ISPs Using "Deep Packet Inspection" On 100,000 Users

dstates writes "The Washington Post is reporting that some Internet Service Providers (ISP) have been using deep-packet inspection to spy on the communications of more than 100,000 US customers. Deep packet inspection allows the ISP to read the content of communications including every Web page visited, every e-mail sent and every search entered, in short every click and keystroke that comes down the line. The companies involved assert that customers' privacy is protected because no personally identifying details are released, but they make money from advertisers who use the information to target their online pitches. Deep packet inspection is a significant expansion over tools like cookies in the ability to track a user. Critics liken it to a phone company listening in on conversations."

Comments

So? Use https, ...

[Anonymous Coward]

..., ssh, pgp all the time!

Re:So? Use https, ...

[Anonymous Coward]

NEWS FLASH: unencrypted communication are sent over an unencrypted connection and could be easily read by a third party.

Re:So? Use https, ...

[tomhudson]

First step: https instead of http.

Inspect THAT!

Re:So? Use https, ...

[Ernesto Alvarez]

Let me add OTR messaging to the list.

Available for Pidgin (aka GAIM), Adium X, mICQ, Kopete, Miranda, Trillian and as a proxy for people that use other clients. Works on any IM network.

(I've been using it on GAIM for some time and I recommend it)

Re:So? Use https, ...

[bignetbuy]

Thank you for the link. There's an rpm available for Fedora Core 8 too. Wow. Just installed.

Re:So? Use https, ...

[mabhatter654]

Like the post said, so are voice phone calls, but we expect phone companies not to bug our phones. Hell, you could go to those little green boxes with a generic uniform on and listen all day and nobody would bother you. Of course they're be hell to pay if you were caught. Why is "internet" communications any different than normal ones, why should telcos be "listening in" to our conversations?

Re:So? Use https, ...

[ta bu shi da yu]

Yes, but of course the service you are using needs to be actually running SSL.

Re:So? Use https, ...

[CSMatt]

They can still read the URL.

Re:So? Use https, ...

[CSMatt]

It's difficult enough to convince my non-technical peers to start using e-mail clients instead of webmail services, let alone have them attend key-signing parties.

Re:So? Use https, ...

[jeknull]

QUOTE but we expect phone companies not to bug our phones UNQUOTE True, but they keep a record of to whom you call, so keeping a record of what you visit or inquiry, I think it looks similar.

Re:So? Use https, ...

[Anonymous Coward]

Except the article mentions a record of the contents thereof.
Not exactly a record, but inspection and analysis of.

I always thought that observing the content of users transmissions nullified their exemption from protection by the law for facillitating any illegal acts that go on through them...

Re:So? Use https, ...

[danknight]

most of us who work for the big telcos dont wear uniforms

Re:So? Use https, ...

[Cramer]

Negative. The best they'll see is a hostname if it's provided in the client hello -- which is a recent addition to the SSL protocol to allow name-based SSL virtual hosts.

So what's the status on IPSec?

[Anonymous Coward]

DNSSec and opportunistic IPSec should put an end to the snooping and throttling once and for all.

Re:So what's the status on IPSec?

[Anonymous Coward]

Mod parent up.

Even if fairly "lightweight" encryption were used for all communications, it would thwart the vast majority of this snooping. As CPUs increase in power, we could slowly ramp-up the baseline strength of the encryption.

Re:So what's the status on IPSec?

[NeverVotedBush]

In response to another article, I said that we should start encrypting all of our traffic and asked for programmers to start adding that functionality and making it the default so that even unsophisticated users' trafic would be encrypted.

But with the revelation the other day that the Bush administration believes the Fourth Amendment (right to privacy and protection from searches without cause), this becomes just another good reason to get cracking with all traffic encrypted.

http://yro.slashdot.org/article.pl?sid=08/04/03/1219200

Re:So what's the status on IPSec?

[NeverVotedBush]

Yikes - What I meant to say was that the Bush administration believes the Fourth Amendment does not apply to them and that they have the right/power to monitor and wiretap at will.

Also, another point about this is people have always said that users should understand that their activities on the Internet could be monitored by third parties. This, however, is different (at least to me) in that it is systematic snooping on the part of ISPs.

The situation has somewhat changed in another way, too. It used to be that there was no practical way to store or monitor all of the traffic. The technology just wasn't there. Now it is. The FBI has "Carnivore" and who knows what else. Storage is cheap and computers are now very fast. Everything people do can be stored, sifted, inspected, categorized, and given a score as to how likely the person is to be a terrorist, commit a crime, etc.

It is starting to get where people are putting themselves on the line just by posting to forums like these. Obviously that is a paranoid view, but it is also one that is now possible - if not probable - and all it takes is for the right (or wrong) person or organization to decide some site, person, or group should be monitored and it becomes reality.

Re:So what's the status on IPSec?

[rawler]

Which is only one of the countless reasons why NAT must die. By coincidence, IPv6 doesn't encourage NAT, and IPSEC is a lot firmer integrated there. (Also, don't EVER trust your NAT-gw to be a firewall, especially not if it's UPnP-enabled in which case it's actually very likely to be the spy itself.)

Re:So what's the status on IPSec?

[Anonymous Coward]

And I hope you like seeing cpu load on servers grow exponentially. Some sites can barely handle their load already, including sites you'd REALLY rather have come to you encrypted (4chan.org, waffles.fm, just to name a couple).

but alas, you it isn't always your choice whether or not you get to use encryption on all communications -- it takes two to encrypt. That means you either need to be willing to give up all communications with people unwilling(people who feel they have nothing to hide) OR incapable (people who are using a machine they have little control over, like IMing from a cellphone or public machine. Or again, websites that don't have the resources to spare).

So you either give up a large chunk of your internet use, or have enough stuff be clear text that a warrant for the rest of your connection becomes simple to get.

There are means of general purpose encryption like tor, but that only protects half of the connection leaving the other half wide open for attack and still able to hurt you just as bad as you could hurt yourself. These means are also so slow you give up a lot of what you're paying for in internet connectivity in exchange for the illusion of privacy and security.

Re:So what's the status on IPSec?

[Anonymous Coward]

NAT is not a problem since IPSec is host-level encryption, not application- or user-level. The network address translator can be an encrypting gateway. That's not a problem because it already mangles the packets in other ways. From the public network point of view, it is a leaf node, one end in end-to-end.

The problem with opportunistic encryption is the key management. That's why DNSSec is important. Without trustworthy public keys, man in the middle attacks are trivial. But DNSSec isn't so simple with dynamic IP addresses and that is the real reason why residential users are going to be the last to get working IPSec.

Re:So what's the status on IPSec?

[hey]

DNSSec and IPSec are too fancy.
Just begin every internet communication with STARTTLS. Works for ftp, pop3, imap, smtp and soon http.

Re:So what's the status on IPSec?

[Anonymous Coward]

Great, so what happens when the other side of your starttls doesn't have a cert from a CA that you already trust?

A self-signed cert can be spoofed by an in-the-middle attacker.

Moreover, starttls has some disadvantages with respect to the downforcing of crypto; are you going to disconnect when the counterparty chooses a potentially weak algorithm? This is an ongoing debate in the TLS WG at IETF.

Finally there are plenty of transactions which aren't really amenable to starttls -- connectionless stuff like DNS comes immediately to mind. DNS Spoofing + your blind trust of self-signed certificates --> pwnage.

Encryption without strong authentication of the other party is only useful to prevent the most casual sniffers from intercepting your traffic. Attackers who can divert traffic or inject DNS poison are an actual problem already, and negotiated TLS does not help if at least one side fails to fully verify the cert of the other side.

Compare your browser with

openssl s_client -verify 99 -connect www.microsoft.com:443

The latter will say ...
        Verify return code: 27 (certificate not trusted)

because Microsoft isn't following TFM with respect to intermediate certificates. Same with www.apple.com:443 ...

www.hotmail.com:443 is even worse

and

www.mac.com:443 is insidious in two ways -- firstly it has the same problem with intermediate certs not being given over in the certchain, and secondly they immediately force you into http URIs (i.e., not https) and keep you there.

Guess how IE and Safari react to these problems? Hint: they don't raise alarm bells. It could be that the webmasters at both sites are *UNAWARE* that MITM can be used against their https-connecting clients thanks to their cert chain deficiencies.

Finally, as for works for ... ... smtp ...

openssl s_client -verify 99 -connect smtp.mac.com:25 -starttls smtp

Is enlightening.

Re:So what's the status on IPSec?

[Deagol]

I don't suppose you could provide a site that Does the Right Thing(tm)? Every site I've tried (including one I maintain myself) doesn't come back with anything that seems to indicate the cert can be trusted. Includes my credit union, Wells Fargo, and just about any other big name site I can think of. Perhaps I'm missing something to correctly run this openssl verification command you provide? I can't fathom *all* of the big sites I've tried being incorrectly set up.

Re:So what's the status on IPSec?

[MadAhab]

I think that GWB has been more destructive to America than we can really contemplate right now, but I have to give the credit to "the other side" on this one.

There was a time when encryption-by-default could have become the norm for Internet communications. It was largely passed by because the Clinton administration treated encryption technology as if it were chemical weapons. Even though the math to do it was a genie out of the bottle, they forbade American companies from trafficking in encryption technology if it involved overseas clients. So either it wasn't pursued, or the companies went overseas (e.g. F-Secure) but the end result is that encryption did not become a fundamental part of Internet communications.

Even weirder, one of the few to take a stand against this was John Ashcroft. Though, to his credit, he stood up to illegal wiretapping in the Dubya years as well. I don't agree with him on very much at all, but I have to give him credit for being a rare principled individual on this score.

So, to sum up, had the Clinton admin not squashed crypto so badly, we might not have to worry about mass spying on the public. They'd still be able to get around the encryption when it really mattered; they do black bag jobs and put keyloggers in mafioso computers when they need to do that, and I think that's a good balance of civil liberties and legitimate law enforcement, assuming warrants are involved.

Sadly, America has apparently decided that the First Amendment is tolerable, the Second is awesome, and fuck the rest of them. What an insult to our nation.

My favorite amendment? The Ninth: any rights not explicitly delineated in the Bill of Rights probably exist. Of course, the current Supreme Court (and conservatives in general) shit on that amendment, for some weird reason.

Re:So what's the status on IPSec?

[Anonymous Coward]

One example:


$ openssl s_client -verify 9 -connect www.hsbc.co.uk:443 ...
        Cipher : DES-CBC3-SHA ...
        Verify return code: 19 (self signed certificate in certificate chain)


Not bad. Self-signed cert indications are fine (or better). It's the untrusted/unverifiable certs that are the problem.

www.verisign.com:443 is fine
www.cibc.ca:443 is fine
www.bankofamerica.com:443 is fine

But, yes, www.wellsfargo.com:443 results in a code 27. Bad, bad, bad! Also, they negotiate only RC4-MD5 at strongest.

In *most* of these cases it's because the website admins installed the cert without following the instructions from the cert issuer properly. In *many* cases (e.g. Verisign class 3), the latest big web browsers, and curl, and wget, all have private additional databases which include the intermediate certs. However, in a scary number of cases, the web browsers will just silently connect, without telling you about a code 27. Either they're not verifying the cert chain, or they aren't reporting verification failures. That's pretty bad, since you can supply a real top level CA cert and a real self-signed cert signed by a fraudulent intermediate cert purporting to be from the top level CA, and in these browsers It Would Just Work.

There are of course also bad fallback modes for mail reading and sending clients... Not only do they ignore cert verification problems (or not verify) and do imaps/pop3s over a not-really-secure tls/ssl connection -- encrypted but not authenticated, and not necessarily free from MITM eavesdroppers -- but some will send passwords or email in the clear when the other end doesn't offer STARTTLS in response to EHLO or the equivalent. *That* is spooky.

Re:So what's the status on IPSec?

[cyb3rdemon]

Another good idea is to download so much random webpages that the ISP can't tell the real browsing history from the noise. Basically like TrackMeNot, except applied to the entire web.

Re:So what's the status on IPSec?

[GWBasic]

In response to another article, I said that we should start encrypting all of our traffic and asked for programmers to start adding that functionality and making it the default so that even unsophisticated users' trafic would be encrypted.

Ooooh, you just hit a nerve! I'm currently enabling SSL in a project that I'm working on.

The problem with saying "let's just encrypt everything" is that, at some point, both parties need to exchange keys. With SSL, unless you use a certificate signed by a trusted 3rd party, the ISP can intercept the initial key exchange and perform a man-in-the-middle attack.

Getting a certificate signed by a 3rd party is a pain-in-the-ass. In order for the scheme to work, certificates must be signed to a specific domain. This means that you have to trust that the 3rd party is reliable enough not to let your ISP generate a correct certificate when it performs a man-in-the-middle attack.

Really, the "let's just encrypt everything" mindset is going to turn into an arms race. The 3rd party can be impersonated or intercepted.

Encrypt everything.

[ookabooka]

Thats it, I say webservers move to SSL only transactions. All other plaintext transmissions should get encrypted at the endpoints transparently. Then when the government whines about not being able to find the terrorists they can blame datamining companies that paid for their election campaign. Then they can make a law that forces a back-door, which would create a need for some nifty-ass steganography which would lead to massively excessive processor and network overhead (encryption and steganography respectively) for the most basic of transactions which would lead to NSA funded algorythms to find these hidden messages which would. . .holy shit it's almost 10AM, I need to hit the sack.

Re:Encrypt everything.

[cs02rm0]

Seconded. It's beyond me why this hasn't happened already. Google do it fairly well as an option with gmail and google reader for example but not with their searching?

Re:Encrypt everything.

[maxwell demon]

What about Slashdot? After all, you might not want your ISP to know that you read such subversive web sites! :-)

Re:Encrypt everything.

[Anonymous Coward]

Remember many "SSL sites" only encrypt your authentication/login and not the subsequent content such as your E-mail traffic. I encourage any ISP employee who has knowledge of this process by their employer to dime them out here and to provide as much detail as possible. People in the US get worked up about Government monitoring but its corporate monitoring that is the primary threat to the average persons privacy in the USA.

Re:Encrypt everything.

[pla]

Thats it, I say webservers move to SSL only transactions.

I agree completely, but keep in mind that even with encryption, ISPs can still collect quite enough information on us to put together a truly impressive profile. Sure, they won't know exactly what you read, but if you visit Erowid, I'd call it a good bet you don't want recommendations on a cheese to go with dinner.

For targetted advertising purposes, the simple "where" counts for 90% of the "what".

Re:Encrypt everything.

[seneces]

SSL's general uptake is held back by two unfortunately major points. Firstly, it costs money to buy a SSL certificate, and you have to deal with all sorts of shit (or spend more money) if you use subdomains, alternate domains, etc. Something like CACert could fix this issue if it were widely accepted, but of course that would make the entire system less trustworthy..

Secondly, there is no normally implemented way to do name-based virtual hosting with SSL, and most people don't want to or can't give each domain it's own IP. There is a TLS extension to solve this, but afaik browser and httpd support is minimal or nonexistant currently.

