Using VPNs for "privacy" on forums, and forum spammers - Page 1
Forum section: electronics / general

author: peter-h
author_rank: Super Contributor
timestamp: May 06, 2021, 06:29:39 am
content: I run a community site (techy hobby but not electronics related) and one big issue is with spammers. Currently around 50% of new signups are spammers, and each time one of these manages to get in, one wakes up in the morning to find the forum covered in adverts for fake passports, fake IELTS, fake all sorts of certificates... so I put some effort into not allowing them posting rights (which is a manual permission).These are not bots. We are using a hidden google catpcha which is pretty good at blocking bots. They are humans and they put a lot of time into this. They sign up and then go away for a week (because most forums don't let you post for a few days) and then come back and dump their stuff.Various things give away a spammer. One is setting their country to one which does not match their IP (this isn't 100%; some genuine people are on a SIM card from another country, on holiday, etc) but if the IP is in say India and they put their country as the USA then it will be a spammer. Another one is that the IP or their email address is a hit on one of the many "stop forum spam" lists. We also filter against a list of about 2000 throwaway email domains; this is important because forum notifications bounce back and then your whole site gets an elevated spam rating. Another is that the signup uses a female name or email address; in any "tech" hobby women are extremely rare so while this isn't 100% it is a strong indicator especially if you get one like mentioned below. Genuine female posters always get a hugely enthusiastic reception on a techy site and "windup merchants" ("genuine" posters with a grudge, not spammers) often use a female identityCurrently I am seeing a lot of people join up via VPNs; usually one called VYPR VPN. These are usually obvious spammers from other indicators so I don't let them post, but notably they are taking a lot of trouble to sign up, even uploading an avatar (the last one is a woman in a keep fit class, not wearing a whole lot)andselecting the right country to match the signup IP.I have two questions:Do "normal people" use a VPN routinely for forum browsing? If so, what is the point, for non illegal activities? I see the latest Firefox comes with a VPN but it isn't free. If your browser supports a "non tracking mode" that chucks away cookies which does most of the job. A VPN changes the IP but doesn't alter any of the dozens of other client browser parameters which get potentially published to the server. This site will demonstrate the futility:https://amiunique.org/fpDo people who use these "privacy VPNs" know which country that particular session terminates in? Historically a lot of spammers (and other "windup merchants") used the TOR browser and AFAIK on that one you don't know the terminating country (often it is in Africa, because the TOR browser is used for a lot of illegal stuff).

author: ataradov
author_rank: Super Contributor
timestamp: May 06, 2021, 07:04:31 am
content: Yes, people use VPNs normally. If you are only using VPN for "illegal activities", then you are telegraphing to the world that you are currently doing something illegal when using VPN.Also, people don't want to be spied on by their ISPs.Also, some countries are overly zealous with their blocking of stuff (China, Russia). So using VPN that terminates in another country is almost a must.One of the best captachas are the ones unique to the site. Something basic. Like this forum might ask you to solve Ohm's law or something like that. Lichess.org asks you to solve "mate in 1" puzzle before posting to their forum. Spam farms are bad at solving that stuff.Pre-moderation on first post may help too. Especially if certain trigger words are present in the messaage.

author: peter-h
author_rank: Super Contributor
timestamp: May 06, 2021, 07:58:35 am
content: Captchas are a funny one.I got someone to produce a captcha which asked to multiply two numbers. Both numbers were presented as graphics so a bot for this would need to do OCR. It took the guy a few days to code this (in Ruby but it could have been PHP). It then took another clever unix programmer about 10 mins to write a bot which did OCR and pasted in the answerI don't have the details to hand but there is a unix utility which does OCR on a specified region of the page, so you don't even have to write any "software". So if you want to create a custom bot which creates 100 new signups and posts 1000 adverts for fake IELTS or whatever, it's very easy.And the standard google captcha ("identify all images containing a bus") is hated by everybody, and often is very hard to solve. Some research indicates that it drives away a large % of the audience.The basic issue is that there are people dedicated to doing this and they aren't stupid like they always were in the past. So blocking them has to involve something whichthey are not aware you will be looking for.Sure I see a VPN being handy in China etc but for most online communities in the Western world there is negligible participation from these countries.Pre-modding of 1st post remains a very good method.I have a lot of admiration for whoever runs EEVBLOG which does not exclude posters from China etc. In fact they can't, since they accept adverts from JLCPCBBut at least having adverts means you can employ a paid person to do this job. I don't have that luxury.

author: ataradov
author_rank: Super Contributor
timestamp: May 06, 2021, 08:06:50 am
content: That's why you need a captcha that involves basic knowledge of the forum's subject. You can't automate that.Let's say you have a forum about gardening. Your captcha may ask what type of fertilizer is not compatible with tomatoes, or something like that. Even if they OCR the question, the answer still not solvable by the computer. And if the number of questions is large an they are updated from time to time, then bots may just give up.I also don't believe EEvblog does anything special against spam, just the normal captcha and manual reporting by forum members when there is spam.

