Disapproval of FCC regulations a significant blow against privacy protection

https://www.nytimes.com/2017/03/29/opinion/how-the-republicans-sold-your-privacy-to-internet-providers.html

by crispyambulance • 9 years ago

313 214 9 years ago

nytimes.com

mozumder• 9 years ago

But her emails?

j2bax• 9 years ago

Is there anything the average user can do to protect their data/privacy from their ISP?

adrianN• 9 years ago

Run everything over an encrypted channel.

0xcafecafe• 9 years ago

vpn?

somebehemoth3• 9 years ago

VPN is a solution but requires trust in VPN provider. OpenVPN on a VPS can help. Also, consider DNS traffic can leak information, but I've not read of a fool proof way to fully protect DNS queries.

M_Grey4• 9 years ago

Good VPNs have DNS leak protection now, and frankly, I recommend avoiding one that doesn't.

edraferi5• 9 years ago

I use a VPN, but I have to turn it on for each device. Is there a good way to set up my router to automatically push all traffic through a VPN? I'd probably need to make exceptions for stuff like video traffic.

M_Grey4• 9 years ago

Encrypted VPN that doesn't keep records (I like NordVPN, but have had good experiences with others like IPV and PIA), uMatrix, uBlock Origin, and don't forget to turn on your user agent spoofing options.

davidiach• 9 years ago

I'm afraid that the problem is bigger than that, most people have a number of devices that connect to the internet, not all of which work with VPN.

eric_h• 9 years ago

I second NordVPN, plus their interface is adorable.

maccam912• 9 years ago

Yes VPN is a good answer here, but another idea to make the data they collect and sell less useful would be something like https://github.com/WhiteBeachStudios/cyberflare to hide your real usage habits among a bunch of artificially generated traffic.

somebehemoth3• 9 years ago

CyberFlare looks interesting, thank you for sharing. If anyone knows of similar tools or a guide on using CyberFlare I would greatly appreciate the information.

snowpanda3• 9 years ago

How would one use cyberflare? Any easier tools?

mhaymo• 9 years ago

Use Tor.

thomnottom3• 9 years ago

Start with not using their DNS servers (OpenDNS https://www.opendns.com)

Install HTTPS Everywhere (https://www.eff.org/https-everywhere)

Install uBlock Origin (Chrome - https://chrome.google.com/.../ublock-origin / Firefox https://addons.mozilla.org/addon/ublock-origin/)

JumpCrisscross2• 9 years ago

Concur with your recommendations. Would throw some caution on the OpenDNS recommendation, though. They're U.S. based and owned by Cisco. Depending on your threat model, this may or may not be desirable.

fastest963• 9 years ago

Just because you're not using their DNS servers doesn't mean they still don't see the DNS requests as its sent through their pipes and log them.

good_sir_ant• 9 years ago

The article's main argument is that the ISPs are selling something that doesn't belong to them, but to the consumer.

I don't like the idea of my personal information being sold, but how could you state this as fact? Shouldn't it be up to the consumer to choose to do business with a company that sells your personal info vs a company that does not?

somebehemoth3• 9 years ago

Via precedent set by protecting phone calls:

"For decades, in both Republican and Democratic administrations, federal rules have protected the privacy of the information in a telephone call. In 2016, the F.C.C., which I led as chairman under President Barack Obama, extended those same protections to the internet."

wu-ikkyu2• 9 years ago

Wasn't much of a precedent:

https://www.theguardian.com/world/2013/jun/06/nsa-phone-reco...

gbrown3• 9 years ago

That would be great, but privacy policies are unreadable and ISPs tend to be total or partial geographic monopolies anyway.

This is a classic case for regulation.

Asdfbla2• 9 years ago

You say that as if everyone had the ability to changes ISPs freely. Consumer choice is irrelevant if there's nothing to choose from.

fosco2• 9 years ago

I have a single altenative ISP that offers over 15 mbs, there is no fiber in my area. I live in New York. not the city, and I do not live 'upstate'.

as the above pointed out to your comment, it is very difficult to chane ISP's I am not happy with mine and I do not have an alternative. my unhappiness came way before this bill.

dangerlibrary• 9 years ago

Regional monopolies are tolerated and the companies benefit tremendously from legislation and regulations that make it near impossible for meaningful competition to exist. Ideologically, the "harmful regulation" rhetoric is incredibly hypocritical.

Which is to say: most consumers have no choice among providers. That fact is a result of government action. If companies would tolerate legislation that would encourage increased competition in exchange for the right to sell consumer information, then you would be right. Of course, that isn't what happened here.

revelation• 9 years ago

It's the same obvious policy applied to phone calls previously and mail previously previously.

pcarolan• 9 years ago

Don't downvote people who ask questions. Answer them if you disagree.

0xfeba3• 9 years ago

Should a company you pay to make phone calls over sell the data of who you call?

Should a company you pay to mail packages/letters inspect your mail and sell the data of what mail and subscriptions you are getting?

theseatoms• 9 years ago

Shouldn't it be up to the consumer to choose to do business with a company that sells your personal info vs a company that does not?

Ideally, yes. But there's a lack of competition in the ISP industry, due to either government-granted monopolies or plain old high fixed costs, which create a barrier to entry.

Though, the historically low interest rate environment should minimize this "barrier to entry" issue.

