Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The House just voted to wipe out the FCC’s landmark Internet privacy protections

washingtonpost.com

Post reply on HN
Print view View original

291–300 of 534 posts

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#291

Post by latj »

pnathan wrote: post #19

This, right here, is the consequence of the withdrawal from politics many geeks advocated very strongly in an earlier time. "Everything is corrupt, it doesn't matter"... turns out to only be a viable philosophy when things mostly work well enough . What we have in protections and freedoms were purchased through a ton of hard work by prior generations: the liberty to slack and think that it just works ok is a nice sid…

Here is an alternative account of what has happened.

The government is trying to reduce protections of civil liberties, the environment, etc.

Why?

Because the party in control of the legislative and executive branches are removing those protections.

Why?

Because it is in their best interest and because they promised to do so in their election campaigns.

Why?

A. Because their corporate sponsors want less regulation.

B. Because their supporters want less regulation.

Why?

Because less regulation means more profits (If you ignore the environmental and human costs).

And, because many Americans equate regulation with infringement of their personal freedom.

We need to stop assuming that bad things are happening because a few bad apples tricked roughly half the population to support them. They are making America great again. Look at any point in time before now in American history and you will find less civil liberty, more oppression of workers, and more destruction of the environment. It was promised. Its being delivered. And no one was fooled. It is straight up whathalf the population asked for.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#292

Post by defined »

eli_gottlieb wrote: post #263
misnome wrote: post #234

Earlier quoted context omitted.

So it's the fault of people who vote third party that you have a two-party state?

Two-party? The American federal government is, de facto, a one -party state.

Yeah. The Janus party.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#293

Post by defined »

jonathansizz wrote: post #58
pnathan wrote: post #19

This, right here, is the consequence of the withdrawal from politics many geeks advocated very strongly in an earlier time. "Everything is corrupt, it doesn't matter"... turns out to only be a viable philosophy when things mostly work well enough . What we have in protections and freedoms were purchased through a ton of hard work by prior generations: the liberty to slack and think that it just works ok is a nice sid…

A core problem is that it's much easier to break things than to build or maintain things, so huge amounts of work can be eliminated very easily, whether through neglect or design.

That's a sutra.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#294

Post by gwu78 »

openasocket wrote: post #255
gwu78 wrote: post #249

Earlier quoted context omitted.

You assume that DNS is being used. What if the user already has the IP address and knows the hostname? SNI makes gettng the hostnames easier than if they were encrypted as they are without SNI.

> What if the user already has the IP address and knows the hostname? Then the ISP just does a reverse DNS lookup, which can be implemented a bunch of different ways, it's not particularly difficult. > SNI makes getting the hostnames easier Getting the hostname from SNI requires TCP sessionization and at least some form of DPI. Getting the hostname my way just requires single-packet inspection with a reverse DNS look…

"Getting the hostname from SNI requires TCP sessionalization and at least some form of DPI."

I have done it with tcpdump.

What does getting the hostname from an encrypted packet require?

Assume DNS is not used and there is no reverse DNS information available that gives the specific domainname requested by the user.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#295

Post by johncolanduoni »

gwu78 wrote: post #267
openasocket wrote: post #255

Earlier quoted context omitted.

> What if the user already has the IP address and knows the hostname? Then the ISP just does a reverse DNS lookup, which can be implemented a bunch of different ways, it's not particularly difficult. > SNI makes getting the hostnames easier Getting the hostname from SNI requires TCP sessionization and at least some form of DPI. Getting the hostname my way just requires single-packet inspection with a reverse DNS look…

Do you understand why I do not like SNI? It has nothing to do with getting these stupid hostnames. It is a modification that needs to be made to software to accomodate the spread of the use of the SNI extension. As a user, I have no need for SNI. Are you saying that doing reverse lookups on every IP address, where some of these IPs will have many virtual hostnames, is easier than extractng the plaintext hostname from…

> Do you understand why I do not like SNI? It has nothing to do with getting these stupid hostnames. > It is a modification that needs to be made to software to accomodate the spread of the use of the SNI extension. As a user, I have no need for SNI.

It's a modification that has already been made to software and widely deployed. The RFC was back in 2003. Are there even any TLS implementations that don't support SNI that aren't also so horribly out of date that they're full of since patched vulnerabilities?

