Congress votes to let ISPs sell browsing history

bononos

Diamond Member
Aug 21, 2011
3,928
186
106
https://lifehacker.com/senate-votes-to-let-internet-providers-sell-your-web-hi-1793574677

This reminds me of the Verizon (and probably others) header tracking scandal which is injected into http packets to allow websites to track Verizon customers with a permanent cookie that is invisible to users.
https://www.wired.com/2014/10/verizons-perma-cookie/
https://www.eff.org/deeplinks/2014/11/verizon-x-uidh

One question I have is whether the Verizon injection of Unique Identifier Header, or UIDH into http packets is unique across all users sharing the same household router or do different people get different UIDH?
 

MagnusTheBrewer

IN MEMORIAM
Jun 19, 2004
24,122
1,594
126
https://lifehacker.com/senate-votes-to-let-internet-providers-sell-your-web-hi-1793574677

This reminds me of the Verizon (and probably others) header tracking scandal which is injected into http packets to allow websites to track Verizon customers with a permanent cookie that is invisible to users.
https://www.wired.com/2014/10/verizons-perma-cookie/
https://www.eff.org/deeplinks/2014/11/verizon-x-uidh

One question I have is whether the Verizon injection of Unique Identifier Header, or UIDH into http packets is unique across all users sharing the same household router or do different people get different UIDH?
If they didn't log on as a different user, how would the isp know?
 

Mike64

Platinum Member
Apr 22, 2011
2,108
101
91
I really hope this gets overturned ASAP!
Heh. Good one. Save your hopes (or I should say prayers) for when we'll really need them, this is just the start...

Wah! Those poor ISPs who irrelevantly just happen to have to ALL our browsing habits at their fingertips, and no less are being paid a minor fortune for the privilege of us having any browsing habits in the first place (unless one takes major steps to avoid it*) would be treated - gasp - differently than individual web service providers we can easily choose to avoid using if we like. The Humanity! <hmm, what's the collective noun for "all corporate persons"?:lol:> and downright anticompetitiveness of it all!

Pardon me now, while I go throw up my lunch... :(

______________________
* And of course, don't be shocked when we see legislation further down the road allowing, or perhaps even requiring, ISPs to block VPN usage completely because... <mumble-mumble-gobbledygook>! ;)
 
Last edited:

Elixer

Lifer
May 7, 2002
10,371
762
126
It doesn't need to be overturned, it needs to be scraped, and totally rewritten.

Why is it OK for A & B & C to do it, but not D or E or F or Z? Answer, it isn't.
Browser history? Google/Yahoo/Bing/... has it already, whatever you search is and has been saved in some database for a heck of a long time.
Using chrome? Google thanks you for making it super easy!
Using Firefox? Mozilla thanks you for allowing them to sell that data as well.
Opera? Yeah, see above.

This has been going on for decades, and it hasn't gotten better during the last administration, or the one before that, or the one before that...
Those people rushing to get a VPN thinking the VPN don't sell the same freaking data are only kidding themselves. There hasn't been one trustworthy, independent review where they can say this doesn't go on.
Other countries do this as well, doesn't make any difference where the HQ is.

It is only when someone in the gov gets their data thrown about is the only time something is done, and the "fix" is usually to exempt those "working" for the gov.
That is pathetic.
 

bononos

Diamond Member
Aug 21, 2011
3,928
186
106
It doesn't need to be overturned, it needs to be scraped, and totally rewritten.
Why is it OK for A & B & C to do it, but not D or E or F or Z? Answer, it isn't.
Browser history? Google/Yahoo/Bing/... has it already, whatever you search is and has been saved in some database for a heck of a long time.
Using chrome? Google thanks you for making it super easy!
Using Firefox? Mozilla thanks you for allowing them to sell that data as well.
Opera? Yeah, see above.

This has been going on for decades, and it hasn't gotten better during the last administration, or the one before that, or the one before that...
Those people rushing to get a VPN thinking the VPN don't sell the same freaking data are only kidding themselves. There hasn't been one trustworthy, independent review where they can say this doesn't go on.
Other countries do this as well, doesn't make any difference where the HQ is.
........

