Snoopers Charter

[techguyone]

ukaskew said:

Any news on how they are going to exclude MPs from this (and presumably an unpublished list of other important figures)?

Technically it seems like an absolute mine-field for the ISPs tasked with storing this stuff. The average person probably accesses the internet through many, many means in a given week (so no different for an MP), all through different ISPs.

They're not excluded, so their data will be hoovered up like everyone elses. The difference is no one can access without permission from the Home Secretary/PM

[768]

All that jazz said:

768 said:

All that jazz said:

tankplanker said:

Browsers are the worst as most will uniquely identify you making a VPN or HTTPS pointless as the end point website knows exactly who you are.

How?

https://amiunique.org/

Doesn't answer the question. If you don't "share" your unique ID outside of a VPN that doesn't log then how can the end point website know who you are? All they're going to see is the VPN's IP address and a random browser ID which tells them nothing.

Not random, but repeated for every call you make to any website. Quite what the picture it builds up is depends on where you're looking... and if your browser even once connects before the VPN client is up. There's certainly a good chance it amounts to nothing if you just operate one website and aren't a state actor.

[tankplanker]

All that jazz said:

Doesn't answer the question. If you don't "share" your unique ID outside of a VPN that doesn't log then how can the end point website know who you are? All they're going to see is the VPN's IP address and a random browser ID which tells them nothing.

Have a read of this: https://panopticlick.eff.org/about as it goes into a bit more detail. Your browser's unique fingerprint is nothing to do with your IP address, the VPN's IP address or any other network address. It'll follow you around using the same browser regardless of how you connect.

[All that jazz]

tankplanker said:

All that jazz said:

Doesn't answer the question. If you don't "share" your unique ID outside of a VPN that doesn't log then how can the end point website know who you are? All they're going to see is the VPN's IP address and a random browser ID which tells them nothing.

Have a read of this: https://panopticlick.eff.org/about as it goes into a bit more detail. Your browser's unique fingerprint is nothing to do with your IP address, the VPN's IP address or any other network address. It'll follow you around using the same browser regardless of how you connect.

Interesting reading, thanks. I think that's bordering on paranoia though. I suppose you could be at some marginal risk to browser fingerprinting if you happen to use the same machine all the time and never change any settings or extensions. By their own admission in the article, it's pretty easy to circumvent by simply altering the colour depth of your screen, local time zone and jumbling up your extensions a bit as those alone would create a completely different fingerprint. Also, like it says, stuff like NoScript goes a long way in preventing the end site knowing much about your system and "fingerprint". It basically amounts to putting 2 and 2 together and crossing your fingers that you get 4 but there are so many other variables at play that it could be literally any other number. As they say, the best way to avoid browser fingerprinting is to use the msot common browser in vanilla form with the most commonly used OS, not change any settings and not install any extensions and add-ons and then you pretty much hide in the noise with the hundreds of thousands of other folks with the same set-up.

Of course the worry is completely negated if you happen to use different devices to do your internet stuff. That'll fox them!

I appreciate you posting the link - I do enjoy educating myself on these kind of matters.

[Tonsko]

Regarding the ICR kind of thing, Schneier has a great solution: leave your wifi open so that anyone can use it. Then there's that much traffic the metadata becomes useless.

[768]

All that jazz said:

Interesting reading, thanks. I think that's bordering on paranoia though. I suppose you could be at some marginal risk to browser fingerprinting if you happen to use the same machine all the time and never change any settings or extensions. By their own admission in the article, it's pretty easy to circumvent by simply altering the colour depth of your screen, local time zone and jumbling up your extensions a bit as those alone would create a completely different fingerprint.

Changing it from one unique to another amongst the noise of other people not changing it may not help.

[NerveAgent]

How long until we see a big hack of some ISPs and/or some government bods personal accounts?

[robinessex]

Ok. In 5 years, when the ISP’s have all our internet access stuff logged, what the hell is it going to mean and do? Considering all the websites available are perfectly legal and legit, I’m completely bemused as to what the government expect to see/find/obtain. And one last thought. How many times has a terrorist or related event happened, and the perpetrators WERE ALREADY ON MI5/MI6 suspect/watch list! It seems possible terrorist and others are already on the ‘radar’, but nothing less than incompedence allows them to commit atrocities. And now they want to add on the internet activities of 60,000,000 of our citizens. MP’s, paranoid incompetent idiots.

Edited by robinessex on Saturday 3rd December 09:10

[CoolHands]

whats the point in a vpn if all most of us are doing is browsing sites like pistonheads? Nothing I (and probably 99.999% of us) do is exciting.

[768]

CoolHands said:

whats the point in a vpn if all most of us are doing is browsing sites like pistonheads? Nothing I (and probably 99.999% of us) do is exciting.

Privacy?

Ever Googled a medical symptom? Happy for someone to discern any sexual tastes from a snapshot of your browsing history and publish it in a newspaper alongside who you work for?

I don't even particularly want there being central records of who I bank with, who my car insurance is with, who my local council is, where I get my car serviced, which restaurant I'm going to next, where I'm getting tickets to a cinema/comedy night/whatever, where my food is from, who my smart lighting/fridge/toaster is from, who my front door lock's from. If sufficiently resourced you can build up a very detailed picture.