These are issues the community really needs to be concentrating on, because all too often these days it does not make sense to communicate and let the rest of the world watch.

Re:Encrypt everything.

[DaleGlass]

The problem is that SSL happens before any HTTP does, and SSL is a general mechanism that can be used for any kind of TCP connection.

How does the webserver know what to give you when foo.com and bar.com map to the same IP address, and the browser requests something like index.html that exists on both? This works only because when the browser makes the request it also tells the webserver which domain it was trying to access. The browser sends something like this:

GET /index.html HTTP/1.1
Host: foo.com

Now, this breaks for SSL, because SSL happens before the connection is established, so there's no way to decide which certificate to use based on the domain.

To fix to this is adding the support directly to SSL. rfc4336 contains a mechanism to do this with TLS.

Re:Encrypt everything.

[neumayr]

Plus it's computationally, and therefore financially, expensive.

Re:Encrypt everything.

[Anonymous Coward]

HTTPS is not used for one simple reason. IT addes HUGE overhead to a session and reduces the number of sessions a server can handle, thus a web host needs more investment into servers in order to service the same level of users it does now.

Re:Encrypt everything.

[interiot]

Wrong RFC. That would be RFC4366,

Re:Encrypt everything.

[mollymoo]

Encryption doesn't stop people knowing who you're talking to, just what you're saying to them. And Slashdot does offer SSL to subscribers.

Re:Encrypt everything.

[darkpixel2k]

It's beyond me why this hasn't happened already.

As far as I know, IIS and Apache don't quite support TLS yet (although it's in-progress) which means every SSL-enabled website would have to be on it's own unique IP/port...making the IP 'crunch' even more of an issue.

Re:Encrypt everything.

[mysidia]

There is another option.

subjectAltName

SSL Certificates should be issued to the web server's hostname, not to domains.

Every single domain name hosted by the webserver should be listed on the SSL certificate.

This requires revoking the web server's original certificate and issuing a new one every time a new domain is added.

Another alternative would be to place *.webserver_hostname.domain.tld on the certificate

And use https://sitename.webserver_hostname.domain.tld/ for all SSL hosting.

The existence of these alternatives eliminate any technical need for SSL itself to be aware of the hostname typed in the browser.

Re:Encrypt everything.

[VGPowerlord]

I'm confused. I thought they did support TLS, but only on IP based virtual hosts because of the way SSL/TLS work... the TLS handshake is done before the server knows which domain name you're connecting to.

Re:Encrypt everything.

[Juergen Kreileder]

Underscores are not allowed in hostnames (RFC 952). Besides, it's an ugly solution and the URLs look like those used by phishers.

The subjectAltName option is nicer but some browser have problems with it.

Re:Encrypt everything.

[wings]

Sure, they won't know exactly what you read, but if you visit Erowid, I'd call it a good bet you don't want recommendations on a cheese to go with dinner.

I don't want recommendations suggestions on ANYTHING in the form of advertising.
I wonder what sites I should be visiting to achieve that goal? ;-)

Re:Encrypt everything.

[perlchild]

Defaulting to encryption would probably be simple... Except on cell phones/other devices that don't do ssl yet. On the other hand, the keywords are transmitted to third parties anyways(You can see them in stats analysis), so google probably figures securing them isn't such a priority.

Re:Encrypt everything.

[Anonymous Coward]

"Slashdot does offer SSL to subscribers."

it's called elitism ... only the affluent deserve privacy

Re:Encrypt everything.

[mollymoo]

it's called elitism ... only the affluent deserve privacy

Nobody deserves to have access to Slashdot - Slashdot has no obligation to provide anything at all, let alone encrypted access. It's called economics. SSL costs more to deliver, not so much the certs (they're cheap) but in terms of machine resources. Perhaps I'm just too damn wealthy, but half a cent per page with a $5 minimum purchase doesn't seem to require very much affluence to me.

Re:Encrypt everything.

[_ph1ux_]

I have two ideas:

(I dont know if this is implementable)

A USB encryption device that looks like any other USB key - when plugged in and its running, all data is routed through it and encrypted. Both traffic intended for wired interfaces and wireless.

the traffic could be routed to any number of "open" community run proxies as the device could be setup to create a tunnel between you and that proxy.

---

In 2002 I wrote a short white paper on an idea to use NBAR/ deep packet inspection to allow for service based routing of traffic and advertising in public networks.

Basically the idea would be very loosly based on the principle behind JXTA - where a user who attaches to a wireless public mesh is connected with resources that are geographically closest to him (I hadnt thought of GPS as a part of the system for some reason) - but the idea would be that if you wanted to print you would simply "print" i.e. send your print job and the network would route the job to the closest printer. The idea was that the network would dynamically route based on the intent of the flow...

So on the one hand you want the network to be "the pipes are not aware of the water flowing throguh them" and on the other you want the network and computers to "just work" (menaing no configuration necessary)...

Re:Encrypt everything.

[Anonymous Coward]

Hmm, so to retain your privacy by remaining anonymous you can use Slashdot's SSL service... as long as you log in with your personal identification details?

It's extremely difficult to retain anonymity these days and this is precisely part of the reason why.

Re:Encrypt everything.

[Anonymous Coward]

Apache sure does; it even supports RFC 2817 (via the SSLEngine Optional mod_ssl config option and the SSLRequireSSL Directory option)

Now find a browser that *supports* TLS upgrade...

Now find a way to tell that browser to request TLS upgrades. It's easy for the server to require it, it's another thing for the browser to figure out when it should ask. Always? Then why not just use https URIs? If not always, then when, and what should it do when the site doesn't support TLS upgrades?

Re:Encrypt everything.

[Anonymous Coward]

Oh, please no! If even trivial traffic moves to encrypted one, the ability to protect servers and workstations drop significantly as you can't efficiently use packet inspection (snort) on networks or run anti-whatever (clam) software on proxy servers. The whole battle against exploits, viruses, malware and all that shit would shift right back to the last defence line as it was before.

And spare me of switch-to-this-or-that-OS to cure all mantra, corporate base will not sign in until major vendors start to port their apps to alternative platforms.

Re:Encrypt everything.

[darkpixel2k]

I thought they did support TLS, but only on IP based virtual hosts because of the way SSL/TLS work... the TLS handshake is done before the server knows which domain name you're connecting to.

Perhaps someone more qualified can answer this, but as I understand it SSL does the handshake before the server knows which domain you are connecting to--making it IP-based. TLS allows you to connect and issue a command that pretty much says "hey I'm connecting to this domain and I want an encrypted connection".

Re:Encrypt everything.

[Anonymous Coward]

As far as I know, IIS and Apache don't quite support TLS yet (although it's in-progress) which means every SSL-enabled website would have to be on it's own unique IP/port... -- (emphasis added)

Not quite true. At least with Apache, multiple virtual servers on same IP/port can be SSL-encrypted. Only the SSL-certificate is limited to one per IP/port.

This makes the browser generally complain about a mismatched certificate for virtual servers except for the domain matching the name on the certificate, but the connection is encrypted anyway. In essence, the data transfer is encrypted, but the browser cannot assert the end-point is who it claims to be.

Re:Encrypt everything.

[Renraku]

"Sure, they won't know exactly what you read, but if you visit Erowid, I'd call it a good bet you don't want recommendations on a cheese to go with dinner."

99.99% of the time, any advertisement or unsolicited recommendation I see is ignored. So how about we cut to the chase and say that no matter WHICH website I visit, I don't want recommendations of products or commercial services.

And if you haven't checked lately, alcohol is considered a drug..I believe its listed on Erowid as well. Many people find that cheese goes well with wine.

Re:Encrypt everything.

[nametaken]

I probably shouldn't be piggy-backing your post, but WOW customers should check on this ASAP. Per the articles reference to cookie usage for tracking services on WOW customers through NebuAd, I checked my cookies list. I do, in fact, have ones set by nebuad.adjuggler.com. I contacted Wide Open West about this, and the customer service rep had no concept of what I was talking about, was disconnected, and can't get in touch with them since I mentioned the Washington Post article and the implications of it. Since then their general number has been non-functional, though oddly I can call anyone else just fine. I hope other customers would take this opportunity to call in and ask about the policy changes and monitoring practices. Their number is 1-866-496-9669. None of the menu options really applies, so I used 4 for internet problems. I'd be interested to see what they tell other customers. :)

Re:Encrypt everything.

[Anonymous Coward]

All of this does not matter.

SSL and TLS are both still susceptible to man-in-the-middle attacks. When the connection is established, the machines doing the deep packet inspection intercept the key exchange, replace the keys with their own, and send the new keys to each end. All data remains visible to these deep packet inspection machines.

This is exactly what some bandwidth shaping "deep packet inspection" products sold in this day do.

To fix this, a new protocol must be created which encrypts all data, including the key exchange. This would require the dependence on a trusted third party to maintain the public keys used for initial encryption and authentication. Current business today selling SSL certificates already require this kind of trust, but have demonstrated that they are not trustworthy as they have been selling their root certificates to third party companies which are abusing them.

Simply put, there is no way to do truly secure public key exchange today because there is no company that can be trusted to maintain a secure public key certificate database.

The next best bet is that your network providers require this kind of trust. Your network provider must be trusted not to inspect the contents of potentially encrypted traffic. Furthermore, your network provider's equipment provider must have this kind of trust. Comcast has demonstrated that they are not worthy of this trust. This article also demonstrates that many more network providers are not worth of this trust.

The best we can hope for are tougher enforced laws, which give the same kind of penalties when interfering with network traffic as postal fraud and money fraud.

We are pretty much screwed.

Re:Encrypt everything.

[NeverVotedBush]

A big part of blocking recommendations created by third parties like doubleclick and such is a good hosts file.

A good hosts file can also keep your computer out of trouble when websites get booby-trapped to send you to another site that installs malware.

Here is a good how-to and a pretty good hosts file:

http://www.mvps.org/winhelp2002/hosts.htm

Re:Encrypt everything.

[sjames]

It's a shame that way back when, encryption and authentication got squished together into SSL. If not for that, many more sites would at least support encryption and authentication for virtual hosts would have been dead simple.

The real issue is that both TLS and SSL are vulnerable to a man-in-the-middle attack if the attacker controls your upstream network!!! It's still not useless as it would take way too much computational power to do that with all customers all the time, but it's not the absolute protection some imagine it to be.

Re:Encrypt everything.

[nametaken]

A little more research for WOW customers... Internet Use Terms and Conditions http://www1.wowway.com/wow/wow.aspx?ConIdent=28&RCView=False&TermID=11 In there you'll find the section on NebuAd, and their opt-out page.

Re:Encrypt everything.

[Dan541]

Thats it, I say webservers move to SSL only transactions. All other plaintext transmissions should get encrypted at the endpoints transparently. I agree with you about SSL but the problem is the cost. Webbrowsers actively warn users away from SSL sites unless the owner pays one of their partners to sign a certificate.

~Dan

Re:Encrypt everything.

[mysidia]

?!

RFC 952 is an obsolete RFC that describes a thing called the 'internet host table' that used to exist. It is no longer a relevant document, and it has no bearing on domain names, the concept did not even exist at the time of 952.

If you go by 952, we can't have IPv6 either, or classfless addressing, check out the lexical conventions shown for a host entry.

Nowadays DNS is in more common use, which has more relaxed rules on what exactly can be contained in a label.

The URLs will look pretty straightforward, you just need a distinctive name for the site. I.E. if my main site is "www.blah.com"; and the hosting provider is example.com, my SSL site may be https://blah.secure.example.com/

This kind of scheme is periodically used, and seeing it is no indication of a phishing attempt.

SSL will not tell you whether a site is a phishing site or not. SSL does not have that as a goal, and SSL does not accomplish it at all.

The use of certificates has exactly one function: to verify that you are connecting to the web server that you think you are connecting to. I.E. That an unknown third party is not performing a man-in-the-middle attack on your SSL connection. The problem of phishing is totally separate and not addressed by or effected by SSL or URL scheme.

If you are just surfing, you will probably not care about phishing.

If you are banking online or similar, NEITHER the URL, nor the signature of a SSL Certificate Authority is sufficient to establish that a phishing attempt or cross-site scripting attack is not occuring.

You need to receive the bank's X.509 certificate out-of-band, for example by going to your bank and picking up a USB stick with their x509 certificate including the public key and identification of site name. In exchange, you give your bank a USB stick with _your_ personal client SSL certificate, which they load into their system and associate with your account.

You install their server x.509 certificate in your web browser as trusted for their chosen name. So when you browse to the site, you will know they have proved their identity, if the correct X.509 certificate is being used.

They enter your client SSL certificate in a database so that when you enter your passphrase into your browser and connect with your client's x.509 certificate, they will immediately know you have proved your identity as the account holder.

A method such as this is the only way SSL can guarantee that no phishing is involved. A third-party certificate authority simply has no way of knowing that https://mybanc.example.com/ is an attempt at creating a phishing site against https://mybank.example.com/

Re:Encrypt everything.

[scruffy]

Why just add an optional exchange of public keys to the HTTP protocol (and others)? This would be susceptible to man-in-the-middle attacks, but I don't the ISPs would ever have the compute power to do this for all their customers.

Re:Encrypt everything.

[tux_attack]

It could also be done with a greasemonkey script, there's already one that forces wikipedia to https.

Re:Encrypt everything.

[tux_attack]

cynicism{ No corporation can be trusted and the government can't be trusted either, get used to it } Probably the best way would be to have many companies all maintaining their own database, then make them all hate each other so they won't conspire; or maybe a reward for having the most trustworthy database is given to the best key maintainer so if you violate trust you lose money. Yes, we are screwed.

Re:Encrypt everything.

[Anonymous Coward]

"if you visit Erowid, I'd call it a good bet you don't want recommendations on a cheese to go with dinner"

http://www.erowid.org/chemicals/heroin/heroin_article1.shtml

Filesharing Responsibility?

[Thruen]

If ISPs are monitoring traffic so closely, doesn't that make them more responsible for what people are using their service for? Namely piracy.

Re:Filesharing Responsibility?

[NeverVotedBush]

I do believe that one could make that point. Comcast already has ways to throttle Bittorrent. If they are doing deep packet inspection, I would think that they would know down to the data block what files were being transferred.

Re:Filesharing Responsibility?

[Anonymous Coward]

If ISPs are monitoring traffic so closely, doesn't that make them more responsible for what people are using their service for? Namely piracy.
More than that. It means that if you are downloading something legitimately such as paid-for streaming content, the ISP will be making a copy of it. So they are committing piracy even when the customer isn't.

Re:Filesharing Responsibility?

[budgenator]

Not yet, but it seems that they are bound and determined to get there. I figure if they want to crawl that far up my ass, I'll just write a Perl script to spider every link on a page, and let it run recursively, give them enough data they start to buffer-overflow and fill up their hard-disks until they puke. Sure I probably can't do much to them, but ten thousand of us crawling the web can.

