Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ISP Spying

harrisonsand.com

Post reply on HN
Print view View original

81–90 of 134 posts

Re: ISP Spying

#81

Post by EADGBE »

laveur wrote: post #71

When I bought my fist house a few years ago here in the Bay. Comcast tried to give me one of their new routers wifi and everything built in. I let them but I wasn't happy. I hooked up my own router and ended up double natting it. After a few hours of frustration I went out bought my own cable modem. Installed that and returned the one comcast had provided. When asked why I sighted security and privacy concerns. Worki…

Does not using their own routers make ISP traffic sniffing that much harder?

I'd assume if you're using their pipes, they can see what goes through it, regardless.

Genuinely intrigued in this.

Re: ISP Spying

#82

Post by gcb0 »

tzahola wrote: post #10

I don't know if it's true, but I've heard that some ISPs route your entire traffic through their machines. They even have access to your IP packets. Very shady!

you're so late to the party. verizon even adds tracking cookies to your outgoing http requests

Re: ISP Spying

#83

Post by dsr_ »

markwaldron wrote: post #66
wepple wrote: post #63

I’ve pulled apart router firmware plenty of times, and am never surprised to see nbtscan, nmap, and all sorts of other tools on there. A lot of ISPs will perform remote diagnosis by connecting into your router and scanning your internal hosts to see if there are any problems. Between that capability and general appalling security of routers, you’re basically on Starbucks WiFi from a security perspective even at home.…

This is very informative! What router would you suggest purchasing?

I built my own.

These days, you can rely on Linux on fairly low-end CPUs to handle a gigabit of traffic, including IPv4 NAT, IPv6, firewalling, DHCP and DNS.

For serious firepower, Jetway sells a 10 x 1 Gbit tiny fanless machine with a J1900 Celeron and up to 8GB of RAM, under $400 (without RAM or disk). All most people need is 2 gigabit ports and maybe a good WiFi interface -- although I prefer to scatter consumer WiFi boxes around my house in bridge mode.

Re: ISP Spying

#84

Post by dsr_ »

EADGBE wrote: post #81
laveur wrote: post #71

When I bought my fist house a few years ago here in the Bay. Comcast tried to give me one of their new routers wifi and everything built in. I let them but I wasn't happy. I hooked up my own router and ended up double natting it. After a few hours of frustration I went out bought my own cable modem. Installed that and returned the one comcast had provided. When asked why I sighted security and privacy concerns. Worki…

Does not using their own routers make ISP traffic sniffing that much harder? I'd assume if you're using their pipes, they can see what goes through it, regardless. Genuinely intrigued in this.

Using their CPE routers implies (but does not guarantee) that you are using them for NAT and firewalling, and thus the ISP has a device inside your security perimeter.

Re: ISP Spying

#85

Post by Feniks »

RoadieRoller wrote: post #74

Somewhere someone could be selling your data for money. I can imagine the below happening. After all, all corporates are hand-in-glove with each other when it comes to public's privacy. This is probably what your ISP is doing. Take your MAC Addresses, try to find the phones in your house which is connected to the wifi, take those MAC addresses to all the telecoms, get the SIM card number and the phone number associat…

"Somewhere someone could be selling your data for money"

Depending upon country that would be illegal. I can be reasonably sure my ISP or telco isn't.

Re: ISP Spying

#86

Post by TheRealDunkirk »

markwaldron wrote: post #66
wepple wrote: post #63

I’ve pulled apart router firmware plenty of times, and am never surprised to see nbtscan, nmap, and all sorts of other tools on there. A lot of ISPs will perform remote diagnosis by connecting into your router and scanning your internal hosts to see if there are any problems. Between that capability and general appalling security of routers, you’re basically on Starbucks WiFi from a security perspective even at home.…

This is very informative! What router would you suggest purchasing?

I built my own, several years ago, on a (fanless!) board like this:

http://www.pcengines.ch/apu3a4.htm

It has 3 NIC's, for inside, outside, and DMZ. You can also put a wifi radio on it, and make it an access point.

I run a full Ubuntu on it, with local DNS, DHCP, Shorewall, etc.

Re: ISP Spying

#88

Post by a012 »

alyandon wrote: post #75
markwaldron wrote: post #66

Earlier quoted context omitted.

This is very informative! What router would you suggest purchasing?

Usually, anything you can install a third party firmware on like openwrt, dd-wrt or tomato (shibby's version of tomato is the one I used the most). However, I gave up on consumer hardware and went with Ubiquiti for wifi AP and Mikrotik as my router. It was a bit of a pain to set up all my NAT rules in the Mikrotik router because unfortunately consumer devices do a lot of extra work behind that scenes (like setting up…

Opposite on me, I'm having a Mikrotik hAp ac and considering to use it as AP only then buy a Ubiquiti ER-X in front of it.

Re: ISP Spying

#89

Post by js2 »

aus_ wrote: post #80
wil421 wrote: post #79

Earlier quoted context omitted.

I thought about bridging an Ubiquit EdgeRouter and putting in front of the AT&T gateway. You must pass authentication back to the gateway. Users were also reporting around 100megs max speed which wasn’t acceptable for me since I pay for gigabit. There is a new line of EdgeRouters out and maybe it has some acceleration for bridging. I would like this setup.

You might try this: https://github.com/jaysoffian/eap_proxy You have to enable `set system offload ipv4 vlan enable` else your routing performance will suffer.

Hey that’s me! I’m glad it’s working for you. All credit to the folks who figured out this bypass. I just coded it up in Python when I couldn’t get some of the other solutions to work for me.

Re: ISP Spying

#90

Post by oger »

brigade wrote: post #58
LeoPanthera wrote: post #18

I've been forwarding all outgoing connections on port 80 (and a selection of other commonly-unencrypted ports) through a VPN (in the router) for a while now - but leaving all other ports (including most importantly 443) connecting directly. It feels like a good compromise between privacy and speed. (I realise this is not the subject of the article exactly but I figured it's a related issue.)

Why do you feel that way? VPNs are vastly more likely to actually read your traffic than any ISP.

Not an issue when you run your own VPN with a cheap VPS - meaning the data is exiting in a datacenter in a location of your choice. While they or their upstream providers will certainly have some 'lawful interception' capability they are usually not interested in analyzing / selling the data on their wires as the consumer-facing ISPs.
Post reply on HN