April1st, US has voted to allow everyones internet browsing data,freely for sale - Page 1
Forum section: electronics / general

author: MK14
author_rank: Super Contributor
timestamp: March 29, 2017, 06:05:35 am
content: Obvious April 1st Joke...Or is it ?https://www.congress.gov/bill/115th-congress/house-joint-resolution/86http://www.theregister.co.uk/2017/03/28/congress_approves_sale_of_internet_histories/Summary:In the US your internet service provider (who already knows your name and address etc). Can sell (without your knowledge or permission etc), your entire internet browsing history.Hence your medical conditions, interests (Transistors with their bare leads showing), political affiliations etc etc.I'd be really, really annoyed. It isMY/OURprivate information and outside of crime/terrorism and tax avoidance. Absolutely is none of the governments business to mess around with and agree for it to be sold.I'm rather furious/upset about it and I don't even live in the US.I'm annoyed enough about the UK, allowing the browsing history to be available for the secret service, Police and other government bodies. But allowing ISPs to sell it to businesses, is just so so wrong, on so many levels.Polite Notice:Please try and avoid talking about politics, as you may get this thread closed.I think that this thread is technically related, because internet services should be reasonably private.But if we can't keep it technical/privacy related, it may get closed.

author: Rick Law
author_rank: Super Contributor
timestamp: March 29, 2017, 07:04:23 am
content: As I understand it, the bill is intended to stop FCC power-grab. This move merely puts the responsibility back under one roof.FCC(Federal Communications Commission) was setup by congress to manage radio waves (HAM, AM/FM, so forth). While congress has not given FCC the charge to manage internet, it has seen upon itself as master of the internet. Of the big internet players, onlyISP companies comes under FCC.Privacy (in the view of congress) is the purview ofFTC(Federal Trade Commission). Matter regarding privacy is handed back to FTC.Google, Facebook, type players are generally regulated by FTCand thus are not affected by FCC rules had it been kept in place.My read between the lines is either way, our data is being sold. FCC rules doesn't control companies that isn't a communication company.This is not an issue of keeping privacy. This is a war between who gets to sell your privacy."... [the overturned rules] required telecommunications firms such as Comcast Corp. and Verizon Communications Inc. to get customers' permission to market their app and web-browsing history to third parties. It was opposed by broadband providers, who said it could unfairly tilt the playing field in favor of internet rivals, such as Alphabet Inc.'s Google unit and Facebook Inc., which generally are regulated by another agency, the Federal Trade Commission..."Quoted from:http://www.foxbusiness.com/politics/2017/03/28/house-approves-bill-to-overturn-fcc-privacy-rule.html

author: MK14
author_rank: Super Contributor
timestamp: March 29, 2017, 07:21:12 am
content: Quote from: Rick Law on March 29, 2017, 07:04:23 amThanks!I somewhat understand what you are saying (it is not your fault I don't fully understand, it is because I am not to familiar with the US agencies and how they work).Although Google/Facebook etc, have similar information. They don't necessarily tie in the websites visited (especially google) with your real life name/address/telephone number etc.But if these changes mean that the web browsing history and your personal details, areCOMBINED. Then businesses could do all sorts of unpleasant things.E.g. All US residents who access EEVBLOG forums or watch electronics related videos on youtube, could be phoned up and written to about every new scope, meter and other stuff. Regardless of if you want to be bombarded with such information or not.But I guess this already happens to an extent, as they have other ways of knowing.

author: boffin
author_rank: Unknown
timestamp: March 29, 2017, 08:00:40 am
content: And what's next for the people that thought Alleged Billionaire Trump was a good idea ?The US Post Office to sell your mailing history ?The phone companies able to sell your calling history ?

