4 ms·

> The solution here shouldn't be technical; it should be legal. I disagree. Solutions should be technical whenever possible, because in practice, laws tend to

> The solution here shouldn't be technical; it should be legal. I disagree. Solutions should be technical whenever possible, because in practice, laws tend to be abused and/or not enforced. Laws also need resources and cooperation to be enforced, and some laws are hard to enforce without creating backdoors or compromising other rights. "ISPs will be prohibited from spying on their customers" doesn't mean ISPs won't spy on their customers.

account42 1y ago
The legal part should be requiring a technical solution. E.g. the you should be able to own your router and even if you choose to rent you should have full control over the software.
transpute 1y ago
We need more funding for open-source WiFi Sensing counter-measures, e.g. EU research, https://ans.unibs.it/projects/csi-murder/ https://ans.unibs.it/projects/csi-murder/ > this paper addressed passive attacks, where the attacker controls only a receiver, but exploits the normal Wi-Fi traffic. In this case, the only useful traffic for the attacker comes from transmitters that are perfectly fixed and whose position is well known and stable, so that the NN can be trained in advance, thus the obfuscator needs to be installed only in APs or similar ‘infrastructure’ devices. Active attacks, where the attacker controls both the transmitter and the receiver are another very interesting research area, where, however, privacy protection cannot be based on randomization at the transmitter. https://github.com/ansresearch/csi-murder/ https://github.com/ansresearch/csi-murder/ > The experimental results obtained in our laboratory show that the considered localization method (first proposed in an MSc thesis) works smoothly regardless of the environment, and that adding random information to the CSI mess up the localization, thus providing the community with a system that preserve location privacy and communication performance at the same time.
taneq 1y ago
It might make it a bit harder to use the information obtained through spying, though. Both is good.
lovich 1y ago
Technical and legal solutions are for different classes of problems. Encryption is a technical solution trying to solve the problem of people being able to steal your data/money without your knowledge. The law/police are the solution to the 5 dollar wrench problem, where you are very aware of the attack but unable to physically stop it
- scarface_74 1y ago
  And the law can’t stop someone from using a $5 wrench before the harm is done…
  - lovich 1y ago
    I don’t expect the law to prevent the crime. Much like my comment you replied to, I recognize different tools are for different situations. The law is there to enforce the “rule of law” It’s a little ambiguous because the phrase is in English and doesn’t match up 1:1 with the common vernacular, but I want the “rule of law” to enforce that the rules are real, not to prevent someone from testing their existence
heavyset_go 1y ago
There is no technical solution for this unless you want to invest billions/trillions in building new computing and networking platforms created with privacy in mind. ISPs will always have the ability to at least deduce whether a connection was used, the MAC address, and it there is WiFi, unfortunately whether people are physically present. If we look at the roadmap for WiFi/phones/etc, they will soon gain the ability to map out your home, including objects, using consumer radios.
- giantg2 1y ago
  "There is no technical solution for this" This isn't really true. The easiest technical solution to the problem of ISPs using your wifi data is to simply use your own WiFi router which does not send the data to them.
  - newshackr 1y ago
    They can still deduce this from the traffic patterns.
    - giantg2 1y ago
      They can map your home and motion with traffic patterns?
      - heavyset_go 1y ago
        The OP was also talking about deducing presence based on connections and traffic patterns, which using your own WiFi AP isn't going to mitigate.
        giantg2 1y ago
        I don't think there's any reliable way around that. They can do that with real-time power meter monitoring even if you don't have an internet connection.
      - 1y ago
dcow 1y ago
And how do you technically stop an ISP from using the radio in their hardware to detect small changes in phase angle of signals in your home?
- RajT88 1y ago
  Own your own hardware is how. Comcast cannot administer my router/AP or modem. Some other ISP's like AT&T force you to use their gateway. I try and avoid these companies or severely limit the functions of the built in gateway.
  - dcow 1y ago
    And how do you force all consumers to buy their own privacy hardware? Edit: sorry my question is not strictly how one person would mangle their hardware so it breaks presence detection, it’s how the tech industry would develop an at scale everyday consumer solution to this problem.
    - dghlsakjg 1y ago
      Require certain disclosures to be made in not so fine print. Require that each privacy waiver is individually initialed, per clause, in wet ink. This shit would end tomorrow if they had to start delivering modems with 1 inch high letters that said "THIS DEVICE WILL TRACK YOUR LOCATION WITHIN YOUR HOME AND SHARE THAT DATA WITH LAW ENFORCEMENT WITHOUT YOUR KNOWLEDGE", and the modem didn't work until you went down to the Comcast store to sign your rights away. You don't have to force anything except taking this knowledge out of the fine print and prove that your customers are actually aware of the contractual clauses they are subject to. The tech industry could come together and come up with a privacy standard guarantee that device manufacturers could use (Something as simple as, we will never share data with law enforcement unless legally compelled). There's a lot of solutions, ranging from technical (firmware update) to social (pass some laws with teeth).
      - jolmg 1y ago
        > This shit would end tomorrow if they had to start delivering modems with 1 inch high letters that said "THIS DEVICE WILL TRACK YOUR LOCATION WITHIN YOUR HOME AND SHARE THAT DATA WITH LAW ENFORCEMENT WITHOUT YOUR KNOWLEDGE", I have the urge to laugh at this, but maybe I'm just too cynical. Pretty sure we still live in an age where most people would let go of principles like privacy for a bit of convenience.
mbreese 1y ago
You can’t solve social problems with technical solutions. Technical solutions won’t work without some kind of legal backing to force it.
- lioeters 1y ago
  Sometimes mathematics and physics provide superior solutions than man-made laws. Encryption for example. It's better to make something impossible, than to have laws that are routinely ignored by law enforcement.
- xoa 1y ago
  >You can’t solve social problems with technical solutions. Sure, this has a fair amount of truth to it. However, security is not a social problem, it's an economic one. No one, not even the most well funded and skilled organizations like the NSA, has access to infinite resources. Whether a given attack/data harvesting effort costs $1 million, $10 thousand, $100, $1, or $0.01 makes an enormous difference in impact. Can a given three letter agency afford to spend $1m on anyone? Sure. Can they afford it against everyone? No. Same with private orgs, if harvesting data costs $10000/person, it has to generate well over that much money in profit to make it worth it. Is that likely on average? Probably not. If it costs fractions of a cent, then they will be incentivized to scale it as hard as possible, since payoff from even one person will cover thousands of duds. So sure, by all means we should pursue laws too, as that also shifts costs a bit. But there is zero reason not to simultaneously pursue technical means to make costs as high as possible. Both tracks matter a lot.
  - mbreese 1y ago
    I am really struggling to see the technical solution here. This isn’t a security question - security has already been lost. We’re talking about a device in a home that the owner doesn’t control, being able to monitor the presence of a person using either WiFi signals or device identifiers. The obvious solution is to not use that device. But that’s not necessarily possible for a variety of reasons, not all of them controllable. So, what is the technical solution to this? Anything that’s going to mask a persons RF signal is probably going to make WiFi difficult to use. Anything at the network level is already lost because we have a potentially hostile device in a critical point in the network path. Am I missing a different solution?
citizenpaul 1y ago
It makes it much more difficult to be profitable if its illegal. This deters the majority of opportunists leaving only the dedicated criminals. And just like thief's people might understand why they steal no one sheds a tear when they go to prison.
sleepybrett 1y ago
When we find them spying on customers they will take it all the way to the supreme court where the definition of spying will be put the wringer and flushed of all actual meaning. Then the law will be struck because it violates the corporation's 1st amendment protections concerning 'free speech'. See also Citizen's United.

