Live data from Hacker News

The House just voted to wipe out the FCC’s landmark Internet privacy protections

washingtonpost.com

241–250 of 534 posts

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#241

Please do not complain into the echo chamber of comments here. Please take a moment to support the EFF, call your representatives, and speak to friends and family. EFF: https://www.eff.org/ Find your reps: https://tryvoices.com/

support the EFF Not to say that most of what EFF does isn't valuable, but this privacy exposure has been going on for over a year and a half already . Why didn't the EFF call attention to it until now?

In Feburary 2015, the EFF was cautiously celebrating [1][2][3], although the context was primarily Net Neutrality:

"Reclassification under Title II was a necessary step in order to give the FCC the authority it needed to enact net neutrality rules. But now we face the really hard part: making sure the FCC doesn't abuse its authority." [2]

"The FCC has also failed to give proper consideration to the invasiveness of deep packet inspection, used by ISPs to read a user's Internet traffic. The "lawful content" limitation may give legal cover to this privacy-violating practice. In response, the Commission simply suggests that users protect their own privacy using encryption, virtual private networks, and Tor. While it's a very good idea for users to protect themselves with such tools, that shouldn't be their only protection against the very companies they are forced to trust in order to gain access to the Internet – particularly when ISPs like Verizon have gone to extreme measures to circumvent users' privacy controls. Leaving users to fend for themselves does not bode well for the FCC's future proceedings on privacy rules." [3]

By January 2016, the EFF, along with several other advocacy groups, have co-authored a letter [9] to the FCC in response to the FCC's announcement that it will soon make rules about customer privacy for broadband internet [5]. This was done soon after the FTC's commissioner welcomed the FCC's cooperation to result in stronger privacy protections. For a rationale of the FCC's actions, too long to quote inline, I highly recommend the section "III. A. Background and Need for the Rules" of FCC 16-148 [11] and other sections to follow.

As they often have, Ars Technica provided excellent coverage of the context surrounding these events [4][5][6][7][10]. Notably, their recent article [8] writes about the nuances of which rule was made in response to what, and how the situation we find ourselves in today came to be. The 9th Circuit's opinion in the FTC vs. AT&T case threw a wrench into things [10][12].

[1] https://www.eff.org/deeplinks/2015/02/huge-win-open-internet... [2] https://www.eff.org/deeplinks/2015/02/fcc-votes-net-neutrali... [3] https://www.eff.org/deeplinks/2015/03/todays-net-neutrality-... [4] https://arstechnica.com/business/2015/02/fcc-votes-for-net-n... [5] https://arstechnica.com/tech-policy/2016/03/isps-wont-be-all... [6] https://arstechnica.com/business/2016/03/fcc-votes-to-help-p... [7] https://arstechnica.com/information-technology/2016/10/isps-... [8] https://arstechnica.com/information-technology/2017/03/how-i... [9] https://www.publicknowledge.org/assets/uploads/documents/Bro... [10] https://arstechnica.com/tech-policy/2016/08/atts-common-carr... [11] https://apps.fcc.gov/edocs_public/attachmatch/FCC-16-148A1.p... [12] https://iapp.org/news/a/the-att-v-ftc-common-carrier-ruling-...

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#242
post #72

Earlier quoted context omitted.

Does this mean we can crowdsource and buy the private browsing history of our favorite representatives and post them online for everybody to see?

That's a lot of money that could go to other causes like the EFF. Black hat hacking is cheaper and has the potential to reveal much more about the people that voted for this.

This vote will be a lubricant for just such black hat cracking. The Congress opened the barn door on their own members' privacy.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#243
post #171

Earlier quoted context omitted.

I always interpreted that resignation as "both sides are terrible, so I'm going to keep voting for my side". I wonder how many people really felt strong enough about politics to claim both sides are equally bad and then decided not to vote on that basis alone.

That attitude is true to a point, but surely people don't think that Gore would have invaded Iraq? That difference alone strikes me as so obvious and tangible, that there's no excuse for these kinds of false equivalences anymore.

It's actually a GOP strategy to paint all of government incompetent and that both sides are terrible. You get less participation.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#245

Earlier quoted context omitted.