author: Rick Law
author_rank: Super Contributor
timestamp: March 29, 2017, 05:28:54 pm
content: Quote from: boffin on March 29, 2017, 08:00:40 amThis is not a disagreement about whether a regulation should be there or not. This is a dispute about which department should originate the regulation.FTC(Federal Trade Commission) is theofficialfederal office for consumer protection, whereasFCC(Federal Communications Commission) was official set up to regulate radio waves.The bill therefore official leave no doubt that only the official office with the charter has the authority to regulate. For example, this would be no different than overturning a "Car Pollution Standard" issued by theDoED(Department of Education) and turn the issue back to theEPA(Environmental Protection Agency) as pollution is under the purview of EPA.Your question "what's next?" is now we the consumers getting FTC to do something - writing, calling, complaining, whatever. What FTC does will apply to all companies instead of just some companies.This isn't even a Trump thing but instead a US Congress thing. So, whether you are pro-Trump or anti-Trump, this is not really related to the matter. That said, Google and Facebook (etc. etc) lobbied pretty hard for this regulation and donates heavily to the Democrats. So, there could be (speculations) some "pay back" in play here as well. I certainly would not rule that out.

author: PlainName
author_rank: Super Contributor
timestamp: March 29, 2017, 06:41:04 pm
content: This is what happens when you treat privacy as a non-issue - it just ratchets up until it gets so bad even the most uninterested notice that it's a problem, and by then it is HUGE problem which is pretty much unfixable. We've made our bed and now have to lay in it.In essence, what this bill means is that you have a wiretap on your data line, and whoever can access that can sell whatever they can grab from it to whomever they like. Your details are worth $30-$60 a month, and it's not you that's going to benefit but whatever bottom dwelling leeches have the biggest pockets. The likes of Google would die for the output from this wiretap since it gives far more data than even they can suck up, and you can't turn it off like you can with cookies.

author: metrologist
author_rank: Super Contributor
timestamp: March 29, 2017, 07:01:40 pm
content: The article I read said that financial data and social security numbers can be sold.It is not clear to me what data we are talking about.Does this affect raw data like what is transferred while filing tax returns, the content of emails and attachments. Any data transmitted over non-ssl lines, or does ssl even matter any more? Can they capture and decrypt that data and then sell it?I'm not sure why any current law does not apply. For example, what stopped phone companies from recording your calls and selling lists of numbers you've called back in the 80's? For a long time, my internet connection was a phone call. Was the wire tapping law written such that it only applies to twisted pair so once we move to fiber and other modulation schemes, suddenly wire tapping laws don't apply?

author: yuzuha
author_rank: Contributor
timestamp: March 29, 2017, 07:05:18 pm
content: That will last until someone posts all the porn sites the congressmen visit.

author: PlainName
author_rank: Super Contributor
timestamp: March 29, 2017, 07:30:41 pm
content: QuoteDon't know, but Google accesses your email contents so I don't see why this should be different. There is probably a distinction between using the contents to derive interests (then selling that deduction on), and selling the contents verbatim. If nothing else, copyright law should still be applicable. But...QuoteAs countless security people and services have disclosed many times, the metadata is just as useful, sometimes more so, than the content. For instance, an email saying "Party at mine tomorrow" is OK, but knowing who it was sent to is far more valuable. So long as SSL doesn't impact the metadata too much, it's not that important. (Of course, the ISP is ideally position to do MITM attacks, so all of a sudden SSL certificates that can be vouched for might be far more important than the self-signed 'encrypted but don't really know who it is' ones.)

author: Avacee
author_rank: Unknown
timestamp: March 29, 2017, 07:56:25 pm
content: I take it selling their customers data isn't limited to individuals but also includes business customers.If so some Industrial Sabotage just got a bit easier.Either way is it fair to guess that the happiest people will be lawyers who must be over the moon at the lawsuit potential?

author: metrologist
author_rank: Super Contributor
timestamp: March 29, 2017, 08:29:53 pm
content: Dang it! The brits will know about every frenchie i've contacted, and then there will soon be associations with the aussies. point is the impact of this is global.

author: chicken
author_rank: Frequent Contributor
timestamp: March 29, 2017, 08:33:29 pm
content: Quote from: Rick Law on March 29, 2017, 07:04:23 amSo "telecommunications firms such as Comcast Corp. and Verizon Communications Inc." are not communication companies.