account42 1y ago

The legal part should be requiring a technical solution. E.g. the you should be able to own your router and even if you choose to rent you should have full control over the software.

transpute 1y ago

We need more funding for open-source WiFi Sensing counter-measures, e.g. EU research, https://ans.unibs.it/projects/csi-murder/ https://ans.unibs.it/projects/csi-murder/ > this paper addressed passive attacks, where the attacker controls only a receiver, but exploits the normal Wi-Fi traffic. In this case, the only useful traffic for the attacker comes from transmitters that are perfectly fixed and whose position is well known and stable, so that the NN can be trained in advance, thus the obfuscator needs to be installed only in APs or similar ‘infrastructure’ devices. Active attacks, where the attacker controls both the transmitter and the receiver are another very interesting research area, where, however, privacy protection cannot be based on randomization at the transmitter. https://github.com/ansresearch/csi-murder/ https://github.com/ansresearch/csi-murder/ > The experimental results obtained in our laboratory show that the considered localization method (first proposed in an MSc thesis) works smoothly regardless of the environment, and that adding random information to the CSI mess up the localization, thus providing the community with a system that preserve location privacy and communication performance at the same time.

taneq 1y ago

It might make it a bit harder to use the information obtained through spying, though. Both is good.

lovich 1y ago

Technical and legal solutions are for different classes of problems. Encryption is a technical solution trying to solve the problem of people being able to steal your data/money without your knowledge. The law/police are the solution to the 5 dollar wrench problem, where you are very aware of the attack but unable to physically stop it

scarface_74 1y ago
And the law can’t stop someone from using a $5 wrench before the harm is done…
- lovich 1y ago
  I don’t expect the law to prevent the crime. Much like my comment you replied to, I recognize different tools are for different situations. The law is there to enforce the “rule of law” It’s a little ambiguous because the phrase is in English and doesn’t match up 1:1 with the common vernacular, but I want the “rule of law” to enforce that the rules are real, not to prevent someone from testing their existence

heavyset_go 1y ago

There is no technical solution for this unless you want to invest billions/trillions in building new computing and networking platforms created with privacy in mind. ISPs will always have the ability to at least deduce whether a connection was used, the MAC address, and it there is WiFi, unfortunately whether people are physically present. If we look at the roadmap for WiFi/phones/etc, they will soon gain the ability to map out your home, including objects, using consumer radios.