You can keep using clever witticisms like that if it makes you feel better, and meanwhile bills like this will keep passing along party lines.

So it's the fault of people who vote third party that you have a two-party state?

No, it would be a two-party state whether or not they voted third party.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#246
post #239

Earlier quoted context omitted.

How do you create an encrypted connection to an IP address? Just a regular Diffie-Hellman key exchange? That's pretty easy to MitM, and then the attacker can view the certificate the server passes, which will contain the domain name. A little more involved than sniffing SNI, because now you need to scale out MitM-ing instead of DPI, but pretty much the same problem.

Once the connection is MitM'd, the certificate validation would fail, since the MitM host cannot sign the "hash of everything that's been exchanged in this connection so far" with the correct server certificate. So the MitM would have to choose between either learning the domain name but failing the connection, or letting the connection pass but not learning the domain name.

Darn, that right. I guess I fall back to my other answer then: the ISP can always get the domain name from the server ip address and reverse or passive DNS, and there's nothing you can do about that.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#247
post #187

Earlier quoted context omitted.

The votes in both the house and the senate were almost entirely along party lines. Every republican in the senate that voted, voted for this act and every democrat in the senate that voted, voted against this act.

The reality is more nuanced--the time to stop this legislation was by preventing it coming to vote in the senate. Typically the senate needs 60 votes to forcefully end debate[0], then merely majority to pass it. Once can disguise support for a bill by approving to end debate, then voting "Nay" given it will get the necessary 50 to be approved. For JS 34 [1] Mitch McConnell (R, KY) limited debate to 10 minutes--I'm un…

You can't do that for rule repeals, they are only subject to a majority vote in the senate:

https://en.wikipedia.org/wiki/Congressional_Review_Act

Relevant section:

The law provides a procedure for expedited consideration in the Senate. If the committee to which a joint resolution is referred has not reported it out within 20 calendar days after referral, it may be discharged from further consideration by a written petition of 30 Members of the Senate, at which point the measure is placed on the calendar, and it is in order at any time for a Senator to move to proceed to the joint resolution.[7] If the Senate agrees to the motion to proceed, debate on the floor is limited to 10 hours and no amendments to the resolution or motions to proceed to other business are in order, and so the Senate may pass the joint resolution with a simple majority.[7] A joint resolution of disapproval meeting certain criteria cannot be filibustered.[8]

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#248

Please share your VPN setups. I would like to have my VPN connection at the router level, if possible. Edit: Here's sort of an answer to my own question https://www.howtogeek.com/221889/connect-your-home-router-to...

But where would your VPN go to? It would have to be outside of the US, I assume. That means slower speeds and higher latencies.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#249
post #56

This thread may grow long and maybe turn to the topic of HTTPS. SSL with SNI exposes plaintext hostnames/domainnames on the wire for anyone to read, aggregate and sell, not to mention tamper with. It should be an optional extension. For many users it adds no benefit. For some users, it breaks their software and adds needless complexity. Now the privacy advocates have a reason to dislike it too. Just say no to SNI.

The IP layer already exposes the IP addresses they are contacting, and you can use reverse DNS or passive DNS to get the domain name. SNI doesn't even make things easier, because extracting that from traffic requires DPI and TCP sessionization.

You assume that DNS is being used. What if the user already has the IP address and knows the hostname?

SNI makes gettng the hostnames easier than if they were encrypted as they are without SNI.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#250
post #19

This, right here, is the consequence of the withdrawal from politics many geeks advocated very strongly in an earlier time. "Everything is corrupt, it doesn't matter"... turns out to only be a viable philosophy when things mostly work well enough . What we have in protections and freedoms were purchased through a ton of hard work by prior generations: the liberty to slack and think that it just works ok is a nice sid…

"Geeks like to think that they can ignore politics, you can leave politics alone, but politics won't leave you alone." - RMS

See also: "Just because you do not take an interest in politics doesn't mean politics won't take an interest in you."

https://www.brainyquote.com/quotes/quotes/p/pericles387116.h...

Post reply on HN