Are there notable startups in the ISP space?

bonyt• 9 years ago

Ideally, that may be true (though whether people realize the value of their online data is unclear) - however the market for internet service is far from perfect. Over half of Americans only have one choice in broadband providers (at 25Mpbs), and just under 15% have more than two to chose from (at any speed)[1]. The cost of entering the broadband market and laying last mile cables is simply too high for there to be meaningful competition in much of the US. Hopefully, a policy like dig once[2] will eventually create real competition in ISP market, but until then the largely monopolistic ISP industry cannot go unchecked.

[1] https://cdn.arstechnica.net/wp-content/uploads/2014/09/fcc-b...

[2] https://www.washingtonpost.com/news/the-switch/wp/2015/09/22...

gbrown3• 9 years ago

This is like FedEx or a privatized USPS being able to open your packages and read your mail without telling you.

I pay you to carry my damn packets, keep your filthy hands off my data.

jvandonsel• 9 years ago

A better analogy would be FedEx selling your incoming and outgoing addresses and package weights to third parties, not necessarily the contents of your packages.

fowlerpower• 9 years ago

Why not the contents? What happens when most content is not over a secure connection such e.g. Over HTTP? Could they not inspect the content?

It sure seems like they could. For most people most of the internet is still insecure.

accountface• 9 years ago

More like your landlord selling the keys to your apartment, but you still have the key to a series of safes inside. Everyone can get a lot of your stuff and probably watch you poop, but hopefully those safes are built well enough to keep everyone out of your valuables.

gbrown3• 9 years ago

Only if every package and letter I sent was securely sealed so they couldn't get in.

acomjean• 9 years ago

In case people don't know, the author, Tom Wheeler was the previous chairman of the Federal Communications Commission.

With the administration changed he no longer is in government.

also formerly a lobyist for the cable and wireless industry, which gives him some insight into the industry.

https://en.wikipedia.org/wiki/Tom_Wheeler

Asdfbla2• 9 years ago

At least consumers still have https going for them I suppose? Or maybe ISPs are now more motivated to man-in-the-middle those connections to get to the data, under the guise of security or something?

notheguyouthink3• 9 years ago

Yea that was my main question during this. What can we do. I thought https made this near impossible unless they MITM it, which would be difficult no? Or is it easy?

This is all the more reason we need to start encrypting all communication. All my hand built services (home bots, etc) need to start using tls for everything.

cjcampbell2• 9 years ago

Three problems here. First being that the ISP is a permanent MITM. Second is that TLS will not protect the hostnames, which are sent in the clear so that servers can identify the correct certificate for a given connection. Likewise, DNS is not encrypted (though companies like OpenDNS do provide alternatives here).

Operyl2• 9 years ago

They can still correlate traffic going to specific IPs, DNS requests, and SNI information (since it's not encrypted, because the remote server needs to know what certificate to use). There's plenty of data to choose from.

huxley• 9 years ago

I don't believe SSL alone would protect you since ISPs would still have access to the DNS lookups, the fully qualified domain name of the server (which is sent in cleartext for SNI), and IP addresses for the person browsing, so there's still plenty of "meta-data" for them to sell.

Maybe if you use a third party DNS service, but then you need to trust them.

state_less3• 9 years ago

Is there TLS connections to DNS servers available for the major operating systems?

edit: You're still broadcasting the IP you're connecting to, but it's still nice to close up this DNS lookup leak.

jonjohn84• 9 years ago

I feel like this isn't going to go anywhere but I'm still tempted to contribute: https://www.gofundme.com/BuyCongressData

SonicSoul• 9 years ago

im conflicted about this. hate to hand over millions to ISP's just to prove a point. I'd rather put the money towards starting a competing anonymized ISP.

ericd2• 9 years ago

Why on Earth would this be set at $500M, and why on Earth would people trust a random person on the internet with that?

joe_momma• 9 years ago

good thing this will create jobs jobs jobs! aka just ordinary bull shit.

cryoshon• 9 years ago

if i dare to say that the republicans fucked us over i'll be banned for "partisan bickering", so:

we just need to develop technological workarounds to the politicians. vpns are an okay start.

notheguyouthink3• 9 years ago

It's actually interesting, now i feel like VPNs are going to get a huge spike in customers.

On that note though, if all ISPs are doing this, what VPN choice do you have?

0xfeba3• 9 years ago

In 2016, the F.C.C., which I led as chairman under President Barack Obama, extended those same protections to the internet.

Oh how nice of Tom Wheeler to play the good-guy now. It took a lot of public outcry for him to change his tune about Net Neutrality.

chrisrhoden• 9 years ago

He came around, and then was a reasonably good champion. Let's live in a world where people aren't permanently branded with temporary positions.

0xfeba3• 9 years ago

I suppose you're right. But I will still remain suspicious of a former lobbyist turned head of FCC turned NN champion.

sbov• 9 years ago

We need to laud people who change their positions for the better, not continue to becry them. It's harder for people to admit they are wrong than be right in the first place.

tzs5• 9 years ago

Oh how nice of Tom Wheeler to play the good-guy now. It took a lot of public outcry for him to change his tune about Net Neutrality.

That's wrong. He was for net neutrality from day one at the FCC.

You are probably thinking of the first net neutrality rule he proposed, which would have allowed for paid fast lanes, and interpreting that as somehow not being for net neutrality.