Old news - proxies, compressors, etc

[Gothmolly]

ISPs have always been notorious for secretly compressing your images, caching your traffic, proxying stuff, slipping their own content into your web pages, etc. They look at the contents of your mail, since you can't spoof from anyone to anyone via their servers. How is this different, other than some joker gave it an ominous sounding name like 'Deep Packet Inspection' ?

Re:Old news - proxies, compressors, etc

[SCHecklerX]

They don't snoop on my mail, thanks, since I use TLS to the next gateway (which isn't owned by the ISP). Of course, all bets are off regarding what *they* may be doing with the mail, but it won't be my ISP doing it.

Re:Old news - proxies, compressors, etc

[Anonymous Coward]

How is this different, other than some joker gave it an ominous sounding name like 'Deep Packet Inspection' ?

First, I believe the "joker" in question was named Rakesh or Larry. Second, this differs in the number of people who can easily access that data, how easy it is to archive and export that data, and how easy it is to make and share long running profiles. Also, assuming this is the product I think it is (based upon the trademarked term DPI) they also make products aimed at the enterprise for your company to track you (and there is a large potential of interoperability). Before this product an ISP could track your data flowing across their network. This is the first one I know of (and I worked at one of these companies) that lets big ISPs seamlessly share the data with one another by selecting a check box once.

I think this is a good thing.

[Anonymous Coward]

I think the ISPs spying like this is a good thing - if indeed it can push people to use encryption more. People will be too lazy to do it by themselves without some "motivation" like this. And the ISPs doing it for advertising is a relatively harmless example. Sure beats waiting until a government decides to outlaw some major political party.

I just hope that this invasion of privacy is significant enough that businesses get offended (and they should get offended that some other company is reading most of their emails) to reach the tipping point of encrypting all their communication (email, etc); and home use will follow.

Re:I think this is a good thing.

[Anonymous Coward]

Perhaps someone could make up a web-server that creates a random page using links to other websites selected at random. Then anyone can make that a home page, which would mess up all the statistics collected.

Like in the UK?

[Anonymous Coward]

Is this the phorm system?

http://www.theregister.co.uk/2008/02/29/phorm_documents/

http://www.theregister.co.uk/2008/02/29/phorm_roundup/

time for some hactivism

[jollyreaper]

Let's start turning over rocks in the private lives of telcom CEO's and see what scurries out. I'm sure they won't mind, it's in the interests of an open society and free debate, don'cha know.

Re:time for some hactivism

[Pancake Bandit]

zomg HACK THE PLANET

Re:time for some hactivism

[ArsenneLupin]

Let's start turning over rocks in the private lives of telcom CEO's and see what scurries out. hihi...

Is This Any Way To Do Business?

[JackSpratts]

if they spent half as much time increasing network capacity at the physical layer as they do spying on customers' bits we'd all be twice as well off, and we might even have a shot at some true global parity. as it is now they've got u.s. customers all drinking from their same dwindling pool.

- js.

Re:Is This Any Way To Do Business?

[Overzeetop]

I'm sure part of it is to determine what is passing through the network and how to reduce the overall traffic flow - which would reduce the amount of physical plant needed. It's not all sunshine and light - they make money any way they can, and if snooping does it for them, they'll do it until it is illegal. I'm just pointing out that ignoring all traffic and building out physical plant isn't necessarily in the financial interest of the ISPs. Using what they have in the most "efficient" way is. Their efficiency may not be in line with your bandwidth usage expectations, of course.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Good luck with that

[TheMohel]

Never mind that it's evil, or that it's a great step to losing their common-carrier status.

Never mind that it's a true violation of privacy.

Never mind that I block cookies pretty well and I run with NoScript most of the time and I don't see very many ads, and besides, half of the time I'm inside my employer's VPN.

But even more than that, I have seven other users in my household, half of them teenagers. If they want to sniff all of my NAT-ed packets coming out, they're going to discover that I'm a geek who has four Facebook sites, likes art and hates it, plays Runescape incessantly (the 10-year-old), likes the Wiggles, and works as a beauty consultant. So go ahead and hand me the ad for the latest XBox game (I hate games). Offer my kids server hardware, and see if you can get my wife to click on fun games to play with the Backyardigans. Oh, wait, you already do. It's called "not targeting advertising", and it's free.

So what we have is a thoroughly broken high-cost borderline-illegal absolutely-unethical service offered to advertisers in a difficult economic period. By people who we all hate a lot, and who will rapidly become targets for everything from blocking to legislative action to you name it.

I knew there would be some kind of career move for spam kings in the future. I just thought it would pay better.

I predict a less than stellar outcome for these idiots, and they deserve every painful moment.

Re:Good luck with that

[ChowRiit]

However, you still get more accurate data on user trends as a whole - you no longer have the old problem of the fact that only the sort of people who fill in surveys will fill in your surveys, and they're not generally a representative sample.

Any data at all on user trends more than their competitors will help advertising companies make money.

Re:Good luck with that

[mpaulsen]

Never mind that it's evil, or that it's a great step to losing their common-carrier status.

They don't have a common-carrier status to lose.

Re:Good luck with that

[Nimey]

it's a great step to losing their common-carrier status. HA HA HA! You underestimate the power of bought congressweasels. One will slip in an amendment into a big must-pass bill, and Bob's their uncle.

Re:Good luck with that

[neumayr]

I'm pretty sure they can distinguish different users behind a NAT gateway. Everyone uses NAT.
But that's besides the point - sure, you might have some defenses against that sort of thing, but about 99.9% of Internet users don't.

Meaning, your personally being less affected does not make any difference - they don't need any luck.

Re:Good luck with that

[Anonymous Coward]

Never mind that it's evil, or that it's a great step to losing their common-carrier status.

ISPs are not and have never been common carriers!

Re:Good luck with that

[nurb432]

Thats all and good when it just about 'targeting' advertisements to you.

But when it turns to the government doing profiling on your 'habits', its not so harmless. And we all know that is next.

Re:Good luck with that

[msormune]

So if that stuff is so private, why did you just tell it to the whole world? I mean, you got +5 Insightful, and your household's Internet usage profile was just read by 1000000 people.

Re:Good luck with that

[jmorris42]

> If they want to sniff all of my NAT-ed packets coming out, they're
>going to discover that I'm a geek who has four Facebook sites, likes
> art and hates it, plays....

Silly person, they are much smarter than that. Each of those PCs can be identified, see previous slashdot articles on the subject. Especially since each PC in a network serving a diverse family as you are describing will probably have obvious differences in OS and browser versions. Then there is detailed packet header inspection (DEEP INSPECTION, remember?) to seperate out OS subtle version differences, etc. And each PC/account will offerup different cookies to the same websites like Google.

NAT won't stop them. SSL won't stop them. Laws might. This sort of snooping isn't 'like' listening in on phone conversations. It IS listening in on conversations.

Re:Good luck with that

[TheMohel]

Yeah, I know. They have a legal exemption from liability for the contents of the traffic they carry, subject to certain restrictions. Which isn't common-carrier status, although it acts a little like it.

But if they start to routinely "deeply inspect" traffic, a frisky plaintiff's attorney is going to see gravy in the "knew or should have known they were defaming my client" kind of stuff, and here we go.

Re:Good luck with that

[dstates]

But broad band ISPs are effectively monopolies in their local markets in large part as a result of government granted monopolies to provide cable TV service and local telephone service. The monopoly status of local telcos is the reason common carrier status was created in the first place. Bringing ISPs under common carrier rules is long overdue.

Communications privacy is a huge issue in a democratic society. Do not just kvetch on Slashdot. Write to your congressman and senators to tell them that this matters to you.

Re:Good luck with that

[ScrewMaster]

Never mind that it's evil, or that it's a great step to losing their common-carrier status.

Another common misperception. I don't know of any major United States Internet Service Provider that operates under common carrier regulation. The Telcos still do, but only for phone service. Their data services are considered exceptions to common-carrier regulation.

They obviously looked at the legal situation and decided the lack of immunity from lawsuits over the use of their equipment was a risk worth taking. Operating as a common carrier has regulatory burdens that they really don't want. What they want, actually, is to have the immunity from prosecution and still operate without any particular regulatory controls (i.e., they want to have their cake and eat it too.)

Re:Good luck with that

[Anonymous Coward]

ISPs do not have common carrier status and never did.

Re:Good luck with that

[ltkije]

They don't have a common-carrier status to lose. Then the obvious step is: petition your congressman to have Internet Service Providers regulated as common carriers. That's the only way we'll get rid of this nonsense for sure.

Re:Good luck with that

[davidwr]

plays Runescape incessantly (the 10-year-old) Oh dear, now every pedophile on the planet is going to try to buy info from your ISP!

Only kidding. I hope.

Re:Good luck with that

[avatar4d]

... Then there is detailed packet header inspection (DEEP INSPECTION, remember?) to seperate out OS subtle version differences, etc. To help against this, OpenBSD PF has a mechanism called "scrub" that has a bunch of options, but the following option should prove interesting...particularly the last bullet:

reassemble tcp
        Statefully normalizes TCP connections. When using scrub reassemble tcp, a direction (in/out) may not be specified. The following normalizations are performed:

                * Neither side of the connection is allowed to reduce their IP TTL. This is done to protect against an attacker sending a packet such that it reaches the firewall, affects the held state information for the connection, and expires before reaching the destination host. The TTL of all packets is raised to the highest value seen for the connection.
                * Modulate RFC1323 timestamps in TCP packet headers with a random number. This can prevent an observer from deducing the uptime of the host or from guessing how many hosts are behind a NAT gateway.

Re:Good luck with that

[tux_attack]

They can distinguish by unique MAC address.

Re:Good luck with that

[riondluz]

Well said. I haven't finished reading all the threads, but i'm curious how this is different from the /. post on BT and PHORM
It seems to like they are doing the same thing, just under
a different company name.

(you can opt out of this 'feature' by clicking here for your FREE laptop)

Faith in Godel

[buravirgil]

deeplink down
deep packet clowns
show me your packets
is that a smile or a frown?
thrice cola crown
Godel the bounds
where is Gibran's appendix found?

Throttling bandwidth

[element609]

Isn't this the real issue with clogging 'tubes'? How can the government and ISPs keep up with the computational resources needed to continue this as we demand greater and greater amounts of bandwidth? OK, so they could only inspect http traffic, rather than say, bittorrent traffic, but OMG what happens when 'terrorists' start communicating with other protocols?

Re:Throttling bandwidth

[mikael]

How can the government and ISPs keep up with the computational resources needed to continue this as we demand greater and greater amounts of bandwidth?

Multi-core CPU's and high capacity disk drives? Everything is constantly coming down in price.

Since the invention of frequency-tunable lasers, there is no limit on how much information can be sent down a fibre-optic cable. In the UK at least, the government tried to pass the cost of these computational resources onto the ISP's.

At least with the telephone network, the monitoring capability was built into the telephone system itself - partly because it was cheaper to give field engineers the ability to inspect and tune line quality remotely rather than having to drive all the way up to the exchange.

Re:Throttling bandwidth

[riondluz]

"How can the government and ISPs keep up with the computational resources"

They'll do just what most bigger ISP's (telco's) have done:
let their friendly DHS/NSA add a little room at their data center.

Cull through YRO and its apparent that .gov shares info with .biz
and .biz returns the favor. Now, the advertisers found a way
to get their fingers into the pie.

And will someone please post more stories on the infamy that
is Infragard!

ssh tunnelling + squid

[Orp]

I pay for a dedicated server (essentially colo but they provide the hardware) from a company with a decent AUP. I put linux on the server and run squid on a non-standard port, allowing connections from localhost only. Then from the machine I'm surfing from I tunnel into the squid server. Say squid is running on port 1234 and sshd is running on 4567:

ssh -f -N -L 1234:localhost:1234 -p 5678 my.squid.server.com

Configure firefox to use a proxy to localhost:1234 and all traffic is encrypted to the squid server.

Of course, I could just use Tor, which is great, but can be slow. In fact, you could run a tor server on your colo machine and have all tor traffic bounce off of the server, which would be pretty fast if you leave tor running as a daemon and dedicate a decent amount of bandwidth to the tor network.

Re:ssh tunnelling + squid

[jmorris42]

> I pay for a dedicated server (essentially colo but they provide
> the hardware) from a company with a decent AUP. I put linux on
> the server and run squid.....

And you are a fool with more money and tech knowledge than you have the brains to use wisely.

Exactly what are you hoping to accomplish by going to all of that bother? Your last mile ISP can't monitor you but the hosting company and THEIR ISP can so you have just shifted the point of attack.

And the government (which is what you are afraid of, right?) can't monitor either (the spooks can but anything they find can't be used against you in a court... they would just have to kill ya) without a warrant. And with a warrant they can monitor you wherever. Doing the kind of crap you are doing makes you a likely target for governmnet snooping. So don't come whining to me whne ya find a keylogger on your machine.... buried inside your keyboard controller chip.

Re:ssh tunnelling + squid

[nxtw]

Exactly what are you hoping to accomplish by going to all of that bother? Your last mile ISP can't monitor you but the hosting company and THEIR ISP can so you have just shifted the point of attack.

Well, his traffic is flowing through a datacenter that's normally used for hosting websites, not visiting sites. Why would anyone look at outgoing traffic?

And that hosting provider might have more than one ISP.

Re:ssh tunnelling + squid

[typedef]

I did something similar to this when I lived in the dorms in college to avoid their weird and draconian anti-filesharing policies. They were pretty pissed off when they saw a large (but not excessive) amount of traffic flowing to my port, but couldn't figure out what it was.

Re:ssh tunnelling + squid

[Anonymous Coward]

ssh -D ftw.

Re:ssh tunnelling + squid

[Orp]

You presume I am doing anything illegal in the first place. And if using ssh raises red flags for the gov't then they are going to be very very busy as it's really the de facto remote login protocol for all Unix machines.

My example is a case where if the AUP of the colo company explicitly states that they do not monitor traffic, and your ISP for the last mile does, you can avoid your ISP's deep packet sniffing.

Re:ssh tunnelling + squid

[mpeg4codec]

A combination of ssh -D with proxychains makes life pretty damn nice, especially on wireless nets.

Re:ssh tunnelling + squid

[Anonymous Coward]

I remember that there are companies in Sweden that provide essentially that service

Re:ssh tunnelling + squid

[elucido]

The government snoops on everyone. Being more or less of a target doesn't make any difference to a government who watches every living thing.

Re:ssh tunnelling + squid

[Anonymous Coward]

Tor's main goal is to provide anonimity, which Ssh does not provide. If everyone would use ssh, you'd still know who connects to what server.

Re:ssh tunnelling + squid

[tux_attack]

Yup, one of the companies is called Relakks except they use a vpn not ssh.

Re:ssh tunnelling + squid

[Anonymous Coward]

Try this:

ssh -D 127.0.0.1:8888 you@your.host.com

Then point your browser @ port 8888/tcp and set it for socks5. No additional software required on the server side.