This ISP tracking is different and alot worse than the current problems with browser privacy. When the ISP does the tracking, you are well and truly screwed since it can track all your activity unlike google/facebook which can only track you on their websites and google/facebook cookies can be deleted. You have no control over and cannot delete ISP injected headers which are not like browser cookies.

Edit to be clearer- That method of ISP tracking in my OP link doesn't work over https websites however.

Mozilla/FF does not collect or sell your browsing history. Reputable VPNs should not collect and sell your browsing history either although many do collect aggregate stats. Its the free proxy/VPN services which do collect and sell browsing data. PIA is one example of a VPN whose claim of no-logging/collection held up in court.
https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/

Republicans pushed through the bill to overturn privacy rules and it was a party line vote which is something to remember whenever you hear the typical Republican scaremongering about big govt spying.
 
Last edited:

Mike64

Platinum Member
Apr 22, 2011
2,108
101
91
This ISP tracking is different and alot worse and the current problems with browser privacy. When the ISP does the tracking, you are well and truly screwed since it can track all your activity unlike google/facebook which can only track you on their websites and google/facebook cookies can be deleted. You have no control over and cannot delete ISP injected headers which are not like browser cookies. That method doesn't work over https websites however.

Mozilla/FF does not collect or sell your browsing history. Reputable VPNs should not collect and sell your browsing history either although many do collect aggregate stats. Its the free proxy/VPN services which do collect and sell browsing data. PIA is one example of a VPN whose which claim of no-logging/collection held up in court.
https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/

Republicans pushed through the bill to overturn privacy rules and it was a party line vote which is something to remember whenever you hear the typical Republican scaremongering about big govt spying.
Thank you. I wasn't going to bother getting into a pissing contest over a bunch of bullshit assertions of non-fact, but that's exactly the point. Not to mention that "at least" the Web-based service providers like Google and even, God forbid, Facebook, can rationally argue that they're providing their services in exchange for the right to collect and sell users' data, unlike the ISPs which are already being paid through the nose and then gibber that they're being treated "differently and unfairly" because they're not allowed to make even more money on top of that by selling unequivocally personally identifiable data as well...
 
Last edited:

bononos

Diamond Member
Aug 21, 2011
3,928
186
106
Thank you. I wasn't going to bother getting into a pissing contest over a bunch of bullshit assertions of non-fact, but that's exactly the point. Not to mention that "at least" the Web-based service providers like Google and even, God forbid, Facebook, can rationally argue that they're providing their services in exchange for the right to collect and sell users' data, unlike the ISPs which are already being paid through the nose and then gibber that they're being treated "differently and unfairly" because they're not allowed to make even more money on top of that by selling off our personal info as well...
AT&T used to have a package which charged users $29 more if they didn't want to be tracked.
https://arstechnica.com/business/20...it-fiber-that-doesnt-watch-your-web-browsing/
 

bononos

Diamond Member
Aug 21, 2011
3,928
186
106
I ran across ad nauseam, an extension which tries to defeat browser activity tracking in a different way - by automatically clicking on nearly every web ad and creating a alot of noise which paradoxically obscures the real user's 'profile'.

Google doesn't like it and took it down from their store.

I think that that method of spamming ad clicks works better with a browser history that has already been to many different websites to build up a whole lot of nonsense data that ad companies can't decipher.
 

Mike64

Platinum Member
Apr 22, 2011
2,108
101
91
Google doesn't like it
Do tell... :rolleyes: Websites themselves would presumably love it, though, since it must boost their ad revenue significantly...:D

The only problem I can see is that it I assume it wouldn't work properly with add-ons like NoScript and adblockers? I'm not willing to give those up just for my sanity's sake, aside from whatever road-bumps they put in trackers' efforts... But I imagine it works well for people who don't use those anyway.
I think that that method of spamming ad clicks works better with a browser history that has already been to many different websites to build up a whole lot of nonsense data that ad companies can't decipher.
I'd think a couple of quick visits to general sites like Yahoo, Fox News, and/or other clickbait-y news sites would generate all the (rather general, quasi-random) garbage data anybody could want... ;)
 
Last edited:

Elixer

Lifer
May 7, 2002
10,371
762
126
This ISP tracking is different and alot worse than the current problems with browser privacy. When the ISP does the tracking, you are well and truly screwed since it can track all your activity unlike google/facebook which can only track you on their websites and google/facebook cookies can be deleted. You have no control over and cannot delete ISP injected headers which are not like browser cookies.

