Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Patriot Act amendment needing a warrant for browsing history fails

theregister.co.uk

Post reply on HN
Print view View original

11–20 of 184 posts

Re: Patriot Act amendment needing a warrant for browsing history fails

#11

Post by b3kart »

teddyh wrote: post #7
brenden2 wrote: post #4

I do most of my browsing in private mode anyway. I'm usually pretty careful to never put things onto websites that I don't want people to find publicly as well. The US has no strong privacy protections, so you should just assume that nobody has your best interest in mind. This includes HN, Reddit, and the FAANG giants. Although Apple is probably the only one that isn't strongly incentivized to violate your privacy.

> I do most of my browsing in private mode anyway. What do you think “private mode” is, exactly? I’ll tell you what it is: It’s a mode where your local web browser doesn’t save its history, which only means that people who has physical access to your device cannot see this saved history. Your ISP can still see everything of consequence, and your DoH provider can see most of it.

Same with Google. It's naive to think that if you are "logged out" in "private mode" they aren't saving your queries. It's not difficult to know who's searching if you have access to an IP address and browser fingerprint information.

Re: Patriot Act amendment needing a warrant for browsing history fails

#12

Post by NikolaeVarius »

brenden2 wrote: post #4

I do most of my browsing in private mode anyway. I'm usually pretty careful to never put things onto websites that I don't want people to find publicly as well. The US has no strong privacy protections, so you should just assume that nobody has your best interest in mind. This includes HN, Reddit, and the FAANG giants. Although Apple is probably the only one that isn't strongly incentivized to violate your privacy.

All private mode does is prevent family friends from knowing what porn you watch.

It's useless for real "privacy"

Re: Patriot Act amendment needing a warrant for browsing history fails

#14

Post by brenden2 »

snazz wrote: post #9
brenden2 wrote: post #8

Earlier quoted context omitted.

This doesn't work so well when you a) disallow tracking cookies and b) don't use your ISP's DNS servers. I used to work directly with these big ISPs, and I can assure you they aren't very sophisticated. Even if they log every IP you send a packet to, and they know every domain that points to each of those IPs, they can't know exactly what you requested or which particular website you visited provided these websites u…

If you're not using DNS over HTTPS, then they're still tracking your DNS queries regardless of which server you use.

This is true, but it requires deep packet inspection, and that's something which usually isn't on by default. They might enable it for specific clients under some circumstances, but I haven't heard of ISPs logging that level of detail permanently. I suppose the could run a service that just inspects DNS packets, pulls out the domains, and correlates them with each client, but I haven't heard of that being deployed in the wild (although perhaps that's changed).

Their DNS severs, however, and definitely doing this, and they sell that data to 3rd parties.

TLS SNI also leaks the domain name, but again that would require deep packet inspection to extract and correlate with the clients. Definitely possible, but probably not deployed.

Re: Patriot Act amendment needing a warrant for browsing history fails

#15

Post by fullstop »

snazz wrote: post #9
brenden2 wrote: post #8

Earlier quoted context omitted.

This doesn't work so well when you a) disallow tracking cookies and b) don't use your ISP's DNS servers. I used to work directly with these big ISPs, and I can assure you they aren't very sophisticated. Even if they log every IP you send a packet to, and they know every domain that points to each of those IPs, they can't know exactly what you requested or which particular website you visited provided these websites u…

If you're not using DNS over HTTPS, then they're still tracking your DNS queries regardless of which server you use.

I wonder how big a hosts file could get before it degraded performance?

You can still do DNS over VPN. That is, I could set up an unbound cache on a VPS and secure my traffic to that server using wireguard or openvpn. This just pushes the eyeballs out of my home and into someone else's datacenter, though.