author: Rick Law
author_rank: Super Contributor
timestamp: March 29, 2017, 09:14:53 pm
content: Quote from: chicken on March 29, 2017, 08:33:29 pmre:So "telecommunications firms such as Comcast Corp. and Verizon Communications Inc." are not communication companiesOf course they are. But as I said, "FCC rules doesn't control companies that isn't a communication company." Google and Facebook are not. FCC rules will therefore apply to only ISP's but not Google, Facebook, Tweeter, etc., etc.Congress made no statement regarding whether the rule is good or bad, needed or not needed. [ EDIT:So there is no need to argue about that.] Discussion of privacy is a good discussion, but no point in discussing if congress overturn a good rule since Congress made no statement about the goodness of the rule. [ end EDIT ]What Congress did was it merely say FCC overreached and FTC is the designated official department regarding consumer protection. Congress has the ultimate say on what authority they delegate to which department.Can you imagine the confusion if the Department of Education issues regulation about Car pollution? Next thing you know, the Food and Drug Admin will be issuing regulation about work place safety, and the Labor Department will be regulating what trans-fat content can be in your french fries.These "privacy rules" are rules that Google, Facebook, etc. influenced and lobbied the FCC really hard for passage. Imagine, if we believe in and rely on Google and Facebook to defend our privacy, we are in real bad shape then. I trust Google/Facebook as far as I can throw a house.EDIT: see strike-out line above.

author: chicken
author_rank: Frequent Contributor
timestamp: March 29, 2017, 09:55:16 pm
content: I don't think your comparison is valid. This is about privacy of communication, so it is very related. Like the department of education may come up with extra saftey requirements for school buses.This is more about the Republican party being obsessed with undoing any rule that was enacted/proposed in the Obama era.EDIT: I very much agree that Google and Facebook and the data brocker industry in general are in dire need of privacy rules as well.

author: Bassman59
author_rank: Super Contributor
timestamp: March 29, 2017, 10:45:58 pm
content: Quote from: dunkemhigh on March 29, 2017, 07:30:41 pmThe difference? Google (and Facebook, and EEVblog, and thousands of other services) are free to the users. Of course they are not free, because if you aren't paying, you're the product. These services are free (as in beer) because Google's and Facebook's primary business is advertising. They are selling your personal data to other businesses for the purpose of enabling those businesses to more effectively advertise their products to you. You have a choice, of course, to simply not use these services.ISPs, on the other hand, charge you for access to their networks. And the cost isn't trivial. I pay about $70 per month to the local monopoly Internet provider, and another $120 a month for two smartphones. For the former, I have no choice in my provider, as there is exactly one in my area, so my choice devolves into "do I want Internet access at home or not?" As for the latter, my choice is "which of these highly-similar services do I want to provide mobile access, or do I want that access at all?"That these companies can sell your Internet traffic (and now with the elimination of Net Neutrality rules route that traffic as they see fit) for which you pay is the difference.

author: Rick Law
author_rank: Super Contributor
timestamp: March 29, 2017, 10:52:21 pm
content: Quote from: chicken on March 29, 2017, 09:55:16 pmFood and Drug Admin (FDA) in fact is a perfect example. It can issue regulation about manufacturing facilities making food or drug. Imagine for a moment these two made-up regulations were to be issued today:1 "any rodents discovery must be reported within X days"This would be a perfectly valid regulation as rodents would affect your food.2. "95% of the parking must be Handicap accessible"This would be an overreach. Handicap parking is a matter for regulation by Congressional act (Americans with Disabilities Act (ADA) in 2010). Authority was designated to 5 agencies (ODEP, EEOC, DOT, FCC, and the DOJ). If FDA wants a Handicap parking rule, it should refer the matter to one of those five. DOT (Department of Transportation) is likely the one that should deal with parking.I am sure with some imagination, you can make up a rule that the DoED can issue (pollution affects student performance) which will step on the toes of EPA.* * *So, Congress' action yesterday shows FCC can issue regulations about communication. Consumer protection (Privacy) is already designated to be under FTC. FCC Should forward the matter to FTC. And they made their intentions very clear in some interviews by news agencies.Trump did made some statement about stream-lining the Federal Government and overlapping regulations. He made the statement in regard to EPA issuing regulations governed by other agencies. So contrary to my earlier statement, this may indeed be more than just Congress.Whether it is pro or anti Trump. It make sense that if the authority is already designated to agency-A, agency-B should refer the matter to agency-A.