Edit to be clearer- That method of ISP tracking in my OP link doesn't work over https websites however.
Yes, I understand that, they are more "low level", but again, everyone is doing tracking, gmail(and the rest) reads mail and throws ads at you based on content, who is to say they don't keep tabs on specific people? Most mail can be read anyway, since nobody really uses encryption on them, and mail is bounced around server to server.

All I am saying is that all this BS should be stopped cold, not pretend that it isn't a big problem with all the companies that have a hand in the cookie jar.
Mozilla/FF does not collect or sell your browsing history. Reputable VPNs should not collect and sell your browsing history either although many do collect aggregate stats. Its the free proxy/VPN services which do collect and sell browsing data. PIA is one example of a VPN whose claim of no-logging/collection held up in court.
https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312
I should have been a bit more clear, Mozilla (and...) gets paid by search engine providers, and those search engines do keep track of who you are, and what you are searching for, well, except for Duck Duck Go, they claim (unverified) they don't do that.

As for that VPN, we have no idea what goes on behind the scenes, and who is actually in charge. They didn't raid the place, so, it is impossible to tell what they actually store.
 

John Connor

Lifer
Nov 30, 2012
22,757
618
121
This apparently is to level the playing field with Facebook and all the rest. I call BS and I hope it isn't signed into law. The only way you can get past this is with a VPN.
 

bononos

Diamond Member
Aug 21, 2011
3,928
186
106
......
The only problem I can see is that it I assume it wouldn't work properly with add-ons like NoScript and adblockers? I'm not willing to give those up just for my sanity's sake, aside from whatever road-bumps they put in trackers' efforts... But I imagine it works well for people who don't use those anyway.
I'd think a couple of quick visits to general sites like Yahoo, Fox News, and/or other clickbait-y news sites would generate all the (rather general, quasi-random) garbage data anybody could want... ;)
Maybe adblock could be turned off temporarily for the cookie trawling. It might take more than a few quick visits since you want the browser to get really muddied up so it might take some time to trawl through many sites.
 

bononos

Diamond Member
Aug 21, 2011
3,928
186
106
Yes, I understand that, they are more "low level", but again, everyone is doing tracking, gmail(and the rest) reads mail and throws ads at you based on content, who is to say they don't keep tabs on specific people? Most mail can be read anyway, since nobody really uses encryption on them, and mail is bounced around server to server.
.............
I should have been a bit more clear, Mozilla (and...) gets paid by search engine providers, and those search engines do keep track of who you are, and what you are searching for, well, except for Duck Duck Go, they claim (unverified) they don't do that.

As for that VPN, we have no idea what goes on behind the scenes, and who is actually in charge. They didn't raid the place, so, it is impossible to tell what they actually store.
No. Websites like facebook don't have your name, address, soc#. You are just an IP to them unless they are using fingerprinting to get a better fix on you. With ISP tracking, they have you at the very moment you start your browser because they are tagging packets leaving your browser with *this is elixir*, and every website will know for sure who you really are(or at least which household you belong to) even if you reinstall your browser or format your entire drive or change your PC or move to a different house but keep the same ISP. So this is not the same thing that been going on for 'decades' like you said in your original post.

Some privacy search engines are open source or have been audited/accredited like ixquick. Big email providers use https which is encrypted so your mails aren't being read as you said. Some bigger more well known VPNs like PIA are audited/accredited.
 

NAC4EV

Golden Member
Feb 26, 2015
1,882
754
136
Anything for a buck.

193673_600.jpg
 

John Connor

Lifer
Nov 30, 2012
22,757
618
121
Yeah, this is certainly not a left or right issue at all. This is an American issue on the grounds of our privacy. If you want, here's the White House phone number. Just leave a simple message that you disapprove. Don't, for the love of GOD! be disrespectful in the voice mail or with the White House operator. Just state your case. Hopefully, with enough push back Trump won't sign it. I can dream can't I?

