Which ISPs Are Spying On You? 160
firesquirt sends us an article from Wired about a survey they conducted to determine major ISPs' data retention and other privacy practices. Over a period of two months, four national ISPs would not give Wired the time of day; and another four answered some of their questions in a fashion not altogether reassuring.
All of them (Score:2, Informative)
Re:All of them (Score:5, Insightful)
That's true... (Score:5, Insightful)
Re:That's true... (Score:4, Interesting)
Re: (Score:3, Insightful)
Re: (Score:2)
Re:All of them (Score:5, Informative)
Re: (Score:2)
in this case our overlords are hardly new.
Re: (Score:2, Informative)
that was funny.
Re: (Score:2)
I use XS4ALL in the netherlands. They tend to go to court rather than give up user privacy. Only if they lose, they will give it out.
Similar in the UK (Score:2)
Re: (Score:2)
Anyone that uses the open part of my wireless freenet is not logged, and even if I did log, I could only keep about 50k of logfiles (the free space available on my router). If my ISP was spying on me, they may get all sorts of stuff coming through my router that is not being downloaded by me, and unless they find it on my machine (which they won't, since it's routed to a separate subnet), there's not much they can do about it.
Re: (Score:2)
All of them, DUH (Score:2)
Re:All of them, DUH - NO. Some do the right thing (Score:5, Interesting)
http://www.rsync.net/resources/notices/canary.txt [rsync.net]
In addition to a stated policy of "No data or meta-data concerning the behavior of our customers or filesystem contents will ever be divulged to any law enforcement agency without order served directly by a US court having jurisdiction. All such orders will be reported to our entire customer base."
You should read their philosophy page [rsync.net].
Re:All of them, DUH - NO. Some do the right thing (Score:4, Informative)
Ummm... dream on about this part (at least), as "Patriot Act"-backed demands (with or without a warrant) can forbid the disclosure of said demand.
And while an especially conscientious service provider might insist on dotting i's and crossing t's, it is doubtful any of their personnel (or bosses) will be willing to be jailed as a "terrorist".
Re: (Score:2)
That is what the canary is for (!)
Read this again:
rsync.net warrant canary [rsync.net]
If they are served with a secret warrant, they simply stop updating the warrant canary...
Which, since everyone knows what it means, effectively functions as a way of disclosing that they've been served with a warrant demanding nondisclosure. I hope they're not relying on whatever lawyer told them that this was a good idea to bail them out after the fact, or they may be in for a rather rude surprise.
Re:you should read more closely ... the canary ... (Score:5, Interesting)
Sort of. But it's an interesting idea. The law *does* prevent them from stating that they've been raided, in certain situations anyway.
But does the same law have the power to force them to continue publishing signed lies ? That's what they'd be doing if they continued to claim that they have never been raided after they where indeed raided.
I don't know enough US-law to know the answer, but atleast it's not obvious that it wouldn't work.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
No. Even then the judges don't appreciate it. They may in certain cases have to put up with it for sligthly longer, to guard against the possibility that judgements are overturned on appeal as a result of rushing things.
Still, willfully ignoring the spirit of law or the orders of the judge, while nominally complying with the *letter* of it, is a great way to annoy most judges. It's unlikely to benefit you in the medium term, and not something I'd recommend.
Witness SCO. True, it does take ridicolosuly lo
Re: (Score:2)
It's not possible to write totally unambigously. Furthermore, trying to hard, by explicitly stating things which are common sense makes the situation *worse* because there's a tendency to be more loopholes in 10000-word laws than in 1000-word laws. Furthermore increased complexity of law benefits those with the most resources, because they're the ones with the most hope of finding and understanding every last detail.
Re: (Score:2)
Re: (Score:2)
So? BFD. I wouldn't give Wired the time of day, either. Wired had promise in the last century, but is nothing more than a hybrid of Ars Technica and People Magazine.
In spite of what the people at Wired think of themselves, they're not the New York Times, or any other news organization with a 100+ year track record of journalism (recent gaffes notwithstanding). They're just a garish tech fanboi rag, and not even a goo
Re: (Score:2)
I wouldn't give Wired the time of day, either. Wired had promise in the last century, but is nothing more than a hybrid of Ars Technica and People Magazine. In spite of what the people at Wired think of themselves, they're not the New York Times [..] They're just a garish tech fanboi rag, and not even a good one of those.
Wired is rubbish. I could post why here, but I'd just be repeating myself since I've already done this [slashdot.org] on more than one occasion.
in EU this is mandated by the government... (Score:4, Informative)
Re: (Score:2)
Is the Internet considered private or public? Minus the VPN's or ssh'ing which would be considered private. If it's public then what is the difference between ISP's providing data to whichever agency and your local Park Ranger providing information to the local police about you when you visit a park?
