Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data brokers sell access to the backbone of the internet

vice.com

Post reply on HN
Print view View original

21–30 of 41 posts

Re: Data brokers sell access to the backbone of the internet

#21

Post by hnthrowtier1 »

nisegami wrote: post #10
ganoushoreilly wrote: post #8

What blows my mind is the number of people signing up for these "VPN" services thinking it's secure. Time and time again we've found that they are logging and if they aren't it's logged at the flow point (as linked in this article). I'm fine with VPN to evade restrictions or whatever purpose you want, but stop pretending it's all that different. I can say though for a fact that a few of the largest security companies…

I've held the same opinion for a long time, but this news gave me pause. Why would it be worth paying for data that can trace VPN traffic if they weren't doing _something_?

Power, paranoia, crime, curiosity.

Power: Businesses are run by humans, who do not merely optimize discounted cashflows. Some humans enjoy wielding power, and frequently do so in an antisocial manner. See eg Stanford Prison Experiment.

Paranoia: Royalty have always been paranoid. Much has been written about the intelligence operations of paranoid merchants in Renaissance Venice. You should think of huge private entities like Koch Industries and Bloomberg as kingdoms. Maybe security teams want to see threats, which increases their importance to the organization.

Crime: Theft, manipulation, subversion. Companies do crime all the time, and are rarely held to account. There are indirect indicators that this type of conduct is becoming more common.

Curiosity: According to Snowden, even cleared NSA employees who pass a polygraph and invasive FBI background check abuse their access to personal data out of curiosity. This is probably a human invariant.

Re: Data brokers sell access to the backbone of the internet

#22

Post by relax88 »

andrewmcwatters wrote: post #15

Can someone explain to me why anyone would use a consumer VPN versus SSH tunneling through to a nation with secure data privacy laws if you know what you're doing, other than convenience or the number of countries you can connect to for Netflix purposes maybe?

VPN services are cheaper than a VPS and most people just want to pirate movies without getting legal threats or to avoid region locking.

Re: Data brokers sell access to the backbone of the internet

#23

Post by relax88 »

ganoushoreilly wrote: post #8

What blows my mind is the number of people signing up for these "VPN" services thinking it's secure. Time and time again we've found that they are logging and if they aren't it's logged at the flow point (as linked in this article). I'm fine with VPN to evade restrictions or whatever purpose you want, but stop pretending it's all that different. I can say though for a fact that a few of the largest security companies…

Is anyone actually pretending it’s different?

Most people I talk to buy VPN services to avoid legal threats from pirated movies or to avoid traffic surveillance from their local ISP / workplace / institution.

I’ve never heard someone describe it like a hard-to-denonymize tor node or anything.

Re: Data brokers sell access to the backbone of the internet

#24

Post by andrewmcwatters »

relax88 wrote: post #22
andrewmcwatters wrote: post #15

Can someone explain to me why anyone would use a consumer VPN versus SSH tunneling through to a nation with secure data privacy laws if you know what you're doing, other than convenience or the number of countries you can connect to for Netflix purposes maybe?

VPN services are cheaper than a VPS and most people just want to pirate movies without getting legal threats or to avoid region locking.

Are they? I can lease a VPS for under $12 a year. I don’t know of a VPN service that cheap unless it’s free and has limitations.

Re: Data brokers sell access to the backbone of the internet

#25

Post by nightpool »

What's the next step to protect against traffic analysis? Are there any VPN providers that provide stochastic masking to defeat traffic analysis? Is TOR working on mitigations? A quick search turns up https://blog.torproject.org/new-low-cost-traffic-analysis-at..., which discusses the use of fixed-size padding in TOR protocol headers, but it's mostly focused on traffic analysis using then-commercially available data sources (for example, Real Time Bidding logs & DNS queries), and considers full netflow data a "high-effort" attack available only to "intelligence agencies". It seems like this may need to be reassessed.

EDIT: looks like this is addressed to some extent in the FAQ for Tor https://2019.www.torproject.org/docs/faq.html.en#SendPadding.

Re: Data brokers sell access to the backbone of the internet

#26

Post by eloff »

relax88 wrote: post #23
ganoushoreilly wrote: post #8

What blows my mind is the number of people signing up for these "VPN" services thinking it's secure. Time and time again we've found that they are logging and if they aren't it's logged at the flow point (as linked in this article). I'm fine with VPN to evade restrictions or whatever purpose you want, but stop pretending it's all that different. I can say though for a fact that a few of the largest security companies…

Is anyone actually pretending it’s different? Most people I talk to buy VPN services to avoid legal threats from pirated movies or to avoid traffic surveillance from their local ISP / workplace / institution. I’ve never heard someone describe it like a hard-to-denonymize tor node or anything.

Lots of services are advertised that way. It's probably half the ads I encounter on YouTube.

Re: Data brokers sell access to the backbone of the internet

#27

Post by ssss11 »

missedthecue wrote: post #11
atok1 wrote: post #9

Why is it not illegal to sell this type of data everywhere?

" The information, known as netflow data, is a useful tool for digital investigators. They can use it to identify servers being used by hackers, or to follow data as it is stolen. " Doesn't look like they're selling 'atok1 loves to browse hacker news' type data.

But that’s like saying it’s ok for banks to sell everyone’s bank account transactions because it’ll catch those pesky criminals when they make a transaction.

Why should everyone be surveillance for catching the minority who do the wrong thing. It’s not about whether anyone cares about atok1’s data specifically right now.

Re: Data brokers sell access to the backbone of the internet

#28

Post by is_true »

andrewmcwatters wrote: post #24
relax88 wrote: post #22

Earlier quoted context omitted.

VPN services are cheaper than a VPS and most people just want to pirate movies without getting legal threats or to avoid region locking.

Are they? I can lease a VPS for under $12 a year. I don’t know of a VPN service that cheap unless it’s free and has limitations.

that cheap? where?

Re: Data brokers sell access to the backbone of the internet

#29

Post by mishafb »

andrewmcwatters wrote: post #24
relax88 wrote: post #22

Earlier quoted context omitted.

VPN services are cheaper than a VPS and most people just want to pirate movies without getting legal threats or to avoid region locking.

Are they? I can lease a VPS for under $12 a year. I don’t know of a VPN service that cheap unless it’s free and has limitations.

That would have lower bandwidth, no easy way to switch countries, and your server IP is completely static and identifiable (worse privacy). And it's more likely to be a datacenter IP which is blocked.

Re: Data brokers sell access to the backbone of the internet

#30

Post by gruez »

ssss11 wrote: post #27
missedthecue wrote: post #11

Earlier quoted context omitted.

" The information, known as netflow data, is a useful tool for digital investigators. They can use it to identify servers being used by hackers, or to follow data as it is stolen. " Doesn't look like they're selling 'atok1 loves to browse hacker news' type data.

But that’s like saying it’s ok for banks to sell everyone’s bank account transactions because it’ll catch those pesky criminals when they make a transaction. Why should everyone be surveillance for catching the minority who do the wrong thing. It’s not about whether anyone cares about atok1’s data specifically right now.

>But that’s like saying it’s ok for banks to sell everyone’s bank account transactions because it’ll catch those pesky criminals when they make a transaction.

You're right, it's not okay. But it's totally okay (and mandatory) to send certain transaction information to the state (ie. FinCEN).

Post reply on HN