giantg2 1y ago
"There is no technical solution for this" This isn't really true. The easiest technical solution to the problem of ISPs using your wifi data is to simply use your own WiFi router which does not send the data to them.
- newshackr 1y ago
  They can still deduce this from the traffic patterns.
  - giantg2 1y ago
    They can map your home and motion with traffic patterns?
    - heavyset_go 1y ago
      The OP was also talking about deducing presence based on connections and traffic patterns, which using your own WiFi AP isn't going to mitigate.
      - giantg2 1y ago
        I don't think there's any reliable way around that. They can do that with real-time power meter monitoring even if you don't have an internet connection.
    - 1y ago

dcow 1y ago

And how do you technically stop an ISP from using the radio in their hardware to detect small changes in phase angle of signals in your home?

RajT88 1y ago
Own your own hardware is how. Comcast cannot administer my router/AP or modem. Some other ISP's like AT&T force you to use their gateway. I try and avoid these companies or severely limit the functions of the built in gateway.
- dcow 1y ago
  And how do you force all consumers to buy their own privacy hardware? Edit: sorry my question is not strictly how one person would mangle their hardware so it breaks presence detection, it’s how the tech industry would develop an at scale everyday consumer solution to this problem.
  - dghlsakjg 1y ago
    Require certain disclosures to be made in not so fine print. Require that each privacy waiver is individually initialed, per clause, in wet ink. This shit would end tomorrow if they had to start delivering modems with 1 inch high letters that said "THIS DEVICE WILL TRACK YOUR LOCATION WITHIN YOUR HOME AND SHARE THAT DATA WITH LAW ENFORCEMENT WITHOUT YOUR KNOWLEDGE", and the modem didn't work until you went down to the Comcast store to sign your rights away. You don't have to force anything except taking this knowledge out of the fine print and prove that your customers are actually aware of the contractual clauses they are subject to. The tech industry could come together and come up with a privacy standard guarantee that device manufacturers could use (Something as simple as, we will never share data with law enforcement unless legally compelled). There's a lot of solutions, ranging from technical (firmware update) to social (pass some laws with teeth).
    - jolmg 1y ago
      > This shit would end tomorrow if they had to start delivering modems with 1 inch high letters that said "THIS DEVICE WILL TRACK YOUR LOCATION WITHIN YOUR HOME AND SHARE THAT DATA WITH LAW ENFORCEMENT WITHOUT YOUR KNOWLEDGE", I have the urge to laugh at this, but maybe I'm just too cynical. Pretty sure we still live in an age where most people would let go of principles like privacy for a bit of convenience.

mbreese 1y ago

You can’t solve social problems with technical solutions. Technical solutions won’t work without some kind of legal backing to force it.

lioeters 1y ago
Sometimes mathematics and physics provide superior solutions than man-made laws. Encryption for example. It's better to make something impossible, than to have laws that are routinely ignored by law enforcement.
xoa 1y ago
>You can’t solve social problems with technical solutions. Sure, this has a fair amount of truth to it. However, security is not a social problem, it's an economic one. No one, not even the most well funded and skilled organizations like the NSA, has access to infinite resources. Whether a given attack/data harvesting effort costs $1 million, $10 thousand, $100, $1, or $0.01 makes an enormous difference in impact. Can a given three letter agency afford to spend $1m on anyone? Sure. Can they afford it against everyone? No. Same with private orgs, if harvesting data costs $10000/person, it has to generate well over that much money in profit to make it worth it. Is that likely on average? Probably not. If it costs fractions of a cent, then they will be incentivized to scale it as hard as possible, since payoff from even one person will cover thousands of duds. So sure, by all means we should pursue laws too, as that also shifts costs a bit. But there is zero reason not to simultaneously pursue technical means to make costs as high as possible. Both tracks matter a lot.
- mbreese 1y ago
  I am really struggling to see the technical solution here. This isn’t a security question - security has already been lost. We’re talking about a device in a home that the owner doesn’t control, being able to monitor the presence of a person using either WiFi signals or device identifiers. The obvious solution is to not use that device. But that’s not necessarily possible for a variety of reasons, not all of them controllable. So, what is the technical solution to this? Anything that’s going to mask a persons RF signal is probably going to make WiFi difficult to use. Anything at the network level is already lost because we have a potentially hostile device in a critical point in the network path. Am I missing a different solution?

citizenpaul 1y ago

It makes it much more difficult to be profitable if its illegal. This deters the majority of opportunists leaving only the dedicated criminals. And just like thief's people might understand why they steal no one sheds a tear when they go to prison.

sleepybrett 1y ago

When we find them spying on customers they will take it all the way to the supreme court where the definition of spying will be put the wringer and flushed of all actual meaning. Then the law will be struck because it violates the corporation's 1st amendment protections concerning 'free speech'. See also Citizen's United.