More Encrypted Webpages

[nurb432]

If everyone offered https, ( or only ) and all email is encrypted then this would become a moot point really quick.

All they would know then is where you went, not what you did. ( Tho in this country, just going there is enough to get you put in jail it seems )

Or we can all move to freenet and really stick it to them.

Re:More Encrypted Webpages

[Anonymous Coward]

But who's going to pay for it?

Re:More Encrypted Webpages

[nurb432]

The same people that pay now. The advertisers.

History Repeats Again

[Anonymous Coward]

There is no way this can go horribly wrong.

install Firefox and this

[FudRucker]

https://addons.mozilla.org/en-US/firefox/addon/1865

Torproject.org

[Anonymous Coward]

Tor is great, don't masturbate without it!

Re:Torproject.org

[nurb432]

Freenet adds another layer of security, for when they come for your data.

There should be a law

[nysus]

It's illegal for anyone to open mail not intended for them. The same should be done for electronic communication.

And if I hear one libertarian say we need less laws, I'll puke. It's as if they though they had a magic wand and all the troubles of the world would disappear by removing government. Unfortunately, the world hasn't worked that way since we left the caves 12,000 years ago.

Re:There should be a law

[Tynin]

In that case, try to hold your lunch in. Are you expecting our current 1 party government to actually have the insight and knowledge to make a decent law? Especially a law that protects the interest of the citizen and not business? That is the problem with law, especially American law with its case law and precedence. We keep hoping that the law will be just, yet most of all we get are half baked bandaid crap that in turn allows for even worse laws down the road thanks to precedence.

That all said, I do not have an answer for how to make good laws, as that would require our government to actually read, and comprehend what laws they pass... not just rubber stamping everything through. Until everyone that is passing these laws bother to read, how can we trust in the law?

Re:There should be a law

[nurb432]

We *do* need fewer laws. However, the ones that remain need to be effective and of value, and actually enforced.

The law to protect your right to privacy already exists, it just needs to be enforced. Creating more laws doesn't help with lack of enforcement of what is already there.

Re:There should be a law

[Anonymous Coward]

And if I hear one libertarian say we need less laws, I'll puke.

Pesky semantics....

While it may be true that the actual raw number of laws presently on the books is huge and unwieldy, and while it may be true that the removal of many of those laws would actually bring a good deal of efficiency while also eliminating some loopholes that are routinely exploited to the detriment of the majority, and while it may be true that a common knee-jerk response to any kind of exploitive behavior is to cry "pass a law that says you can't" even which there is actually no feasible way to construct or enforce a law that will accomplish that.....while all these things may be true...

Sometimes, it is also true that in this specific circumstance, a new law is actually feasible, beneficial, and totally warranted.

While I don't have a problem with far-reaching statements like "we need fewer laws," I DO have a problem with the thoughtless application of such statements to all circumstances equally. Not all circumstances are equal, and they must each be intelligently judged, on a case-by-case basis.

I hope I didn't make you puke.

Re:There should be a law

[chunk08]

Brilliant post! The problem, though, is that the citizens will not stand up for their rights, because our current culture is taught to depend on the government to fix all of the problems. If citizens were to take a stand on the issue, government and corporations would see that it is not in their best interest to continue these practices. What needs to happen is (as has previously been posted) citizens encrypting their communications and taking other steps (Tor, Freenet, etc.) to prevent snooping, government, corporate, or otherwise.
Liberty and capitalism don't solve problems, they just give us an opportunity to. That's why less government is good.

Re:There should be a law

[debatem1]

Laws are not static things. They get interpreted, and they get implemented, and in the course of either process bad things can happen to even the best of ideas. The 'laws' regarding privacy in the states are a joke anymore, having been effectively interpreted into oblivion, and bounded on all sides by public safety measures designed to countermand what should have been basic rights. We do not need more useless laws, or more laws restricting our rights, that much we agree on; but to say that we don't need any more privacy laws (or constitutional amendments) does nothing but allow conflicting laws precedence.

Re:There should be a law

[phantomcircuit]

It's illegal for anyone to open mail not intended for them. The same should be done for electronic communication.

And if I hear one libertarian say we need less laws, I'll puke. It's as if they though they had a magic wand and all the troubles of the world would disappear by removing government. Unfortunately, the world hasn't worked that way since we left the caves 12,000 years ago. In fact it is already illegal to open USPS mail not intended for you. It's a federal crime. The problem is that the laws of the real world that have been in place and working for a very long time have not yet been interpreted to apply on the internet. I fail to see the difference between physical mail and electronic mail.

Re:There should be a law

[corsec67]

It is just like all of the new patents related to the internet and computers:

Laws are different when it is "on the internet", or "using a computer"

Reading mail not intended for you isn't a problem, "on the internet"

I agree with you that it shouldn't be like that at all, though.

Re:There should be a law

[dstates]

What ever happened to "A government of the people, by the people and for the people"? Get involved, and stay involved. As Adlai Stevenson (who??) said, "In a democracy, people get the government they deserve."

Re:There should be a law

[Anonymous Coward]

It's illegal for anyone to open mail not intended for them. The same should be done for electronic communication.

It already has been; at least, I don't know about in the USA, but certainly in that terrible police state of Great Britain, it is illegal to intercept electronic communications over public or private telecommunications systems unless you have specific legal authority to do so.

Amusingly enough, the legislation that provides us with this privacy protection is the much-reviled RIPA, which is the one that has that crazy clause that makes it illegal to forget your passwords if the police want to know them. (Has anyone tried to enforce that bit yet?)

Re:There should be a law

[Salgat]

As long as the right to privacy is considered a fundamental right, the 9th amendment will protect us, which means libertarian philosophy doesn't interfere with our right to privacy.

Re:There should be a law

[Anonymous Coward]

What ever happened to "A government of the people, by the people and for the people"?

It was a myth. It never existed.

Up until the 20th century, participation was restricted to that part of the people who happened to be white and male, and by the time it was extended to women and blacks, the big corporations and lobbies had arrived on the scene and started buying politicians.

Maybe one day we will manage to create such a government, but nobody has ever managed it in the entire history of human civilization, so let's just say I'm not holding my breath. What we can do is exploit the system we've got: join and fund our own lobby groups like the EFF, vote for the least corrupt people we can find, participate, participate, participate. The government won't work for us, whatever we do, but we can hope to mitigate the badness to some extent, and the more of us who fight, the more battles we'll win.

Re:There should be a law

[Anonymous Coward]

I would agree with those Libertarians that there should be less laws. I mainly say this because most laws protect these companies when they pull shit like this. The point is that the laws we have are not effective in protecting people's rights. We really should only have one law: "Do on to others what you want done on to you" all problems solved if you could enforce it.

Re:There should be a law

[David.R.Benham]

Let the puking commence.

Libertarians don't support anarchy, they advocate smaller government that doesn't overreach it's constitutionally defined boundaries.

That being said, there is probably no reason to have a government mandated solution for this. And it would be wise to see if existing laws already address this issue. If not, then MAYBE a new law is needed, but only as a last resort.

But all too often the new law is the first and only solution. Oh how would we survive a day without the government babysitters?

Re:There should be a law

[tux_attack]

I wish.

NOT like google...

[danep]

"Dykes noted that by a couple of measures, their system may protect privacy more than such well-known companies as Google."

If I'm searching for something that I'd rather not have permanently stored on [Google's || my ISP's] servers I can always just log out, or go to another [search engine || ISP].

That sentence only makes sense one way. DPI is absolutely nothing like how Google operates. At least what Google does (storing search histories, etc) actually provides a service to the user...

How are they to deliver targeted advertising?

[Skapare]

If these are the ISPs (as opposed to the visited web sites) doing the spying, then how are the advertising companies involved supposed to deliver the content? Are they going to use the same "deep packet" method to inject the advertising? If the advertising delivery is away from that deep packet inspection, then how do they identify which user was interested in penis enlargement products vs. which user was interested in replica watches? Or are the ISPs going to lock-in the IP address, now?

Re:How are they to deliver targeted advertising?

[jmorris42]

> If these are the ISPs (as opposed to the visited web sites) doing
> the spying, then how are the advertising companies involved supposed
> to deliver the content?

Because the visited web sites already aren't the ones delivering the advertising. You go to CNN.com and view a page. The ads come from an outside site. That site partners with your ISP. They toss a packet with the IP and perhaps other info (like browser info so the ISP can determine which PC behind the home NAT is making the request and map that to a 'user number or email identity') and returns it. The ad server examines the previous history for that identity and the page being requested and picks an appropriate ad. And it all happens behind the scenes in the page load delay. Frightened yet?

Re:How are they to deliver targeted advertising?

[rastoboy29]

It would have great value just for the demographic research and usage patterns.  That's probably what they're after--at this time.

Re:How are they to deliver targeted advertising?

[Skapare]

Frightened ... maybe. If CNN is making reference to them so their ads show up in the CNN page, then at least one of my worries is gone (that being they would inject their ads on sites not making money from them, such as substituting an entire image for some image ad request that should go to the user requested site).

That they collect the info about me outside of the scope of web sites I choose to visit based on agreements between those sites and the advertisers that aggregate the data from among many web sites, is still the big concern. I don't have much concern about the web sites themselves doing it because I can always choose to avoid them if I think they are doing something bad (or, rather, they have to decide if too many people will avoid them in their decision to do it or not).

I'm behind on upgrading my Firefox version, so I don't know if they've added such security features. But one thing I think would be useful is a proximity test on objects (images, stylesheets, javascript, etc) referenced by a given page. The proximity test is a bit complex but works like this. Get the IP address of the main page HTML server. Get the IP address of the server delivering the referenced object. If they are the same, don't worry. If they are in the same /24 subnet, don't worry much. If they are not in the same subnet, then lookup up the NS record (not the PTR record) of the IN-ADDR.ARPA equivalent for each IP. If the NS records are the same, don't worry too much. If they are different, suppress the object. But this is more of an ad blocker.

Ultimately we need a spy blocker. That's where HTTPS and IPsec can come in handy. I just need to figure out how to enabled IPsec in such a way that anyone can communicate either way at their choice.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Inspect this!

[Wowsers]

My old ISP rolled out "deep packet inspection" in an attempt to throttle user bandwidth on ports they didn't like (including VoIP to push their own VoIP solution), they were very proud of their achievement. I was also very proud of my achievement by leaving them for a company that gives me what I pay for, not throttling ports "to enhance my user experience".

The only way to teach these companies a lesson is where possible, leave them for another company, money (and subscribers) talk, and a lack of subscribers hurts them.

Re:Inspect this!

[corsec67]

Kind of hard to teach a company a lesson by leaving them when they are a monopoly.

Many people have exactly 2 options for ISPs: Cable and DSL.

What if both are evil? How do I switch to a better company in that case?

(My solution is to have the ISP/content provider be legally prevented from having a share of the "last-mile" stuff, so that you can have competition in the ISP space, and then last-mile provider has many requirements, like no filtering of any kind, upgrades every so often, a specified maximum fee structure, etc.)

I think this has another unintended consequence

[jskline]

Fact is that if there is packet inspection going on, this is slowing down traffic on that one connection. Imagine now that there is many users traffic who is being "scanned", redirected or filtered, et al.

Now; has anyone else noticed that the net is getting slower and slower recently?? We already know that sites such as FoxNews.com and other similar types, have special applets that download and attempt to arrange items on the page so that you are forced to see specific adds for a specific period of time before the rest of the page; including the intended content shows into view!

There are other sites that are beginning to "fiddle" with flash ads and present them in a way that you are unable to avoid them. This is getting to be quite annoying.

Time for those magical host lists again!!

Re:I think this has another unintended consequence

[Thing 1]

Time for those magical host lists again!!

I love synchronicity. I read "real" news at the Excite portal, and "tech" news here. Lately Excite has put interstitial ads in their pages, so you have to "Click here to skip this ad." Once you do so, though, the Back button is still disabled so you can't get back to the ad (which I sometimes want to, so pity for the idiot who architected this).

The issue is that sometimes due to this, a page will sit there spinning and no more pages will load. To "fix" this I need to open a command prompt, "ping google.com", and wait for it to start responding (usually by the second or third attempt; rarely do I need to run the ping twice -- this is on Windows XP SP2, Seamonkey 1.1.8).

Then I need to reload all the pages that failed (I open news stories in separate tabs by middle-clicking the headlines, so then I can read and close the tabs at my leisure). This was taking too long today, and I noticed "adbright.com" in the status bar, so I added that to my hosts file: "127.0.0.1 adbright.com" -- and, that is the only other entry than localhost, so this was a significant pain point to push me to this.

Now, Excite pages loads rather quickly. Those interstitial ads are still there, but at least my connection isn't getting clogged up by their turds.

Every ISP has spy tools - it can help non-hackers

[Anonymous Coward]

And ones that don't are horrible -- unless you'd like to administer the entire network yourself...

Plus it keeps the cops from coming up with excuses to break into my house to collect evidence (ideas they can afford to patent or register before I can) more than once a week.

BTW -- if you're wondering who your main competition will be when you enter the workforce... you may be a genius or subgenius, but your competion has police and military contacts any knows everything you do, and basic security to prevent this costs $1 million dollars.

Listening in? Um, yeah.

[Perp Atuitie]

Critics liken it to a phone company listening in on conversations.

Um, my ISP IS my phone company. If they can get away with reading my emails and stuff like this comment, what's to stop them from listening to my phone calls? We're really at a crossroads: either the law makes ISPs common carriers with no interest in, or control over, content like a real phone company, or we lose most of the potential of the communications tech revolution.

Re:Listening in? Um, yeah.

[mapkinase]

Technically, it is more difficult to parse out possible ad targets from the content of your phone calls. The information of where you are calling and when might be the only thing that is more or less useful for their evil advertising schemes.

Re:Listening in? Um, yeah.

[Reziac]

I was just wondering something like that myself: at what point does this sort of datamining overstep privacy to the point that it revokes common carrier status??

Also, AOL's little fiasco proved that you CAN identify individuals through their searches... what's to prevent this from being used similarly?

I also have to wonder about what if the ISP is "clean" but their backbone is datamining??

Re:Listening in? Um, yeah.

[Anonymous Coward]

Actually, we CAN listen to your phone calls. I used to do that straight from the switch when I was working as a Telco field engineer. I even recorded the conversations of one of my ex-girlfriends. If I can do that, just for being a psycho-stalker, think about what I can do if I have a memo telling me to do so...

Re:Listening in? Um, yeah.

[argent]

If they can get away with reading my emails and stuff like this comment, what's to stop them from listening to my phone calls?

Apart from the law, the fact that speech recognition is a much harder problem?

Critics?

[baffled]

How can the article summary call defenders of our privacy critics? People who stand up for our privacy are critics? OP has a strange point of view..

Re:Critics?

[dstates]

Point taken, I was quoting from the Washington Post text and should have modified this.

Communications privacy is a serious issue. Write to your congressman and senators and tell them that this matters.