(202) 456-1111
 

Elixer

Lifer
May 7, 2002
10,371
762
126
Yeah, this is certainly not a left or right issue at all. This is an American issue on the grounds of our privacy. If you want, here's the White House phone number. Just leave a simple message that you disapprove. Don't, for the love of GOD! be disrespectful in the voice mail or with the White House operator. Just state your case. Hopefully, with enough push back Trump won't sign it. I can dream can't I?

(202) 456-1111
While that would be nice (if he don't sign it), it still don't help the overall picture of things.
They just don't get it and I mean all of congress.

Some states are trying to set up protections, we will see how far they get.

PIA is one example of a VPN whose claim of no-logging/collection held up in court.
https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/
...
Some bigger more well known VPNs like PIA are audited/accredited.
A further comment on this, I know people quote this all over the place, but, that might not even be true, since we don't have all the facts, and we can't know if a gag order was issued or not.
They (PIA) could have cherry-picked what they wanted (save face), and couldn't talk about anything else if they had a gag order. We just don't know.
Warrant canary is useless as well, if that gag order told them to either remove, or not be up there in the first place, as has already been proven to be done in the past.
https://torrentfreak.com/vpn-provider-proxy-sh-compromised-gag-order-160626/
Being audited or accredited is worthless if you don't trust the people doing the audit or accreditation. (They can be under a gag order as well.)

Is using a VPN better than not? Maybe, assuming the traffic to said VPN is busy (though, they still can get issued a realtime warrant), and depending on whom is actually running it.
Will it stop anyone that is determined to track you (for whatever reason)? No, there are just so many ways people are being tracked these days, it isn't funny.
 

Mike64

Platinum Member
Apr 22, 2011
2,108
101
91
Yes, I understand that, they are more "low level", but again, everyone is doing tracking, gmail(and the rest) reads mail and throws ads at you based on content, who is to say they don't keep tabs on specific people? Most mail can be read anyway, since nobody really uses encryption on them, and mail is bounced around server to server.
They may very well, but nobody's forcing anyone to use gmail or create a Google account of any kind (except Google, if you want to use their services.) I was laughing at the then-hipsters who were falling all over each proclaiming the coolness of Google's search engine (even before it was notably better than its erstwhile competitors) much less thought gmail was "so cool" and rushing to wrangle invitations while Google trumpeted that stupid "Do No Evil" slogan... (If that itself/alone wasn't a tip-off, I don't know what would have been.:D) The only Google accounts I've personally ever had are dummies I use only for Google, and that's bad enough... And yes, of course all the non-ISP email providers eventually started doing it too. I guess having used BBS-type services before the Internet went public was useful training, since I've always known better than to write anything in a personal email I wouldn't be willing to have blazoned on a billboard in Times Square if push came to even not-very-hard shove (though of course I've written things I'd "just as soon" have remain private...;)), and that's even more true of email sent from work-related addresses. The only even vaguely "confidential" things I've ever written in those were business-related "confidences" of the client confidentiality, trade-secret type, nothing personally embarassing, let alone damaging.


All I am saying is that all this BS should be stopped cold, not pretend that it isn't a big problem with all the companies that have a hand in the cookie jar.
I don't disagree, but I never said it wasn't a problem in general. But there are relatively easy ways (for now, anyway) to at least limit the amount of information that can be identified to any given person as "an individual in real life", which will become almost impossible, at least without serious effort, with ISP-identified data) and I also know it's sheer fantasy to hope it will ever be "stopped cold". And frankly, I don't think the English language has adjectives strong enough to describe the level of fantasizing needed to think it could conceivably happen with The Donald in the White House and today's "Republicans" in control of Congress. Hoping pixies will drop a big bag of gold on your head while you sleep would be a much more productive use of your time, since it's far more likely to actually happen...;) For the foreseeable future, we'll be lucky to maintain the status quo, pathetic as it is, without wasting time or blood glucose even thinking about getting Congress to improve the situation.

