Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disapproval of FCC regulations a significant blow against privacy protection

nytimes.com

Post reply on HN
Print view View original

51–60 of 242 posts

Re: Disapproval of FCC regulations a significant blow against privacy protection

#51

Post by cjcampbell »

notheguyouthink wrote: post #30
Asdfbla wrote: post #11

At least consumers still have https going for them I suppose? Or maybe ISPs are now more motivated to man-in-the-middle those connections to get to the data, under the guise of security or something?

Yea that was my main question during this. What can we do. I thought https made this near impossible unless they MITM it, which would be difficult no? Or is it easy? This is all the more reason we need to start encrypting all communication. All my hand built services (home bots, etc) need to start using tls for everything.

Three problems here. First being that the ISP is a permanent MITM. Second is that TLS will not protect the hostnames, which are sent in the clear so that servers can identify the correct certificate for a given connection. Likewise, DNS is not encrypted (though companies like OpenDNS do provide alternatives here).

Re: Disapproval of FCC regulations a significant blow against privacy protection

#52

Post by pythonaut_16 »

fowlerpower wrote: post #36
jvandonsel wrote: post #27

Earlier quoted context omitted.

A better analogy would be FedEx selling your incoming and outgoing addresses and package weights to third parties, not necessarily the contents of your packages.

Why not the contents? What happens when most content is not over a secure connection such e.g. Over HTTP? Could they not inspect the content? It sure seems like they could. For most people most of the internet is still insecure.

I know for me personally I already assume anything over a non-HTTPS or non-secured protocol will be received and possibly read by anyone and everyone.

Re: Disapproval of FCC regulations a significant blow against privacy protection

#53

Post by mbel »

fowlerpower wrote: post #36
jvandonsel wrote: post #27

Earlier quoted context omitted.

A better analogy would be FedEx selling your incoming and outgoing addresses and package weights to third parties, not necessarily the contents of your packages.

Why not the contents? What happens when most content is not over a secure connection such e.g. Over HTTP? Could they not inspect the content? It sure seems like they could. For most people most of the internet is still insecure.

Yeah, the closer analogy would be FedEx selling information about content of your packages unless they are shipped in some kind of locked strong box.

Re: Disapproval of FCC regulations a significant blow against privacy protection

#54

Post by state_less »

huxley wrote: post #35
Asdfbla wrote: post #11

At least consumers still have https going for them I suppose? Or maybe ISPs are now more motivated to man-in-the-middle those connections to get to the data, under the guise of security or something?

I don't believe SSL alone would protect you since ISPs would still have access to the DNS lookups, the fully qualified domain name of the server (which is sent in cleartext for SNI), and IP addresses for the person browsing, so there's still plenty of "meta-data" for them to sell. Maybe if you use a third party DNS service, but then you need to trust them.

Is there TLS connections to DNS servers available for the major operating systems?

edit: You're still broadcasting the IP you're connecting to, but it's still nice to close up this DNS lookup leak.

Re: Disapproval of FCC regulations a significant blow against privacy protection

#55

Post by xienze »

Operyl wrote: post #48
xienze wrote: post #40

So the only thing I don't understand as far as the fuss about this is concerned -- everything I've read indicates that this is undoing a protection put in place late last year. So essentially we've gone back in time six months ago or so. If ISPs weren't selling our info then when they could have, why does it logically follow that we're now in some uncharted territory of ISPs selling personal info? Or is this simply b…

Because why the push to undo something if they weren't planning to do it, or weren't already? I know Verizon has an opt in program for it where they gave you deals and free data.

Can't argue with that, but again, the status quo for many, many years was that your ISP could have done this, but didn't. And the next time there's a changing of the guard the protections will be put back in place, so I can't see how ISPs are going to bet on selling this information as a viable long-term business strategy.

Re: Disapproval of FCC regulations a significant blow against privacy protection

#56

Post by SonicSoul »

jonjohn84 wrote: post #13

I feel like this isn't going to go anywhere but I'm still tempted to contribute: https://www.gofundme.com/BuyCongressData

im conflicted about this. hate to hand over millions to ISP's just to prove a point. I'd rather put the money towards starting a competing anonymized ISP.

Re: Disapproval of FCC regulations a significant blow against privacy protection

#57

Post by somebehemoth »

maccam912 wrote: post #24
j2bax wrote: post #3

Is there anything the average user can do to protect their data/privacy from their ISP?

Yes VPN is a good answer here, but another idea to make the data they collect and sell less useful would be something like https://github.com/WhiteBeachStudios/cyberflare to hide your real usage habits among a bunch of artificially generated traffic.

CyberFlare looks interesting, thank you for sharing. If anyone knows of similar tools or a guide on using CyberFlare I would greatly appreciate the information.

Re: Disapproval of FCC regulations a significant blow against privacy protection

#58

Post by falcolas »

xienze wrote: post #40

So the only thing I don't understand as far as the fuss about this is concerned -- everything I've read indicates that this is undoing a protection put in place late last year. So essentially we've gone back in time six months ago or so. If ISPs weren't selling our info then when they could have, why does it logically follow that we're now in some uncharted territory of ISPs selling personal info? Or is this simply b…

There were some ISPs which were selling people's data prior to this order (Verizon was one, IIRC, and a few others were actively injecting ads and JS into non-TLS traffic), and many more were considering it.

Yes, we've "essentially" just gone back in time, but it's not a positive regression.

Re: Disapproval of FCC regulations a significant blow against privacy protection

#59

Post by barryfandango »

edraferi wrote: post #31
somebehemoth wrote: post #6

Earlier quoted context omitted.

VPN is a solution but requires trust in VPN provider. OpenVPN on a VPS can help. Also, consider DNS traffic can leak information, but I've not read of a fool proof way to fully protect DNS queries.

I use a VPN, but I have to turn it on for each device. Is there a good way to set up my router to automatically push all traffic through a VPN? I'd probably need to make exceptions for stuff like video traffic.

You can install Tomato (http://www.polarcloud.com/tomato) on a compatible router. It has a bunch of options for routing all/some/groups of devices through various VPN's. This might be a feature in newer stock router firmware too.
Post reply on HN