When he proposed that rule that was about the strongest net neutrality rule possible without reclassifying ISPs as common carriers. Reclassification was a very risky approach, with probably at least an order of magnitude more chance of not surviving. He did state that he was open to that approach, if the comments on the first proposal indicated that there was enough support for reclassification.

dragonwriter6• 9 years ago

You are probably thinking of the first net neutrality rule he proposed, which would have allowed for paid fast lanes

That was the second; the first he got passed did not, but it was struck down by the courts for exceeding the power the FCC had without Title II reclassification. The draft of the replacement might have allowed paid prioritization (it was clearly not intended to, but it was limited because it attempted to stay within the boundaries of what would pass muster without Title II reclassification.) The final replacement order opted for Title reclassification, and was not only stronger than the draft, but stronger in many ways that the 2010 order it replaced.

Wheeler was always on the side of net neutrality, and in fact his actions in favor of it are one of the main reasons the issue became well known.

dragonwriter6• 9 years ago

Oh how nice of Tom Wheeler to play the good-guy now. It took a lot of public outcry for him to change his tune about Net Neutrality.

Tom Wheeler was the driving force behind all of the FCC net neutrality efforts, including early case-by-case actions, the 2010 Open Internet Order and the 2015 Open Internet Order. The idea that he was somehow an opponent of net neutrality mostly comes from ab unfair set of hit pieces in popular outlets (including, notably, Jon Oliver's Last Week Tonight) based around some groups (legitimate) concerns that the first public draft of the 2015 order (written to address the court decision striking down the 2010 order) was an insufficiently strong instrument.

ryanmarsh• 9 years ago

Begun the crypto wars have.

xienze5• 9 years ago

So the only thing I don't understand as far as the fuss about this is concerned -- everything I've read indicates that this is undoing a protection put in place late last year. So essentially we've gone back in time six months ago or so. If ISPs weren't selling our info then when they could have, why does it logically follow that we're now in some uncharted territory of ISPs selling personal info? Or is this simply blowing the situation out of proportion because Republicans did it?

Operyl2• 9 years ago

Because why the push to undo something if they weren't planning to do it, or weren't already? I know Verizon has an opt in program for it where they gave you deals and free data.

xienze5• 9 years ago

Can't argue with that, but again, the status quo for many, many years was that your ISP could have done this, but didn't. And the next time there's a changing of the guard the protections will be put back in place, so I can't see how ISPs are going to bet on selling this information as a viable long-term business strategy.

falcolas3• 9 years ago

There were some ISPs which were selling people's data prior to this order (Verizon was one, IIRC, and a few others were actively injecting ads and JS into non-TLS traffic), and many more were considering it.

Yes, we've "essentially" just gone back in time, but it's not a positive regression.

xienze5• 9 years ago

Yes, we've "essentially" just gone back in time, but it's not a positive regression.

I agree, but with the way this thing has been reported you'd think we've gone back to the dark ages rather than where we were just prior to the election. I don't recall a lot of discussion on HN about which proxy to use because "OMG my ISP is going to sell my browsing history!!!" back then.

That's all I'm getting at. Wondering why the reaction to going back to the status quo of not long ago at all is seen as some assault on civil liberties.

Latty3• 9 years ago

I don't get your point, even if no one does do it, why repeal the protection? It's effort and time wasted just to create a potential for something bad to happen.

Even if you think this will never be abused, I don't see how it's being blown out of proportion, this is still bad.

xienze5• 9 years ago

I don't see how it's being blown out of proportion

Really? Where was all the hyperventilating about the status quo on HN prior to when the protection was put in place? That's all I'm getting at, the reaction to being back in the dark ages of late 2016 seems a bit overblown in my opinion.

ericd2• 9 years ago

The FTC was preventing them, until it was decided that it was outside their purview. The FCC took over, but that's just been reversed. Now no one is preventing it.

tzs5• 9 years ago

So the only thing I don't understand as far as the fuss about this is concerned -- everything I've read indicates that this is undoing a protection put in place late last year. So essentially we've gone back in time six months ago or so.

Sort of, but you've missed a key aspect. Yes, six months ago (or whenever) there was (possibly) no protection. However, that was a fairly recent development. Earlier, ISPs had been regulated by the FTC when it came to privacy.

As part of the implementation of its net neutrality order, the FCC changed its classification of ISPs from information services to common carriers. Last year a court ruled that the FTC did not have the authority to regulate common carriers.

The FCC's privacy rule was meant to step into the void left by the FTC losing jurisdiction.

programmarchy4• 9 years ago

Here is a less editorialized summary of the bill:

https://www.govtrack.us/congress/votes/115-2017/h202

It repealed 73 pages [1] of regulation on ISPs.

Personally, I'd like to see more competition in the ISP space. This bill may help by reducing barrier to entry, but the central problem remains that national carriers have lobbied the state to prevent competition at the municipal level.

Furthermore, this bill seems like a minor nuisance compared to the data collected by Facebook, Google, and the NSA.

So yes, I'd say this is being blown out of proportion. The Republicans aren't being evil, but they have much more to do before I'd consider them being good.

[1] https://www.gpo.gov/fdsys/pkg/FR-2016-12-02/pdf/2016-28006.p...

Latty3• 9 years ago

You think that regulation is the relevant barrier to entry to being an ISP? Not the cost of running lines or anti-competitive practices by rivals?

Please, this just means no protection for an environment where, right now, we have no competition to move to when our ISP decides to do something shitty.

shopkins2• 9 years ago

Furthermore, this bill seems like a minor nuisance compared to the data collected by Facebook, Google, and the NSA.

