Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ISP Spying

harrisonsand.com

Post reply on HN
Print view View original

11–20 of 134 posts

Re: ISP Spying

#11

Post by thinkMOAR »

jstanley wrote: post #9
moviuro wrote: post #6

Earlier quoted context omitted.

You're just paying some extra third-party that handles all your traffic now. What's to prevent them from doing the same? You're moving trust to another actor.

It's easy to move your VPN to an arbitrary VPS anywhere in the world, but there's only a handful of residential ISPs available in any given area, and they are almost univerally scummy.

scummy often by law, if it was up to many ISPs, like in the early days of the internet, they only cared if you paid your monthly bill.

Re: ISP Spying

#12

Post by philjohn »

Buge wrote: post #7

That router looks like its control panel is hosted on an external server. Router control panels usually show what devices are connected. So for router control panel functionality, they need to have the router report all connected devices to the server. Obviously they should be doing this encrypted, not unecrypted. But ignoring encryption, this is the price you pay for cloud management: the could knows your data.

Remember, the TR-069 traffic starts at your device, and terminates at their end, it's not making it out onto the public internet, it's entirely within the ISP network.

That's not to say it still shouldn't be encrypted, but with a FTTH connection using a PON network there's already physical layer encryption going on typically, otherwise a custom configured ONT could snoop on other peoples traffic on the same segment.

Re: ISP Spying

#13

Post by shubb »

moviuro wrote: post #6
mirimir wrote: post #4

I always assume that they might be. So I always use my own perimeter router/firewall running pfSense. Plus I use VPN services. And so my ISps don't end up seeing anything except encrypted streams. And have no visibility into my vLANs.

You're just paying some extra third-party that handles all your traffic now. What's to prevent them from doing the same? You're moving trust to another actor.

Personally I very much agree that using a vpn service for all your traffic is probably not a good idea. As well as other objections, some have been confirmed to sell fine grain traffic information, and may have an easier time justifying that as it is arguably anonymised.

That said, if you set up your own vpn on a digital ocean node, moving your network boundary to the datacentre, then the cloud hosting companies network that you end up trusting is less likely to be set up to spy on you then a consumer isp.

I get bad speed though when I do this. The processibg speed required to encrypt a connection at 300mbps just isn't there in my router.

Re: ISP Spying

#14

Post by philjohn »

This isn't an issue if you're not using the ISP equipment, or put the ISP equipment into a bridge modem mode.

For instance, BT in the UK do the same reporting over TR-069 if you use their home hub - however - if you connect a different VDSL modem/router you can disable TR-069, and if you use a dedicated VDSL modem in bridged mode and a wireless router behind that there's no TR-069 to worry about in the first place.

Re: ISP Spying

#15

Post by prima-facie »

mirimir wrote: post #4

I always assume that they might be. So I always use my own perimeter router/firewall running pfSense. Plus I use VPN services. And so my ISps don't end up seeing anything except encrypted streams. And have no visibility into my vLANs.

Commercial VPN services are not a good idea in the first place https://gist.github.com/joepie91/5a9909939e6ce7d09e29

Re: ISP Spying

#16

Post by mysterypie »

rishabhd wrote: post #3

well, who isn't? Even at the most basic level, my local ISP is injecting ads into browsers.

The original title before the admins changed it was "Your ISP is Probably Spying On You", and you wrote:

> well, who isn't?

I can understand that we all get weary from the constant news of yet another privacy intrusion, surveillance method being discovered, or new government law eroding privacy. But why be dismissive? When Snowden revealed what he knew, it confirmed what I had already suspected. But I didn't go and say, "well of course, we all knew that we were being illegally spied on us". I thought that getting the specific information was very important.

Re: ISP Spying

#17

Post by Aaargh20318 »

jstanley wrote: post #9
moviuro wrote: post #6

Earlier quoted context omitted.

You're just paying some extra third-party that handles all your traffic now. What's to prevent them from doing the same? You're moving trust to another actor.

It's easy to move your VPN to an arbitrary VPS anywhere in the world, but there's only a handful of residential ISPs available in any given area, and they are almost univerally scummy.

> there's only a handful of residential ISPs available in any given area

Depends on where you live, I haven't exactly counted them but I have at least 20 options. Worst-case you can start your own ISP.

Re: ISP Spying

#18

Post by LeoPanthera »

I've been forwarding all outgoing connections on port 80 (and a selection of other commonly-unencrypted ports) through a VPN (in the router) for a while now - but leaving all other ports (including most importantly 443) connecting directly.

It feels like a good compromise between privacy and speed.

(I realise this is not the subject of the article exactly but I figured it's a related issue.)

Re: ISP Spying

#19

Post by Aaargh20318 »

moviuro wrote: post #6
mirimir wrote: post #4

I always assume that they might be. So I always use my own perimeter router/firewall running pfSense. Plus I use VPN services. And so my ISps don't end up seeing anything except encrypted streams. And have no visibility into my vLANs.

You're just paying some extra third-party that handles all your traffic now. What's to prevent them from doing the same? You're moving trust to another actor.

You should not trust anyone handling your traffic, that's why things like HTTPS and SSH exist.

The problem here is not that the ISP can not be trusted, you should never trust them anyway. The problem is that the ISP is using their router to force their way into what is supposed to be the trusted part of your network, your LAN.

This is exactly why I don't use the ISP provided router, and every piece of equipment of theirs I have to use (mainly the IPTV box) is in a separate, untrusted, VLAN.

Post reply on HN