Re: Patriot Act amendment needing a warrant for browsing history fails

#16

Post by the_af »

NikolaeVarius wrote: post #12
brenden2 wrote: post #4

I do most of my browsing in private mode anyway. I'm usually pretty careful to never put things onto websites that I don't want people to find publicly as well. The US has no strong privacy protections, so you should just assume that nobody has your best interest in mind. This includes HN, Reddit, and the FAANG giants. Although Apple is probably the only one that isn't strongly incentivized to violate your privacy.

All private mode does is prevent family friends from knowing what porn you watch. It's useless for real "privacy"

Indeed. Even worse, Chrome calls this "incognito mode", which is even less accurate. This isn't incognito. The joke about calling it "porn mode" was way more honest.

Re: Patriot Act amendment needing a warrant for browsing history fails

#17

Post by brenden2 »

34679 wrote: post #10
brenden2 wrote: post #8

Earlier quoted context omitted.

This doesn't work so well when you a) disallow tracking cookies and b) don't use your ISP's DNS servers. I used to work directly with these big ISPs, and I can assure you they aren't very sophisticated. Even if they log every IP you send a packet to, and they know every domain that points to each of those IPs, they can't know exactly what you requested or which particular website you visited provided these websites u…

I'm curious about a case like duckduckgo, which uses https, but puts your search term in the url.

The path and query string are only transmitted over TLS, so it should be fine so long as you never use HTTP without TLS.

Re: Patriot Act amendment needing a warrant for browsing history fails

#18

Post by brenden2 »

teddyh wrote: post #7
brenden2 wrote: post #4

I do most of my browsing in private mode anyway. I'm usually pretty careful to never put things onto websites that I don't want people to find publicly as well. The US has no strong privacy protections, so you should just assume that nobody has your best interest in mind. This includes HN, Reddit, and the FAANG giants. Although Apple is probably the only one that isn't strongly incentivized to violate your privacy.

> I do most of my browsing in private mode anyway. What do you think “private mode” is, exactly? I’ll tell you what it is: It’s a mode where your local web browser doesn’t save its history, which only means that people who has physical access to your device cannot see this saved history. Your ISP can still see everything of consequence, and your DoH provider can see most of it.

I think you may be overestimating the technical proficiency of the government. When they talk about browsing history, they're probably quite literally referring to looking at your web browser history. Yes, they might also subpoena your ISP for data, but if the ISP isn't collecting it in a way that is 100% correlated with your computer and browser (which is pretty hard with a NAT), then they only have a weak case at best. It probably wouldn't hold up in court.

Re: Patriot Act amendment needing a warrant for browsing history fails

#19

Post by tialaramex »

woofcat wrote: post #2

I'm curious at how the article implies that DoH is going do anything. I'd imagine CloudFlare, etc. would comply with FBI requests just as much as your local ISP. Factor in co-operation from CDN's and really that covers a vast array of data that the US Government could access.

The main practical problem is that the NSA and similar agencies currently collect absolutely everything. Regardless of warrants, constitutional amendments, or senators banging their fists on the table, these agencies operate with impunity and they know it.

DoH pragmatically reduces their ability to conduct such global surveillance. "Pervasive Monitoring is An Attack".

We speak of man's laws and nature's as though they were the same kind of thing but they really, really aren't. I can no more magically replay the session keys from last week's Wikipedia visit in response to a court order, a warrant or the US Constitution itself than I could dance on the surface of the sun if they required that.

The idea here isn't that Public Enemy Number One today is protected from surveillance, but instead that you today are protected from the hypothetical surveillance of your past that might be authorised if some day you become Public Enemy Number One.

Re: Patriot Act amendment needing a warrant for browsing history fails

#20

Post by softwaredoug »

giffarage wrote: post #13

Between Https and VPNs, this seems ineffectual for people who actually want to stay hidden. Am I missing something?

Except the US is sadly notorious for weakening encryption standards. One common example is how it was hard for a long time to export strong encryption

https://en.m.wikipedia.org/wiki/Export_of_cryptography_from_...

Post reply on HN