Comment removed

[account_deleted]

Comment removed based on user account deletion

because every website has https support

[Anonymous Coward]

Please. The AC's don't even try anymore. :(

What's the difference

[Ernesto Alvarez]

The difference is that in the first case, the data passes through a dumb machine that compresses, caches, etc. The result is cached like it is expected (RFC 2616 is pretty clear about that), even though it is done transparently. No need to keep logs about who downloaded what.

In this case, the data is explicitly mined, by a company interested in building a profile of each user. It doesn't say it is limited to web traffic only, only that "Nor does NebuAd record a user's visits to pornography or gaming sites or a user's interests in sensitive subjects -- such as bankruptcy or a medical condition such as AIDS.", which I doubt both on technical grounds and because it is a market and someone will want to take advantage and "The company said it processes but does not look into packets of information that include e-mail or pictures." which I think is in contradiction with other parts of the article and even if they didn't, it's a matter of time before they do.

Basically, it's the intent that counts. The ISP can intercept everything they want because they're in the middle. When they start doing so for reasons that are not part of maintaining the communications as specified (like forwarding, maybe firewalling and proxying depending on the conditions), alarms should go off.

Re:What's the difference

[Gothmolly]

If you don't think that they were doing it before, then I have a bridge to sell you in Brooklyn.

Re:What's the difference

[NeverVotedBush]

An ISP is essentially a system administrator. As such, one of the basic tenets of being a system administrator is to respect users (i.e. customers) privacy.

And regarding Gothmolly's reply, I know one of two guys that started their own ISP and also an internet cafe. They eventually broke up the relationship because the guy that I didn't know (but was told about) had a habit of reading his customer's e-mail and also piggybacking on their browsing to watch what they were looking up. It didn't take long for him to find a few people that gave him lots of voyeuristic enjoyment. The guy I knew thought it was immoral and pulled out of the company. As far as I know, this other guy is still doing it.

But I'd still rather have some sick maladjusted fuck reading my e-mail and watching what I do than have companies and governments doing it. Sure, in a perfect world you wouldn't have to worry about any of it, but I guess this is just our reality now.

Encryption?

[ameline]

I expect that they will combine this snooping with throttling of all encrypted (or otherwise random) looking packets.

Re:Encryption?

[Dan541]

If encryption becomes widespread. Who's is going to go with a slow ISP?

~Dan

Re:Track this!

[buravirgil]

that rabbit might take your head off
i know a lapland tale about a hole where women
got dropped off...turned my stomach a little
but i don't know, maybe the story will keep

and never repeat if the tale is told of what
fools of old kept their King a fold and a
narrative hit the street

Up to 2 years imprisonment

[gweihir]

If you do this in the EU. Packet pauyloads are off-limits without court order. You may not even store them.

Re:Up to 2 years imprisonment

[yuna49]

From TFA:
In England, Phorm is expected in the coming weeks to launch its monitoring service with BT, Britain's largest Internet broadband provider.

Last I heard the United Kingdom was a member of the European Union. Perhaps BT's attorneys have a different interpretation of the laws than you?

Re:Up to 2 years imprisonment

[Anonymous Coward]

The United Kingdom has requested a special exception regarding this law, and has been granted it.

Re:Up to 2 years imprisonment

[Stevecrox]

Phorm argues it doesn't break the law because they offer an "opt out" clause and so isn't effected by the RIPA act. BT's trial last year of Phorm against 10,000 users is being investigated as potentially illegal as users wern't given the chance to opt out. It should be a easily won case since BT by supplying 121media and not asking if they can share this information have broken the Data Protection Act. BT maintains plans to implement Phorm with the ability to opt out (through a cookie on your PC.)

I've already sent a letter to my service provider (virgin media) informing them I want no part of Phorm and if they implement it (which they are considering) I will be prosecuting them under the Data Protection Act. I suggest all BT, Talk Talk and Virgin Media users do the same.

The Data Protection Act in the UK is the best defense against this sort of thing, it defines how companies my handle personal data, the right a person has to that data and what responsibilities the organisations have with it. The biggest problem with it tends to be phone operators who've never read it trying to tell you the section you read to them is wrong.

I believe someone is trying to prosecute Facebook because they were unable to remove their information from Facebook (when you leave a service you have a right to have all information on a companies database to be deleted) If I were to go into a police station and demand all the CCTV footage they have on me they would have to supply it (my right to see) finally if I don't agree that companies can share my information with 3rd parties then they aren't allowed to share it full stop if they do you can prosecute.

121Media argue phorm doesn't violate the Data Protection Act because you are visiting public websites (it being akin to walking along a public highway and so no right to privacy) Hopefully the Information Commisson won't see it that way and will enforce the view that sending unencrypted http packets through port 80 is the same as making a phone call and so falls under the same protections.

Re:Up to 2 years imprisonment

[yuna49]

Thanks for that excellent reply! I'd mod you up if I could.

Re:Up to 2 years imprisonment

[Inda]

Nothing has angered me more in recent years than this Phorm spyware that I seem to have no choice in using. I think an easily corruptible text file (cookie) downloaded from www.webwise.com as means of opting-out is far from ideal.

I too have complained to Virgin Media about their lack of communication regarding Phorm. I await their reply after the weekend. I have a deep suspicion they'll eventually let me know through my old NTL email address that I haven't used in years...

The DPA is an excellent tool to use. I recently used it to get my account deleted on William Hill. I gave them 30 days to delete the account, warning them that if I received emails, or was able to log into my account, I would prosecute them for non-compliance. After this threat, it took less than two days for account deletion. I will use the threat of the DPA for many, many things in the future.

I think a new FireFox addon that poisons Phorm's database will be in order. I'll happily leave it running 24/7. I do not believe they will honour an opt-out cookie.

Re:Up to 2 years imprisonment

[kwark]

What law? The EU mandates monitoring and storing of all kinds of data. It grants the right, with consent (the small print in your contract), to use this data for marketing purposes:
  http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32006L0024:EN:NOT

"(3) Articles 5, 6 and 9 of Directive 2002/58/EC lay down the rules applicable to the processing by network and service providers of traffic and location data generated by using electronic communications services. Such data must be erased or made anonymous when no longer needed for the purpose of the transmission of a communication, except for the data necessary for billing or interconnection payments. Subject to consent, certain data may also be processed for marketing purposes and the provision of value-added services."

Re:Up to 2 years imprisonment

[gweihir]

You are looking in the wrong place. Look to the national versions of the data privacy )or the like) acts. There are no "EU laws", just guidelined for the national laws.

There is some disputa about location data and usage data. Also it is currently unclear in Germany, e.g., whether storing IP addresses in your webserver logs is legal or not. (My take is that if somebody sens a packet to you, it has shared ownership, and you can store and analyse it in full. There may be limits on what you can do with the information.)

Re:Up to 2 years imprisonment

[datatrash]

Tim Berners-Lee has come out against this, saying he would change providers. I am very glad he said what he said, and his, among other voices got Phorm backtracking and spinning on what they were doing in the UK. The problem I think is, particularly in the US (where Phorm said they were in discussions with various ISPs) is when it becomes a common practice and it doesn't matter if you switch providers because they use a similar model.

It is definitely the time to put the pressure on ISPs, govt, whomever to let them know this is not acceptable. Further, I really like Berners-Lee saying saying that his data and web history belonged to him.

Regular postal mail...

[NotQuiteReal]

After all, your ISP knows your street address.

Search for info on heartburn... get some post cards advertising the latest antacid. Search for info about Lasik eye surgery... gee handy flyers about your local providers appear.

You get the idea. If I were selling a service and an ISP offered to sell me names and addresses based on keyword searches, why wouldn't I buy that list?

"Customer revolt"

[frdmfghtr]

FTA:

For all its promise, however, the service providers exploring and testing such services have largely kept quiet -- "for fear of customer revolt," according to one executive involved.

Guess what pal..the word is now out.

Ever get the feeling the the Internet just isn't worth it anymore?

Re:"Customer revolt"

[Anonymous Coward]

I hope this get reposted in every blog aggregator,newssite and blog.
NSA doesn't get away with it.

Re:"Customer revolt"

[Inda]

Was it ever worth it? Maybe the homepages of 1997 were worth it...

Re:"Customer revolt"

[Anonymous Coward]

Ever get the feeling the the Internet just isn't worth it anymore?

Yes, the Internet is completely not worth it. I'm canceling my connection right now. Seriously, what has the Internet ever done for me?

no, encryption is not the answer

[Briden]

standing up for our rights is the answer. unfortunately, corporations listen only to once voice, money, so hit them where it hurts.

Cancel your internet, refuse to pay your bills... boohoo, then you won't have internet? you won't have internet anyway, if they get their way.

Re:no, encryption is not the answer

[dstates]

Do not just kvetch on Slashdot. Communications privacy is a serious issue for a democratic society. Write to your congressman and your senators and tell them that this matters to you.

Re:no, encryption is not the answer

[Anonymous Coward]

Just to clarify...

You're saying that in order ot remain free, the government should create another restriction^Wlaw?

Re:no, encryption is not the answer

[Anonymous Coward]

Give the man a cigar!

After you put market pressure on your ISP in favor of privacy, why not put some legislative pressure on 'em too? It should be *fricking illegal* for an ISP to spy on their customers' communications.

Why not spider the web?

[budgenator]

You think these guys don't like BitTorrent, wait until everyone starts a process to spider the web to obfuscate where the fleshies are really browsing at and run that 24/7 to overload their deep-packet inspection devices.

Re:Why not spider the web?

[PopeRatzo]

Strong Encryption. That's what we all need.

The second amendment gives us all the right to the strongest encryption we can get our hands on.

Re:Why not spider the web?

[CrazedWalrus]

Are you kidding? There's a LARGE number of people that don't even think it guarantees the right to firearms, which it specifically mentions, let alone cryptography, which it doesn't.

This, spoken as a believer in the individual right to firearms. I agree with you, but I think it'll be a hard sell.

Re:Why not spider the web?

[Ortega-Starfire]

The US Government has (or at least had) classified cryptographic programs as a munition at one point, so technically, yes, second amendment would apply. :)

Re:Why not spider the web?

[budgenator]

Many people are going to argue that the "well regulated militia" applies to the Regular Military and the National Guard rather than the traditional popular ad hoc militia that Military personal appreciate from watching our backs and families at home while we are off and about.

Re:Why not spider the web?

[mabhatter654]

it regulates ARMS, not fire arms... that includes billy clubs, nun-chucks, swords, daggers, bowstaffs, BODY ARMOR etc. 90% of concealed weapons laws violate the right to bear a weapon... but it's not a gun so nobody cares.

Re:Why not spider the web?

[mabhatter654]

The militia is of the STATES, so National Guard does not apply. In fact National Guard would generally be illegal as Quartering troops because the State Governors do not have control over their troops. The Army does not have legal right to operate in the States unless specifically asked by the state.

They knew exactly what they were writing. The frontier was subject to constant "terrorist" attacks from indians and french at the time. The British had specifically forbidden the smaller villages from maintaining arms caches to defend against attacks in the middle of the night. Instead they demanded British troops be stationed in people's homes ruled only by the crown and not by Colony or local rules. It was the right of you and your neighbors to defend yourselves without "asking permission" from any government and without reprisal for doing so. Note that Britain as basiclly out lawed self defense even in your own home today. Even if your daughter is being raped, in your home, you can be brought to charges for having any kind of weapon used to defend her if the attackers die.

Re:Why not spider the web?

[sjames]

Many people are going to argue that the "well regulated militia" applies to the Regular Military and the National Guard rather than the traditional popular ad hoc militia that Military personal appreciate from watching our backs and families at home while we are off and about.

They might argue that, but they would be wrong. In the language of the time, the 'militia' consisted of every able bodied citizen with a rifle. 'Well regulated' meant that they were sufficiently practised and (self) trained to mount an effective defense.

So, citizens ready, willing, and able to mount a defense are necesary to the security of a free stat, and so, they must have the right to keep and bear arms. That is, to not just own weapons, but to carry them.

Re:Why not spider the web?

[meringuoid]

Note that Britain as basiclly out lawed self defense even in your own home today. Even if your daughter is being raped, in your home, you can be brought to charges for having any kind of weapon used to defend her if the attackers die.

Citation needed. You're entitled to use reasonable force against an attacker in situations such as this. If for instance an intruder is attacking a family member, and you bash him over the head with some heavy blunt instrument, you're unlikely to be charged even if he later dies of the injury you dealt him.

If on the other hand an intruder has finished attacking a family member, and he leaves, and you pursue him down the street and beat him to death in revenge, you'll rightly be up on murder charges. Shooting intruders in the back while they're fleeing is also frowned upon, as is the practice of filling your house and grounds with booby-traps in expectation of intruders.

A great many specific weapons are illegal in the UK, but the principle of self-defence remains very much in force.

Re:Why not spider the web?

[budgenator]

The National Guard is primarily under State control routinely the National Guard is Federalized for 15 day out of the training year, and the command structure is usually organized so that combat arms units have their major commands in a stationed neighboring state this is in return for significant funding and equipment. The downside is during periods like the current military operation in Iraq the National Guard has insufficient resources to maintain their State missions.

Re:Why not spider the web?

[PopeRatzo]

'Well regulated' meant that they were sufficiently practised and (self) trained to mount an effective defense.

In what language does "well regulated" mean "self-trained"?

You had me up to there. In fact, I'm not even sure that "bear arms" means "carry a concealed Glock".

But if the gun nuts are going to claim that the 2nd amendment gives them the right to conceal/carry, I'm claiming that it gives me the right to strong 'crypto.

Re:Why not spider the web?

[sjames]

In what language does "well regulated" mean "self-trained"?

Self was in parenthesis because it is not necessary to the meaning but is not excluded either. While we wouldn't normally use the term regulated inthat sense today, it was actually common at one time. As in adjusted to function properly or accurately. English changes over the centuries.

Carrying arms doesn't necessarily mean carry a concealed Glock, but I'm sure you knew that.

As for strong crypto, the first or fourth amendment may be stronger arguments, but in any event, I fully support your (and my) right to strong crypto.

Btw. is your ISP Knology?

[xpiotr]

One name comes to mind after RTA: Anthony Palermo. ""I don't view it as violating any privacy data at all," said Anthony Palermo, vice present of marketing at Knology." 1. Find his adress 2. Intercept his snailmail (which later is returned). 3. Scan it and post it to our small group of Slashdotters. 4. Ask him if he thinks that this is a violation of his privacy? 5. ?? 6. Profit!

Re:Btw. is your ISP Knology?

[Shakrai]

1. Find his adress 2. Intercept his snailmail (which later is returned). 3. Scan it and post it to our small group of Slashdotters. 4. Ask him if he thinks that this is a violation of his privacy? 5. ?? 6. Profit!

7. Go directly to Federal-pound-me-in-the-ass-prison for postal fraud. Do not pass go, do not collect $200.

Seriously, if the USPS, UPS or Fedex started doing this can you imagine the outrage? Yet somehow it's ok to do it with electronic communications? WTF?