author: PlainName
author_rank: Super Contributor
timestamp: March 29, 2017, 11:15:49 pm
content: QuotePractically, you don't. Facebook tracks you across websites whether you are logged in or not, whether you even have an account or not. Appear in any photo a Facebook user posts? You're probably named and shamed. Have an acquaintance with a Google email address? Your emails are already absorbed. Etc.

author: Rick Law
author_rank: Super Contributor
timestamp: March 30, 2017, 12:37:06 am
content: Quote from: dunkemhigh on March 29, 2017, 11:15:49 pmI personally think privacy protection against Facebook and Google is as important and perhaps more important as privacy protection against ISP's. And, I probably engaged in "guilt by association" - any privacy rules pushed by Facebook and Google is by such association can't be good. Thus, I was happy to see the regulation they wanted being overturned.I also agree with Congress that FTC is a better play to deal with them. Consumer Protection Agency. A Google Chrome user may not be a Google customer since they don't pay, but as users, they certain are consumers of Google services/products.Besides privacy regulations, I would like to see their respective monopolies broken up. Sherman Antitrust Act covers monopolies earned by merit or naturally arose. I think they are getting too powerful. Too powerful may not be adequate for breaking them up. Like old-AT&T, if they are broken up to 5 baby-googles, may be that will do technology and us the consumers a lot of good.

author: raspberrypi
author_rank: Frequent Contributor
timestamp: March 30, 2017, 12:48:58 am
content: the best way to protect your info is to make fake info and bury the real info since you can't hide it. If you have a unique first or last name you lost of your privacy. Type your name into google and see how much these companies know about you, its scary. The FTC's job is to protect the share holders not individual people. You don't own shares? They don't give a shit.Did you know that cable companies don't have to censor their content (that annoying beeping sound) but they do anyways? The FCC's job changed ALOT in the 2000's.

author: Rick Law
author_rank: Super Contributor
timestamp: March 30, 2017, 03:52:52 am
content: Quote from: raspberrypi on March 30, 2017, 12:48:58 amIt changed again yesterday - when Congress voted. FCC/FTC leaders better take a close look at what the Congressman/Congresswoman said because their job is whatever Congress say it is.

author: Red Squirrel
author_rank: Super Contributor
timestamp: March 30, 2017, 04:08:22 am
content: That is such a ridiculous thing to pass. The simple idea that your ISP can be allowed to do this, or possibly even modify your traffic to inject ads (which I imagine is the goal here) is completely infuriating. I guess this is going to be good for the VPN industry... until they make those illegal. Can't win.

author: technix
author_rank: Super Contributor
timestamp: March 30, 2017, 04:17:33 am
content: @EEVblog Dave, please set up mandatory TLS on this website. This keeps at least *some* prying eyes out of us.I think that there are free or low cost SSL certificate providers out there. I am using a free one from Let's Encrypt on my personal blog (https://en.maxchan.info)You should also set up automatic redirection from unsecured HTTP to secured HTTPS. This can be implemented on your server easily.You should also turn on HTTP Strict Transport Security so browsers won't even bother checking the unsecured version after the first visit.Also use only strong cryprography with TLS 1.3 and maybe TLS 1.2. Switch off older, vulnerable cryptoprotocol and cipher suites.

author: Monkeh
author_rank: Super Contributor
timestamp: March 30, 2017, 04:53:21 am
content: Quote from: technix on March 30, 2017, 04:17:33 amAll of which is complicated and substantially nullified by having Cloudflare sat in the middle.

author: Red Squirrel
author_rank: Super Contributor
timestamp: March 30, 2017, 05:31:07 am
content: Yeah HTTPS is a good idea, I need to revive my forum (been saying this for years and keep getting side tracked) and when I do it will be HTTPS. No cloud flare. I feel that just adds an extra layer of complexity. I think the concept is neat but personally I rather be in full control of how my website gets served.

author: technix
author_rank: Super Contributor
timestamp: March 30, 2017, 10:19:04 am
content: Quote from: Red Squirrel on March 30, 2017, 04:08:22 amChina Telecom began injecting ads to EVERY unencrypted HTTP session back in 2014 (?) and I immediately moved my home network (mostly) onto an IKEv2 tunnel.