I should have been a bit more clear, Mozilla (and...) gets paid by search engine providers, and those search engines do keep track of who you are, and what you are searching for, well, except for Duck Duck Go, they claim (unverified) they don't do that.
You seem to be willfully ignoring the point that no one is forcing you to use those services - which aren't exactly "crucial" to daily life, yet, anyway - and that there are easy ways of at least limiting the information that can be aggregated without serious effort. (Not to mention what I think is the very significant fact that ISPs are already being paid a lot of money to do what they do. There's no quid-pro-"user data" involved there at all. That's just unadulterated corporate greed, pure and simple.) Ultimately, if someone who knows what they're doing really wants to track you, you will be tracked. But that's not what I, and most ("mainstream") privacy advocates, are complaining about. The NSA, law enforcement generally, and even the odd neckbeard troll infesting his parents' basement (with much higher than typical hacking ability) can track me until they pass out from sheer boredom for all I care. But that's a far cry from my ^%#ing ISP selling my aggregate browsing behavior on the open market, all linked neatly, clearly, and unequivocally to me as an individual, since I have no access to the Internet at all without them. (And seriously speaking, these days it's almost as absurd to say "well then just don't use the Internet" as it would be say "no one's forcing you to use electricity"...) I'm sorry if this sounds rude, but if you don't see much less understand that difference, you're not only not paying attention, you probably don't even have the intellectual capacity to be able to pay attention in the first place.

As for that VPN, we have no idea what goes on behind the scenes, and who is actually in charge. They didn't raid the place, so, it is impossible to tell what they actually store.
Well, maybe, but afaic that's taking a step over the tinfoil hat line. You never "know for sure" about anything you don't see or hear personally, and even then you'd be wrong half the time if you took even that at face value. For that matter, if you're going to take the argument that far, what would there be to stop any company from continuing along its merry way even if the strongest possible Federal law prohibiting or sharing personal information were passed?
 
Last edited:

repoman0

Diamond Member
Jun 17, 2010
5,191
4,570
136
Yeah, this is certainly not a left or right issue at all. This is an American issue on the grounds of our privacy. If you want, here's the White House phone number. Just leave a simple message that you disapprove. Don't, for the love of GOD! be disrespectful in the voice mail or with the White House operator. Just state your case. Hopefully, with enough push back Trump won't sign it. I can dream can't I?

(202) 456-1111

Keep that head of yours in the sand!

https://arstechnica.com/tech-policy...ell-your-web-browsing-history-to-advertisers/

The Senate vote was 50-48, with lawmakers voting entirely along party lines.
 
  • Like
Reactions: Mike64

corkyg

Elite Member | Peripherals
Super Moderator
Mar 4, 2000
27,370
239
106
Get used to it - it was signed into law.
 

Elixer

Lifer
May 7, 2002
10,371
762
126
For a good read, check this out.
He puts it into perspective.

As shocking as this sounds, virtually nothing has changed about the privacy of the average American’s connection to the Internet as a result of this action by Congress, except perhaps a greater awareness that ISP customers don’t really have many privacy protections by default. The FCC rules hadn’t yet gone into effect, and traditional broadband providers successfully made the case to lawmakers that the new rules put them at a competitive disadvantage vis-a-vis purely Web-based rivals such as Facebook and Google.

Nevertheless, this hasn’t stopped news outlets from breathlessly urging concerned citizens to reclaim their privacy by turning to VPN providers. And VPN providers have certainly capitalized on the news. One quite large (and savvy) VPN provider even took out a full-page ad in the New York Times listing the names of the Republican senators who voted to repeal the still-dormant regulations.

I’m happy if this issue raises the general level of public awareness about privacy and the need for Internet users everywhere to take a more active role in preserving it. And VPNs can be a useful tool for protecting one’s privacy online. However, it’s important to understand the limitations of this technology, and to take the time to research providers before entrusting them with virtually all your browsing data — and possibly even compounding your privacy woes in the process.
https://krebsonsecurity.com/2017/03/post-fcc-privacy-rules-should-you-vpn/

There are a ton of snake-oil VPNs out there, and more & more of them are popping up all the time, they take your $$$ & info, close shop, open, rinse & repeat.