author: Zero999
author_rank: Super Contributor
timestamp: May 06, 2021, 10:33:44 am
content: Whist I do agree with asking questions, we need to bear in mind that this forum has a beginners section, so they have to be easy enough for someone with minimal knowledge to answer.Severely limiting the number of accounts from the same IP and new posts per day/hour/miniute for those with under 100 posts would help a lot.Moderation of the first few posts is a good idea, but labour intensive. It also needs to be smart. Quite often we get people signing up and creating pointless posts, such as "Thanks for the info.", "Nice site.", "I like electronics" etc. which aren't spam and don't violete the rules, only to change the signiture to spam, or start spamming later. Fortunately the staff here are smart enough to spot this pattern and ban such accouts, before they spam. Many users here have also seen this pattern, including myself and will report pointless posters.

author: peter-h
author_rank: Super Contributor
timestamp: May 06, 2021, 11:46:32 am
content: "And if the number of questions is large"I agree, but somebody has to set that up."Severely limiting the number of accounts from the same IP and new posts per day/hour/miniute for those with under 100 posts would help a lot."Indeed - that's a good tool. But VPN users just switch IPs for each session, and of course dump their cookies."Quite often we get people signing up and creating pointless posts, such as "Thanks for the info.", "Nice site.", "I like electronics" etc. which aren't spam and don't violete the rules, only to change the signiture to spam, or start spamming later. Fortunately the staff here are smart enough to spot this pattern and ban such accouts, before they spam. Many users here have also seen this pattern, including myself and will report pointless posters."One clever tactic I have seen is to pick a random old thread and add a post to the end of it, by copying the first post in the thread (which is usually a question). It's really cunning, if you think about it. It produces a meaningful post without any effort. On a long thread, nobody will spot the duplication.Also I find that forum users lose interest in reporting stuff. They might report outright obvious spam but the admins will find that anyway soon after they get out of bedThere may be a way of automatically checking email addresses and IPs against the "stop forum spam" sites. You probably have to pay for it... and every so often the link will break and somebody has to spend half a day of their life making it work again.

author: Zero999
author_rank: Super Contributor
timestamp: May 06, 2021, 12:38:53 pm
content: Yes. We also had spammers copying the first post in a thread. I suppose such users could be theoretically banned automatically, if the forum sofware were flexible enough to be controlled with a suitable script.Can't you simply download lists of email addresses and IPs from stop forum spam sites and convert them to text format, then automatically block/ban said accounts?I never tire of reporting spam, unless the forum has too much of it, in which case, after giving the forum staff a fair chance to deal with it, I leave.It's important to have at least three moderators, in opposite time zones, for 24 hour coverage.

author: NiHaoMike
author_rank: Super Contributor
timestamp: May 06, 2021, 01:01:02 pm
content: Perhaps put posts from new members in an approval queue?To really mess with the spammers, instead of outright banning them, blacklist them so that their posts are shown to them (making it look like it went through) and then silently discarded after a short time.

author: peter-h
author_rank: Super Contributor
timestamp: May 06, 2021, 01:46:33 pm
content: That works only while their session is active. As soon as they log out or dump their cookies, they will see their post is missingThis feature has been implemented on some forums. It is sometimes called "annoying poster mode".An approval queue is a tricky topic. You would think that any serious poster will happily wait some hours for their first post to be approved. But actually usability research shows this is not the case. Participation goes way down with any barrier you put up. One really needs to approve new signups within an hour or preferably much faster, otherwise most never come back. It's the way "modern people" areSo I get an email on new signups and can approve them (clumsily) with just my phone, but can't do a whole lot of checking with the phone.

author: fordem
author_rank: Regular Contributor
timestamp: May 06, 2021, 08:01:09 pm
content: Quote from: peter-h on May 06, 2021, 06:29:39 amI'm going to say NO - most "normal" people don't even know what a VPN is - the ones who do either use it for security (as in to connect to a corporate LAN), or for nefarious purposes (as in hiding their location, or, accessing content that they would not or could not legally access).The concept of using a VPN for privacy is ludicrous - first - think about this - how many "paranoid users" place their trust in an unknown VPN provider to provide them with privacy, what stops the VPN provider from snooping? Second - the encryption exists only between the VPN user and the VPN server - the data then travels unencrypted from the VPN server to it's final destination - the "relevant authorities" need only to "snoop" on the VPN provider's exit point to be able to access all the "paranoid users" unencrypted data - the data belonging to all the paranoid users.QuoteIt depends on the VPN - the VPN I use allows me to select a terminating country of my choice.

author: ataradov
author_rank: Super Contributor
timestamp: May 06, 2021, 08:32:15 pm
content: Quote from: fordem on May 06, 2021, 08:01:09 pmIf traffic goes over HTTPS, then none of those people could snoop without some serious certificate tampering.One of the bigger things VPN protects against are non-securable parts of the process, like DNS lookups. And that is less of a problem with DoH becoming a thing.The privacy part of the VPN comes from the fact that a company located in a remote place will probably have no interest in a person in another country. Unlike customer's ISP, which has all the incentive to grab as much data as possible.If you are wanted to the point where it makes sense to track your behaviour across continents, then you are screwed no matter what. But this is not the case for majority of people.

