Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ars tests Internet surveillance by spying on an NPR reporter

arstechnica.com

Post reply on HN
Print view View original

21–30 of 67 posts

Re: Ars tests Internet surveillance by spying on an NPR reporter

#21

Post by doctorshady »

exelius wrote: post #2

None of this is shocking except for maybe how unavoidable sharing all this information online actually is. The default settings on most devices are not designed with privacy in mind. In order to avoid this type of data collection, you'd have to walk around with a dumbphone, avoid using any bank-connected services and basically only log on to the Internet via a VPN. Ironically, this usage pattern is so far out of the…

> This type of technology is so intertwined in our daily lives that avoiding it isn't a realistic option.

That seems like somewhat of an apathetic attitude to have. Try living without internet for a week, or even a day. It isn't so bad.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#22

Post by panarky »

Smerity wrote: post #10

I really appreciated this story. It's so hard to make people care about "small" data leaks when they have no idea what many "small" data leaks can lead to. The bug the journalists discovered that revealed Skype's contact list is the perfect example -- the programmer just did something completely "reasonable" (grabbing avatars) that ended up leaking a vital set of information. Imagine if surveillance was your full tim…

This was a wake-up call for me. On my desktop browser, I can use SSL, NoScript, etc. to control what's exposed.

But on my phone I'm powerless. How do I know what each app is capturing and transmitting in the clear? If even Google searches don't use SSL, what hope is there for other apps?

Re: Ars tests Internet surveillance by spying on an NPR reporter

#23

Post by helper »

ufmace wrote: post #18
helper wrote: post #3

Looks like the "Pwnie Express PwnPlug R2"[1] is just a Mirabox[2] with an extra wireless card in the Mini PCIe slot and an external antenna. The PwnPlug R2 sells for $1095; the Mirabox sells for $150. [1]: https://www.pwnieexpress.com/penetration-testing-vulnerabili... [2]: https://www.globalscaletechnologies.com/p-58-mirabox-develop...

I only skimmed the description of it, presumably the cost is more about being pre-loaded with a good software package for pen testing as opposed to having to set it all up yourself. Could be a pretty decent expense, even for a bigger pentest shop that has the resources to make a standard process for building and setting up stuff like that.

Right, you are paying an extra $945 for them to install a wifi card/antenna and preload a bunch of open source software on it. I'm sure that for some people it is totally worth it, and others would rather do it themselves.

I mostly pointed it out because I've used the Mirabox for a bunch of projects and recognized it in the picture. Its a great little ARM box with 2 gigabit ethernet ports (hard to find a on dev board)and 2 USB 3.0 ports.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#24

Post by coffeecheque »

How far would an always on VPN go to solving parts of these problems? At least it'd be encrypted to the VPN data centre.

I suppose from there it'd be in the clear, but at least it'd stop snooping at an ISP level. Or am I missing something, and would it be useless?

Re: Ars tests Internet surveillance by spying on an NPR reporter

#25

Post by daeken »

Smerity wrote: post #10

I really appreciated this story. It's so hard to make people care about "small" data leaks when they have no idea what many "small" data leaks can lead to. The bug the journalists discovered that revealed Skype's contact list is the perfect example -- the programmer just did something completely "reasonable" (grabbing avatars) that ended up leaking a vital set of information. Imagine if surveillance was your full tim…

> I'll again state that this is why I feel so strongly that Google Analytics should be updated to be HTTPS by default

That's an incredible waste of bandwidth for no improvement in privacy whatsoever. If HTTPS pages were including GA over HTTP, then yes, this would be an issue, but you're already requesting the page over HTTP, if you're getting GA over HTTP. There's simply no advantage whatsoever -- for privacy, security, or anything else -- to using HTTPS for this script. It doesn't make any attack harder in any way, shape, or form -- it just makes pages slower and more expensive to load.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#26

Post by lsh123 »

ojilles wrote: post #5

At this point, should we not just drop non-SSL traffic on the web completely?

Even SSL trafic leaks information about websites you are visiting, how much data you download (e.g. for email), how much time you spend, when do you do it, etc. More importantly, it doesn't protect you from the website (and any owner of any 3rd party plugin/widget/js/css/img on the website) from collecting data about your online behavior based on your browser signature or simple cookies.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#27

Post by lsh123 »

coffeecheque wrote: post #24

How far would an always on VPN go to solving parts of these problems? At least it'd be encrypted to the VPN data centre. I suppose from there it'd be in the clear, but at least it'd stop snooping at an ISP level. Or am I missing something, and would it be useless?

VPN is a tunnel. Your computer is on one end and there will be another computer on another end. The ISP or cloud provider on the other end will be able to spy on you even if you use VPN. And of course the website you are visiting has all the information in any case.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#28

Post by zhng »

daeken wrote: post #25
Smerity wrote: post #10

I really appreciated this story. It's so hard to make people care about "small" data leaks when they have no idea what many "small" data leaks can lead to. The bug the journalists discovered that revealed Skype's contact list is the perfect example -- the programmer just did something completely "reasonable" (grabbing avatars) that ended up leaking a vital set of information. Imagine if surveillance was your full tim…

> I'll again state that this is why I feel so strongly that Google Analytics should be updated to be HTTPS by default That's an incredible waste of bandwidth for no improvement in privacy whatsoever. If HTTPS pages were including GA over HTTP, then yes, this would be an issue, but you're already requesting the page over HTTP, if you're getting GA over HTTP. There's simply no advantage whatsoever -- for privacy, secur…

Using HTTPS be default may encourage more people to adopt it.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#29

Post by Terr_ »

panarky wrote: post #22
Smerity wrote: post #10

I really appreciated this story. It's so hard to make people care about "small" data leaks when they have no idea what many "small" data leaks can lead to. The bug the journalists discovered that revealed Skype's contact list is the perfect example -- the programmer just did something completely "reasonable" (grabbing avatars) that ended up leaking a vital set of information. Imagine if surveillance was your full tim…

This was a wake-up call for me. On my desktop browser, I can use SSL, NoScript, etc. to control what's exposed. But on my phone I'm powerless. How do I know what each app is capturing and transmitting in the clear? If even Google searches don't use SSL, what hope is there for other apps?

You can put on an firewall to block certain apps (requires rooting) but it's true that the measure won't help with "mostly respectable" ones that aren't using https.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#30

Post by Terr_ »

coffeecheque wrote: post #24

How far would an always on VPN go to solving parts of these problems? At least it'd be encrypted to the VPN data centre. I suppose from there it'd be in the clear, but at least it'd stop snooping at an ISP level. Or am I missing something, and would it be useless?

I use OpenVPN on my home desktop, but the main benefit is just that it protects my laptop/phone from people sniffing wifi in public locations.

So the other folks in Starbucks won't know what Reddit comments I'm leaving :p

Post reply on HN