Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ars tests Internet surveillance by spying on an NPR reporter

arstechnica.com

Post reply on HN
Print view View original

61–67 of 67 posts

Re: Ars tests Internet surveillance by spying on an NPR reporter

#61

Post by exelius »

doctorshady wrote: post #50
exelius wrote: post #42

Earlier quoted context omitted.

Sounds great for a vacation. But considering I make a living talking to people who don't wear tinfoil hats, it's really not realistic to live the rest of my life disconnected from the net. I imagine the same goes for 99% of people on this site.

That's a fair point, but I'm still willing to bet you could at the very least drastically reduce the amount of time you spend on the net if you wanted to.

Yeah; but it's not about how much time you spend on the net: simply owning a smartphone and using it sparingly exposes a lot of information.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#62

Post by sroerick »

XorNot wrote: post #52
sroerick wrote: post #6

Earlier quoted context omitted.

> In order to avoid this type of data collection, you'd have to walk around with a dumbphone, avoid using any bank-connected services and basically only log on to the Internet via a VPN. Ironically, this usage pattern is so far out of the ordinary that it would make you stick out like a sore thumb. Have you considered trying this, or some implementation of it? I, for one, would like to see websites that didn't instal…

"If there was a news website that didn't install any tracking software, but instead just offered pages with cryptocurrency addresses, I would switch to that as my default news source in a second." No you wouldn't. You might be hard-minded enough to try and commit to it, but instead you'd almost certainly just stop reading any news...then go back to aggregators/blogs whatever. It's a well studied problem that as soon…

> No you wouldn't. You might be hard-minded enough to try and commit to it, but instead you'd almost certainly just stop reading any news...then go back to aggregators/blogs whatever.

Yes I would. I do soft boycotts of all music that isn't Creative Commons, and movies by major media companies. I've listened to almost exclusively free music for years. (Libre music for close to 6 mo.) I still go to movies sometimes, but who cares? The point of a boycott isn't necessarily to hurt a company's revenue, it's also to drive change in consumption habits.

I'm not trying to quit the normal web altogether, I'm just saying that if there were ONE news website that didn't have tracking software installed, I would switch to it as my default news source. I can't say for sure if I would donate to articles via a bitcoin link, but I would imagine it would be optional.

HN is nice, but it's just an aggregator. Even though it doesn't have tracking software, everything that it links to does.

EDIT: Oh, and I meant to say, I have indeed switched to a dumbphone, and I use a VPN. I still use bank related services, but I try to use bitcoin when I can. I have no illusions about its anonymity, I just try to vote with my feet and my dollars. Just because there are a lot of consumers who don't change their consumption habits doesn't mean that some won't.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#63

Post by daeken »

x1798DE wrote: post #32
daeken wrote: post #25

Earlier quoted context omitted.

> I'll again state that this is why I feel so strongly that Google Analytics should be updated to be HTTPS by default That's an incredible waste of bandwidth for no improvement in privacy whatsoever. If HTTPS pages were including GA over HTTP, then yes, this would be an issue, but you're already requesting the page over HTTP, if you're getting GA over HTTP. There's simply no advantage whatsoever -- for privacy, secur…

The only significant overhead that TLS imposes is in the initial (public-key) handshake, and even then the overhead is primarily for high-traffic servers. Once a TLS (HTTPS) session has been established, it's essentially free to continue using it. Given that Google Analytics is basically everywhere on the web (and thus you can imagine your session would be fairly persistent as you're surfing around) and that Google c…

The cost is quite low for a single connection, but given that Google Analytics is on a huge portion of sites, that adds up really, really quickly. In addition, the additional roundtrips required for the TLS handshake is killer on a high-latency connection, seriously slowing things down for mobile devices.

Given that there really is no privacy benefit, I can't imagine why you would take on that overhead; Google clearly agrees, or they would've turned on HTTPS by default.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#64

Post by sroerick »

rev_bird wrote: post #39
sroerick wrote: post #6

Earlier quoted context omitted.

> In order to avoid this type of data collection, you'd have to walk around with a dumbphone, avoid using any bank-connected services and basically only log on to the Internet via a VPN. Ironically, this usage pattern is so far out of the ordinary that it would make you stick out like a sore thumb. Have you considered trying this, or some implementation of it? I, for one, would like to see websites that didn't instal…

Google metrics aren't always used for spying on people -- news sites in particular drool over every possible metric to measure popularity, referrals, etc. to better tailor their online marketing (and sometimes story selection). It sounds weird, but I'm not sure a website without tracking would be as good.

