Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI now recommends using an ad blocker when searching the web

standard.co.uk

Post reply on HN
Print view View original

381–390 of 445 posts

Re: The FBI now recommends using an ad blocker when searching the web

#381

Post by autoexec »

devnullbrain wrote: post #377
autoexec wrote: post #40

Earlier quoted context omitted.

adnauseam is seriously a terrible idea. It's actually dangerous. The idea that you can somehow trick advertisers by polluting your dossier and making it useless to them after filling it with random data is fundamentally flawed. Every scrap of data collected about you will be used against you. It doesn't matter if it's accurate or not, nobody cares if they data they have about you is accurate, data brokers will happil…

These theoretical problems sound like compelling reasons to damage parties that sell this information as much as possible.

I'd be very surprised if all those problems were just theoretical even for you. Insurance companies are already using info from data brokers (https://www.propublica.org/article/health-insurers-are-vacuu...), employers are using it in employment screening (illegally) and data brokers have already been fined because of it (https://www.engage.hoganlovells.com/knowledgeservices/news/f...), it's used to set individualized prices online and offline (https://www.forbes.com/sites/adamtanner/2014/03/26/different...). Data brokers are already selling lists of people who have visited abortion clinics. (https://www.vice.com/en/article/m7vzjb/location-data-abortio...)

Companies are using every scrap of data they can get their hands on to take more of our money and they want more. The government is buying up data they can't legally collect directly. It's pretty likely that you've already experienced real world consequences of the data taken from your online activities. (https://epic.org/issues/consumer-privacy/data-brokers/)

They tell us that all the tracking we're subjected to is just about ads, but the data being collected is used all over the place offline. What we really need is privacy regulation with real teeth, but that's probably not going to happen any time soon because it's making companies tons of money. There's a multi-billion dollar a year industry around the buying and selling of the our data for a reason.

Re: The FBI now recommends using an ad blocker when searching the web

#382

Post by mlry »

Xenoamorphous wrote: post #334
emacdona wrote: post #203

I recommend using an ad-blocker while visiting that site :-/ Lately, I find myself using more and more plugins to make the "modern web" tolerable. To list a few: Channel Blocker (lets me block channels from search results on Youtube); uBlock Origin; Disconnect; F.B Purity; Consent-O-Matic (auto fill cookie consent forms); Kagi Search; PopUpOFF; Facebook Container; Privacy Badger; ClearURLs; Return YouTube Dislike Bas…

> Basically, if I visit a website and don't like the experience, I either never go back (Kagi lets me exclude it from search results) or find a plugin to make it tolerable. If you like a site to go back to it repeatedly don't you think it would be fair to "pay the fee" of seeing the ads, thus supporting that site, however annoying they are?

It's not really about seeing ads. It's getting tracked every inch of the way, being sorted into unkownable categories and actively being served malware that makes me use an adblocker. Classic TV made do without "personalized" ads, why should this not be enough to compensate for presenting and maintaining a website?

Re: The FBI now recommends using an ad blocker when searching the web

#383

Post by JohnFen »

tsimionescu wrote: post #292
JohnFen wrote: post #168

Earlier quoted context omitted.

> force all 443 traffic though a proxy That's insufficient. There's nothing stopping a web site (or ad on a website) from forming its own DoH request that bypasses the browser and the port. It can be done entirely within the HTTPS stream.

If you're monitoring the HTTPS stream, you'll see it. The point of the proxy is exactly to inspect the content of HTTPS requests (that's why you need to install your own certificate).

Yes, exactly. That's what I do -- I MITM all HTTPS streams for this purpose.

Re: The FBI now recommends using an ad blocker when searching the web

#384

Post by JohnFen »

LinuxBender wrote: post #171
JohnFen wrote: post #157

Earlier quoted context omitted.

> I have yet to come across one utilized in the wild How would you be able to tell?

I confine everything on my network and if anything is able to resolve any one of the sanctioned countries or if the domains I override resolve to their correct address I will see it. I can only think of one opaque device I have that could even try to do that but I know it doesn't because I have to unblock .cn to get vehicle updates for it. I should add that I do not let random IoT's onto my network and that vehicle d…

You should consider filtering your HTTPS streams.

Re: The FBI now recommends using an ad blocker when searching the web

#385

Post by JohnFen »

josephcsible wrote: post #195
JohnFen wrote: post #154

Earlier quoted context omitted.

But when the network is mine, and I'm the administrator, anything that prevents me from seeing what's happening is a Bad Thing. DoH opens me up to security problems that I wouldn't otherwise have, and the extent I have to go to in order to stop it is crazy. > DoH is a tool like any other. Good or bad entirely on why and how it’s used. Except that it's a tool I have little control over, and no control over how and why…

> But when the network is mine, and I'm the administrator, anything that prevents me from seeing what's happening is a Bad Thing. That's not true when the just the network itself is yours. It's only true when all of the computers on it are too. > DoH opens me up to security problems that I wouldn't otherwise have, and the extent I have to go to in order to stop it is crazy. What? No it doesn't. > Except that it's a t…

> It's only true when all of the computers on it are too.