This is the bullshit argument Republicans/ISPs are pushing that anyone technical should immediately realize as such. It's conflating two separate issues.

I can choose whether or not to use Google and Facebook, and indeed willingly "agree" to their TOS when I log on. But to even get to those providers, I need to go through an ISP. As someone in rural America, I don't have a choice in ISPs, and even in a lot of cities where you have "choice," they all share the same privacy-invading practices. That's the point of the rules passed by the FCC: protecting us, the consumers who are subject to the whims of anti-competitive corporations that have access to large swaths of our personal data.

0wl3x• 9 years ago

Does anyone have a good VPN that they would recommend? This bill is totally fucked.

jonathanwallace• 9 years ago

https://github.com/trailofbits/algo

needz• 9 years ago

I use PIA (https://www.privateinternetaccess.com/) and don't have any complaints. They have apps for every OS, servers all over the place, and don't log anything. If you search around you can find a deal for 2 years for $60.

Clanan• 9 years ago

Tom Wheeler, former FCC chairman and cable/wireless lobbyist, fails to charitably address why his opponents did what they did. To Republicans and opponents of his FCC chairmanship, this was about regulatory authority, not "selling your data to ISPs". They believe the FTC, not the FCC, should be the main privacy regulator as it has in the past. They also contend that ISPs are already disallowed from scooping and selling data without consent, and that the FCC already has authority to prosecute, via sections 201, 202 and 222 of the Communications Act.

dragonwriter6• 9 years ago

They believe the FTC, not the FCC, should be the main privacy regulator as it has in the past.

If they believed that, they would pass legislation to correct the law on which the court relied striking down FTC regulatory authority in this area and allow the FTC to actually do that; not doing that when reversing the FCC rules which mirrored the FTC rules which were struck down demonstrates that that is a pretext, not a genuine motivation.

JumpCrisscross2• 9 years ago

they would pass legislation to correct the law on which the court relied striking down FTC regulatory authority in this area

The FCC rule is being struck down using the Congressional Review Act [1]. CRA provides "an expedited legislative process" [2]. Giving the FTC authority in this area would require passing a real law. (That said, I agree with you regrind the explanation of motive.)

[1] https://en.wikipedia.org/wiki/Congressional_Review_Act

[2] https://web.archive.org/web/20150402230759/http://assets.ope...

earlyriser• 9 years ago

How difficult would be to create a DuckDuckGo of the ISPs? Both at national or local levels.

twsted2• 9 years ago

This and the move to dismantle the Clean Power Plan. Sad.

zaroth• 9 years ago

Internet Provisers -- that's Google and Facebook, right?

On a more serious note, people need to understand that every domain you visit, every query you search, every digital conversation you have, every number you call, every movie you watch or book you read, everything you buy, unless you take active measures to mask your identity that record is being retained by as many different people that can get their hands on it as possible.

Let's be clear about what this bill is potentially changing -- not who is collecting the data but who can monetize it.

Frankly, a bill that allows monetization of data already collected is not about privacy it's about deregulation. As long as the data is retained, privacy is already lost.

I actually really like this bill because it exposes, well, how exposed we all are online. The more people understand how much tracking is going on, the more likely we can garner the will, the market, the demand for technological solutions which actually protect privacy rather than regulating monetization.

M_Grey4• 9 years ago

More likely people will, without ever understanding any of this, become agitated and then over time... nothing they recognize will happen, nothing they can see will change. It will be even harder to get their attention next time...

tcfunk• 9 years ago

It's the slow boil

devmunchies• 9 years ago

...is being retained by as many different people that can get their hands on it as possible.

Which isn't a big deal as long as the data is only being used for internal use (e.g. UX purposes) to make the product better.

wu-ikkyu2• 9 years ago

Sounds like it's time for an "AdNauseam" for browser history obfuscation. Does anyone know if such a tool already exists?

edraferi5• 9 years ago

I want a privacy first router. Does such a product exist?

Key features:

  - I pay a subscription for maintenance (so I'm not the product) say $10/mo

  - Automatically routes all traffic over a VPN.

  - Smart VPN bypass for performance-sensitive traffic like streaming video and gaming

  - Provides non-logging DNS service

  - Automatic advertisement blocking

For VPN, DNS, and adblock I want the option to use servers & block lists maintained by the paid service, augment them with my own, or use my own exclusively. Bonus points for rotating requests between providers.

Does such a product exist? I think I could hack together something similar using DD-WRT[1], but I'm confident the maintenance hassle will eventually outweigh my desire for privacy. #shutupandtakemymoney

[1] http://www.dd-wrt.com/site/index

twsted2• 9 years ago

I'm confident the maintenance hassle will eventually outweigh my desire for privacy.

Nothing should outweigh your right for privacy.

edraferi5• 9 years ago

Sure, but there's a cost to exercise that right. Right now, the cost of protecting myself from my ISP is quite high. I need to maintain DNS and VPN settings for every device in my home... many of which are personal devices of other family members with little patience for such techno-babble.

I want a product that reduces the cost of exercising my right to privacy, and allows me to pay that cost with money instead of time.

aithoughts• 9 years ago

Privacy is weighed against public safety all the time. The question is at which point does it become unreasonable. Warrantless searches of American individuals just so happens to be where we, as Americans, draw the line.

On the other hand, don't mistake my assault on the technical validity of your sentence for disagreement with its intent. We should be outraged.