author: metrologist
author_rank: Super Contributor
timestamp: April 01, 2017, 04:22:04 am
content: Any idea if this service can help or hinder the issue?https://noiszy.com/

author: NiHaoMike
author_rank: Super Contributor
timestamp: April 01, 2017, 05:14:02 am
content: Quote from: metrologist on April 01, 2017, 04:22:04 amThat's more or less what I have suggested as a countermeasure against tracking - generate fake traffic to obscure the real data.Something else to take note is that many ad blockers also block a lot of the tracking.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 07:11:35 am
content: Quote from: NiHaoMike on April 01, 2017, 05:14:02 amHave you ever used Wireshark?Cookies can be blocked, but packet sniffing cannot. The ISP can associate the sniffed packets with specific subscriber and pinpoint who is doing what at when. In China the police have made arrests based on sniffed packets and its associated subscriber. (Keep in mind that in China there is thoughtcrime and merely speaking of thoughtcrime contents warrants capital punishment.)

author: PlainName
author_rank: Super Contributor
timestamp: April 01, 2017, 01:48:06 pm
content: QuoteThere is in the UK now too, though the punishment tends to be rather less severe. At the moment.

author: NiHaoMike
author_rank: Super Contributor
timestamp: April 01, 2017, 04:08:05 pm
content: Quote from: technix on April 01, 2017, 07:11:35 amThe ad blockers break a lot of tracking by not making connections to known tracking domains in the first place. It's not foolproof by any means, but it is a very easy first step.And by generating a lot of harmless "noise", it would greatly increase the effort required to find useful information by any means of tracking.

author: PlainName
author_rank: Super Contributor
timestamp: April 01, 2017, 04:39:20 pm
content: QuoteWhilst that's true, it is targeting the wrong thing. Your browser (andonlybrowsing) is sent to those domains just so a record can be made of where you were sent from - there is no other way to get that info. But now the ISP can SEE direct from your GET packet where you are going. Indeed, the ISP is actually sending you there so must know. There is no need for a spy domain workaround. You cannot block it (except by using a VPN, and the VPN operator will then be in the same position as your ISP - he knows exactly where you are going because he's sending you there).The only issue now is that instead of the spy domains having the info, your ISP does (and the ISP info is far FAR better than that detected by the spy domains). The question is only: how much does the ISP charge for access to that info.But, as alluded to above, the spy domains only capture your browsing stuff. The ISP will ALSO get everything: FTP, VPN, VoIP, ICMP, there is no destination and no protocol the ISP won't see.

author: technix
author_rank: Super Contributor
timestamp: April 01, 2017, 04:44:20 pm
content: Quote from: dunkemhigh on April 01, 2017, 04:39:20 pmThat is why every website need to mandate TLS now. With TLS your ISP knows that you decided to visit a website (through sniffing the DNS packets) but have zero clue on what you are actually doing there (actual HTTP traffic encrypted.)

author: Rick Law
author_rank: Super Contributor
timestamp: April 02, 2017, 06:18:52 pm
content: Quote from: technix on April 01, 2017, 04:44:20 pmYou are right about that, but, unless you are using Linux, chances are, your OS is also spying on you. Both Windows and Andriod are blabber mouths saving every move you make and reporting it back home. If you have a microphone on your system, at least Google could/would eavesdrop. Microsoft could be doing the same thing as well.Source:https://www.theguardian.com/technology/2015/jun/23/google-eavesdropping-tool-installed-computers-without-permissionEven if we get FTC to stop all the selling of info, now corporations are getting so big that they really can sell it within just the companies of the corporation and/or affiliates. Either Microsoft or Alphabet Corp (Google's parent) has income bigger many countries. Furthermore, I have no confidence in either the politicians nor the bureaucrats understanding enough or caring enough to do the proper thing.Perhaps the best solution Sherman (anti-trust) Law. We need 5 baby-googles like we had 7 baby-bells when old-AT&T was broken up, or when Standard Oil was broken up into (according to wiki) 34 baby companies.