I'm all for privacy, but I'd thin
Re: (Score:2)
When it involves those are are not disobeying laws or is otherwise arbitrary in whom it targets.
Re: (Score:2)
http://www.policylaundering.org/issues/comm/ [policylaundering.org]
In Britain, your ISP could be forced to have mass surveillance equipment fitted that sends any and all data to the Govt. Your ISP would be prosecuted for telling anyone.
They can also jail you for not telling them your encryption passphrases (or if you can't remember them).
http://www.magnacartaplus.org/bills/rip/index.htm [magnacartaplus.org]
Just one of the many terrifying la
Noisy clickstream (Score:5, Insightful)
As for the other things such as IM's, emails, torrents, ect I can encrypt those should I feel the need. Yes, I could start using TOR, but it's slow and watching a web crawler do a random walk can be entertainment all by itself.
Re:Noisy clickstream (Score:5, Funny)
Re:Noisy clickstream (Score:5, Funny)
Re: (Score:2)
Re:Noisy clickstream (Score:5, Informative)
Also see Bruce Schneier's opinion on the matter [schneier.com].
In short, it isn't a good idea.
Re: (Score:2, Informative)
Re: (Score:2)
While I agree that using such a dictionary as TrackMeNot uses is dumb, if you rather used the leaked AOL searches instead, it would be much more efficient. Well, I still think the whole thing is pointless and tinfol-hat-esque anyways.
Re: (Score:1, Redundant)
The random noise generated by the geek with the Big Idea is not going to change anything. Except that he just might see his shared connection to the net throttled down to the speed of a 300 baud modem.
Re: (Score:1)
Except that you only have to do it once, since the same algorithm would be used on each person's web browser.
I thought the point was to keep them from casually snooping on your leg
Re: (Score:2)
Install filter before logs are made. Problem solved.
Filtering a log pretty much makes it useless as evidence. Though the Feds can just disappear you regardless of legal procedure these days.
Secure proxy? (Score:2)
but it's that very effort that makes it cost prohibitive to do it across a broad scale
That's a good idea. Poisoning the data well.
I'm wondering if a secure proxy would defeat your ISP's snooping? For some reason I was thinking it's possible to snoop https traffic. Difficult, but possible. It would certainly be a pain the rear and an ISP would need a good reason to go to all the trouble. Especially with so many, many people who wouldn't bother. All the search engine would have is the proxy IP, all
ISP's fearful of RIAA/MPAA? (Score:5, Insightful)
I would think all they need to do is show they warned their users they are 1. being watched 2. downloading illegal data. Actually providing the authorities with a history of the data is not their job and should only be the acquired by the authorities with their own equipment and only under a court order.
At the least the ISP's should give their users the ability to opt-out of their "data retention" programs.
Re: (Score:1)
Re: (Score:3, Interesting)
Most ISPs assign dynamic IP addresses to the majority of their customers. Where I used to work, we used RADIUS to provide dynamic IP addressing to our customers, and we would keep logs that would let us determine which customer had any given IP address on any given day and time. This data was used to help troubleshoot customer login problems, resolve billing disputes with customers, suspend and/or warn customers who had violated our terms and conditions of use, and
Re:ISP's fearful of RIAA/MPAA? (Score:4, Insightful)
I would like to think that no ISP would ever spy on me or keep records of my activities. I would like to think that no ISP would provide data without a court order. Unfortunately, what I would like to think bears little relation to what actually is. And my understanding is that the (US) government no longer requires a court order to demand such things.
Re: (Score:2)
In any case, your poin
Re: (Score:1)
Actually providing the authorities with a history of the data is not their job and should only be the acquired by the authorities with their own equipment and only under a court order.
Actually, that is the new trend in law enforcement -forcing businesses to enforce the laws so the police don't have to. This frees up the police for more important things, like going after the businesses for not adequately enforcing the laws.
Brick and mortar businesses are required to make sure that their customers don't smoke or drink in the wrong places, that they aren't buying for someone who is underage, that they are not selling drugs, or even whether their driver's license is expired. If you own
Rogers Slogan is "Don't be not evil." (Score:4, Informative)
These are, after all, the goons who think just about any kind of encrypted traffic coming out of your box is a terrorist threat to the movie industry -- even if it's just a VPN connection.
Does anyone know what Rogers retention policies actually are?
Re: (Score:1)
http://www.shoprogers.com/privacy1.asp [shoprogers.com]
Re: (Score:1, Funny)
Re: (Score:1)
Re: (Score:2)
Last I checked, both Rogers and Shaw were refusing to turn over account information to the CRIAA. Has this changed?
