. the you should be able to own your router and even if you choose to rent you should have full control over the software.
  • transpute 1y ago
    We need more funding for open-source WiFi Sensing counter-measures, e.g. EU research, https://ans.unibs.it/projects/csi-murder/ https://ans.unibs.it/projects/csi-murder/ > this paper addressed passive attacks, where the attacker controls only a receiver, but exploits the normal Wi-Fi traffic. In this case, the only useful traffic for the attacker comes from transmitters that are perfectly fixed and whose position is well known and stable, so that the NN can be trained in advance, thus the obfuscator needs to be installed only in APs or similar ‘infrastructure’ devices. Active attacks, where the attacker controls both the transmitter and the receiver are another very interesting research area, where, however, privacy protection cannot be based on randomization at the transmitter. https://github.com/ansresearch/csi-murder/ https://github.com/ansresearch/csi-murder/ > The experimental results obtained in our laboratory show that the considered localization method (first proposed in an MSc thesis) works smoothly regardless of the environment, and that adding random information to the CSI mess up the localization, thus providing the community with a system that preserve location privacy and communication performance at the same time.
  • taneq 1y ago
    It might make it a bit harder to use the information obtained through spying, though. Both is good.
  • 1y ago
• hamhock666 1y ago
  > ... I can't imagine a world where Congress could actually achieve something that widely helpful for regular citizens. The solution is to not use the internet if you care about your privacy.
  • kevin_thibedeau 1y ago
    We are now treating foreign students with suspicion when they don't have a satisfactory internet footprint. Only a matter of time until that gets turned against the citizenry. Submit to surveillance capitalism or go to jail you deviant.
    • pixl97 1y ago
      Heh, soon your modem will report to the SS on how many undesirables you are sheltering in your home. Us humans love building the Torment Nexus.
• slt2021 1y ago
  just buy your own simple modem and install your own wireless access point. do not buy any device from comcast you dont fully control!
  • jitl 1y ago
    Also make sure your phone and other every day carry items never connect to the Internet via your ISP’s network or emit radio signals while nearby your home.
  • class3shock 1y ago
    Until the day when to use the service you have to use their device. Or it's being used at work, a hotel, in stores, in your kids school, or anywhere you have no say on the devices used.
• sandworm101 1y ago
  >> The solution here shouldn't be technical The solution can be technical, but only if it is also sneaky. Blocking or disallowing certain information is one thing but making that information worthless is better. A simple AI agent could pretend to ping all sorts of services. It could even do some light websurfing. This fake traffic would nullify any value from the real traffic, destroying the market that feeds this surveillance industry. I see a UI that allows homeowners to fake certain people being in the house when they are not, either replaying traffic or a selection of generic bots that mimic the traffic of various cohorts.
• jvanderbot 1y ago
  In the future when you say things like this, please say "First" or else you're starting an endless back-and-forth of one-ups and false dichotomies. A legal precedent easily leads to a technical block.
• giantg2 1y ago
  "The solution here shouldn't be technical; it should be legal." Laws can be broken. Laws of physics cannot. Best to utilize both a legal and physical defense.
• dcow 1y ago
  We suffer from a problem that engineers want nothing to do with politics. I 1000% agree we need a digital bill of rights. It pains me every time a “well behaved” website pops up a cookie consent banner for the billionth time after I already consented because the browser wiped all the persistent user identifiers available to it. For my protection -_- I want privacy codified in human law. I didn't vote for standards bodies to pave the road to hell by removing every goddamned persistent handle we can find from existence. I didn't vote for the EU to reinvent an internet worse than popup ads by attacking the symptoms not the cause. I would rather have the internet of the 2000s back in a heartbeat than keep putting up with shitty “technical solutions” to corporations having too much power at scale. I don’t care if people break the law: prosecute them when they do and make the punishments enough to deter future law breakers. There is absolutely something civilized beyond a lawless advertising wild west where the technical solution is to all be masked Zorros. Why is it that if someone said “we need a legal solution to gun violence” the people that say “no we need a technical solution all people should wear kevlar and carry 9mm pistols” are considered the lunatics but when we ask for a legal solution to rampant non-consensual tracking for the purpose of indoctrinating the consumer class with propaganda we all laugh and say bah the solution must be technical? I don’t get it.
  • reissbaker 1y ago
    What law would you propose? I think the hard part is "Instagram and TikTok remain free-with-ads."
    • nerdsniper 1y ago
      Would ads still be worth enough if they were targeted based on things like what you watch/read/follow/subscribe to on that platform and your general location? Or can instagram only be free if ads are targeted to detailed profiles of individuals built over decades as they are tracked across the whole internet?
      • chronogram 1y ago
        The heavily profiled ads cost a lot more money for the advertiser to run compared to traditional ads, if those platforms turn to contextual ads they do not have their special expensive profiled ads product to sell anymore. So it's not about the perceived effectiveness of advertisements that you feel as a user, it's about the rather more unique product that they sell to advertisers that really raises their revenue.
• devwastaken 1y ago
  you cant tell most of those things because same ip doesnt coorespond to a unique service and plenty of programs and websites phone to servers where addresses have changed. there is no static database. you also cant associate it to a person automatically. the burden of proof is high - how many jurors have tech at home they know nothing about and maybe got hacked?
• wyager 1y ago
  > The solution here shouldn't be technical; it should be legal. The technical solution seems strictly preferable Legal "protections" only protect you up the moment a warrant is issued, if that
• mindcrime 1y ago
  > The solution here shouldn't be technical; it should be legal. I expect more than a few commenters here will disagree with you. Some rather vehemently. To those that do so, I'd encourage you to read the novel Attack Surface by Cory Doctorow. While it's fiction, in the book, Doctorow makes a pretty compelling argument for the notion that when it comes to privacy, we can't win by "out tech'ing" the governments and corporations. We're simply too heavily out-resourced. If I'm interpreting his message correctly, he is saying basically what Josho is saying here: that we have to use the political/legal system to get the privacy protections that we care about enshrined into law and properly enforced. Now, is that going to be easy? Hell no. But after reading the book I was largely sold on the idea, FWIW. That said, the two approaches aren't necessarily mutually exclusive. But I do believe that those of us who care about privacy should focus more on using our (knowledge|skills|resources) to try to foster change through politics, than on trying to beat "them" with better tech. YMMV, of course. But if you haven't read the book, at least consider giving it a shot. Probably Doctorow makes the argument better than I can.
• pdonis 1y ago
  > The solution here shouldn't be technical Why not? Just run your own router instead of the one your ISP tries to give you.
• like_any_other 1y ago
  > The solution here shouldn't be technical; it should be legal. It should be both, one serving as a backup to the other. Theft is illegal, yet we lock our doors.
• preisschild 1y ago
  > Comcast can achieve the same by how many active IPv6 addresses are in use Isn't this basically impossible with IPv6 Privacy Extension Addresses?
• WhyNotHugo 1y ago
  In the EU, residential users have a right to use their own routers. IMHO, this should be the norm, and ISPs shouldn't be shipping routers to users. Problem is, most folks aren't aware of how much spying the ISP routers do, and they want the most easy and convenient choice. Hence the status quo.
  • rank0 1y ago
    Same in the US! Unfortunately, only the nerdiest nerds do things like buy their own routers...and that sort of thing is pretty much impossible to evangelize.