Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Patriot Act amendment needing a warrant for browsing history fails

theregister.co.uk

Post reply on HN
Print view View original

21–30 of 184 posts

Re: Patriot Act amendment needing a warrant for browsing history fails

#21

Post by fullstop »

brenden2 wrote: post #14
snazz wrote: post #9

Earlier quoted context omitted.

If you're not using DNS over HTTPS, then they're still tracking your DNS queries regardless of which server you use.

This is true, but it requires deep packet inspection, and that's something which usually isn't on by default. They might enable it for specific clients under some circumstances, but I haven't heard of ISPs logging that level of detail permanently. I suppose the could run a service that just inspects DNS packets, pulls out the domains, and correlates them with each client, but I haven't heard of that being deployed in…

DPI is available on inexpensive routers now and has been an option on Cisco/Fortigate/Palo Alto/Ubiquiti gear for ages. I have no doubt that it is heavily used at most IPSs.

Re: Patriot Act amendment needing a warrant for browsing history fails

#22

Post by scalableUnicon »

teddyh wrote: post #7
brenden2 wrote: post #4

I do most of my browsing in private mode anyway. I'm usually pretty careful to never put things onto websites that I don't want people to find publicly as well. The US has no strong privacy protections, so you should just assume that nobody has your best interest in mind. This includes HN, Reddit, and the FAANG giants. Although Apple is probably the only one that isn't strongly incentivized to violate your privacy.

> I do most of my browsing in private mode anyway. What do you think “private mode” is, exactly? I’ll tell you what it is: It’s a mode where your local web browser doesn’t save its history, which only means that people who has physical access to your device cannot see this saved history. Your ISP can still see everything of consequence, and your DoH provider can see most of it.

Firefox even shows a link to "Common Myths about Private Browsing"(https://support.mozilla.org/en-US/kb/common-myths-about-priv...) whenever private browsing windows are opened.

Re: Patriot Act amendment needing a warrant for browsing history fails

#23

Post by notthemessiah »

When we look at the kinds of things these surveillance powers are used for, it's a glimpse of how it's abused. Thanks to FOIA requests, we found that the Boston Regional Intelligence Center was using their surveillance capabilities to spy on Occupy Boston during the Boston Marathon that was bombed, despite the ostensible aim of the center being to coordinate local and federal intelligence capabilities and despite the FBI receiving a tip from Russia that the Tsarnaevs were up to something. If we want to make the world safer, we should focus on making responsible and strategic use of the intelligence we have than to grant new powers.

http://www.justiceonline.org/unaware_of_tsarnaev_warnings

Re: Patriot Act amendment needing a warrant for browsing history fails

#24

Post by snazz »

fullstop wrote: post #15
snazz wrote: post #9

Earlier quoted context omitted.

If you're not using DNS over HTTPS, then they're still tracking your DNS queries regardless of which server you use.

I wonder how big a hosts file could get before it degraded performance? You can still do DNS over VPN. That is, I could set up an unbound cache on a VPS and secure my traffic to that server using wireguard or openvpn. This just pushes the eyeballs out of my home and into someone else's datacenter, though.

I'm guessing that the time required to open the hosts file for reading would eclipse the amount of time required to parse it and do a linear search on the entries. I would think that the file would have to be measured in the hundreds of megabytes for performance to be a significant consideration, but I haven't benchmarked it.

Re: Patriot Act amendment needing a warrant for browsing history fails

#25

Post by tialaramex »

brenden2 wrote: post #17
34679 wrote: post #10

Earlier quoted context omitted.

I'm curious about a case like duckduckgo, which uses https, but puts your search term in the url.

The path and query string are only transmitted over TLS, so it should be fine so long as you never use HTTP without TLS.

Indeed, let's break it down:

The scheme (https) is implied but isn't transmitted anywhere. An adversary can infer you used HTTPS because it was port 443 and looks like TLS traffic.

The hostname (www.duckduckgo.com) is somewhat implied by the destination IP address on the connection, and is also transmitted in the clear as part of TLS Server Name Indication so that the receiving server knows which service you wanted. In TLS 1.2 and earlier the site's certificate is also transmitted in the clear (but this is fixed in TLS 1.3). Encrypting SNI is a work-in-progress.