author: BrokenYugo
author_rank: Super Contributor
timestamp: May 06, 2021, 08:33:52 pm
content: I use a VPN on my desktop machine, because I'm too lazy to set it up to only run the torrent traffic through the VPN.

author: tooki
author_rank: Super Contributor
timestamp: May 06, 2021, 08:48:47 pm
content: Quote from: peter-h on May 06, 2021, 06:29:39 amIt may actually be bots, believe it or not. I remember reading about one way crooks defeat captchas so their bots can do their bidding: they forward the captcha onto a free porn site where horny humans have to solve the captcha. Then, armed with the right answer, the bot can solve the captcha on the target site. Dunno if this still works with modern captchas, it’s been a while.

author: PlainName
author_rank: Super Contributor
timestamp: May 06, 2021, 09:38:59 pm
content: Disclaimer: I don't run a web forum anymore, and when I did it was for a small number of users. However, I did write a bot detector and auto-banner for a popular online game. The logic behind it was infallible, but eventually I came to realise I was wrong, and some obvious bots actually weren't. OK, on with the show...QuoteOh dear. Personally I don't use one but I am aware of people that do, for one or several of many reasons. Outstanding ones:* Your ISP is not net-neutral and prioritizes certain traffic. The VPN hides that one's traffic is low-priority rubbish and it doesn't get clobbered.* Your ISP monitors your data so they can spam you with 'relevant' adverts. And/or sell your stats onwards. Hey, being a Brit, don't you rememberPhorm? The VPN prevents that.Etc.QuoteSee my note above re logic. They could be bots, it's just that the bot offloads captcha decoding to wetware. Rooms of people sit in front of a PC and answer dumb questions, identify objects, etc. They have no idea where it comes from or what it's for, just that they will make a pittance if they do enough of them.https://humancoder.com/

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: May 07, 2021, 12:57:52 am
content: I use VPNs and Tor all the time, and I think this is becoming a new norm. As for eliminating spammers, you have few options:* Gatekeeping strategies that recruits members only via invites. Forum is either read only or inaccessible until the user is invited somehow.* Sandboxing new users into a "introduce yourself" sub-forum. Once the new users reached X amount of non-spam posts, they are granted full access to the rest of the forum.* Organise a vigilant moderator team who are effective at cleaning up rubbish.* Roll your own captcha that has Q&A about specific interests that spammers are unable to answer. For example electronics questions that only electronics geeks could answer.* Combination of the above.The truth is, once your forum is specifically targeted, you'll have a hard time eliminating all spam with one easy step.

author: Whales
author_rank: Super Contributor
timestamp: May 07, 2021, 04:52:18 am
content: If you can't stop them attacking you by building better walls, then perhaps getting rid of the gold in your castle could work better? Eg:adding rel=nofollow to all links in posted content. This informs search engines to treat the links as untrustworthy, dramatically (completely?) reducing the value of link spamming your site. Many big sites do this, including Wikipedia.Quote from: AntiProtonBoy on May 07, 2021, 12:57:52 amExample of this:https://lobste.rs/u#Hales. If a lot of spam users appear under someone they (and their whole tree) get banned.Quote from: AntiProtonBoy on May 07, 2021, 12:57:52 amA different variant of this is pre-moderating all content before it goes live. I wonder if there is much of an effort difference for mods?QuoteI highly recommend this, but you don't have to make the questions super hard. Any custom captcha will make your site only spammable by extra human effort. Ie you drag yourself out of the "lowest hanging fruit" pile where everyone using an off-the-shelf common system sits....which brings me onto...Quote from: peter-h on May 06, 2021, 06:29:39 amThat's really interesting. I don't know how successful Google's recaptcha is.Maybe people run web-scrapers looking for specific forum software, then give these lists to the human work-force? Making the registration a bit weird or different could help defeat this?I've written up onmy own experiences doing anti-spam, but only for a very small website's comment section. Against automated attacks: even making your form fields slightly different to what is expected is very effective. Of course against human attacks this is mostly naught.

author: peter-h
author_rank: Super Contributor
timestamp: May 07, 2021, 06:10:44 am
content: The google recaptcha is very good. It works in a complex way, probably linked to other stuff they run e.g. gmail's antispam measures (which are way over-zealous and make gmail unusable for any "international" business, but that's another topic). While we don't know what we don't know, if one was getting a load of failed signups then eventually some % of people will click on the Contact link and tell you, and this isn't happening.Yes, there are people who search for specific forum software, usually PHP-BB, which being open source gets attacked and hacked mercilessly - unless administered with a lot of expertise. So e.g. the Magento online shops are getting hacked a lot. The forum in question here was custom written in Ruby on Rails, by an expert in security, and so far it has not been obviously hacked, but Ruby is practically impossible to maintain (was a big fashion ~10-15 years ago)."Organise a vigilant moderator team who are effective at cleaning up rubbish."That's a funny one. Experience shows that youeitherhave to pay them the going rate (which requires a big site with lots of adverts and traffic)oryou end up with a bunch of controlling-personality weirdoes who eventually tend to do a Colonel Kurtz in Apocalypse Now, piss off a load of people, and the site disintegrates.

