Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Patriot Act amendment needing a warrant for browsing history fails

theregister.co.uk

Post reply on HN
Print view View original

41–50 of 184 posts

Re: Patriot Act amendment needing a warrant for browsing history fails

#41

Post by tialaramex »

brenden2 wrote: post #14
snazz wrote: post #9

Earlier quoted context omitted.

If you're not using DNS over HTTPS, then they're still tracking your DNS queries regardless of which server you use.

This is true, but it requires deep packet inspection, and that's something which usually isn't on by default. They might enable it for specific clients under some circumstances, but I haven't heard of ISPs logging that level of detail permanently. I suppose the could run a service that just inspects DNS packets, pulls out the domains, and correlates them with each client, but I haven't heard of that being deployed in…

DNS blocking is an affordable technology deployed in many countries. For example in the UK if you use the sort of large ISP advertised on TV it has DNS blocking.

With DNS blocking if you try to look up a "forbidden" FQDN you get back either a bogus NXDOMAIN or A records chosen by the blocker.

DoH bypasses DNS blocking pretty cheaply. DNSSEC would detect it and stop but doesn't bypass it. Tor bypasses it but at considerable cost.

The (eventually indefinitely delayed) UK government plans to institute mandatory censorship of the Internet relied on DNS blocking as their backstop. The idea was if anybody anywhere in the world didn't voluntarily agree to obey censorship rules, they'd be blocked in the UK. The government would just accept that some proportion of users would install Tor to bypass that restriction. DoH means "some proportion of users" potentially becomes "everybody with a modern browser" and that was not palatable.

Re: Patriot Act amendment needing a warrant for browsing history fails

#42

Post by nickbauman »

lenlorijn wrote: post #36
giffarage wrote: post #13

Between Https and VPNs, this seems ineffectual for people who actually want to stay hidden. Am I missing something?

Metadata such as what domains/ip's are contacted can still be harvested.

And remember: metadata is everything. It makes the actual content of the communication discoverable and indexable. The information of what you're saying and doing is not actionable without being able to find it / categorize it at scale.

Re: Patriot Act amendment needing a warrant for browsing history fails

#43

Post by thedudeabides5 »

_8j50 wrote: post #3

Actual terrorists(like 9/11 type, well funded) know better than to even touch anything digital for comms. They literally get a drone strike for having called a known terrorist or for going to a wedding other terrorists with cell phones go to. For home grown terrorism, how many school shootings happen when the people who know the shooter literally tell police/fbi beforehand about the state of the shooter. Are school s…

Well for security minded folks, the fact they can't use traditional comms (likely because of existing snooping techniques) is a good thing.

Now, does all that snooping and invading countries increase the background desire and willingness for bad guys to do terrorist-type things, almost certainty.

Re: Patriot Act amendment needing a warrant for browsing history fails

#44

Post by jgrahamc »

lonelappde wrote: post #40
quit32 wrote: post #28

Earlier quoted context omitted.

For one cloudflare is a lot more reputable than most US ISPs. Cloudflare explicitly says "We committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours." https://blog.cloudflare.com/announcing-1111/ If gov tried to force CF to change that they would likely put up a huge public legal fight to prevent it whereas ATT / Verizon and Comcast would bend over backwards to secretly comply…

Does CloudFlare have multiple external auditors verifying their claims?

https://blog.cloudflare.com/announcing-the-results-of-the-1-...

Re: Patriot Act amendment needing a warrant for browsing history fails

#45

Post by craftinator »

brenden2 wrote: post #32
gnulinux wrote: post #30

Earlier quoted context omitted.

I don't think you understand what's going on. Private browser has no visible difference to server or the party listening to your communication in the middle. The only effect it has is that it doesn't persist your browser history upon closing it.

There's a big difference between what's possible in theory and the reality of current practices. I think many people in this thread are missing that point.

The NSA has been grabbing all of your browsing practices for over a decade [0]

[0] https://arstechnica.com/tech-policy/2014/12/newly-published-...

Re: Patriot Act amendment needing a warrant for browsing history fails

#46

Post by isoskeles »

_8j50 wrote: post #3

Actual terrorists(like 9/11 type, well funded) know better than to even touch anything digital for comms. They literally get a drone strike for having called a known terrorist or for going to a wedding other terrorists with cell phones go to. For home grown terrorism, how many school shootings happen when the people who know the shooter literally tell police/fbi beforehand about the state of the shooter. Are school s…

> Are school shooters not terrorists?

They are not. Terrorism is supposed to be a political tool. Whereas school shooters are often just deranged or troubled people lashing out.

Re: Patriot Act amendment needing a warrant for browsing history fails

#47

Post by quit32 »

lonelappde wrote: post #40
quit32 wrote: post #28

Earlier quoted context omitted.

For one cloudflare is a lot more reputable than most US ISPs. Cloudflare explicitly says "We committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours." https://blog.cloudflare.com/announcing-1111/ If gov tried to force CF to change that they would likely put up a huge public legal fight to prevent it whereas ATT / Verizon and Comcast would bend over backwards to secretly comply…

Does CloudFlare have multiple external auditors verifying their claims?

Literally the next para in that blog - "we committed to retaining KPMG, the well-respected auditing firm, to audit our practices annually and publish a public report confirming we're doing what we said we would."

In addition Mozilla put them through a rigorous process when selecting them as their default DoH provider which included them contractually agreeing to adhere to their stated policy. https://wiki.mozilla.org/Security/DOH-resolver-policy

Re: Patriot Act amendment needing a warrant for browsing history fails

#48

Post by JoeSmithson »

_8j50 wrote: post #3

Actual terrorists(like 9/11 type, well funded) know better than to even touch anything digital for comms. They literally get a drone strike for having called a known terrorist or for going to a wedding other terrorists with cell phones go to. For home grown terrorism, how many school shootings happen when the people who know the shooter literally tell police/fbi beforehand about the state of the shooter. Are school s…

> Actual terrorists(like 9/11 type, well funded) know better than to even touch anything digital for comms

Shit like this is said all the time on HN with absolutely nothing to substantiate it.

Re: Patriot Act amendment needing a warrant for browsing history fails

#49

Post by kortex »

tialaramex wrote: post #25
brenden2 wrote: post #17

Earlier quoted context omitted.

The path and query string are only transmitted over TLS, so it should be fine so long as you never use HTTP without TLS.

Indeed, let's break it down: The scheme (https) is implied but isn't transmitted anywhere. An adversary can infer you used HTTPS because it was port 443 and looks like TLS traffic. The hostname (www.duckduckgo.com) is somewhat implied by the destination IP address on the connection, and is also transmitted in the clear as part of TLS Server Name Indication so that the receiving server knows which service you wanted.…

This is a really good summary! A few months back I was hunting for an answer as to whether url/query parameters were encrypted with HTTPS. The answer space was strangely sparse for something so critical.

Re: Patriot Act amendment needing a warrant for browsing history fails

#50

Post by diablo1 »

Define 'your' browsing history. Where I live you can buy a SIM card with cash, load it with credit and surf on a 3G/4G network, without having to register the SIM or attach your legal name to it in any way.

I can also encrypt my phone, turn on permanent incognito mode, disable Javascript, and have uBlock Origin running to stop trackers. Good luck trying to pin my legal name to a particular website visit. Then there's the fact that 3G/4G uses vague carrier-grade-NAT IPV4 addresses so countless others all share the same IP address enabling you to 'hide among the crowd' (providing the useragent is something common that many people use like Safari on an iPhone5)

Post reply on HN