Re:Btw. is your ISP Knology?

[blhack]

Fedex and UPS DO do this.

Its not like there is somebody at Qwsest sitting there reading each and every one of my emails, rather they're searching through it looking for things that look suspicious. Its the same thing that couriers do looking for people shipping drugs around.

Don't get me wrong, I think its asinine, just pointing out that its not something that is exclusive to the internets.

Re:Btw. is your ISP Knology?

[Shakrai]

Fedex and UPS DO do this.

Fedex and UPS open your packages to look at what you are shipping so they can sell that data to advertisers?

rather they're searching through it looking for things that look suspicious

Did you even bother to RTFA? Wait, dumb question around here. This has nothing to do with looking for 'suspicious activity'. The ISPs in question are allowing third-party companies to build profiles of their users by spying on their traffic in order to do targeted advertising.

Re:Btw. is your ISP Knology?

[Anonymous Coward]

Just how confident are you that USPS isn't inspecting your mail? Perhaps they've got some non-invasive scanners that can read mail through envelopes. Remember, this administration has already likened electronic wiretaps to measures taken by historical administrations to intercept domestic communications... in other words, the postal system. I'd almost be more surprised if they weren't doing routine surveillance of postal traffic. The only reason not to is because nobody really communicates by letter except for special occasions any more.

Re:Btw. is your ISP Knology?

[budgenator]

I don't believe that the information on the outside of an envelope is private date, it's public because it's necessary for routing the mail and by nature it's public; going into someone's mailbox is very probably a crime or at least hideously rude behavior.

Re:Btw. is your ISP Knology?

[Shakrai]

I don't believe that the information on the outside of an envelope is private date, it's public because it's necessary for routing the mail and by nature it's public; going into someone's mailbox is very probably a crime or at least hideously rude behavior.

If all they were basing this marketing system off was the 'envelope' (i.e: the IP Addresses and/or ports that you communicate with) then I wouldn't be concerned about it. I'd be annoyed, but not concerned per say.

That's not what they are doing though. They are doing deep packet inspection. Not only do they know you are communicating with Slashdot.org, they know what stories you are reading or what comments (even AC) you are posting. And all of this information is used to compile a profile for you that is then used to target ads.

Even if you are in the small minority of people that wouldn't have a problem with that, don't you see how wrong it is of them to do this? Without even notifying their users in any meaningful way?

bah

[Sicnarf]

Shame on them ISPs. Makes me wanna signup to proxify, so that I can opt out of the ridiculous eavesdropping that's taking place. incase consumers don't know, here are some tools to protect yourself:

Scroogle with HTTPS, -> i use this as my primary interface for searching on google, since your search queries reveal alot of personal information and gets used for marketing purposes. :(

Tor Anonymity Network, with Firefox plugin to quickly enable/disable anonymous browsing.

Proxify with HTTPS, although for advanced stuff they want you to signup to their service :(

Last but not least: GnuPG, for encrypting your private data.

Enough!

[iamacat]

Time has shown that nobody will protect your privacy besides yourself. It's time for ALL Internet traffic and ALL phone traffic to be encrypted with an option to get SSL keys for each machine or phone from trusted authorities in different countries. This way a particular person asserting privacy is not labeled a terrorist, Comcast can not selectively block bittorrent, Chinese firewall is out of business and phone companies do not need immunity for spying on subscribers. IPV6 will have to be adopted anyway in the next 10 years and it included encryption, so the time is right to make both switches at once with little extra IT overhead.

Re:Enough!

[old and new again]

problem is that BELL throttles all encrypted traffic so using encryption doesnt work at the moment the only way is to use port 80 to torrent on untill they do the DPI on this port and annoys ALL clients

Re:Enough!

[iamacat]

How do they distinguish encrypted traffic from an ordinary download of a zip or a jpeg?

Re:Enough!

[Anonymous Coward]

Just look at the first data packet ... ZIP/JPG/GIF all have known 'signatures' in the first few bytes.

Re:Enough!

[iamacat]

If anyone here doesn't understand an obvious workaround, or how the workaround can be fine tuned to get around any given filtering system, please let me know and I will be happy to explain.

Re:Enough!

[old and new again]

How do they distinguish encrypted traffic from an ordinary download of a zip or a jpeg? they use DPI to look into the packets for the application identifier

Encrypt everything!

[IGnatius T Foobar]

The government may have the resources to break strong encryption in real time, but even the largest ISP's do not. So maybe now the FreeS/WAN project no longer sound like tinfoil-hatted paranoiacs when they push opportunistic encryption at every node. Everything gets encrypted automatically and transparently when talking between two OE nodes, regardless of the protocol.

This was their goal, but hostility and forking ensued when most people really wanted to just have an IPsec implementation on Linux. OE is still a good idea, though, and that's what they're focusing on now.

The obvious design win would be if Linksys and Netgear built OE into their consumer grade firewall/routers. Then everyone would have it, not even know it, and when large site operators started deploying it on their network edges, massive amounts of crypto would start traversing the Internet, and no one would be bothered by it.

That's really the key to good system design: add complexity, but don't bother the end user -- it's not his problem.

Re:Encrypt everything!

[Skapare]

I've experiemented with IPsec. One problem I find is that I have to choose a policy per IP (I can make that be for all IPs, or select IPs, of course). So far, I have been unable to make an IPsec configuration that merely allows the peers to decide if they want to use IPsec or not.

The idea is to make a transitional web server. Anyone who does not have IPsec install, enabled, configured, or determined for this web server IP, can still access the web sites therein in the usual unencrypted way. However, anyone who does have IPsec set up to force encryption, that will work, too, and all their traffic will then be encrypted.

Only after a sufficiently large number of people are doing IPsec voluntarily, then I can set the web server to require IPsec for all. And maybe this step isn't even needed.

Re:Encrypt everything!

[Anonymous Coward]

that merely allows the peers to decide if they want to use IPsec or not.

Well, that's the point of opportunistic encryption. If the peers support ipsec (and the listening side has the appropriate implementation details taken care of, typically a public key in its dns record), it'll encrypt, otherwise it won't.

ISPS ARE NOT COMMON CARRIERS

[oyenstikker]

and they never have been.

Come on, overreaction

[DamienRBlack]

The companies don't use this for targeted per-person adversing. They use the general metrics to figure out what adword to pay more for, or what sites get more conversion, or what spelling error are most common in searches. Stuff that could help them do SEO type things. Yes, they are probably shady types trying to weasel google and other to giving them a higher rating than they deserve, but not THAT shady.

Re:Come on, overreaction

[Guido von Guido]

Sure, they don't use it for targeted advertising. Do you think that's because of ethical concerns, or because of technical limitations? Do you imagine that they'll always resist the urge to send their customers targeted advertising?

As an aside, I'm well aware that there are benign uses for this sort of technology. For instance, we had a customer that installed some kind of deep packet monitoring app to monitor and troubleshoot customer application issues on their web site (which were costing them a bundle). I can't think of any additional privacy issues there, since they already knew where their customers were browsing on their site, etc. (Although perhaps I'm being naive.)

Sounds like it is time

[Kylere]

For Anonymous to target the personal information of the CEO's, CIO's and other staff of the ISP's involved.

Re:Listening in? ISPs should be "common carriers"

[dstates]

The HUGE difference is that your telephone communications are carried under "common carrier" rules. There is a legal expectation that your telephone conversations are private, that you can use your telephone to talk to anyone and that all common carriers will inter-operate. These rules were put in place because local telephone companies are government grants monopolies.

When it is acting as your ISP, your telephone company is not governed by common carrier status. USA Today has an article today pointing out that essentially all ISP service agreements give them the right to inspect your communications, alter the contract without notice, block access to sites and terminate your service at will. For example, these agreements allow and ISP to block access to competitor web sites if they feel that the site has objectionable content like claims to provide better service at lower costs.

The problem with all the "encrypt everything" posts is that encryption costs money. Why doesn't Slashdot offer? Because it would cost them a fortune to add all the server hardware needed to meet the demand.

The problem with all of the "I dropped my ISP" posts is that in most communities you have little or no choice in broad band providers, basically the cable company and the phone company. Just like local telephone companies, broad band ISPs are effectively local monopolies and should be governed by the same common carrier rules.

What is the potential harm? How would you feel if you learned that you weren't hired for a job because your name was on a list of potentially disruptive employees who read (or even worse, post to) Slashdot?

Don't just kvetch on Slashdot. Write to your congressman and senators and tell them that this is a serious issue for you.

VPN FTW

[billcopc]

Funny, while loading this page I got a "bandwidth cap warning" from my ISP, stealthily inserted into the page (Rogers Cable).

I expect nothing less from the despicable scam shop that is Rogers, but it's still kind of creepy.

For me, it's not a huge deal because I run a number of geographically diverse servers, I can VPN or proxy my traffic through any combination of them, should the need arise. Like any invasion of privacy, I'm not concerned about the marketing uses, it's the inevitable abuse that scares me, either by ISP staff sniffing passwords, or script kiddies rooting the monitoring systems (and/or the idiot sysadmin's PC).

The thing is, at this point I've given up on common sense. Things will continue to get more and more ridiculous until we reach a breaking point... the bubble will burst and there will be backlash against these invasions of privacy, but only when the common fool finally realizes their life is being tarnished by the practice.

Until then, we'll continue to be labeled as paranoids with our tinfoil hats.

Re:VPN FTW

[corsec67]

Funny, while loading this page I got a "bandwidth cap warning" from my ISP, stealthily inserted into the page (Rogers Cable).

Doesn't that violate the copyright on the page held by /.? (Rogers made a derivative of the page, and distributed that to you)

Re:VPN FTW

[billcopc]

Sure it does, if you want to be anal. Problem is, this is Canada. We're not all that big on frivolous lawsuits, because quite frankly there are better way to spend one's time than sitting in court arguing over the semantics of a few sentences written in a different century.

For the sake of argument, if Rogers adds a 300px block at the top of a page, without disrupting the rest of the content, are they really making a derivative ? Or is it independent content prepended to a separate document, akin to a Fax cover sheet ?

The bottom line is: I don't care what the judge, a couple attorneys and that nosey activist think. I've got no problem with the warning itself, I have a problem with the technical workings of snooping and modifying packets in-transit. Why don't they just fire me off an email, or even an automated phone call ? Someone went to great expense to install such a system, and I guarantee you they didn't go through all that effort just to help me control my consumption... anathema! There has to be a very real profit attached to this implementation, and that's what worries me.

NebuAd info, and a request for info

[Animats]

I just checked NebuAd's Privacy policy:

NebuAd products do collect and use the following kinds of anonymous information:

• Web pages viewed and links clicked on
• Web search terms
• The amount of time spent at some Web sites
• Response to advertisements
• System settings, such as the browser used and speed of the connection
• ZIP code or postal code

Now that's way out of line for an ISP to collect, let alone send to an ad agency.

We may be able to do something about this.

We run SiteTruth AdRater, which rates advertisers. We have a Firefox extension which displays a rating icon for each ad served. When an ad link goes by, and it's not in the browser cache, the extension contacts our server for a rating of the advertiser. So we collect, over time, a list of advertisers for various ad systems. We're not collecting data about users; we're interested in advertiser behavior. (You can read the source code for the plug-in, so there's no mystery about what we're doing.)

We're not currently tracking NebuAd, Front Porch, or Phorm ads; we've been focusing on the bigger players. It looks like we need to be tracking this behavior. If anyone can find ad links from those services, please post the ad link here, or mail it to "info@sitetruth.com". We need some examples so we can modify the plug-in to recognize them.

If we can collect sufficient information about this class of advertisers, we may publish their customer list, which would be useful for boycott purposes. Thanks.

Re:NebuAd info, and a request for info

[Anonymous Coward]

So, if ad companies are going to serve you ads anyway on the umpteen-billion sites that use ads, and there was a technology that used anonymous data to provide you with *better* ads, you would still be upset?

Personally if I'm going to be forced to see ads, I'd rather see ads I care about. I've had enough with the "get a 5,000,000$ mortgage for 5$/month" ads, I might even follow an ad if it had something relevant in it.

People already do

[mark_hill97]

its called tor.

Re:People already do

[Anonymous Coward]

As good as the Tor network is unfortunately it's awfully slow all-too-often. I appreciate the resource contributions the server operators have donated to the project though I suspect they're just too limited in what they can provide given demands on the service. I'd like to run a Tor node myself but fear for how my address might be used if I configure it as an exit node. I really do not fancy my ISP or any other party/agency investigating me through suspicion of my involvement in potentially illegal acts. As you know the system allows for anonymous activity, and it's this very anonymity that empowers people to act in ways they otherwise wouldn't.

Re:People already do

[gsarnold]

Spiderlike, sure, but IIRC Tor only obfuscates your identity from the site operator via a maze of proxies - It doesn't do anything like create an encrypted tunnel for the traffic, so eavesdroppers at the phone company can still snoop all they want.

Just sayin'.

Re:People already do

[Artuir]

You know, for all the free advertising this program has been given, it doesn't work very well. I installed the bundle and Vidalia wouldn't even let me save my port settings. Maybe it's user stupidity, but when I type valid ports in, click "save".. they shouldn't disappear the next time I look at settings.

Perhaps I just have crappy luck when it comes to OSS.

Re:People already do

[ksd1337]

You can always run Tor as a node if you open up the ports. It improves your own security, and makes the network faster.

Re:People already do

[Alereon]

Tor does NOT provide a secure or encrypted connection, it provides an ANONYMOUS connection, which is entirely different. Unless you encrypt the data you send over the network yourself, it will be sent in cleartext readable by anyone. If you don't want someone looking into your packets, sending them over Tor to bounce among a number of untrusted hosts is not a very good idea.

Re:People already do

[NeverVotedBush]

And it is already well known that various governments and government entities operate tor nodes to monitor the traffic through them.

Re:People already do

[ThisNukes4u]

It does encrypt traffic all through the Tor network, i.e. from you all the way to the last tor node on the way to the destination, but the last hop necessarily must be cleartext(unless you use something like https, which has its own pitfalls with the Tor network unfortunately).

Re:People already do

[Dan541]

The problem I have with tor is that you never know who is running the end point.

~Dan

Re:People already do

[tux_attack]

Tor just sends your traffic through other servers. I don't think that that is the statistical noise that the parent poster meant. I think he meant something like track-me-not http://mrl.nyu.edu/~dhowe/trackmenot/ which runs random searches to screw up data mining.

Re:People already do

[Anonymous Coward]

I'll give some consideration to doing that, thanks.

Re:People already do

[GiveMeAnFingAccount]

Not to advertise but I use XeroBank http://xerobank.com/ It uses OpenVPN to encrypt your network and run it through offshore servers at a couple of MB/s. Also provides offshore IMAP email accounts and some other free cool software.

Re:People already do

[budgenator]

That's almost exactly what I was thinking about, except expanded from just search queries to all HTTP requests. It would be like trying to figure out what a Googlebot is interested in.