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: May 07, 2021, 06:42:42 am
content: Quote from: peter-h on May 07, 2021, 06:10:44 amDepends on the community. If the forum is big enough and is respected, there will be plenty of volunteers who'd want to moderate. That said, moderation can be hard when it comes to social dynamics and community appeasement (i.e. you never win as a moderator, no matter what action you make). But cleaning up obvious spam bots, is really a no-brainer.

author: peter-h
author_rank: Super Contributor
timestamp: May 07, 2021, 07:20:04 am
content: Modding a forum is a very difficult job. 10x more so on a site which doesn't carry adverts or is too small to make money out of ads, and then the chances of finding a volunteer mod who does a good job in the long run are IME zero. I have never seen it work, since web forums started to be popular c. 2000. Mods just go weird, sooner or later. If the forum is basically unmoderated (whichisa viable formula, for a while, until you get sued a few times) then it can run for quite a while. But a forum which is modded to e.g. not allow personal attacks needs very skilful modding, and it is almost impossible as a volunteer effort.Coming back to spammers, on every forum an admin can see all activity (obviously) and bots are fairly obvious in the pattern and the timing. Of course theycouldbe humans... but probably not because most of these are widespread attacks, not a vengeful hit on one specific site.I'd say the use of a VPN, particularly some of them, is a strong indicator of a spammer. Most "real" people have a life and just can't be bothered about "privacy" issues. Google has already got everything on you, but it doesn't sell it in personal detail - unlike FB and such whichisa really nasty company.

author: Zero999
author_rank: Super Contributor
timestamp: May 07, 2021, 08:24:05 am
content: Regarding moderation: just give most moderators the job of removing spam, pornography, copyrighted material etc. The personal stuff should be handled by a supermoderator, or the main site administrator.I have moderated a site before and I just left the personal stuff alone. The trouble was, the administrator didn't give ordinary moderators the power to ban, so deleting spam was pointless, as it would just get reposted and is why I left, never to return. To be fair we did have a problem with a bad moderator before, which caused lots of people to leave, but that's only because the adminstrator too far too long to deal with it. Numberous people had complained about the bad moderator, over a long period, so there was no excuse!If there was a need, which there isn't, I'd be happy to moderate here for free and I would stay out of the personal stuff, especialy if it involves me. If someone called me a cunt, I'd just report it and allow a supermoderator, or administrator to deal with it.

author: Zero999
author_rank: Super Contributor
timestamp: May 07, 2021, 10:25:12 am
content: I'd be wary of using AI to block nasty posts, because most of the time on this forum, they're about shoddy software, poor products, crappy companies etc. There are countless nasty posts about Microshaft & Winblow$ 10. Would your AI bot ban someone who said the scumbag who developed the Office 360 user interface should be stonned to death? It might be better at detecting pointless posts and obvious spam.An obvious use of automation is to detect duplicate posts and copy, pasting. I don't know whether automatically banning duplicate posters should be done though. Often newcommers think it's okay, as they think they'll reach a wider audiance if they create the same thread in different sections and it has happened before acidentally. Perhaps such a ban could be temporary, with a message telling the user why they've been banned, for how long and how to appeal it, if they think it's a mistake.

author: peter-h
author_rank: Super Contributor
timestamp: May 07, 2021, 01:34:33 pm
content: Many forums prevent duplicate postsif consecutive, not least because that is a common issue with submitting new posts if the connection is a bit dodgy.But checking all the back through the thread for duplicate posts would be a new oneBut I think, fundamentally, there is no solution to forum spam unless you manually approve all new signups. If you do that, it is pretty easy. One simple tip for admins: look at pre-signup activity and if there isn't any (i.e. negligible reading of the forum) then don't approve it. Almost no real person behaves like that, but 99% of spammers do. BUT you need to approve new signups quickly (not hours later) otherwise most will be lost for ever (people have a short attention span these days).This wasn't a problem 10 years ago but today it is really big. Especially with fake passports / fake IELTS / etc being such a big thing.