No, I don't think it would be. For a company to announce that they were forgoing tracking would be a brave step. I understand that analytics is a really really useful thing for a company.

But, as a corrolary, what if Google Analytics alters the content in a way that makes it less useful? The obvious example here is clickbait articles (See, Clickhole), but I think there's other more subtle problems here. Isn't the job of a reporter to report what _they_ think is news, rather than what people want to read?

Beyond that, I am troubled by the spying on people. It occurs to me that even if I remove Google Analytics from my website, anyone coming to or going from my website will be subject to monitoring by Google. It's not exactly opt out.

Microtransactions are hard, though, that problem still hasn't been solved.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#65

Post by daeken »

Smerity wrote: post #41
daeken wrote: post #25

Earlier quoted context omitted.

> I'll again state that this is why I feel so strongly that Google Analytics should be updated to be HTTPS by default That's an incredible waste of bandwidth for no improvement in privacy whatsoever. If HTTPS pages were including GA over HTTP, then yes, this would be an issue, but you're already requesting the page over HTTP, if you're getting GA over HTTP. There's simply no advantage whatsoever -- for privacy, secur…

There is a major improvement to privacy in the larger scale: the Google Analytics servers are a funnel for a substantial percentage of all web traffic. Read the write-up I linked to, specifically "How does that help the NSA?". Usage of unencrypted Google Analytics + Google cookies[1] means that you don't need to eavesdrop on individual connections, just one small set: the endpoints to the Google Analytics servers. He…

> Usage of unencrypted Google Analytics + Google cookies means that you don't need to eavesdrop on individual connections, just one small set: the endpoints to the Google Analytics servers.

Admittedly, it is a smaller number of endpoints than monitoring every site in the world (that much is obvious), but it's not one or two -- they're all over the place.

But even ignoring that, it really comes down to one thing: Google Analytics can't possibly make an HTTP site any less secure or less private -- you're sending a postcard with your personal details on it a million times a second! It may in some situations make it slightly (very slightly) easier for someone to snoop on a tiny bit of info about your traffic, but the fix for this isn't to make that harder, it's to make it harder to snoop on your traffic entirely. We already have a solution for this: ubiquitous TLS.

IMO, this is slapping a band-aid where your arm used to be; trying to increase the privacy of HTTP sites is a fool's errand and a complete and utter waste of time.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#66

Post by XorNot »

sroerick wrote: post #62
XorNot wrote: post #52

Earlier quoted context omitted.

"If there was a news website that didn't install any tracking software, but instead just offered pages with cryptocurrency addresses, I would switch to that as my default news source in a second." No you wouldn't. You might be hard-minded enough to try and commit to it, but instead you'd almost certainly just stop reading any news...then go back to aggregators/blogs whatever. It's a well studied problem that as soon…

> No you wouldn't. You might be hard-minded enough to try and commit to it, but instead you'd almost certainly just stop reading any news...then go back to aggregators/blogs whatever. Yes I would. I do soft boycotts of all music that isn't Creative Commons, and movies by major media companies. I've listened to almost exclusively free music for years. (Libre music for close to 6 mo.) I still go to movies sometimes, bu…

Creative Commons is different - you don't pay.

The point I was making was that the act of knowing that every click through was costing you some small but real amount of money, would change your behavior dramatically.

So that's the challenge: you need no tracking, but no obvious fees either.

Re: Ars tests Internet surveillance by spying on an NPR reporter

#67

Post by voltagex_ »

helper wrote: post #60
voltagex_ wrote: post #54

Earlier quoted context omitted.

Have you ever used the Dreamplug? I'm still hanging onto mine but it sounds like the Mirabox might be a suitable upgrade. How's the kernel support? How's uBoot? (On the Dreamplug, you have to upgrade uBoot via JTAG once you get past a certain kernel version)

Yes I have used the Dreamplug, the Mirabox is a logical upgrade from that. The Mirabox uses a Marvell Armada 370 SOC. When I first got my Mirabox the kernel support wasn't great. But Marvell has been contracting with an embedded Linux contracting firm, Free Electrons, to get everything into the mainline. Free Electrons has done a great job and now you can run a stock kernel fairly easily. The Mirabox comes with the M…

>The Mirabox comes with the Marvell fork of uBoot which is unfortunately quite old. It doesn't have support for device-tree, for example. I'm not aware of a newer working version from either Marvell or Globalscale. There was some initial work to get Barebox working on the Mirabox, but it is very feature limited.

This was the situation with the Dreamplug before it got mainline uBoot support. Is there any hope for the Mirabox?

Post reply on HN