IANAL, but there is a Canadian law in effect that causes liability if they disclose information to third parties - especially on a large scale. I'm not sure if the law has any teeth, but private individuals can use it as leverage against large companies.
There's already enough trouble with frivilous lawsuits (e.g. Warning: do not place ladder on frozen cow patties). Violating an actual law will be worse against companies, since they will need to win on a technicality (which won't always work.)
Sure... We spy..... (Score:3, Funny)
Time to encrypt (Score:2)
Sure they know where you went, but not what you viewed or 'said' while there.
Think about that... (Score:5, Insightful)
Sure they know where you went, but not what you viewed or 'said' while there.
Back when I was operating a mailing list on a controversial topic on my home machine, I had a couple rules:
- No postings soliciting or admitting to breaking laws.
- No encrypted traffic (not just on the list: All traffic (except passwords) to-from the machine was in the clear).
The thinking was like this:
- Police, other government investigative agencies, and various unofficial snoops have a long track record of ignoring laws against various kinds of eavesdropping. So you have to assume that the line might be tapped.
- If the police became interested they could always get a warrant and tap the line. (Or illegally tap the line without a warrant to see what's going on, then (if it looked interesting) get a warrant to tap it legally.)
- If the data was encrypted they could STILL get it - by getting a warrant and seizing the computer (and everything else of interest in the house).
- If the data was UNencrypted they would want to keep a low profile to avoid scaring off any "bad guys", would eventually see that there was nothing to go after, and thus would probably switch to hunting real bad guys elsewhere and go away WITHOUT breaking in and trashing stuff.
"Encrypt everything" seems like a nice solution. But if only a few are doing it, just the fact that their traffic is encrypted makes them targets. It's easy to trump up enough stuff to get a warrant and go after the machine.
Once a LOT of people are all swapping lots of encrypted traffic (as the default way of "sealing" the "envelope" on the datagrams) the fact of encryption will stop making the users targets. (The police can still get a warrant and grab the machines. But with so many potential machines to grab they'll have to find some other way to pick the ones to hit - like by bothering to dig up real "probable cause" from other evidence, like they're supposed to.)
Fortunately we don't need to construct a "shelling point" for this: The internet is gradually moving toward pervasive encryption, as the legitimate need to encrypt for personal and corporate security becomes broadly understood. Once that becomes the norm our electronic "papers" will be about as secure as our physical ones. We're starting to get there. But IMHO we're not there yet.
Unfortunately we WON'T be fully safe using encryption until the typical machine configurations are such that, if the machines are seized, it will be impossible to recover incriminating data from them - even with passwords browbeaten out of their owners. Until that time it will still be useful to bypass encryption by raiding one of the machines at the endpoints.
= = = =
Re the list and "no encrypted traffic": When one of the regulate-the-internet laws was about to make it too much hassle to continue, we closed down the list (after finding volunteers to run its successor and - since the participants hadn't agreed to have their info forwarded - announcing the successor on the original list and giving people time to sign up.
Now I regularly use SSH to telecommute or to access the primary house machine from the vacation house. But that's still low-profile: It's clear from the IP addresses that the SSH connections are going to the company, coming from it, or coming from a single external dialup machine via a particular service provider.
Re: (Score:2)
step 1 run all your internet apps from a thumbdrive with portable versions.
step 2 use a good encryption system on that thumbdrive that gives you deniability.
step 3 keep the PC you use clean and seperate from your regular PC (laptop preferred and hideable.)
ste
Re: (Score:2)
step 2 use a good encryption system on that thumbdrive that gives you deniability.
Step 2B. Don't let your thumb drive go through the washer and drier. (Just happened to me yesterday.) B-( (Fortunately not with a thumb drive containing the only copy of something important.)
Re: (Score:2)
In which case I'm already hosed. I've got a bunch of encrypted files lying about to which I've long since forgotten the pass phrases (which, according to standard advice about passwords, I NEVER wrote down). Nothing of interest to them, of course. (Just ancient personal stuff.) But try to convince them of tha
sAKafdfDds6SFALGI5as4fdf564saDDdaASDSsdaf (Score:5, Insightful)
64F5F6sAS4Dd46KJfUYd0NsafH54UJ6Y35U135KdYUsU1Jf35
JD3hFdJf8o
SD45uio5K2o
Re: (Score:1, Funny)
Re:sAKafdfDds6SFALGI5as4fdf564saDDdaASDSsdaf (Score:4, Funny)
Re: (Score:2, Insightful)
Am I missing the point? (Score:1, Interesting)
IRC logs (Score:3, Interesting)
I seldom spend time on IRC.