author: DrG
author_rank: Super Contributor
timestamp: May 07, 2021, 04:25:52 pm
content: The attack-adjust dynamics of admin/user vs spammer is interesting to me and I appreciate the content in the thread. Of course, I immediately start thinking about where it is going.Just some thoughts...It seems like most of the processes in the thread seem to involve automated pre-moderation based on some pattern recognition. That is, excepting perhaps message #20, I am not seeing much on the automation of spam identification after the fact. Why is this? IOW, it seems like shuffling off identified spam into an invisible (to normal users) bin for later processing (a few seconds to days as per resources) where it would be returned to its posting status or deleted. Is it common and just has not been mentioned or is it too difficult or something else?For example, many (most or all) email clients will sort out junk mail. Even to the extent of automated removal after XXX days. Of course you can see it and various places will remind you to 'look into your junk mail folder for our email and add us to your ok lists' or some such message.The SME, or at least subject matter familiarity, captcha was mentioned, but wouldn't this simply be a matter of time before it no longer worked? That is, automated answers to such captchas would seem like they would only require some additional 'knowledge data bases'.I am amazed at some of the bots I see on places, including here, and I am assuming, perhaps erroneously, that they are bots. Perhaps I simply lack vision but I don't see the justification for that much effort for such poor performance (maybe I just have not suspected the good ones).I used to enjoy thwarting the phone spammers by blocking the numbers. I would check the effectiveness by not blocking some and see if they would call a second time. Now, they never call a second time. Apparently phone lines (and IDs) are cheap enough to be never-the-same-twice. Now I am much closer to having an allow list (for deciding if I will answer)...something that the forums already use with a minimum number of posts and something that the spammers strive to defeat.VPNs are offered as part of packages of anti-virus software (two large vendors come to mind). People may use them because they paid for them and feel like they have to get their money's worth and believe the hype.I went back and read my response to a thread we had a while ago about the future of online discussionhttps://www.eevblog.com/forum/chat/the-future-of-online-discussion-how-do-you-see-it/msg2899818/#msg2899818I have not changed much as far as how I feel about it.

author: peter-h
author_rank: Super Contributor
timestamp: May 07, 2021, 07:02:30 pm
content: Web forums grew rapidly ~2000 onwards. Everybody who knew PHP and a database knocked one up. And people were desperate for online participations and flooded these sites.Today, web forums struggle because their success needs people who can read and write and who have time to participate usefully.These people are still around but many, especially the young, are being lost to "instant satisfaction" / "one liner" places like facebook, twatter, instagram, and such.The fact that these sites are useless for archiving knowledge, and anyway almost nobody bothers to post anything informative there, doesn't concern most people.Then there is a lot more nastiness around. The online world has become generally nastier. This is a problem largely because everybody who comes to a web forum today has been on FB etc where nastiness is pretty much the default, and they expect to be able to do the same on the web forum. They then have to be dealt with by the mod(s) and often they don't like that.Usenet used to be brilliant but has mostly gone under the weight of spam, and few people having a decent client for reading it.The forum I run is modded for zero personal attacks (which is rare, and could not be done if we had adverts because kicking and biting threads bring a lot more advert clicks) and ~98% of the regular group has always been good. But over the 10 years it's been going we have had some "moments"I have few regrets except that troublemakers should have been removed much faster. The big tech forums in the US remove them instantly and there is a lesson to learn there.Quality online discussion will continue on quality well managed sites like this one, which have an educated audience. There it can survive. Once you get away from specialised subjects, to mundane stuff, it is a struggle and most of that will probably end up on FB where everybody has created a forumSomeone mentioned stopping search engines going in. That is absolutely not a good idea because good SEO is key to a forum collecting new people, to replace those who left, died, etc. Web forums still get the best SEO.What is changing is the spammer landscape, because there are high value commodities they can sell. The next one will be fake vaccine passports, but I think the govts are onto that because everybody knows one of them will easily be worth 3 or 4 figures.

author: David Hess
author_rank: Super Contributor
timestamp: May 07, 2021, 11:16:10 pm
content: Quote from: peter-h on May 06, 2021, 06:29:39 amI used a paid VPN by default.Besides frustrating the data harvesting of my ISP, it allows the secure use of WiFi hotspots. Doing otherwise is an invitation to disaster.

author: peter-h
author_rank: Super Contributor
timestamp: May 08, 2021, 06:39:00 am
content: Very true for wifi hotspots. I use a VPN for same reason there.

author: DiTBho
author_rank: Super Contributor
timestamp: May 08, 2021, 09:06:33 am
content: When you enter in a shop to buy some bread, do you wear a balaclava? When you go to a pharmacy shop do you wear something that covers the entire head and neck and like a visor it only leaves the eyes out?So why do you want to hide your identity over the internet? They call it "privacy", but it's ridiculous and paranoid at the same time.QuoteIkea isn’t just for cheap bookcases. Almost inevitably, shoppers will end up eating at one of the Swedish retail giant’s in-store restaurants. They also offer free internet, so you can browse the public web having some of these delicious. Nothing wrong, but in this case, if you need to expose your password to a website, a VPN is a must.It makes sense!Protecting your identity is ok for home banking, it's ok if you really want to do home banking while you are checking the top 10 ranking of things to eat at Ikea, but ... Jesus, if you are visiting a forum, or a blog, well ... I'm like a candy seller in a little fort: I want to see you in face at the check-in before letting you in!It's my house, it's my space, there is nothing to hide, you are my guest, and if you are a spammer, a bot, a nasty person, sorry, but ... there is no party for you.That's it!