Shame on us for having allowed this to happen, and for the dangerous precendent it sets for local monopolies to sell your information.

pragone2• 9 years ago

Someone posted on a similar thread yesterday or the day about something that would fit the bill for you. I'll see if I can find it.

Off the top of my head, I think they sold a router, mostly pre-configured with ddwrt, that you plugged in your info for PrivateInternetAccess and used them as the VPN. Could be wrong though.

Edit: Here's what I was talking about: https://easyvpnrouter.com/. May or may not meet your needs

edraferi5• 9 years ago

That's great! Good find, thanks.

The website mentions an interesting solution to the streaming media problem: "Keep your existing router and run both networks simultaneously. Connect to your Easy VPN Router when you need safety"

So basically I could have the performance-sensitive devices hook up to the existing router, then use Easy VPN as the main access point for everything else. That's probably a lot more maintainable than trying to choose what goes over the VPN dynamically.

dfar12• 9 years ago

A router only helps you at home. We need a service that protects you anywhere.

fosco2• 9 years ago

An app that enables you to use your home router as a gateway could solve this problem.

I had an idea called 'Home Gateway' awhile back, but i do not have the business acumen and lack part of the technical know-how to complete such a task.

bubblethink2• 9 years ago

- Smart VPN bypass for performance-sensitive traffic like streaming video and gaming

It is highly error-prone to maintain (or expect a company to maintain) essentially a large filter list. In the end you'll end up with a product that gives you neither privacy nor performance. For a real world example, try using a smart dns. They suck at dns on its own. And they have to keep up with the cat and mouse of content sellers blocking them. You'll end up with pretty much the same situation with your smart vpn solution. You'll never know reliably what's going over which route (unless you are making the list), debugging will be a nightmare, and you'll have leaks all over.

PietdeVries• 9 years ago

For the nerds among us this shouldn't be too hard. A Virtual Private Server can be rented for a few dollars a month. I have seen examples that charge less than $4 for unlimited bandwidth.

Install VPN software on the server and become your own VPN provider. On your home router you can setup a point-to-point VPN connection and you're done - all traffic encrypted and bypassing your local telco.

I assume that network-providers are not included in this legislation though...

pdkl95• 9 years ago

VPN

This is a political problem. Technology like a VPN or alternative DNS is little more than a placebo. With the ISP as a permanent MitM, modern deep-packet inspection, etc, you are probably still leaking a lot of information.

Worse, you're only moving the problem to a different location. Even if you were able to hide your traffic from your local ISP, your VPN host or DNS service becomes your ISP de facto. Also, if any of your online accounts can be tied back to you on their own, you might not get a choice in the matter; the server's ISP can also sell information. What about TLS? Unfortunately far too many websites are only encrypted to CloudFlare.

However, the real reason that VPNs/etc are not a solution is that privacy shouldn't be limited to people with a technical background. Those of us that do understand the technology have a duty to help the people without that knowledge and experience.

williamle8300• 9 years ago

Tell people to use the Opera browser. It has VPN built-in.

edraferi5• 9 years ago

Worse, you're only moving the problem to a different location

I agree that's true from a technical perspective. However, the VPN provider has an economic incentive to compete on privacy. I would much rather just trust my local ISP, but at least I have a choice in VPN providers.

privacy shouldn't be limited to people with a technical background

Absolutely. That's why I want this as a product that Just Works instead of my own hacked-up implementation.

galacticpony3• 9 years ago

Those of us that do understand the technology have a duty to help the people without that knowledge and experience.

No, we don't. The fact that the "common people" don't value privacy enough led to this whole situation. Those that do value privacy, can pay for it with their money (or their time to learn).

secfirstmd• 9 years ago

You should try a the NetAidKit. We use them a lot for high risk human rights defenders travelling to various places. It works with VPN and Tor. Has wifi bridging, is portable etc.

https://netaidkit.net

peterlk• 9 years ago

I use a service called Cloak[1], and I'm super happy with it. I'm getting 75MB/s down over my Wifi while VPNd through their service. I often forget that it is on because it _just works_. I have no affiliation with them, I just think they make a good product.

[1](https://www.getcloak.com/)

vocatus_gate2• 9 years ago

I seriously doubt you're getting 75 MEGABYTES down over Wifi. Did you mean 75 Megabits (Mb)? There is a major difference between Mb and MB. 75 MB would be equal to 600 Mb per second.

ellius• 9 years ago

I was mulling over a service like this. Was thinking I'd set it up roughly like so:

1. Create Terraform / Ansible scripting to boot up fresh DigitalOcean droplets with OpenVPN and encrypted DNS / pi-hole to strip out ads.

2. Bulk purchase cheap dynamic DNS domains (or just generate sub domains on command and hit some kind of load balancer).

3. Create scripting to shuffle the various VPN boxes every x time (each night, week, whatever).

I'm not an expert, so I might be missing things here. But I'd pay for that, and I think all you'd have to do as a client is put OpenVPN client on your router and point it to whatever static domain you're assigned by the service.

EDIT: I also figured I'd donate some % of proceeds to OpenVPN / Pi-Hole.

djoldman• 9 years ago

The fact that this law has passed raises an interesting question: can a private citizen request and receive any and all information from a government entity about the users of that government's various assets? For instance:

1. Detailed data on the number, character, weight, etc. of every car that passes on a government road. (cameras record license plates, traffic videos exist, weigh stations are sometimes required for trucks, etc.)

