Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Indian ISPs: We already give govt full access to web traffic

entrackr.com

Post reply on HN
Print view View original

101–110 of 113 posts

Re: Indian ISPs: We already give govt full access to web traffic

#101

Post by somenameforme »

JumpCrisscross wrote: post #95
somenameforme wrote: post #88

Earlier quoted context omitted.

PRISM [1] didn't end when the media stopped reporting on it. If anything it's likely only become more emboldened given people's tepid response. This [2] is one of my favorite documents that was leaked. It's a user manual, "User's Guide For PRISM Skype Collection", for NSA agents spying on Skype "peer to peer" connections in real time. It even includes a helpful FAQ like agents wondering why they might receive copies…

PRISM is a good example of the difference between America and India. One, there's vocal and empowered opposition, opposition granted relief by the courts from time to time. Two, there was opposition–MUSCULAR involved hacking Google and Yahoo's clouds. Three, there is a warrant process. It's broken. It needs reform. But it exists.

What empowered opposition or successes? Many seem to have confused the highly publicized 'telephone metadata collection is unconstitutional' ruling with PRISM. That was related to other domestic spying bills - section 215 of the Patriot Act and its subsequent renewal under another spying act, the "USA Freedom Act." These cases/acts had nothing to do with PRISM.

Numerous cases have been filed against the NSA in regards to PRISM, with nothing even remotely close to success. They are invariably thrown out because the NSA acting illegally or unconstitutionally can only be challenged by somebody with standing. You only have standing if you can prove you have been surveilled and affected because of such. Nobody can prove standing, so it's impossible to legally challenge a likely illegal program. Great system we have.

Re: Indian ISPs: We already give govt full access to web traffic

#102

Post by NavinF »

dvno42 wrote: post #92
Anunayj wrote: post #59

People really underestimate the full scale of this, specially today with so many sites using cloudflare without strict ssl reverse proxy connection, Cloudflare Endpoints in India are INSIDE ISP networks [1], what this means is the ISP (and therefore by extension the government) sees EVERYTHING going out of cloudflare servers over http in plaintext. Worse ISP will also modify that content so you get the "This site has…

If I'm understanding you correctly, you are saying that the origin servers only listen on HTTP and that is where the ISP intercepts. Is it not common practice for the origin servers to also being using HTTPS? Afaik there's no simple way for the end user to know this though.

People who run the origin servers often use a CDN to do TLS termination because they are too incompetent to do it themselves. Not having to enable TLS is a major value-add for certain types and you'll see this advertised prominently by every CDN

Re: Indian ISPs: We already give govt full access to web traffic

#103

Post by switch007 »

Anunayj wrote: post #59

People really underestimate the full scale of this, specially today with so many sites using cloudflare without strict ssl reverse proxy connection, Cloudflare Endpoints in India are INSIDE ISP networks [1], what this means is the ISP (and therefore by extension the government) sees EVERYTHING going out of cloudflare servers over http in plaintext. Worse ISP will also modify that content so you get the "This site has…

It’s unethical of CloudFlare et al to offer such a feature.

Re: Indian ISPs: We already give govt full access to web traffic

#105

Post by 0x445442 »

triceratops wrote: post #89
0x445442 wrote: post #71

Earlier quoted context omitted.

I’ve wondered about this for a while now with all the social media banning. The FCC requires one to have a license to broadcast over the airwaves and from what I understand these regulations stem from a limited number of frequencies. But I wonder if the FCC would have been created if that physical constraint did not exist. Was the FCC more about the constrained physics or controlled information?

Constrained physics. The FCC doesn't regulate content on cable TV. Technologically, there's no reason cable radio couldn't have existed.

But I was talking about airwaves, and they do regulate what's on those. It's not just physics.

https://en.wikipedia.org/wiki/Federal_Communications_Commiss...

Re: Indian ISPs: We already give govt full access to web traffic

#106

Post by fomine3 »

huggingmouth wrote: post #64
stevewatson301 wrote: post #26

Earlier quoted context omitted.

NATing IPv4 traffic requires maintaining a 5-tuple of connection state[1], which means the ISP must log these 5-tuples to be able to track citizens individually. Further, if there's another layer of NAT (such as a free WiFi service in an airport or a WiFi router in a citizen's home), cooperation is needed at that NAT layer too. IPv6 obviates the need to maintain these 5-tuples since it has a larger IP address space.…

Wouldn't people just continue using consumer-grade routers which operate their own nat anyway? Even with ipv6, the traffic generated by all hosts behind a single isp subscription would appear to originate from a single ipv6 host, no?

People who live in developing country like India may use internet connection with CGNAT even for residential connection.

Re: Indian ISPs: We already give govt full access to web traffic

#107

Post by fomine3 »

staringback wrote: post #82
ljlolel wrote: post #74

Earlier quoted context omitted.

You would want to use NAT with ipv6 if you want to hide somewhat your traffic— say at university as one example. Couldn’t reply to other comment

No you wouldn't. You would use temporary privacy addresses in your SLAAC prefix (this is the default for a few operating systems)

IPv6 prefix is enough for tracking

Re: Indian ISPs: We already give govt full access to web traffic

#108

Post by triceratops »

0x445442 wrote: post #105
triceratops wrote: post #89

Earlier quoted context omitted.

Constrained physics. The FCC doesn't regulate content on cable TV. Technologically, there's no reason cable radio couldn't have existed.

But I was talking about airwaves, and they do regulate what's on those. It's not just physics. https://en.wikipedia.org/wiki/Federal_Communications_Commiss...

I have no idea what you're trying to say. Yes it's not "just physics" that causes the FCC to regulate the content of broadcasts on radio and TV airwaves. I thought that was obvious.

Even if the FCC chose not to regulate broadcast programming, they or some other body, would still need to enforce rights to frequencies. That's their raison d'etre. Content policing is an added function, which the law has found valid in the past precisely because frequencies are limited. I can't see such public interest legal opinions being newly formed today.

Re: Indian ISPs: We already give govt full access to web traffic

#109

Post by roncesvalles »

NavinF wrote: post #102
dvno42 wrote: post #92

Earlier quoted context omitted.

If I'm understanding you correctly, you are saying that the origin servers only listen on HTTP and that is where the ISP intercepts. Is it not common practice for the origin servers to also being using HTTPS? Afaik there's no simple way for the end user to know this though.

People who run the origin servers often use a CDN to do TLS termination because they are too incompetent to do it themselves. Not having to enable TLS is a major value-add for certain types and you'll see this advertised prominently by every CDN

There is another value add - being able to use self-signed certs and therefore not have to worry about renewals. Last I checked (~12 months ago), there still isn't a good story for doing automated SSL renewals if your application is completely containerized.

Re: Indian ISPs: We already give govt full access to web traffic

#110

Post by staringback »

fomine3 wrote: post #107
staringback wrote: post #82

Earlier quoted context omitted.

No you wouldn't. You would use temporary privacy addresses in your SLAAC prefix (this is the default for a few operating systems)

IPv6 prefix is enough for tracking

IPv6 prefix is assigned on a per router basis, you know, like how IPv4 and NAT already works.
Post reply on HN