Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ISP Spying

harrisonsand.com

Post reply on HN
Print view View original

101–110 of 134 posts

Re: ISP Spying

#101

Post by jimpudar »

markwaldron wrote: post #66
wepple wrote: post #63

I’ve pulled apart router firmware plenty of times, and am never surprised to see nbtscan, nmap, and all sorts of other tools on there. A lot of ISPs will perform remote diagnosis by connecting into your router and scanning your internal hosts to see if there are any problems. Between that capability and general appalling security of routers, you’re basically on Starbucks WiFi from a security perspective even at home.…

This is very informative! What router would you suggest purchasing?

A very secure solution is building your own box to run OpenBSD. There are some good guides on how to set up OpenBSD as a typical NAT router / firewall here: https://www.openbsd.org/faq/pf/example1.html

I like PF a lot more than IPTables. I've found it to be far simpler to configure.

Re: ISP Spying

#102

Post by javajosh »

gruez wrote: post #69
javajosh wrote: post #27

Is it just me or does this look like a huge opportunity? Last I checked we still have control over our devices, and if they are stupid enough to trust the data they collect, then we should feel free to poison the well. I'm talking about opening random connections to endpoints (either random or those we want to protect), to inject noise into the system. I call the idea "data flak". It could be something as simple as a…

>The only counter is for an adversary to own your box, which is far more expensive. or require your clients to run your software, like in AOL days

Well, in general, you'd want to draw a casual link between real physical measurement and network traffic; so yeah, if you own the client (and can accurately determine whether or not it's running in a VM, and/or manipulated by a robot, which is tricky) you can filter out the data flak. If I worked for a data-collection org I'd probably ignore (or blacklist, if I could get away with it) a known source of noise.

Re: ISP Spying

#103

Post by jacksmith21006 »

Problem is in the US ISP they can sell your data without telling you. So I prefer to keep my data away from them. I trust Google more to not sell my data and fine with them renting it out. Others might not. So use them for DNS for example so it does not go to my ISP.

https://www.usatoday.com/story/tech/news/2017/04/04/isps-can... ISPs can now collect and sell your data: What to know about Internet ...

Re: ISP Spying

#104

Post by swinglock »

alyandon wrote: post #93
a012 wrote: post #88

Earlier quoted context omitted.

Opposite on me, I'm having a Mikrotik hAp ac and considering to use it as AP only then buy a Ubiquiti ER-X in front of it.

I did consider going with a pure Ubiquti solution but after borrowing a friends ER-Lite and comparing it to running RouterOS in a VM I decided that Mikrotik was a better overall fit for me from a technical standpoint. The RB3011 having a powerful cpu + the integrated 10 port (actually two different switches) switch helped push me that direction. There was something almost zen-like watching 300Mbps of traffic transiti…

I would stay away from Ubnt routing. Which features that requires disabling packet processing off-loads and the performance impact is not well documented and varies between models and software versions.

There appears to be many bugs related to off-loading as well. The below example is what finally made me decide not to consider Ubnt routers. It may be fixed now, maybe, but even if it was broken for way too long and shrouded in too much mystery, not even making it obvious which models are effected (the thread title was not always that specific either). I can't take Ubnt seriously, even for a home environment, after seeing how basic forwarding is that poor and it's not even their highest priority.

The only good thing that this proves is that at least they don't censor their forums, trying to hide issues.

https://community.ubnt.com/t5/EdgeMAX/UDP-packet-loss-on-Cav...

Re: ISP Spying

#106

Post by js2 »

wil421 wrote: post #99
js2 wrote: post #97

Earlier quoted context omitted.

I get wirespeed routing from my ERL on my 1Gps connection. If it’s maxing out at 100 Mbps, those folks have it configured so that it’s having to route with the CPU.

I can’t find the dslreports link but here is one on the Ubiquiti forums . You can see the comments below about 100Mbps. The dslreports was slightly different but same results. [1] https://community.ubnt.com/t5/EdgeMAX-Stories/Bypassing-AT-a...

That post configures the ERL in bridging mode. The ERL simply isn't suitable for that. Don't buy an ERL if you need to use it in a configuration that it can't offload and expect more than 100Mbps performance. It's got a minimal CPU, so yes, performance will suffer if it can't offload.

You don't need to use bridging mode to bypass the AT&T RG. That post probably predates the EAP proxy solution.

https://github.com/jaysoffian/eap_proxy

Re: ISP Spying

#107

Post by MaxBarraclough »

LeoPanthera wrote: post #18

I've been forwarding all outgoing connections on port 80 (and a selection of other commonly-unencrypted ports) through a VPN (in the router) for a while now - but leaving all other ports (including most importantly 443) connecting directly. It feels like a good compromise between privacy and speed. (I realise this is not the subject of the article exactly but I figured it's a related issue.)

Interesting approach.

It has the happy property that the performance penalty will trend toward zero over time, as fewer and fewer holdout websites stick with unencrypted HTTP. Even Netflix streaming uses HTTPS these days.

By the end of the year I figure we'll have virtually no such holdouts. https://www.theregister.co.uk/2018/02/08/google_chrome_http_...

Re: ISP Spying

#108

Post by _x5tx »

TheRealDunkirk wrote: post #86
markwaldron wrote: post #66

Earlier quoted context omitted.

This is very informative! What router would you suggest purchasing?

I built my own, several years ago, on a (fanless!) board like this: http://www.pcengines.ch/apu3a4.htm It has 3 NIC's, for inside, outside, and DMZ. You can also put a wifi radio on it, and make it an access point. I run a full Ubuntu on it, with local DNS, DHCP, Shorewall, etc.

I was planning to build a firewall/router using an ESPRESSObin http://espressobin.net/

They cost 50$ and have 3Gigabit ethernet ports

Re: ISP Spying

#109

Post by Wheaties466 »

alyandon wrote: post #75
markwaldron wrote: post #66

Earlier quoted context omitted.

This is very informative! What router would you suggest purchasing?

Usually, anything you can install a third party firmware on like openwrt, dd-wrt or tomato (shibby's version of tomato is the one I used the most). However, I gave up on consumer hardware and went with Ubiquiti for wifi AP and Mikrotik as my router. It was a bit of a pain to set up all my NAT rules in the Mikrotik router because unfortunately consumer devices do a lot of extra work behind that scenes (like setting up…

I'll never move on from a mikrotik router and UBNT wireless.

also mikrotik routers comes with a standard config that comes with NAT w/ masquerade pre configured. But I agree there is a TON that is done behind the scenes. That level of granularity is what I am looking for.

Re: ISP Spying

#110

Post by jwilk »

dang wrote: post #105
jwilk wrote: post #29

Please use the original title.

The HN guidelines ask: "Please use the original title, unless it is misleading or linkbait." This one was linkbait—it used the linkbait "you" twice. We took that out. https://news.ycombinator.com/newsguidelines.html

I could figure out that "you" doesn't refer to me personally, and so can the rest of HN. There's nothing "linkbait" about it.

You can express your opinion about the original title in a comment. There's no need it impose this (twisted, IMO) view on everyone.

Post reply on HN