I was unclear. This is exactly the case I'm talking about. The network, and all of the devices on the network, are mine.

> What? No it doesn't.

It does. It makes it easier for bad actors -- mostly advertising networks -- to bypass my DNS filtering. They can do it all with their own code, encrypted through HTTPS to hide it, and never touch my DNS systems, nor be affected by browser settings.

> You're not supposed to be able to have control over what tools other people use on their own computers.

Again, I'm talking about having control over my own machines, not anyone else's.

Re: The FBI now recommends using an ad blocker when searching the web

#386

Post by JohnFen »

yubiox wrote: post #374
JohnFen wrote: post #151

Earlier quoted context omitted.

> killing DoH conclusively on your home network is more difficult than you've made it seem True. I had to install a system to MITM all my https traffic in order to block DoH requests.

Can you give any more detail on how you did this? Is squid the proxy? How does it know which traffic is doh? What do you do with those requests?

Yes, I've installed my own cert to negotiate HTTPS connections, then proxy through software to check the contents being sent.

Basically the same process that some companies use for similar purposes.

Re: The FBI now recommends using an ad blocker when searching the web

#387

Post by JohnFen »

dngray wrote: post #275
JohnFen wrote: post #151

Earlier quoted context omitted.

> killing DoH conclusively on your home network is more difficult than you've made it seem True. I had to install a system to MITM all my https traffic in order to block DoH requests.

> killing DoH conclusively on your home network is more difficult than you've made it seem It's actually not too difficult if your users use Firefox. You can use enterprise policies https://support.mozilla.org/en-US/products/firefox-enterpris... /* 0710: disable DNS-over-HTTPS (DoH) rollout [FF60+] * 0=off by default, 2=TRR (Trusted Recursive Resolver) first, 3=TRR only, 5=explicitly off * see "doh-rollout.home-regio…

That only affects things that use the browser's facilities to engage in DoH. A web page could decide not to do that, and manufacture their own lookups using JS, for instance.

Re: The FBI now recommends using an ad blocker when searching the web

#388

Post by alickz »

hailwren wrote: post #86
madars wrote: post #71

Or, in other words, FBI now recommends using Android :-) It's baffling how much better uBlock Origin + Firefox experience on Android is compared to any iOS ad blocker I have tried. They kind-of work but let half of the ads through.

Yeah, android trades browser ads for system wide tracking. I’m not really sure that’s a good deal.

As does iOS, but the user has no control over the device so can't do anything about it

Re: The FBI now recommends using an ad blocker when searching the web

#389

Post by LinuxBender »

JohnFen wrote: post #384
LinuxBender wrote: post #171

Earlier quoted context omitted.

I confine everything on my network and if anything is able to resolve any one of the sanctioned countries or if the domains I override resolve to their correct address I will see it. I can only think of one opaque device I have that could even try to do that but I know it doesn't because I have to unblock .cn to get vehicle updates for it. I should add that I do not let random IoT's onto my network and that vehicle d…

You should consider filtering your HTTPS streams.

Funny you should mention that. I have a few Squid-SSL-Bump proxies that I use for a few devices. For several years I even used that to visit HN and to my surprise was rarely rate limited or blocked when accessing from a VPS. With Squid I can also make decisions on content types, file sizes and more. There are only a handful of sites it doesn't work with because they for whatever reason are still using public key pinning. A few google sub-domains, eff.org, paypal but interestingly no banks.

This only works with devices that I can install my own CA key onto. I have not figured out how to do that with the vehicle diagnostic tool.

Re: The FBI now recommends using an ad blocker when searching the web

#390

Post by josephcsible »

JohnFen wrote: post #385
josephcsible wrote: post #195

Earlier quoted context omitted.

> But when the network is mine, and I'm the administrator, anything that prevents me from seeing what's happening is a Bad Thing. That's not true when the just the network itself is yours. It's only true when all of the computers on it are too. > DoH opens me up to security problems that I wouldn't otherwise have, and the extent I have to go to in order to stop it is crazy. What? No it doesn't. > Except that it's a t…

> It's only true when all of the computers on it are too. I was unclear. This is exactly the case I'm talking about. The network, and all of the devices on the network, are mine. > What? No it doesn't. It does. It makes it easier for bad actors -- mostly advertising networks -- to bypass my DNS filtering. They can do it all with their own code, encrypted through HTTPS to hide it, and never touch my DNS systems, nor b…

> It makes it easier for bad actors -- mostly advertising networks -- to bypass my DNS filtering. They can do it all with their own code, encrypted through HTTPS to hide it, and never touch my DNS systems, nor be affected by browser settings.

If that makes DoH bad, then privacy is bad too since it makes it easier for terrorists and pedophiles to evade the law.

Post reply on HN