Two weeks ago I was on #debian.
I asked the people if the conversations get logged.
Nobody present could tell me.
Is there a place when you can look up such things?
Re: (Score:3, Funny)
Re: (Score:2)
Unofficially logged, well IRC is a lot like ham radio, once you broadcast it theres nothing you can do.
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
Yes the are (Score:2)
Ok so maybe I'm being a smartass but you have to assume that everything on IRC is logged. Many users log everything just as a matter of course, or because their software does it automatically. I doubt servers normally keep logs as they'd be rather large, but nothing legally or technically is stopping them.
IRC is essentially a public forum.
AOL (Score:5, Funny)
Re: (Score:2)
VPN ISPs? (Score:2)
Re: (Score:3, Informative)
The problem is that the US via CALEA is requiring things like Cisco routers used to terminate many VPN connections be wiretap-friendly, so
Re: (Score:2)
So, I would tunnel to a friendly country like Sealand (example) and send all my packets out from there.
Re: (Score:1, Informative)
2) Don't waste your money on a Cisco router. It is MUCH easier and cheaper to just rent a Linux machine in a "safe country" and install OpenVPN [openvpn.net] on it.
3) Most of your traffic is going to be routed back through the US or EU anyway, where most of the world's servers (and backbones) are located.
4) Your "safe" routing node is still identifiable, even if your ISP refuses to give up your name/addre
Couch Potato Land (Score:1)
Looks like it's time for... (Score:1, Informative)
Now that we know what to expect..... (Score:2)
Suggested Search terms:
"Well damn, if I look at crack sites, am I going to be busted for attempted piracy" when I was really looking for a download 30 trial of autodesk Inventor 2008. Its also interesting that directly after the last law related passed, all crack sites are asking for some small amount of payment --- so as to verify identity....
I'm absolutely certain that search terms can be made to communicate to the spys well enough to cause a "MAD - S
Re: (Score:1)
Obligatory (Score:1)
Optimum Online (Score:1)
Re: (Score:2)
The Decepticons will be pleased.
Re: (Score:2)
"Optimum Online" sounds (to me) like "Optimus Prime", the leader of the Autobots (the good Transformers who opposed the bad Decepticons). I was trying to be moderately funny so that somebody with mod-points would throw me a bone since my life is hollow and meaningless and the only joy I have are the funny mods that I get, but I think I went too obscure.
Time of Day (Score:2, Funny)
What, they blocked port 123?
Take the SPY out of ISP-y (Score:2, Informative)
I prefer to do something about it.
http://www.mysecureisp.com/ [mysecureisp.com]
http://www.blackboxsearch.com/ [blackboxsearch.com]
010000100110100101101110011000010111001001111001 (Score:4, Funny)
Re:01000010011010010110111001100001011100100111100 (Score:2)
Can't read the article... (Score:2)
Beating a dead horse (Score:2)
Encrypt your E-mails, use secure storage options, etc. There is a lot of security available out there, its just that people are too lazy to use it.
But datamining of clickstreams is stil an issue (Score:2)
1) What gov't/law enforcement does (whether legally or nsa-style). This is done to enforce the law or for political control.
2) What HP's Patti Dunn or other private entities do to further a specific interest. Marginally legal at best.
3) What ChoicePoint, Axciom, etc. do. Amassing databases of identity and transactional information and selling datamining services usually for business purposes (and now also for gov't purposes). Still legal but mostly under-
Bell Sympatico == Evil (Score:2)
They are pure evil when it comes to privacy. Less than a year ago they ammended their terms of service to give themselves the right to monitor (content included) anything and everything you do on the internet at their whim and share the information with any government agency that asks for it. (no stipulations that the agency must be Canadian or be making a legal request for information).
That was presumably an attempt to protect themselv
Speakeasy? (Score:2)
Re: (Score:2)
Re:That's easy (Score:5, Insightful)
Somewhere, there are lobbyists laughing at this comment.
Too Easy (Score:2)
-Stare at the TV 4 hours a day
-Stop participating in your Government.
-Allow Civics/government programs to be gutted.
-Turn away from reason to embrace The Lord.
It's _soo_ easy to whip off comments like yours. But it's more patriotic to be labled a Democratic (as in democracy) nut job.
Re: (Score:3, Insightful)
The net is being reined in by those who don't like it. There's little anyone who cares can do to stop it.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
One thing you need to understand: you can never have a choice about the whole route. Getting rid of monopolies or abusive government won't fix the problem. Suppose you found the magic ISP that (illegally?) does not spy on you. They still have to hand the packets off to some other network, unless you're only talking to other people who use that same ISP. Who is that other network? Someone who isn't accountable to you, that's w