author: peter-h
author_rank: Super Contributor
timestamp: May 08, 2021, 10:03:59 am
content: "if you need to expose your password to a website, a VPN is a must."That's true, except that bloody google is de-ranking non-HTTPS sites so everybody has to go HTTPS if they want SEO. And eventually browsers will start blocking HTTP sites... which is a hassle for anybody running a hobby site because they have to organise a certificate and most of them aren't free. I moved a couple of little sites behind Cloudflare, not because they needed caching or DDOS protection but to get HTTPS for free. The many old sites out there which carry valuable content but aren't maintained anymore will have problems...So nobody can see the passwords.POP3 email and FTP is different and they need a VPN. But few people use these today.I also use a VPN (terminated at my house) when accessing my bank website - because the stupid people are blocking non-UK IPsBut for a forum? No. Not even if it was HTTP, and of course the pwd is used only for that forum

author: PlainName
author_rank: Super Contributor
timestamp: May 08, 2021, 11:17:23 am
content: QuoteNo, but I wear a mask nowIt's a different situation. The shop doesn't know where you've come from or are going to, what you've bought elsewhere or how much money you have. The tracking website, OTOH...The problem is not so much that your data is visible but that it's easily collatable. If any data lookup involved a bloke leafing through many volumes of books, it would hardly matter. Isolated data, which is effectively what that would be, is fairly meaningless, but when computers get involved each datapoint isn't isolated but is immediately referenced to all other points. As three-letter agencies will tell you, the contents of your phone calls (what you said) is not as important or useful as the metadata (who you called, when, from where, for how long). It's the metadata (how much money you have, what do you spend it on, where do you spend it) that shops would love, not what your face looks like.An alternative way of looking at it: suppose you go into a shop and someone is looking at you. Not a big problem. Now suppose you got to another shop and notice the same person looking at you. Not only that but you discover that this person is actually following you, making notes in a notebook whenever you buy or even just look at something. They are waiting for you when you leave your house in the morning and follow you, a few steps behind, everywhere during the day, always making little notes in the book, perhaps taking a photo of you now and then. Are you seriously suggesting that you would be OK with that?

author: PlainName
author_rank: Super Contributor
timestamp: May 08, 2021, 11:36:31 am
content: QuoteI was going to post a link to some research, but I don't have time to find it at the moment. However....Remember Cambridge Analytica? During that fracas an appropriate data engineer was interviewed and it was shown how apparently innocuous data about you could indicate who you would vote for, for instance. It was also shown that during the Brexit election, specific groups (found using that kind of inference) were targetted for specific ads on Facebook, and those ads influenced those groups enough to swing their votes.Remember the Capitol riots? There you have another example of people being targetted so they could be fed bullshit to achieve some end.There are also many examples of people's Google searches, Amazon purchases, Facebook posts, etc being quoted in court to show that they are clearly terrorists or drug runners, even though when placed in less emotional contexts it obviously wasn't. Fit-ups like that wouldn't be possible if someone hadn't already grabbed that data.

author: DiTBho
author_rank: Super Contributor
timestamp: May 08, 2021, 12:07:53 pm
content: Quote from: peter-h on May 08, 2021, 10:03:59 amYeah, that's a solid problem nowadays.

author: DiTBho
author_rank: Super Contributor
timestamp: May 08, 2021, 12:52:11 pm
content: Quote from: dunkemhigh on May 08, 2021, 11:17:23 amBut it's not a person, it's a machine, it's an artificial intelligence, it doesn't scary me. It's done to help someone to offer better services. Which is good.Personally I invest a part of my money in Amazon, so ... maybe I am not the right person to talk about "data-collecting" because they help making some little profit.Now consider when nasty guys do exactly what you have just described to and they hide their face through VPNs so they can also blackmail or something.

author: DiTBho
author_rank: Super Contributor
timestamp: May 08, 2021, 12:53:33 pm
content: Quote from: dunkemhigh on May 08, 2021, 11:17:23 amThat's was really hilariousI love this kind of humor