2. Power companies bill the owning address for every power meter connected to the grid - therefore it should be possible to compile detailed historical data on power use. (watt-hours used, at least in monthly time-slices, possibly with geo-locating data, etc.)

3. Same as above for water use.

It seems to me that if the government is going to make it legal for a provider of services that run on government owned property (telephone/internet lines, which if not in all cases outright owned by the federal government, ARE deeply regulated by it), then why not all the databases concerning all gov. property?

eternalban• 9 years ago

This is basically like having your mailman/postoffice sell the list of your to/from addresses.

Isn't it possible to challenge this on constitutional grounds?

deong• 9 years ago

I really doubt it. First, the Constitution places limits on the government; not so much on contractual agreements between private parties. What you and Comcast agree to just has to avoid depriving you of basic human rights (i.e., you can't sell yourself into slavery).

Even ignoring that, you give up most constitutional privacy claims if you start disclosing the information to third parties. The ISP is a permanent and necessary third party here. If you tell your ISP that you want to go to ihaveherpes.com or whatever (by asking them to route your traffic there), then I'm not sure you have any claim to privacy as it pertains to a conversation between you and the herpes people. You willingly gave the ISP the information.

That's why we need legal protections like the prior FCC rules. Because by necessity, you need something above any bare constitutional protection.

milesf• 9 years ago

Time to roll up our sleeves and get to work. I've watched the tech community battle back many times: PGP, SCO Unix vs Linux, WebStandards.org, etc.

How do we fight this using software? Remember that many of the innovations came from single individuals. Is there a way to have a fully private, fast communication between two computers when we know everything we do is being saved and analyzed? Because that's all the Internet really is, whether one of those computers is a web server and the other a browser or any other infinite combination.

jaySmith• 9 years ago

One idea that I have been running through my head for awhile is a Tor like onion router that could be funded by a special cryptocurrency. This would mean each relay would get some amount of money for passing a packet on to the next relay. Ultimately this would solve two problems with Tor: speed (as it is paid there would likely be more relays with faster connection) and issues with spam (DOS over the network would cost a lot more.) Obviously it would suffer from some anonymity issues that would need to be solved as you are paying and it could be traced. I don't know if this idea would solve the issue in this case but I figured I would mention it.

serafinlion• 9 years ago

It's a repeal of the regulation put in place by the FCC last year October prohibiting ISPs (such as Verizon, AT&T) to sell their customers' data. This shows how strong the lobbyist groups are if this very recent item was taken on this quickly -- which makes sense if you think about that it's a $156+ billion industry in the US alone.

The regulation from last October required to ask for expressive consent to sell the following:

- Precise geo-location - Children’s information - Health Information - Financial Information - Social Security Numbers (wait, they actually sold those?!) - Web Browsing History - App Usage History - The content of communication

With the new regulation, passing all of these information on is fair game again. Which is absolute fucking shocking!

Btw, for anyone interested, I wrote a blog post about the implications of the new regulation for ISPs when it was first passed -- just make sure to read it as the opposite of what I wrote: https://blog.datawallet.io/broad-band-providers-take-a-hit-b...

pragone2• 9 years ago

Since this isn't posted in this thread yet, here it is: https://github.com/jlund/streisand

Unless someone can point out why it's not what it's cracked up to be? Seems like a rather easy-to-setup solution, somewhere between straight up paying a service and rolling everything yourself (I do pay PIA, but I've found that, not infrequently, my speeds are drastically throttled. I'll be actively downloading a file while connected at 400kb/s, cancel the download, disconnect from them, restart the same file, and be at 10mbit/s. I have no doubt some of that is due to the nature of the VPN, but I can't imagine all of it is. But, I'm not not a network engineer.)

snowpanda3• 9 years ago

My concern is that if you connect to a VPN server in the US that your traffic will still be sold because the VPN provider technically also an ISP. I could be wrong though.

Spoom• 9 years ago

I'm curious if this will result in ISPs requiring the installation of an SSL root CA on customers' devices -- they can't track SSL traffic without it.

croon2• 9 years ago

They know where you connect to. That's still plenty of information.

Brendinooo3• 9 years ago

I am a strong advocate for privacy, please understand that before you continue reading this. I don't want ISPs to sell my browsing history, and I am continually disappointed in the Republican opposition to net neutrality and online privacy. I'm even working on an open source project involving cryptography and secret protection, so I have skin in the game.

However, this headline is patently false, right? Congress didn't sell anything. They removed protections that were put into place late last year and hadn't gone into effect as far as I know.

Just because companies are legally capable of selling your browsing data doesn't mean that they absolutely will. As far as I know, my browsing history hasn't been sold by my ISP yet, and the regulations that were rolled back were not the reason why this is true.

Maybe I'm just posting because I like being a contrarian, but I do expect a more sober-minded commentary on this site than I've been getting on some recent news items.

If you're interested in the FCC's response, here is a primary source[0]. I don't buy most of it - I know that this is a lot of spin doctoring, particularly that second paragraph. But it provides insight to how the FCC is viewing this, something I haven't seen a lot of in this coverage.

Here[1] is some coverage from 2015 on the FCC/FTC issue that the third paragraph in that presser talks about. Also worth noting is this HN thread[2] from two years ago, where the top comment is a thoughtful critique of putting the hopes of an open Internet in the hands of a bureaucracy. People didn't agree, but that's the sort of commentary that keeps me coming back to Hacker News.