Also it sounded like you cared a ton about getting "these stupid hostnames", and if you don't I'm not even sure what your objection is. That you can't browse some websites on Windows XP anymore? If you care enough about security to complain that TLS sucks compared to CurveCP, you definitely shouldn't be using it anyway.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#296

Post by foota »

alphapapa wrote: post #274
pnathan wrote: post #217

Earlier quoted context omitted.

nit: The previous president could certainly have done this, but chose not to. obscures the reality that the opposition party - and its grassroots supporters was ruthless in opposing all that Obama did, often for no apparent reason. For instance, the SCOTUS nominee. It was poor behavior, giving us "legislative debt", as it fostered executive action over legislative action.

Couple of issues here: 1. The opposing party's opposing the ruling party is a natural process of government. It's the normal state of things. Your saying that it was "poor behavior" implies that it was an anomaly, that the Republicans did something wrong by not supporting everything Obama wanted to do, and that the minority party is supposed to accede to every demand of the ruling party, which would be absurd. 2. The…

Your comments that this isn't how the government was intended to work are spot on -- the founders did not want a two party system.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#297

Post by openasocket »

gwu78 wrote: post #282
openasocket wrote: post #276

Earlier quoted context omitted.

> Are you saying that doing reverse lookups on every IP address, where some of these IPs will have many virtual hostnames, is easier than extractng the plaintext hostname from a certain offset in a Client Hello packet? If the SNI info was at a fixed offset in a packet, it would be easy. But, per the RFC, it goes at the end of the client hello, after the list of supported cipher suites and compression methods. Not onl…

Are you saying that programs that extract hostnames like "sniproxy" cannot scale? And you are saying that all hosts have set up reverse DNS and the data is complete and accurate?

No and No.

I'm talking about a hypothetical ISP that wants to extract all the hostnames its customers are connecting to. It has to analyze the traffic off a live stream and re-construct the TCP stream to do this. Rebuilding the TCP stream on a 100Gbps switch is pretty hard to do. Something like "sniproxy" is only extracting the hostname for all traffic connecting to it, so it doesn't have to try and re-build the tcp stream.

For the reverse DNS stuff, yeah you can't count on PTR records. The easiest thing is to use a third party like Domain Tools (https://www.domaintools.com/), or you can roll your own. The quick and dirty way to do this is to get your hands on regularly updated zone files with all the hostnames, do a DNS lookup for that domain name, and store that data in an index. Assuming you get regular updates to your zone files the daily load is manageable. From memory, for .com you only need to evaluate about 400K domain names a day.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#299

Post by openasocket »

gwu78 wrote: post #294
openasocket wrote: post #255

Earlier quoted context omitted.

> What if the user already has the IP address and knows the hostname? Then the ISP just does a reverse DNS lookup, which can be implemented a bunch of different ways, it's not particularly difficult. > SNI makes getting the hostnames easier Getting the hostname from SNI requires TCP sessionization and at least some form of DPI. Getting the hostname my way just requires single-packet inspection with a reverse DNS look…

"Getting the hostname from SNI requires TCP sessionalization and at least some form of DPI." I have done it with tcpdump. What does getting the hostname from an encrypted packet require? Assume DNS is not used and there is no reverse DNS information available that gives the specific domainname requested by the user.

tcpdump does TCP sessionization, yeah. But we're talking about ISPs extracting the hostnames in bulk for all their customers' traffic live, right? Maybe you're talking about something else, but I figured, based on the article we're having this conversation about, the attacker is these scenarios is an ISP, which only cares about doing these things at scale. You can't put tcpdump in front of a 100Gbps switch and do sessionization live.

> Assume DNS is not used and there is no reverse DNS information available that gives the specific domainname requested by the user.

If it's a hostname it has to correspond to a valid domain name, right? You can always use a third party or roll your own reverse DNS entry, as I described in my other answer. As long as the domain name actually has a DNS A record, we can get it.

Re: The House just voted to wipe out the FCC’s landmark Internet privacy protections

#300

Post by mikeyouse »

slang800 wrote: post #98

Isn't doing this type of data collection without consent already banned under the [Wiretap Act]( https://www.law.cornell.edu/uscode/text/18/2511 )? What part of these protections weren't redundant?

Without consent is the important part, it will soon be part of your ISP's TOS to allow them to sell your data. The wiretap act has a specific call out for this occasion:

> (d) It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.

Post reply on HN