Re:People already do

[Anonymous Coward]

Even with TOR, Traffic STILL GOES OVER THEIR NETWORK. You need full encryption from start to end, not a proxy.

Re:People already do

[Raenex]

It doesn't do anything like create an encrypted tunnel for the traffic, so eavesdroppers at the phone company can still snoop all they want. Wrong:

"Tor anonymizes the origin of your traffic, and it encrypts everything inside the Tor network, but it can't encrypt your traffic between the Tor network and its final destination. If you are communicating sensitive information, you should use as much care as you would on the normal scary Internet -- use HTTPS or other end-to-end encryption and authentication."

That's not perfect, but that's a big difference between the current situation where your ISP can track where you are going and what you are sending. Tor is good for random browsing.

For something like email, people need to start using PGP. Google is not your privacy buddy.

Just sayin'. This has gotten old.

Re:People already do

[tux_attack]

Until someone makes something that does what we want you could try Anchorun and run it in a background tab.
https://addons.mozilla.org/en-US/firefox/addon/1710

Anchorun is a lazy way to traverse the web. While you are browsing a page, click on the anchorun icon on the toolbar, and look the browser surfing by itself - loading a random link from the current page, and then another from the next page and...

Re:People already do

[budgenator]

oh yeah that is seriously cool, that's fun evewn without an ulterior motive, thanks for the pointer.

Re:People already do

[tux_attack]

Your welcome, enjoy!

Re:People already do

[Anonymous Coward]

I used to run tor because I like the fancy idea of privacy, but stopped running it after my ISP cut off my connection without warning. Apparently the spammers use tor quite heavily and my IP address was found to be a major enough source of it. So, spammers 1, privacy 0.

Deep Packet Inspection Not For Ads

[ffejie]

I have a bit of history with two large service providers in the US. While I have not been involved directly with the deep packet inspection teams, I have had direct contact with all of them and helped them design networks using this technology. The technology was never sold to upper management as a way to track our users and target ads to them. It was never intended to capture a web page hit that was directed at a specific company to see what that consumer was interested in. Instead, it was always meant to monitor users (and more importantly, user aggregates) and determine what kind of traffic they were sending.

It was, and is, always about the network profile. If they find out that 10% of the traffic on the network is VoIP traffic, they want to design the network shift this traffic to have lower latency.** If they find out that 50% of the traffic is BitTorrent, they may put rules in place around such services. In my opinion, the service providers that I have dealt with do not have the technology in place to target down to the user. Also, they do not appear to be developing this technology.

**Some can argue that providers are instinctively evil and want to destroy this traffic, but I'm not going to fight this here.

Re:Deep Packet Inspection Not For Ads

[Animats]

Instead, it was always meant to monitor users (and more importantly, user aggregates) and determine what kind of traffic they were sending.

Yeah, right. If you want aggregate information for traffic management purposes, you randomly sample one in every 100,000 packets or so and analyze those. Anybody who says they need detailed per-user data for network provisioning is lying.

Re:Deep Packet Inspection Not For Ads

[Guido von Guido]

There are clearly multiple uses for this kind of thing. When I was doing network management a few years ago for a small-medium hosting provider, we were pitched what was basically a deep packet inspection package (name long forgotten). We debated the merits of selling it as a service to our customers (i.e., using it for additional monitoring/troubleshooting of their networks and their web apps). We decided against it for a variety of reasons.

I don't think we ever considered implementing it to watch all traffic, though. We would have lost customers.

Somewhere below or above I mentioned a customer of ours who did implement something similar for the purpose of monitoring/troubleshooting their own web app (e.g., so they could reconstruct customer sessions).

Re:Deep Packet Inspection Not For Ads

[ffejie]

Absolutely. If you sample 1 in x thousand, you'll get a view as to what the network is doing. This is crucial. However, if you want to classify these packets, and mark and remark as needed to apply to your networks policy, you'll need to look at each and every packet. Additionally, you'll need to look into the payload of each packet. From there, you can mark as necessary, BitTorrent, Voice, Video, etc.

re: Absolutely! But it's too hard to configure

[King_TJ]

Where are my mod points when I need them? This is *exactly* right!

The biggest barrier to getting everyone to use encryption, though, is the relative difficulty in configuring it. For example, I'm on a Mac running OS X right now. This is generally regarded as an "easy to use" OS, and one often recommended for people's parents, relatives, etc. Nonetheless, if I want to encrypt my outgoing email using the Mail.app included with the OS, what are my options? So far, the best I can do for my OS X Leopard 10.5 version is a very buggy beta of a freeware hack that adds PGP support using a GNU PGP add-on. I tried this out the other day, and discovered it crashes or fails to properly decrypt any email containing attachments, and requires the PGP key be generated with ANOTHER GNU program I have to download and run - and it, too is a little buggy. (It added a preference pane to my control panel which promptly told me was "non functional" in my version of OS X. Nice.)

If you want things like this to *really* get used by the masses, the support needs to be included with the core applications, and generation of the public and private keys needs to be done through a "wizard" that pops up at first program launch.

I've been playing with encryption programs for at least 10 or 15 years now on computers, and STILL, it seems to be little more than an afterthought for most popular software. Why isn't this made more of a priority by developers??

Re:Slashbot hypocrisy once again

[dstates]

Some of us do not use Google mail or Google desktop search for exactly the reasons you give.

Who wins?

[edmicman]

From the article:

Advocates of deep-packet inspection see it as a boon for all involved. Advertisers can better target their pitches. Consumers will see more relevant ads. Service providers who hand over consumer data can share in advertising revenues. And Web sites can make more money from online advertising, a $20 billion industry that is growing rapidly.

So the consumers' benefit is better targeted ads? Woohoo? Sounds like the only ones who are winning are the corps and that's it.

Re:Who wins?

[Dhalka226]

The consumer benefits from less annoying ads that have nothing to do with their interests, yes. But no, their primary benefit is two steps down the line in that quote: "Web sites can make more money from online advertising." A lot of sites are supported by advertising dollars. That's the benefit to the consumer.

DPI is for QoS, not marketing

[NicolaiBSD]

Every datacom box supplier is developing DPI features for their products. The main driver is not targeted marketing, but QoS. When you're able to identify traffic on the application layer, it gives you a lot of extra options in determining how to route the traffic.
This way you can decide to route P2P traffic flows on best effort basis, but "over-the-top" video (eg. Youtube) flows you route through a higher quality connection. This improves user satisfaction.
That's the idea anyway, saying it's for targeted advertising sounds quite paranoid to me.

Re:DPI is for QoS, not marketing

[isdnip]

Worse than that. Yes, it does adjust QoS, but it's also for billing.

I'm very familiar with DPI; I have gotten the nondisclosed (since expired; it's been a long time!) pitch from a leading vendor. And it showed up on the Internet anyway in the form of a keynote address given at a 2005 IEC conference by vulture capitalist Rod Randall, whose portfolio company is heavy into DPI and bought that vendor. His key phrase was "don't get Skyped" -- DPI can block VoIP.

The idea is that they can look past the headers of the application layer, right into the user data, and scrute out what you're doing. Then they can block the traffic, pass it, give it QoS, or generate a billing record.

DPI is widely deployed on mobile data networks today. Read their terms of service: Most are very limiting. They can enforce with DPI (and block encrypted packets if need be). The DPI pitch notes that SMS is much more expensive than email, so you can use it to track emails sent and bill for them, even if they don't touch that network's servers.

In the real world that's called wiretapping, but on the internet it's legal. DPI goes way, way beyond web-visit-tracking like what Phorm is doing. It totally destroys the open Internet. The entire network neutrality thing is really about DPI; people just don't all know it yet.

Re:DPI is for QoS, not marketing

[riondluz]

"That's the idea anyway, saying it's for targeted advertising sounds quite paranoid to me."

I would imagine it's more a ? of whether the paranoia is rational or not.

Consider that 2 years ago GWB claimed that the .gov was spying only on international calls originating outside the U.S. Then we find out that it was bi-directional. Then we find out (as the paranoid suspected all along) that the bag-on-the-side at the telco is/was/always-has-been datamining domestically. Combined with what we know of .gov sharing their information w/the likes of Infragard, State and Local LEA, tracking quakers, librarians, anti-war activists and other dissident citizens, the firings in the Atty Gen. Office, 'detaining' ethnic citizens of suspect origins, the scare tactics used to keep anyone from defending them........

Oh happy day, Deep Packet Inspection, How could that possibly be mis-used?

Bend over boyo, we've got a surprise for you.

This starts at home - SSL for slashdot

[Anonymous Coward]

Why doesn't slashdot use SSL? Help us out here commandertaco!

Re:Is This Any Way To Do Business? - OT

[Anonymous Coward]

Is That Any Way To Capitalize A Subject Line?

Are Slashdot Comments Now Formal Titles?

Are You Writing A Book By Any Chance? :)

Only have more questions

[edmicman]

So which ISPs are doing this? What can we do to protect our selves? It sounds like it's "enabled" by a cookie placed there by your ISP or NebuAd? Would Adblock and/or PeerGuardian be enough? Implementing blocking at the home router level? What can home users actually do?

It'd be nice at least to know who's actually participating in this so we could know who to avoid.

Re:Slashbot hypocrisy once again

[pinguwin]

I don't use gmail by choice because of this policy. Gmail isn't a free service, there is a cost to your privacy and if you make that choice, great. I have my own domain specifically for this reason that I'm not under the rules of another company. But for communications that I pay for, my isp thinks they can eavesdrop? Big difference between what google and the isp's are doing.

Re:Slashbot hypocrisy once again

[ccguy]

So, it's bad and evil and wrong if a computer at your ISP reads all your packets for marketing research purposes, but when Slashdot's favourite pet company Google does the exact same thing with all your messages in Gmail, it's perfectly fine and justified?

Yes. You may use gmail or not, and if you do then you agree that they will use your email contents for advertisement.

No one authorized ISPs to inspect packets for any purpose.

However if they provided their service at the same price google offers gmail in exchange for authorization to inspect packets, I'm sure there would be lots of people willing to take the deal.

I think Slashbots need to get their kneejerks straight.

And I think whoever modded you insightful was on crack.

Comment removed

[account_deleted]

Comment removed based on user account deletion

A cookie?

[pinguwin]

TFA says : The opt-out systems work by planting a "cookie," What happens when you clear the cookies, oh say like I do everytime I quit firefox. Doesn't sound like much of an opt out if it only lasts a few hours.

Re:A cookie?

[Skapare]

Then you aren't opt-ing out, anymore. That's why the whole concept of "opt-out" is wrong. People should never be required to opt-out. They should have the option to opt-in by taking that step, or not opt-in by not taking a step at all. This is why you, if a voter in the USA, should for "anyone but (Mc)Cain".

It's not hypocrisy it's consistent

[Anonymous Coward]

The issue here with isps is that they are doing it with
*out* informing the individuals and *without* their express consent.

In the case of Google and gmail, Google *EXPRESSLY* informs the
users of gmail *what* Google is doing and why. Google *owns* gmail
and *no* one is obligated to have a gmail account are they now?

See the difference? One does it without regard to personal rights (evil)
and the other does is *after* informing the users of *their* services
what they are doing and why (no evil).

BTW, would it be possible to have a rule for posting comments on slashdot
that all trolls and shills need to provide a disclaimer with their posting.
It would be so much easier and more entertaining if trolls and shills would
identify themselves.

--Johnny loves Google.

Disclaimer: I'm not a troll, and I'm not a shill -- no one is paying me for
this post, nor do I work for an evil corporation attempting to subvert the
best thing that's happened to the human race: The Freedom Internet.
I think I would love to work for google, but I haven't applied for a job
with them.

Re:It's not hypocrisy it's consistent

[tux_attack]

The fact that Google does the data profiling at all is evil. It also must be noted that though they do disclose what they do most people don't read the "Privacy" statement.

If you have to keep it quiet...

[fuzzyfuzzyfungus]

The fact that the ISPs and their scummy little adpusher friends are being so quiet about the whole thing is a giant red flag. If this were really some kind of "win-win"(for somebody other than the ISP and the advertiser, for who it is a win-win), they would be issuing suitspeak press releases right and left about it. This is nothing but suck for every one of their customers and they know it. Particularly given how deeply uncompetitive the market for internet services is in much of the US, it is a dire sign that they feel the need to keep it quiet. Now we need to know who is doing it so we can figure out who to punish.

Privacy concerns, yes, but also the cost!

[Duncan Blackthorne]

I'm as concerned about third parties snooping into things that aren't their damned business, but there's another concern here too: if this is actually going on, then we're all paying for it, too! We're footing the bill for the technology that's being used to snoop into every freakin' packet sent or received. That's complete bullshit; I'm paying for bandwidth, not for motherfuckers at Comcast (or wherever) looking at what I'm buying online, or personal communications I'm sending to friends, or whatever I'm doing. I don't know about anyone else, but if this kind of shit gets too much worse, they're going to have a rude awakening: I'll just cancel the damned service completely and just not have internet at home anymore. Let's see them 'deep packet inspect' me having a personal, face-to-face conversation with people in a private home!

And they can get the hell off my lawn, while they're at it.

I'm keeping my eyes closed

[BarryBham]

Ut-oh. The "Minority Report" retinal scanners are next.

Hmm..... my webcam looks like it has been moved a little....

News You Can Use

[sarcells]

No regulation needed here, just transparency. Hey, WashPost, dig up the ISP names and report them. This is just part of the ISPs' service: better, more relevant ads. I want to know which ISPs in my area do this, so I can make a more-informed choice of ISP!

Where's real investigative journalism when you need it?

Not only the ISP

[Anonymous Coward]

I work for an ISP. I was recently involved with a project to install network taps for this very purpose. However the request was initiated from a 3rd party, ie this was not an internal project. I tried to find out more, but the people who know will not divulge the name of the 'customer'. The equipment is now installed and running in a number of locations.

Needless to say, the rest of our customer base has not been informed of this.

hrmmm

[spikedvodka]

Hrmmm... I never got the TOS/AUP for my ISP (then again it was just switched on me when Verizon sold it)

gotta contact them, and say "Hey, what's the deal"

You can do this now. Sort of.

[Grendel Drago]

SNI (Server Name Indication) support is available, though not out-of-the-box that I'm aware of. See this test site. Sadly, enabling TLSEXT in openssl (required for SNI) seems to require bumping the soname of the library, which nobody wants to do. Hence, the specs remain unimplemented for the next Ubuntu release, later this month. (It's an LTS release, which makes this especially infuriating.)

And you can't use it on any public-facing websites that you care about people going to. It's unsupported in IE6 and even on IE7 unless you're using Vista. (Though Firefox 2 and later work fine.) Because of the enormous clusterfuck that is Vista, most people seem content to stick with XP. So unless you're restricting your site to a select cadre of friends who use browsers that don't suck, SNI is dead in the water for at least a few more years.

A law--copyright?