[0] http://transition.fcc.gov/Daily_Releases/Daily_Business/2017... [1]: https://iapp.org/news/a/ftc-officials-concerned-about-jurisd... [2]: https://news.ycombinator.com/item?id=9191007

lilbobbytables• 9 years ago

Don't have a moment to read your sources at the moment.

But weren't the protections only put into place last year because they weren't needed until then?

In other words, they were under the jurisdiction of the FTC previously, so this particular legislation a moot point, because the FTC could just say "hey, you can't do that. case closed."

Now because of the "common carrier exemption" I don't think that would hold up.

This was useful in some quick tidbits about FTC + FCC relationship, previous responsibilities, and current. https://www.ftc.gov/system/files/documents/public_statements...

Funny enough, they talk about how the FCC handles data/privacy breaches, and how they came down really hard on a minor breach that affected a few cox subscribers, nothing with payment data or even any actual damages.

This seemingly means that the FTC takes privacy seriously. But congress won't let them.

vancan1ty2• 9 years ago

If legal opinion is now that the FTC does not have the ability to regulate internet privacy, it is not the fault of congress, it is the fault of the 9th circuit's ruling ruling last year [1], which has effect over its area of jurisdiction.

Traditionally it is the FTC which regulates consumer privacy. The republican's position w.r.t. internet privacy is that regulating this is in the domain of the FTC, as has always been the case before [2][3][4].

Sources:

[1] https://iapp.org/news/a/the-att-v-ftc-common-carrier-ruling-...

[2] http://transition.fcc.gov/Daily_Releases/Daily_Business/2017...

[3] https://www.ftc.gov/news-events/media-resources/protecting-c...

[4] http://www.heritage.org/crime-and-justice/commentary/the-ftc...

shawnee_• 9 years ago

However, this headline is patently false, right? Congress didn't sell anything. They removed protections that were put into place late last year and hadn't gone into effect as far as I know.

It's nearly impossible to find even one constituent who wrote to their Congresspeople asking for this law to be axed. It was a handful of lawmakers in Congress who accepted bribes, payments[1], and other kinds of lobbying from telecoms to push this through... that is the definition of "selling". And yes, the votes did happen almost exactly down party lines.

The headline was taken directly from the NYT article, and it is indeed accurate. That HN changed it to appease ??? is really disconcerting.

[1]http://www.vocativ.com/415350/house-rep-pushing-to-set-back-...

rayiner3• 9 years ago

Given that it's illegal for corporations to donate to candidates, I find your reference rather suspect.

Brendinooo3• 9 years ago

I see where your argument is coming from. Lobbyists give money to politicians who push legislation that favors lobbyists. In a sense that could be construed as a 'sale'.

But if we accept that premise, even in that case the only thing that was sold was the potential to infringe on privacy, not privacy itself.

Congressional Republicans don't own my privacy.

They can certainly make it easier for me to protect my privacy and have possibly made it harder after this vote, but they never owned it.

js2• 9 years ago

AT&T had a program in place ("Internet Preferences") where they offered a $29/mo discount on their gigapower FTTH offering to customers who allowed them to inspect traffic for the purpose of ad targeting, including sending you offers by e-mail related to your browsing.

They defaulted you in to the program, hid its terms in fine print, and made it difficult to sign up for service w/o accepting the program.

Now, they did away with this program late last year and started giving everyone the discounted price. It's not clear why they did so: maybe it was the upcoming FCC regulations; maybe it wasn't making enough money; maybe it was competition from Google Fiber.

With Google Fiber going away and the FCC regulations being rolled back, I'll guess we'll see whether the program comes back.

But regardless, at least one major ISP was willing to inspect its customers' browsing data and use it for ad targeting. It would be great if this were solved by the market via customer backlash, but I don't see that happening. Sadly, I think most customers just don't care. People are willing to tolerate a lot to save money.

dfar12• 9 years ago

What is the name of the bill? And where can I read it? Thanks.

tzs5• 9 years ago

Here: https://www.congress.gov/bill/115th-congress/senate-joint-re...

Here's the full text:

Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Federal Communications Commission relating to “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services”.
Resolved by the Senate and House of Representatives of the United States of America in Congress assembled, That Congress disapproves the rule submitted by the Federal Communications Commission relating to “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services” (81 Fed. Reg. 87274 (December 2, 2016)), and such rule shall have no force or effect.

programmarchy4• 9 years ago

S.J.Res. 34: A joint resolution providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Federal Communications Commission relating to “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services”.

https://www.govtrack.us/congress/bills/115/sjres34

peregrine6• 9 years ago

The Hacker News mods should comment why this post has been 'bumped' from the top spot and why it's title is no longer the original title of the article.

From the https://news.ycombinator.com/newsguidelines.html:

Otherwise please use the original title, unless it is misleading or linkbait.

The title is the original, it wasn't misleading and it isn't 'linkbait'. Its the premise of the article and it's the truth.

dang please help me out here.

Brendinooo3• 9 years ago

The headline isn't true. Congress voted to remove regulations, they didn't complete a financial transaction with ISPs.

peregrine6• 9 years ago

Because none of them received donations or were lobbied?

state_less3• 9 years ago

s/regulations/privacy/

sctb2• 9 years ago

A moderator replaced the original title (which was absolutely as linkbait as they come) with a representative phrase from the article. This topic has been discussed extensively already, so this article received many user flags as well as the standard penalty for follow-on posts.

