FCC privacy rules


#1

Now that the FCC privacy rules are on the brink of oblivion, I'm wondering if:
1) Can your ISP track and record all your HTTP traffic and the domain you visit for HTTPS websites? In other words, does your ISP know which sites you visit, and unless that traffic is encrypted (https perhaps?) do they can also know what you’re viewing? I'm asking since ISPs act as an intermediary between you and every thing that you access.
2) Does EFF's Privacy Badger in conjunction with other ad blockers prevent ISP monitoring?
3) Short of using a VPN or Tor for everything (or Red Browser on phones), are there any other options for preventing ISP snooping?

Many thanks in advance,
KAC


#2

1) Can your ISP track and record all your HTTP traffic and the domain you visit for HTTPS websites? In other words, does your ISP know which sites you visit, and unless that traffic is encrypted (https perhaps?) do they can also know what you’re viewing? I'm asking since ISPs act as an intermediary between you and every thing that you access.

When you connect to an unencrypted HTTP site, your ISP can see which site you are connecting to and the content you read or send.

When you connect to an encrypted HTTPS site, your ISP can see which site you are connecting to, but not the content you read or send.

When you connect to an encrypted HTTPS site, the only information that is sent in the clear is the IP address of the server you want to visit. Since DNS records need to be public in order to function, this means that your ISP knows what site you are visiting. There is one caveat here. If you visit https://twitter.com/example, then your ISP knows that you visited Twitter, but not that you looked at @example. However, if you type: twitter.com/example, then your ISP will know that you looked at @example, since your initial request is plain http. Twitter's servers will reply, suggesting that you initiate a TLS connection instead, but by that time, your plain http request has already leaked. This curious detail is why you can host software that the Chinese government doesn't like on Github. The Chinese government can see that a user is visiting Github, but not which repo they are looking at, because Github uses TLS.

2) Does EFF's Privacy Badger in conjunction with other ad blockers prevent ISP monitoring?

No.

3) Short of using a VPN or Tor for everything (or Red Browser on phones), are there any other options for preventing ISP snooping?

I don't know what Red Browser is, but choosing a different browser will not solve this problem.

Yes, a VPN or Tor is the only way to keep your browsing history safe from your ISP.


#3

Ethan,

Thanks, as always, for the prompt and informative posting. If you care to comment on the recent Trump-inspired changes to FCC rules, I'm very interested in your perspectives.

"Red Browser" is an iPhone app that connects to the Tor network. I've found it very reliable, more so than the (maybe now defunct) "Onion" app that I previously used for that purpose. It's open-source so I assume/hope/want to believe it's okay.

Here's some info on "Red Browser":
http://www.gplexdb.com/redbrowser.html

Here's a link to it on the Apple App Store:


#4

Here's a commentary/analysis from Princeton:
https://freedom-to-tinker.com/2016/03/04/what-your-isp-probably-knows-about-you/


#5

And here's a dire prediction from Paul Ohm, a professor at Georgetown University Law Center and faculty director of the Georgetown Center on Privacy and Technology. It deserves attention because he worked from 2001 to 2005 for the Justice Department advising law-enforcement agents and prosecutors who wanted to track Internet behavior. Thoughts on his analysis?


#6

Paul Ohm's take is spot on, as evidenced by Verizon's announcement: https://www.eff.org/deeplinks/2017/03/first-horseman-privacy-apocalypse-has-already-arrived-verizon-announces-plans