author: peter-h
author_rank: Super Contributor
timestamp: May 08, 2021, 02:29:41 pm
content: There are multiple issues.There are two places where a site admin can "spy" on you. One is by looking at his server log, and the other is using google analytics (or one of the other plug-ins).Neither tells himwho you are. You would have to reveal your identity some other wayon his site(or another site he runs) e.g. by registering with an email address of winston-churchill@gmail.com and posting in convincing detail about your exploits in ww2 (you get the idea). And GA doesn't even reveal your IP; the nearest you get is a rough location e.g. Birmingham, so the only way you would find out that the traffic was Winston is if you somehow knew, or could be very sure, that he was the only person accessing your site from Birmingham.What these tools give you is a lot of info about Person X but you won't know who it actually is. So there is no breach of privacy.It's like you set up a portfolio on some share portfolio site, as E Windsor. The portfolio, worth £100M, could be real. But they have no idea who you are. In some cases, if you are stupid, using your full name, and using a fixed IP which is known to belong to Buckingham Palace (because the dickhead in charge of royal IT set up a public DNS for the router) the admin might guess you are the QueenHowever, if you are running a shop flogging microwave ovens, and a W Churchill of 123 High Street Birmingham buys one, then suddenly you know who X is, and who it was all along. It is mainly for this reason that tracking has been made available. It enables commercial sites to track who is watching what and who is then buying what. So if X browsed some special promotion on microwaves in January and came back in June, you get a bit of a metric on how useful that promotion was.Lots of other good reasons for tracking. It tells you the % of mobile devices, the OS, the browser, versions thereof, hitting your site, so you can make sure it works for them. This is very important. With the right plugins or log analysis tools you can get a heat map of the site (where people are clicking) so you can put a big button on the link where 95% of traffic goes, etc. You can even tell how many had to scroll the page, so you can change the design so scrolling is not needed for the most popular features, on the most popular client devices.Cambridge Analytica is different. They bought personal data from Facebook, which sells everything. And FB knows who everybody is, because they bought Whatsapp so they got everybody's full name and mobile number, and until recently they could read all messages (now they can read only group messages). Facebook is a really shitty and ruthless company. I use FB but only to keep in touch with old friends and to exchange non PC jokesThe vast majority of non shopping sites will never find out who you actually are, and even if they did they won't care. Of course, never use your full name on any forum. Always change your surname, and make sure any personal/hobby websites of yours don't have your photo on them. And make sure the domain holder has either got a fake name for you or (like say .co.uk) does not publish the owner details, otherwise a google search for your name will find the domain. This is basic stuff.So I don't see how VPNs help on forums, for any human user. Unless you use the same pwd on many sites (a very bad idea) and are accessing anon-HTTPSforum on a public wifi network.

author: PlainName
author_rank: Super Contributor
timestamp: May 08, 2021, 03:38:39 pm
content: QuoteThat's not necessarily so:https://techcrunch.com/2019/07/24/researchers-spotlight-the-lie-of-anonymous-dataQuoteandhttps://www.theguardian.com/technology/2019/jul/23/anonymised-data-never-be-anonymous-enough-study-findsQuote

author: PlainName
author_rank: Super Contributor
timestamp: May 08, 2021, 03:47:32 pm
content: QuoteCareful what you wish for. What do you think the odds are of you arguing with Google's algorithm to give you back your automatically banned account? It is hard enough to even get to the point where you're talking to a live person, but at least you might have chance (albeit really tiny) with them if they got out the right side of the bed that day.A big problem with privacy today is that it's not a real person with an interest in you collectand acting onthe data. It's a machine who cares not one jot about who you are, just that the data points say you are a kiddy fiddling terrorist with a gun fetish. OK, (hopefully) a bit of an exaggeration, but maybe you haven't figured out why your credit rating is so low you can't get an overdraft. Or even a bank account. It's not a real person making those decisions.

author: peter-h
author_rank: Super Contributor
timestamp: May 09, 2021, 04:25:59 pm
content: Sure; one can de-anonymise big databases if one has access to other big databases. But who is going to do that, in the context of this discussion which is anonymity online?The biggest danger to one's privacy, and at the same time the biggest source of potentially real hassle, is a theft of some bank database. It's been done although usually the thief managed to get only partial data. Usually... one Swiss bank employee did rather betterAnd airlines have had the whole lot stolen. These are serious because your full confirmed name, address and - directly or indirectly - financial data is leaked.

author: DiTBho
author_rank: Super Contributor
timestamp: May 09, 2021, 04:35:32 pm
content: I'm thinking about someone who wants to open a channel on YouTube. If you want to get money by advertising, from sponsors, etc, you have to expose your name and surname.

author: PlainName
author_rank: Super Contributor
timestamp: May 09, 2021, 04:44:59 pm
content: QuoteThose reports didn't use multiple big databases. The amount of data collected for one can be enough, which is why it's important (if you care about any of this) to restrict sucking to needed data rather than data they can grab just because they can.QuoteAre you kidding?!?! Who isn't going to do that, is the smaller subset.QuoteIf you don't have multiple online IDs, who you are online is getting to be more you than what your birth name is. And if you do have multiple online IDs, it doesn't take a lot to tie them together. Remember, you have toalwayskeep them completely separate; the data analyzer only needs to make a match once.I think we also need to recognise that 'privacy' covers several different things. On the one hand there is the danager, as you note, of some online database being grabbed resulting in a financial offloading event. But that's different to being stalked by a nutjob, tagetted by scammers, or your potential future employer seeing what dirt they can dig up before offering you a job. Or, indeed, the aforementioned 'computer says no'. Perhaps we need another (or several) word(s) so we're each on the same page when banging on about it.

author: peter-h
author_rank: Super Contributor
timestamp: May 09, 2021, 05:52:23 pm
content: Yes; this is why- you should use a different ID on every forum- be careful what you write about yourself- any videos you publish will identify you readily (especially if somebody is out to get you legally because a court order on youtube etc will instantly give it to them)- if you run a forum, don't put stuff in the server log which you don't need to run the site- if you run multiple sites which need auth, keep the auth data in one place and use oauth on all the others, so no personal data is stored on them- put as little on FB and LinkedIn as possibleThen there are practical things e.g. you don't want your business customers to discover what you do in your private life. Let's say you are on a boating forum, and you post that you have a $300k boat...