Related discussions:

https://news.ycombinator.com/item?id=13942345

https://news.ycombinator.com/item?id=13981184

https://news.ycombinator.com/item?id=13951347

https://news.ycombinator.com/item?id=13967955

https://news.ycombinator.com/item?id=13983235

https://news.ycombinator.com/item?id=13973727

peregrine6• 9 years ago

Thank you for being transparent. It seems nearly everyday I see articles rise to the top of HN only to disappear when I return.

With no explanation or transparency for the reason.

https://news.ycombinator.com/item?id=13939514

For example was on the front page for less than 2 minutes before disappearing with zero discussion nor reasoning. Even though it contains extremely Hacker News friendly analysis and discussion.

HN needs to come clean, is the no politics rule continuing? Or are the politics of the moderators or the "politics deemed appropriate" going to continue to rule?

bubblethink2• 9 years ago

Why was the title of this post changed retroactively on HN ? The article is an op-ed with the title "How the Republicans Sold Your Privacy to Internet Providers".

xori• 9 years ago

I'm curious, does this mean that an ISP can sell non-anonymized data collected between last October and now?

valine• 9 years ago

What I want is a way to tie my own VPN to something like my Apple id and have it auto configured anytime I move to a different device. Right maintaining VPN clients on a range of devices is a pretty big hassle. I'm not saying I want Apple to run vpn services, I just want an easy way to manage vpn configurations on personal devices.

lloyd-christmas• 9 years ago

https://betterspot.com/ was a Kickstarter project I funded. They haven't shipped yet, but look to be this month.

singularity2001• 9 years ago

This can't be repeated often enough:

If you have some ssh server somewhere (who hasn't), you can very easily create a 'VPN over ssh' by calling:

sshuttle -r user@remote_host 0.0.0.0/0 --dns

JohnLeTigre• 9 years ago

Great, now everyone will use Tor and torrent over I2P. I wonder if these technologies can handle the extra bandwidth.

Thrymr• 9 years ago

I am curious whether any companies are concerned about this for employees who work from home. Can ISPs resell business espionage to the highest bidder? Not all employers are savvy enough to provide and require VPNs.

dsr_• 9 years ago

If engineers would refuse to implement privacy invasions, they wouldn't happen.

Do you work for Comcast, Verizon, AT&T, Time-Warner, CenturyLink, Charter, Cox, Frontier? Don't implement these things. Don't do deep packet inspection, don't log things that shouldn't be logged, don't put in MITM proxies and don't insert cookies in traffic that your customers expected to have unmolested. Explain your decision, and explain it to your coworkers.

Some of you will lose your jobs. I'm sorry. However, you're in high demand. And maybe you can make a difference.

Chaebixi2• 9 years ago

If engineers would refuse to implement privacy invasions, they wouldn't happen.

That'll never work, as long as it's just a personal ethical thing. There's always someone who would rather take the money.

Now, if there was a professional organization or union with some teeth, which could enforce some kind of ethical code, then maybe "engineers" could do something about stuff like this. I'm not sure how it would work in detail, but it might involve pickets/walkouts of entire organizations engaged in unethical projects or expelling members who work on them in a way that negatively affects their future job prospects.

voidlogic• 9 years ago

That'll never work, as long as it's just a personal ethical thing. There's always someone who would rather take the money.

So true

Now, if there was a professional organization or union with some teeth, which could enforce some kind of ethical code, then maybe "engineers" could do something about stuff like this.

That won't work either. A few years ago most of the "programmers/developers/computer scientists" I worked with (we weren't pretending to be engineers yet), all had C-S degrees (either C-S undergrad or math/physics undergrad with C-S masters+). And by and large these people were usually members of the ACM or IEEE.

Now with the rise of the "self tough (software) engineer", these professional organizations are weaker than ever before. My cube make is not only likely to be a boot camp graduate, they are likely to not know what the ACM is, never mind any ethical standards its has and of course have no concern for being kicked out.

Now I am not saying all this is good or bad, democratization of technology has pros and cons. But its a shift that makes depending on professional orgs more worthless than ever before. (some of this is also coast vs inland US, the west coast as always had more self-tough vs academia tought programmers).

fragmede• 9 years ago

That'll never work, as long as it's just a personal ethical thing. There's always someone who would rather take the money.

Sure, but "I was just following orders because someone else was gonna" isn't going to win any ethical arguments. The point is the tech worker that implements these things is complicit, whether it's the database system for a list of Muslims or privacy invasion.

Additionally, the sentiment is that tech workers can easily get another job, so "just following orders to pay the rent/mortgage" doesn't hold up either.

To use an extreme example, if my work gave me a gun and tell me to go shoot a particular somebody, I'm going to refuse to do it (and tell the police). I'm sure they could find a murderer-for-hire, but I'm still not gonna be the one to pull the trigger.

erdojo• 9 years ago

Might be an ignorant question, but could individual websites do more to prevent an ISP from seeing your activity on the site?

I know HTTPS should be able to help (?), but ISPs can still see the domain you're visiting and get metadata on the encrypted traffic, which can be revealing.

Are there architectural or tech stack decisions a company could make that would basically lock an ISP from knowing anything except the root domains you visited?

davidgerard• 9 years ago

Fake title. Actual title: "How the Republicans Sold Your Privacy to Internet Providers"

Disapproval of FCC regulations a significant blow against privacy protection

Related Stories