Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ISP Spying

harrisonsand.com

Post reply on HN
Print view View original

61–70 of 134 posts

Re: ISP Spying

#61

Post by mseebach »

kalleboo wrote: post #54
jstanley wrote: post #9

Earlier quoted context omitted.

It's easy to move your VPN to an arbitrary VPS anywhere in the world, but there's only a handful of residential ISPs available in any given area, and they are almost univerally scummy.

> there's only a handful of residential ISPs available Where I live the nationwide fiber network has around 100 ISPs available of varying reputation. Wikipedia says that PPPoE "offers encryption" but now I'm curious if this is effective, and actually used by anyone...

Having the wire, especially if it's fibre, between your home and ISP encrypted is probably of extremely limited value. Your ISP has access to the (unencrypted) endpoint anyway, and any adversary with the resources to actually tap your fibre probably have higher value and more easily accessible means of spying on you anyway.

Re: ISP Spying

#62

Post by gruez »

alxndr13 wrote: post #32

In Germany you are able to use any router you want, regardless of which ISP you use. https://www.cr-online.de/bgbl116s0106.pdf

Do ISPs actually prevent you from doing that? At the very leas you can hook your router to the ISP's router and set up DMZ?

Re: ISP Spying

#63

Post by wepple »

I’ve pulled apart router firmware plenty of times, and am never surprised to see nbtscan, nmap, and all sorts of other tools on there.

A lot of ISPs will perform remote diagnosis by connecting into your router and scanning your internal hosts to see if there are any problems.

Between that capability and general appalling security of routers, you’re basically on Starbucks WiFi from a security perspective even at home.

important note: buying an off the shelf netgear/tplink/linksys/whatever might stop your ISP remoting in, but is still wildly full of vulnerabilities.

Re: ISP Spying

#64

Post by mseebach »

philjohn wrote: post #14

This isn't an issue if you're not using the ISP equipment, or put the ISP equipment into a bridge modem mode. For instance, BT in the UK do the same reporting over TR-069 if you use their home hub - however - if you connect a different VDSL modem/router you can disable TR-069, and if you use a dedicated VDSL modem in bridged mode and a wireless router behind that there's no TR-069 to worry about in the first place.

Or if you just use the provided router, either in bridge mode or in regular mode, the only device it will ever see and report on is your own router, which is hardly a critical leak.

Re: ISP Spying

#65

Post by drchickensalad »

tzahola wrote: post #56
rocqua wrote: post #35

Earlier quoted context omitted.

ISP's intercepting HTTP traffic to modify it is far from unheard of. In the best case, this is to notify customers of required changes. This is actually used by comcast [1]. In the worst case, this is a service sold to advertisers, or a service that includes arbitrary java-script injection. For something close to the worst case, see [2] (previously discussed on HN [3]). [1] https://tools.ietf.org/html/rfc6108 [2] htt…

Why on Earth would you visit plain HTTP sites with JavaScript enabled?

Because you have to be in the know-how and do work to achieve that?

Re: ISP Spying

#66

Post by markwaldron »

wepple wrote: post #63

I’ve pulled apart router firmware plenty of times, and am never surprised to see nbtscan, nmap, and all sorts of other tools on there. A lot of ISPs will perform remote diagnosis by connecting into your router and scanning your internal hosts to see if there are any problems. Between that capability and general appalling security of routers, you’re basically on Starbucks WiFi from a security perspective even at home.…

This is very informative! What router would you suggest purchasing?

Re: ISP Spying

#67

Post by tortasaur »

markwaldron wrote: post #66
wepple wrote: post #63

I’ve pulled apart router firmware plenty of times, and am never surprised to see nbtscan, nmap, and all sorts of other tools on there. A lot of ISPs will perform remote diagnosis by connecting into your router and scanning your internal hosts to see if there are any problems. Between that capability and general appalling security of routers, you’re basically on Starbucks WiFi from a security perspective even at home.…

This is very informative! What router would you suggest purchasing?

Plenty of routers can be flashed with open source third-party firmware like OpenWRT.

Re: ISP Spying

#68

Post by [deleted] »

45h34jh53k4j wrote: post #47
icc97 wrote: post #20

Who didn't think they were being spied on? This is why you used https to hide the full URL, VPN to push the problem to a 3rd party who might care a bit more about privacy and then Tor on top of it all. Here's the good old EFF explanation [0] [0]: https://www.eff.org/pages/tor-and-https

No, dont run Tor over VPN. Its VPN over Tor. Tor provides anonymity, VPN provides privacy. You want anonymity between you and the VPN, and privacy between you and internet hosts. From the OpSec for xyz series: https://grugq.github.io/presentations/Keynote_The_Grugq_-_OP... • TOR connection to a VPN => OK • VPN connection to TOR => GOTO JAIL

[deleted]

Re: ISP Spying

#69

Post by gruez »

javajosh wrote: post #27

Is it just me or does this look like a huge opportunity? Last I checked we still have control over our devices, and if they are stupid enough to trust the data they collect, then we should feel free to poison the well. I'm talking about opening random connections to endpoints (either random or those we want to protect), to inject noise into the system. I call the idea "data flak". It could be something as simple as a…

>The only counter is for an adversary to own your box, which is far more expensive.

or require your clients to run your software, like in AOL days

Re: ISP Spying

#70

Post by 534b44a »

My ISP provides an online user interface where I can remotely change my Wi-Fi password even if I haven't explicitly enabled port forwarding. If they have access to that, I don't see why they can't easily see my network shares and its contents (I don't password protect the directories for convenience reasons).

I've long ago lost the PPPoE password and this same router gets it automatically somehow. When I install another router, it won't do that.

Post reply on HN