[All that jazz]

CoolHands said:

whats the point in a vpn if all most of us are doing is browsing sites like pistonheads? Nothing I (and probably 99.999% of us) do is exciting.

You seem to be forgetting about the Govt's history in private/secure data management. As mentioned earlier in the thread by someone else, hackers will see this as the Holy Grail if they can crack it. It will happen at some point. Do you really want everything you do online and much of your personal and private information sold to some undesirables and distributed around the world for nefarious purposes? I've no doubt you'll reply with the usual "if you've nothing to hide" line but that's your prerogative. Many of us can see the bigger picture.

[robinessex]

768 said:

CoolHands said:

whats the point in a vpn if all most of us are doing is browsing sites like pistonheads? Nothing I (and probably 99.999% of us) do is exciting.

Privacy?

Ever Googled a medical symptom? Happy for someone to discern any sexual tastes from a snapshot of your browsing history and publish it in a newspaper alongside who you work for?

I don't even particularly want there being central records of who I bank with, who my car insurance is with, who my local council is, where I get my car serviced, which restaurant I'm going to next, where I'm getting tickets to a cinema/comedy night/whatever, where my food is from, who my smart lighting/fridge/toaster is from, who my front door lock's from. If sufficiently resourced you can build up a very detailed picture.

Don't worry, no one is actually interested in you, and that won't happen.

[robinessex]

All that jazz said:

CoolHands said:

whats the point in a vpn if all most of us are doing is browsing sites like pistonheads? Nothing I (and probably 99.999% of us) do is exciting.

You seem to be forgetting about the Govt's history in private/secure data management. As mentioned earlier in the thread by someone else, hackers will see this as the Holy Grail if they can crack it. It will happen at some point. Do you really want everything you do online and much of your personal and private information sold to some undesirables and distributed around the world for nefarious purposes? I've no doubt you'll reply with the usual "if you've nothing to hide" line but that's your prerogative. Many of us can see the bigger picture.

Isn't this data to be stored on the ISP's site, and available to the government if thay have a need to look at it? And such data can easly be stored in a manner that makes internet access impossible.

[All that jazz]

768 said:

All that jazz said:

Interesting reading, thanks. I think that's bordering on paranoia though. I suppose you could be at some marginal risk to browser fingerprinting if you happen to use the same machine all the time and never change any settings or extensions. By their own admission in the article, it's pretty easy to circumvent by simply altering the colour depth of your screen, local time zone and jumbling up your extensions a bit as those alone would create a completely different fingerprint.

Changing it from one unique to another amongst the noise of other people not changing it may not help.

Why wouldn't it? By doing that you've just created a fresh browser fingerprint. The more you change, the harder it becomes for them to see any patterns in your online activity. Throw in the usual VPN IP changes each time you connect and you're pretty much creating a fresh browser fingerprint every time.

[All that jazz]

robinessex said:

All that jazz said:

CoolHands said:

whats the point in a vpn if all most of us are doing is browsing sites like pistonheads? Nothing I (and probably 99.999% of us) do is exciting.

You seem to be forgetting about the Govt's history in private/secure data management. As mentioned earlier in the thread by someone else, hackers will see this as the Holy Grail if they can crack it. It will happen at some point. Do you really want everything you do online and much of your personal and private information sold to some undesirables and distributed around the world for nefarious purposes? I've no doubt you'll reply with the usual "if you've nothing to hide" line but that's your prerogative. Many of us can see the bigger picture.

Isn't this data to be stored on the ISP's site, and available to the government if thay have a need to look at it? And such data can easly be stored in a manner that makes internet access impossible.

Possibly so, but those kind of measures haven't stopped numerous bungles where disk drives contains millions of personal records have been "lost" by government departments or their contractors. There's even a wiki page dedicated to all the known government data losses, it happens that often.

[768]

All that jazz said:

768 said:

Changing it from one unique to another amongst the noise of other people not changing it may not help.

Why wouldn't it? By doing that you've just created a fresh browser fingerprint.

Simply because you can associate different fingerprints with each other; VPN provider, cookies, time of day, sites visited, order they're visited, time spent on each, all the other errata that can be used to statistically deduce that where one browser fingerprint stopped and another started that they're the same person.

[768]

robinessex said:

Don't worry, no one is actually interested in you, and that won't happen.

I could write an article on myself that would fail the Daily Mail test quite easily. I do think the odds of it happening are negligible though.

[All that jazz]

768 said:

All that jazz said:

768 said:

Changing it from one unique to another amongst the noise of other people not changing it may not help.

Why wouldn't it? By doing that you've just created a fresh browser fingerprint.

Simply because you can associate different fingerprints with each other; VPN provider, cookies, time of day, sites visited, order they're visited, time spent on each, all the other errata that can be used to statistically deduce that where one browser fingerprint stopped and another started that they're the same person.

Against all the other millions of fingerprints?! Seriously? I'm a cynical fker by default but I think you may be taking things to extremes with your paranoia here. No-one is going to go to those lengths to ID you unless you're in the top 10 on the world's most wanted list.

[768]

Sure, individual tolerances to risk vary, I'm only talking about technical feasibility not whether anyone cares enough about you to act upon it.

The way to do it is in software though; that way it's done automatically and you get everyone you hold data on, not just the top 10 most wanted.

[robinessex]

It doesn't take much though to buy and use a computer in a manner that is anonymous.