Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ISP Spying

harrisonsand.com

Post reply on HN
Print view View original

121–130 of 134 posts

Re: ISP Spying

#121

Post by jimpudar »

woolvalley wrote: post #113
jimpudar wrote: post #101

Earlier quoted context omitted.

A very secure solution is building your own box to run OpenBSD. There are some good guides on how to set up OpenBSD as a typical NAT router / firewall here: https://www.openbsd.org/faq/pf/example1.html I like PF a lot more than IPTables. I've found it to be far simpler to configure.

Usually the issue in setting up a PC to do this kind of stuff is power consumption. Typically it's a minimum of 60W to run an idle PC, while an ARM router would run at 1-5W and have multiple ethernet ports.

Correct me if I'm wrong - I haven't tried it - but it looks like you should be able to run OpenBSD on ARM https://www.openbsd.org/armv7.html

I'll check what the energy consumption on my router is. I'm using an AMD chip which I had lying around. You're probably right that it uses a bit more power than necessary.

I was thinking about getting something like this: https://www.amazon.com/Firewall-Micro-Appliance-Gigabit-Bare... which uses 10W. It should be easy to install *BSD on something similar.

Re: ISP Spying

#122

Post by Scottn1 »

etskinner wrote: post #98
EADGBE wrote: post #81

Earlier quoted context omitted.

Does not using their own routers make ISP traffic sniffing that much harder? I'd assume if you're using their pipes, they can see what goes through it, regardless. Genuinely intrigued in this.

End-to-end encryption like SSL (https) is meant to limit the middle man's ability to 'see everything'. Instead of seeing the details of your Google search, all they see is that you accessed Google at [x] time, and exchanged [y] amount of data. This is why there is such a push for end to end encryption on web traffic, chat apps, etc.

ISP can very easily see what you searched for even with SSL. SSL encrypts the TRAFFIC so they can't see the content of the webpages, But your search terms are right there naked in the URL even though it is https secured. This is unfortunately the case for Google, Bing and even DuckDuckGo. Try it and you can see for yourself.

At least DDG offers in their options to scramble the URL but one has to know about that feature AND enable it. It is in their settings under Privacy and you have to turn OFF GET (2nd option). https://duckduckgo.com/settings#

Re: ISP Spying

#123

Post by gspetr »

Tijdreiziger wrote: post #21
jstanley wrote: post #9

Earlier quoted context omitted.

It's easy to move your VPN to an arbitrary VPS anywhere in the world, but there's only a handful of residential ISPs available in any given area, and they are almost univerally scummy.

> and they are almost univerally scummy Source? I do not think most of the ISPs in my area are particularly scummy. They provide reliable plain internet service with no data caps (and also TV/phone service if you so desire) for a reasonable monthly fee, and in my experience, most of them hire enough customer service workers on their support phone. All of them also resisted internet filtering until the legal system fo…

> What more is there to ask?

Taking care of insecure IoT devices would be a start: https://news.ycombinator.com/item?id=15946095

Re: ISP Spying

#124

Post by rishabhd »

mysterypie wrote: post #16
rishabhd wrote: post #3

well, who isn't? Even at the most basic level, my local ISP is injecting ads into browsers.

The original title before the admins changed it was "Your ISP is Probably Spying On You", and you wrote: > well, who isn't? I can understand that we all get weary from the constant news of yet another privacy intrusion, surveillance method being discovered, or new government law eroding privacy. But why be dismissive? When Snowden revealed what he knew, it confirmed what I had already suspected. But I didn't go and s…

My apologies, I did read the article and then commented. The author is obviously privacy focused and is writing for a similar audience. Unfortunately, here in India, things are quite different as there are very few legal measures to protect privacy and there is a general lack of awareness regarding why digital privacy actually matters. Things are so bad at some places that even local ISPs (even with no BGP AS) are able to collect data, and sell it to markets in gaffar for as low as 2 USD (for instance a list of 25K users with their browsing habits). A small, cottage industry of data mining and selling operates with zero implications and even the cops can't do anything about it as they are brutally unaware about the privacy laws and shrug it off. I have my own VPN setup (openVPN to tinc mesh over scaleway/hetzner) for my general surfing and have configured it for my whole family through a raspberry pi as well. But again, the when the smallest of enterprises can operate with zero ramifications for mining, there is little you can do en masse without the backings of an informed government.

Re: ISP Spying

#125

Post by rishabhd »

breakingcups wrote: post #30
rishabhd wrote: post #3

well, who isn't? Even at the most basic level, my local ISP is injecting ads into browsers.