The path and query string are encrypted. An adversary can't discover what they are, nor can they tamper with them successfully. The total overall amount of data sent is not hidden, but clients can (though most do not) add padding to hide exactly how much of this was "real".

The fragment identifier (#foo) is not transmitted anywhere it remains only on the client (web browser).

Headers, body and so on of both request and response are encrypted, and the same caveat about an adversary knowing how much data was transmitted and when applies.

Re: Patriot Act amendment needing a warrant for browsing history fails

#26

Post by brenden2 »

fullstop wrote: post #21
brenden2 wrote: post #14

Earlier quoted context omitted.

This is true, but it requires deep packet inspection, and that's something which usually isn't on by default. They might enable it for specific clients under some circumstances, but I haven't heard of ISPs logging that level of detail permanently. I suppose the could run a service that just inspects DNS packets, pulls out the domains, and correlates them with each client, but I haven't heard of that being deployed in…

DPI is available on inexpensive routers now and has been an option on Cisco/Fortigate/Palo Alto/Ubiquiti gear for ages. I have no doubt that it is heavily used at most IPSs.

There's a big different between the data being available vs. being put to use. ISPs have no incentive to put a bunch of effort into collecting data from the 1% or less of their customers which don't use their DNS servers. Thus, it's extremely unlikely they run packet inspection on every packet just so that they can collect browsing history from people who are privacy conscious.

Re: Patriot Act amendment needing a warrant for browsing history fails

#27

Post by shadowgovt »

the_af wrote: post #16
NikolaeVarius wrote: post #12

Earlier quoted context omitted.

All private mode does is prevent family friends from knowing what porn you watch. It's useless for real "privacy"

Indeed. Even worse, Chrome calls this "incognito mode", which is even less accurate. This isn't incognito. The joke about calling it "porn mode" was way more honest.

It's about as incognito as throwing on the hat and glasses the icon shows is.

i.e. "works until someone actually cares enough to take active measures to track you."

Re: Patriot Act amendment needing a warrant for browsing history fails

#28

Post by quit32 »

woofcat wrote: post #2

I'm curious at how the article implies that DoH is going do anything. I'd imagine CloudFlare, etc. would comply with FBI requests just as much as your local ISP. Factor in co-operation from CDN's and really that covers a vast array of data that the US Government could access.

For one cloudflare is a lot more reputable than most US ISPs. Cloudflare explicitly says "We committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours." https://blog.cloudflare.com/announcing-1111/

If gov tried to force CF to change that they would likely put up a huge public legal fight to prevent it whereas ATT / Verizon and Comcast would bend over backwards to secretly comply while also simultaneously seeing if they could inject some ads into the pages you visited.

Re: Patriot Act amendment needing a warrant for browsing history fails

#29

Post by paulryanrogers »

brenden2 wrote: post #4

I do most of my browsing in private mode anyway. I'm usually pretty careful to never put things onto websites that I don't want people to find publicly as well. The US has no strong privacy protections, so you should just assume that nobody has your best interest in mind. This includes HN, Reddit, and the FAANG giants. Although Apple is probably the only one that isn't strongly incentivized to violate your privacy.

> Although Apple is probably the only one that isn't strongly incentivized to violate your privacy.

With their transition from selling widgets to services I wonder how much longer that will be true. And considering their attempt at iAds the privacy incentive is more historical accident than an unchangeable, core culture.

Re: Patriot Act amendment needing a warrant for browsing history fails

#30

Post by gnulinux »

brenden2 wrote: post #18
teddyh wrote: post #7

Earlier quoted context omitted.

> I do most of my browsing in private mode anyway. What do you think “private mode” is, exactly? I’ll tell you what it is: It’s a mode where your local web browser doesn’t save its history, which only means that people who has physical access to your device cannot see this saved history. Your ISP can still see everything of consequence, and your DoH provider can see most of it.

I think you may be overestimating the technical proficiency of the government. When they talk about browsing history, they're probably quite literally referring to looking at your web browser history. Yes, they might also subpoena your ISP for data, but if the ISP isn't collecting it in a way that is 100% correlated with your computer and browser (which is pretty hard with a NAT), then they only have a weak case at b…

I don't think you understand what's going on. Private browser has no visible difference to server or the party listening to your communication in the middle. The only effect it has is that it doesn't persist your browser history upon closing it.
Post reply on HN