author: ataradov
author_rank: Super Contributor
timestamp: May 09, 2021, 07:08:18 pm
content: Why though? What is the problem with having $300k boat and how that would affect a business?I used to try to hide my identity, but over time I realized that there is more value for me in being consistent with names on the forum. If someone is really committed, they will find you no matter what.The idea of a VPN is that it is an easy way to eliminate mass collection of information. If someone is targeting you specifically, VPN won't do anything.

author: peter-h
author_rank: Super Contributor
timestamp: May 09, 2021, 08:13:30 pm
content: In modern business culture, companies are highly political inside. A lot of people are crawling up the ladder and the process is lubricated by shafting others. Shafting a supplier is the safest thing there, so if you advertise an expensive hobby, that can be used against you. I know many people who are carefully anonymous on forums simply due to this.Not a problem with a reasonable customer, but many customers aren't.Then you get the issue of company social media policy. Many people flout these policies, and from time to time they vanishIn fact this, or getting a new job at a company which is strict about it, is a big reason for people vanishing from forums.I too don't really care much about privacy. For a start, anybody who writes more than a line or two will be identified across forums, by the use of language (not least because that is a fairly rare skill).I still don't get this stuff about VPNs. They only conceal the IP. The other 30 or whatever items of data which the browser sends to the server will still be duly delivered. Some of these you can modify (browser agent etc) but some not and e.g. you could easily be using a laptop of a certain age which has an unusual size screen which immediately makes you 1 in 10k of users.

author: ataradov
author_rank: Super Contributor
timestamp: May 09, 2021, 08:29:57 pm
content: Quote from: peter-h on May 09, 2021, 08:13:30 pmIt is fine. I don't mind if destination site can identify and track me. I'm likely to be logged in anyway. After all, they will still be able to track only the activity on their site.The concern here is my ISP being able to track every single site I visit. And the danger is that if ISP does not like what I do, they have the power to cut off my internet access (which in the US sucks, since there are not too many alternatives). And this does not have to be anything illegal. Let's say they don't like that you watch too much YouTube and not enough of their own bullshit TV service.If individual site cuts me off if they don't like what I do there, I mostly won't care.

author: David Hess
author_rank: Super Contributor
timestamp: May 10, 2021, 04:42:12 am
content: Quote from: ataradov on May 09, 2021, 08:29:57 pmISPs do more than that. When I had AT&T U-Verse, I was able to confirm that they were transparently proxying every protocol possible, leading to all kinds of bizarre connection problems. It was so bad that operating with a VPN to a point half way across the US yielded lower latency to any destination, including local ones on AT&T's own network. It also prevented AT&T from intercepting and substituting their own DNS results.

author: james_s
author_rank: Super Contributor
timestamp: May 10, 2021, 05:01:44 am
content: I use a VPN whenever I'm at our cabin, we borrow WiFi from the neighbor (with permission) however it is not a very well secured connection so I use a router to uplink to their 5GHz WiFi as the WAN and then a VPN client runs on the router and feeds my 2.4G network. I also use a VPN on my laptop whenever I'm using a network that I don't own. It's almost no effort since I have the VPN anyway.

author: peter-h
author_rank: Super Contributor
timestamp: May 10, 2021, 07:21:58 am
content: That's a worrying description of US ISPs. Here in the UK you get nothing of the sort, AFAIK.Surveillance at the ISP is implemented everywhere, via the big routers having a "monitoring port" which can be set up to monitor specific traffic and send it to the "national security agency". But in theory a court order is needed for that, so you need to be in their sights to start with.

author: ataradov
author_rank: Super Contributor
timestamp: May 10, 2021, 07:44:55 am
content: Quote from: peter-h on May 10, 2021, 07:21:58 amThey just have not had a chance to make a public blunder out of it. There is no way they do not collect that information. In the contracts it is usually hidden under network performance improvement. Which is true to some extent, as knowing places you visit allows for better caching. But it is also a handy piece of information to sell to marketers.News like this are not uncommonhttps://news.ycombinator.com/item?id=26430266. Sure, involvement of government agencies implies the need for the court order. But only implies.

author: Zero999
author_rank: Super Contributor
timestamp: May 10, 2021, 10:05:27 am
content: An important thing to consider is, although it's possible for your ISP to spy on you, they almost certainly never will. The information gathered will never be seen by a pair of human eyes. It will all be processed by a computer, without anyone seeing the inputs and outputs of the algorithm. The only exception will be if they detect something illegal, which will flag an alarm.

author: peter-h
author_rank: Super Contributor
timestamp: May 10, 2021, 11:31:51 am
content: Yes I am sure that's true.Also I would be amazed if GCHQ/NSA/etc needed a court order to intercept data. BT used to need one and probably still do, for (what was back then) a physical visit to the exchange to set it up. Nowadays call intercept is remotely set up. I would expect ISP traffic monitoring (copying) to say GCHQ needs a court order in theory but in reality they will have a system in place where they get a blanket approval for some general activity. Dragging a judge out of bed to sign a court order is going to be useless.