[coats]

As I read it, the assemblage of what actions I take over the Internet is an original work composed by me. Under the Berne Copyright Convention, as implemented in the US Copyright Act (USC Title 17), it is a work authored by, and automatically copyrighted by me (post-Berne, registration is not necessary; it just ups the penalties for violations).

Distributing that record or any derivative work thereof (including summaries) is a copyright violation. And I personally have standing to sue.

Not what the WIPO had in mind, perhaps, but it's a tool they gave me...

Not necessarily

[davidwr]

You could have 10,000 domains that share a common cert provided by the hosting provider. It does squat for authentication but it does prevent snooping.

With ISPs starting to snoop, suddenly this has real value.

Combine this with 3rd-party SSL-enabled DNS, and you've got some reasonable countermeasures.

Your ISP will know you talked to dns.ssldnsprovider.com over an encrypted channel and then immediately carried on a series of conversations with 1.2.3.4 over port 443, but he won't know which of the thousands of web sites hosted by 1.2.3.4 you talked to.

Dns.ssldnsprovider.com will know you looked up the address for www.freetibetnowdammit.com but not much else.

You will be presented with a certificate for www.somebigwebhostingprovider.com that mismatches www.freetibetnowdammit.com, but freetibetnowdammit.com will explain why and say not to worry about it, as will all the other hosts residing on 1.2.3.4.

The Quick Fix

[Nom du Keyboard]

The quick fix to this is web-sites all allowing https, ssl, and vpn connections to them. That will end deep-packet inspection, leaving only a list of web-pages visited available. gMail already allows https, but you have to ask for it.

Re:The Quick Fix

[jgiltner]

Yep, thats the answer. Lets setup VPN's between every computer and every web, ftp, chat, and whatever server. Or use https, ftps, sftp, etc. on every connection. Just who is going to end up paying for all the equipment upgrades to support all that encryption and decryption on the servers or the extra hardware that needs to be purchased to offload the encryption? Who is going to pay for all of those certificates for SSL encryption? You do realize that the reason most sites don't offer SSL is because they have to pay for certificates? If they use self-signed certificates, they you get those annoying pop-up windows because you browser can't verify the certificate. I for one do NOT want to have to import thousands of self-singed certs.

Re:The Quick Fix

[riondluz]

"Libs vote for candidates who make them feel good. Consrvs vote for candidates who will solve problems we face."

You're kidding? Right? Honestly, I dont know what a conservative voter is
any more; other than someone equally gullible, fearful of that degenerate,
angry, strange world beyond their gated community which, in their ignorance
and desire for more,more,more they helped to create and are equally eager to
invade and sack.

Conservative. Would that be fiscally? Environmentally? Sorry, dont see it.
To me that quacking waddling duck is just a stingy, greeedy 'i got mine,
screw you' hypocrite cruising along in their armored hummerV.

  The only difference i see is Libs are at least more open-minded to
change and tolerant of diversity. And, if there's any room of irony,
blue-collar conservs suffer from the same delusion as their conservative evangels; Thinking that the Elite establishment serves their interests.
Talk about suckers!

Maybe its all in the Meyers Briggs type, buy i think it's more accurate to say consrvs vote for candidates who ignore/deny the problems
long enough to pass them off to someone else's watch. FWIW, it's called
generational terrorism.

my .02

You got step 7 wrong

[davidwr]

Step 7: Don't get caught.

Not without a reason they don't

[davidwr]

It's my understanding that most shippers won't open a package unless they already suspect something or are required to by law.

If they suspect dangerous goods, they may open it to protect their planes and other packages.

If it's at a customs location, they may inspect items if they are acting on behalf of customs agents.

If they suspect illegal material, if their lawyers are smart they will get the cops or courts involved before they open the package.

What they don't do is just snoop for the hell of it, if they did, their reputation would be in shatters and there is too much competition in that industry to withstand the bad press. Unlike some industries *cough*localisps*cough*.

This sounds like a great marketing opportunity

[davidwr]

[Ad in college newspapers nationwide]:

Dear college students:

Are you tired of your ISP blocking your World of Warcraft or interfering with your iTunes? Concerned that your provider's computer techs may get nosy about where you send your resumes? Call 1-800-SPOOFIT and sign up with our worldwide proxy system. We route all of your traffic through one of thousands of proxy hosts around the world. We guarentee that our bonded and insured technical team will not spoof on your traffic except as required by law or to manage technical issues, and we promise to notify you of any such incidents unless prohibited by law and we promise to not keep any data related to such incidents longer than required to solve the technical problem or required by law.

It went away in the 1790s

[davidwr]

The Sedition Act of 1798 one one of many early laws that were the beginning of the end of a government of, by, and for the people.

Way OT: close to 150 freaks

[davidwr]

I have a hundred slashdot freaks! And closing in on 150 fast!

Want to really screw with people's minds? Give freaks a +6 modifier then reply to all of their posts.

Sure you can store the packets

[davidwr]

Last I checked, my routers stored every packet that went through them. I think they stored them in this thing called a "buffer" :).

Mod -6 smartass.

Re:Sure you can store the packets

[gweihir]

Buffering and caching is exempt, also from copyright violation. But it has to be short-term, not for any other use and automatically deleted.

BELL CANADA

[old and new again]

DPI on every packet, theirs or wholesales, throttles EVERY connection not HTTP/port 80 to 40 K/s, still chrges for 5 Mbps can't SSH, vpn, RDC or even download distros youtube grinds to a halt and the itunes store ...lol 4 gb in 2 days, back in 1999 and CBC, national TV, just started using torrents to distribute content funy thing is, bell will aunch a movie store shortly, so they wanted to reclaim all oversold BW for their assholes and penalize 3 rd party/resellers

Why is this not a violation of ECPA?

[anwyn]

Will someone please explain to me why this is not a violation of the ECPA that is the Electronic Communications Privacy Act? Specificly TITLE 18, Sec. 2511. (1)(d) which clearly states:

(1) Except as otherwise specifically provided in this chapter any person who - ....... (d) intentionally uses, or endeavors to use, the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication in violation of this subsection; or ....... shall be punished as provided in subsection (4) or shall be subject to suit as provided in subsection (5).

Re:Why is this not a violation of ECPA?

[dstates]

Two major reasons the ECPA privacy protections do not apply. First, computer communications fall under Title II of the ECPA, the Stored Communications Act (SCA) which provides much weaker protections. For example, no warrant is required for the police to monitor or record computer communications whereas a warrant is required for either a telephone wiretap or even a pen recording (record of who you called).

Second, ISPs are not regarded as common carriers whereas local telephone companies are. The rational is that telcos operate as government granted monopolies and must therefore be subject to special regulation. Back in the day when we all connected to our ISP using a telephone line and modem, the ISP space was competitive and common carrier status did not apply. These days, in most regions there are only one or a small number of broad band ISPs and in many cases these are near monopolies because they are using infrastructure built under telco and cable TV monopoly franchises.

The whole net neutrality debate has further muddied the waters on whether ISPs are common carriers. The law governing privacy of electronic communications is anything but clear.

There is also a history of case law holding that email is not private and that employers are free to monitor email.

Let's have Slashdot on https

[Anonymous Coward]

As the first step in this fight could we have Slashdot on https?

you're a dumbass

[Anonymous Coward]

hacking someones mail does'nt get you in a "pound me in the ass prison"

it gets you in a low security almost vacation like prison with lots of low risk offenders

now stop the bullshit already

Are you being Phormed?

[ajb44]

The best way to generate a groundswell against these systems is for websites to warn their uers if they are on an ISP that does this. For those in the UK worried about the 'phorm' spying system, Richard Clayton has extracted some technical information from them here: http://www.lightbluetouchpaper.org/2008/04/04/the-phorm-webwise-system/ and Gavin Jamie already has a prototype Phorm detector here: http://www.mythic-beasts.com/~gjamie/

Re:Slashbot hypocrisy once again

[Anonymous Coward]

Just stumbled on the 'goog-411' 800 number on my blackberry and initially thought: cool, I don't have to pay 411 charges any more (waht a ripoff). Tried it out, and the first thing they say is 'all calls recorded'.

Thought to myself, thanks but no thanks... and then realized that my employer pays for the 411 charges anyway =)

Probably why...

[SCHecklerX]

Comcrap was 'down' all day here. Funny how my vonage service, and mail servers (using non-standard ports to dyndns mailhop, apparently mail was hit as well) were fine, though.

How can we copyright our AIM logs?

[elucido]

If what you say is possible, how can we copyright our AIM logs so we can sue any corporation that uses or reproduces it? It is possible to copyright literary art right? How might it be done?

Re:How can we copyright our AIM logs?

[tux_attack]

Yes it is, when you make the log it is automatically yours. Copyright just adds stiffer penalties. Though since the person you were talking with also made part of the log you would need to share copyright of the log, release the right to from one person or divide ownership by statement. Any way would still give you grounds to sue.
IANAL

Re:How can we copyright our AIM logs?

[elucido]

And how do you divide the ownership by statement in an automated fashion? And how can we attempt to copyright all our internet activity? is it even possible?

Re:How can we copyright our AIM logs?

[tux_attack]

how do you divide the ownership by statement in an automated fashion? I don't know but I think it is possible.

how can we attempt to copyright all our internet activity? is it even possible? By recording all the activity and taking it to a lawyer. I should think it is possible to copyright it but it would be very expensive.

Re:How can we copyright our AIM logs?

[coats]

IANAL, but... Copyright *exists already* as soon as the activity is recorded. Registering the copyright is expensive (as others have noted), but substantially increases the penalties for infringement. Even without registration, though, the law supports injunctions to prevent further infringement and supports some level of damages (but not prison time for the infringer).

Much information about you

[Anonymous Coward]

Now Slashdot (or OSDN) not only knows all those details about you but they also know your IP addresses (one of your home internet line, one of your employer) which might very well disclose your employer and your email address - that is not publicly disclosed - which might hint at or even include your real name. Well done. :-)

Re: Absolutely! But it's too hard to configure

[Blakey Rat]

The people who care about encryption are not the same set of people who care about usability. Normally I'd say your best bet is to petition some company that's known for usability to add encryption support to their products, but given the Apple experience it looks like that might be pretty useless. :)

Re:Slashbot hypocrisy once again

[Dan541]

But we don't have to use gmail.

We have to use our ISP to connect to the internet and our ISP is a constent they are ALWAYS there with everything you do Google is only there when you use their service.

~Dan

Cut the hydra at the head, adblock

[losttoy]

Let them gather all the information they want. I use adblock so I see no ads targeted or otherwise. Problem solved.

Re:Who thought one cert per ip was a good idea?

[Douglas Goodall]

The people at Verisign that sell certs of course. Certs are used for several things though. Even a self signed cert can be used for encryption. Browsers though get upset if the cert name doesn;'t match the domain name to assure your are connected to who you think you are. Aside from Verisign (see authenticode fiasco) the other guy selling certs made so much money ho could take a ride into space.

Re:Sites I have never been to know my town

[Douglas Goodall]

I do find it intriguing that web sites I visit for the first time know my town, even though my Internet provider's packets hit the Internet 200 miles away. It is not IP numbers. I suspect it is generic cookies. If people are going to do deep packet inspection though I think we should all have interesting signatures so "they" won;t be bored. By the way, with all these Nigerian scam spams in the traffic stream, how would the man identify email about terrorists moving large amounts of money from one country to another, when that seems to be the subject of about half the email I receive.

Regards, Doug

--- Iran, uranium, rail gun, bomb, spies, scientists,

Re:The Quick Fix (ha ha ha)

[Douglas Goodall]

Given that we are only allowed to have encryption that can be broken quickly by certain men in black, Why would you have faith that https and ssl would do any good at all to protect our private communications. As it happens, I don't say anything in email that I am ashamed of. But the principle bothers me nonetheless.

Now it would be a good idea to inspect, and store email to and from certain government offices, mainly the west wing of the whitehouse where we seem to be having trouble with email retention laws.

Another workaround

[ignavus]

This is why I only access sites written in foreign languages which the ISPs and their advertisers cannot understand.

Sites like Slashdot.

(And I set Google to Pig Latin. O-one-nay an-cay understand-ay y-may eries-quay!)

You know. If they are doing simple text analysis, Pig Latin just might work as an encryption method.

Re: Definition of Privacy

[cyclomedia]

Along with the UK's Phorm scandal the business exec types involved seem to be argueing that "not publishing/selling information tied to a particular individual" defines retaining privacy.

So they're trying to parse privacy as something that, IMO, it is not. Privacy is a basic expectation. Privacy is my choosing to write a letter and place it in an envelope - not on a postcard. Privacy is my choosing to talk to my wife over the phone and the conversation's contents remaining known only to us.

If anyone opens the envelope to read the contents, or listens in to the phone call THAT is a volation of my privacy. Regardless of if they read the address on the envelope or return address on the letter, if they see the number dialled or the number dialing. Regardless if they are to use the data collected for marketing or personal kicks. It is the act of snooping ITSELF that violates the privacy.

Now, if an ISP wants to put in their terms and conditions that you grant them some kind of right to inspect or intercept your packets that may or may not be legally kosher. But that is not the issue here. The issue is the repeated attempts to define invasion of privacy from the initial snooping in the first place to what they do AFTER snooping. and that is what we need to fight and what needs to be made clear to the media, so that when they report on these stories their subscribers also understand.

logging in but CATCHPA : Quagmire

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Slashbot hypocrisy once again

[dueyfinster]

Maybe if ISP's move to tiered services (like they say they need to for Bit torrent) we could opt in like Gmail in return for lower prices???

When will people get it?

[houghi]

When will people start realizing that privacy invasion is a bad thing? Companies should not be allowed to sell the information. Not even after an opt-in.

Once you realise that, you should vote for politicians that suport this idea that the people are important, not the companies. Obviously this will not work in the USofA, because it is a socialist idea and both parties are already owned by the companies. Ain't it grat to have a domocracy based on two parties, so you can choose between bad or worse.

Ok, now you can mod me -1 ranting.

Re:Slashbot hypocrisy once again

[McDutchie]

But we don't have to use gmail.

We have to use our ISP to connect to the internet

Not true, you are just as free to choose a different ISP as you are to choose a different email provider. The most that can be said is that switching ISPs is more hassle.

and our ISP is a constent they are ALWAYS there with everything you do Google is only there when you use their service.

That's true, but I don't see how that changes the principle of the matter.

BTW, the "Troll" moderation should be renamed "Unpopular Opinion" as that seems to be how it's often used.

Re:Slashbot hypocrisy once again

[Dan541]

The problem with ISPs is you are very limited in choice you can only use those that are in your area and if they all jump on the bandwagon your somewhat screwed.

At least an email provider doesn't have to be in the same country.

"Troll" seems to be a very popular mod atm

Re: Absolutely! But it's too hard to configure

[asparagus]

http://www.macosxhints.com/article.php?story=20050522045225980

Which then generates a nifty lock button in Mail.app. Good luck finding somebody else to send messages to, though.