That is so fucked up. That isn't the case at all over here. Why do people accept it, a monopoly in their area?

Unfortunately people are simply unaware about their rights in general regarding privacy and the locals laws are not stringent. They are not even aware that their data is being collected, and even if they knew, they can do little about it. Privacy focused users create their own infrastructure or get VPN, rest all contribute to a small cottage industry of data collection, analysis and selling unknowingly.

Re: ISP Spying

#126

Post by Buge »

philjohn wrote: post #12
Buge wrote: post #7

That router looks like its control panel is hosted on an external server. Router control panels usually show what devices are connected. So for router control panel functionality, they need to have the router report all connected devices to the server. Obviously they should be doing this encrypted, not unecrypted. But ignoring encryption, this is the price you pay for cloud management: the could knows your data.

Remember, the TR-069 traffic starts at your device, and terminates at their end, it's not making it out onto the public internet, it's entirely within the ISP network. That's not to say it still shouldn't be encrypted, but with a FTTH connection using a PON network there's already physical layer encryption going on typically, otherwise a custom configured ONT could snoop on other peoples traffic on the same segment.

If there's already encryption, how did the author snoop on the content?

Re: ISP Spying

#127

Post by LeoPanthera »

brigade wrote: post #58
LeoPanthera wrote: post #18

I've been forwarding all outgoing connections on port 80 (and a selection of other commonly-unencrypted ports) through a VPN (in the router) for a while now - but leaving all other ports (including most importantly 443) connecting directly. It feels like a good compromise between privacy and speed. (I realise this is not the subject of the article exactly but I figured it's a related issue.)

Why do you feel that way? VPNs are vastly more likely to actually read your traffic than any ISP.

I control the other end of the VPN, I'm not using a public VPN service. All I care about is routing around my ISP. (Which is Comcast - whom I do not trust.)

Re: ISP Spying

#128

Post by tombrossman »

Scottn1 wrote: post #122
etskinner wrote: post #98

Earlier quoted context omitted.

End-to-end encryption like SSL (https) is meant to limit the middle man's ability to 'see everything'. Instead of seeing the details of your Google search, all they see is that you accessed Google at [x] time, and exchanged [y] amount of data. This is why there is such a push for end to end encryption on web traffic, chat apps, etc.

ISP can very easily see what you searched for even with SSL. SSL encrypts the TRAFFIC so they can't see the content of the webpages, But your search terms are right there naked in the URL even though it is https secured. This is unfortunately the case for Google, Bing and even DuckDuckGo. Try it and you can see for yourself. At least DDG offers in their options to scramble the URL but one has to know about that featu…

> But your search terms are right there naked in the URL even though it is https secured

You are correct that the terms are in the URL, however only the browser and endpoint can see them. All your ISP sees is that you accessed example.com, and not example.com/search-terms-here. The TLS handshake is for the domain only, then encryption kicks in, then everything after is encrypted.

Your ISP cannot see what you are searching for, they can only see which sites you use for search.

Re: ISP Spying

#129

Post by gcb0 »

madez wrote: post #77
RoadieRoller wrote: post #74

Somewhere someone could be selling your data for money. I can imagine the below happening. After all, all corporates are hand-in-glove with each other when it comes to public's privacy. This is probably what your ISP is doing. Take your MAC Addresses, try to find the phones in your house which is connected to the wifi, take those MAC addresses to all the telecoms, get the SIM card number and the phone number associat…

That is very soon illegal in the EU thanks to the GDPR, and it is already in some countries like Germany.

absolutely not.

gdpr is a nightmare for websites, because of the consent rule.

but guess what is the first thing you with a ISP. You sign a contract. done. it's all legal with gdpr or not.

Re: ISP Spying

#130

Post by madez »

gcb0 wrote: post #129
madez wrote: post #77

Earlier quoted context omitted.

That is very soon illegal in the EU thanks to the GDPR, and it is already in some countries like Germany.

absolutely not. gdpr is a nightmare for websites, because of the consent rule. but guess what is the first thing you with a ISP. You sign a contract. done. it's all legal with gdpr or not.

In Recital 43, the GDPR adds a presumption that consent is not freely given if there is “a clear imbalance between the data subject and the controller, in particular where the controller is a public authority.” Importantly, a controller may not make a service conditional upon consent, unless the processing is necessary for the service. Also, data subjects have the right to withdraw given consent.
Post reply on HN