Tags: frontporch, Leo LaPorte, nebuad, phorm, podcast, privacy, security, Security Now!, Steve Gibson
This is just a reminder that the second half of Steve Gibson’s coverage of Phorm/Nebuad/Frontporch/etc (Episode #151) is now available here.
I haven’t had a chance to listen to it yet.. but I’m sure it will be a good listen, not just for Techie’s like me but for anyone that is concerned about their privacy and the fact that ISP’s are selling yours out.
Part 1 is Episode #149 for those that missed it.
Leo and Steve Slide a bit heavily into reminiscing about the good old days and other geekspeak. If you want just the Phorm, etc, stuff skip to 1:00:00. The reminiscing is fun for a techie like me but may be a bit drawn out for people just wanting the skinny on what their ISP is doing to their privacy.
Tags: advertising, adzilla, anonymity, frontprorch, ISP, nebuad, phorm, privacy
After listening to Steve Gibson on Security Now! this week (episode 149) I started doing some digging on some of the other companies that Steve mentioned that are trying to get ISPs to engage in DPI (Deep Packet Inspection) Tracking of their clients (you, me, almost everyone on the net).
The sudden and rapid proliferation of these companies (Phorm, Nebuad, Adzilla, Frontporch, etc) seems to indicate that there is some interest in this business model and that is frightening to a privacy advocate like myself.
Why you ask would I be concerned about “anonymous” tracking of “non-personally identifiable information”. Well, firstly the anonymous part is a blatant lie. The whole reason these companies are doing this is to be able to put better targeted advertisements in front of you. To do that. they MUST know who you are.. perhaps not you in the person of “Joe blow” but the definitely know you when you are surfing a site that their advertising partners use. This means it is completely trivial to strip away your supposed anonymity.
Only a few people worried about the anonymity of information collected by search engines until the United States government tried (and succeeded) in going on a fishing expedition in that data. What is to stop similar abuses of this technology.
Unless they are completely transparent on how they collect the data, what data they collect and how long they retain it we have to assume the worst. DPI lets these companies collect any data that is unencrypted from any online source, e-mail, chat, web browsing, unencrypted VNC sessions (well those are a terrible idea over the open net anyways, but people persist in using them), etc.
Add to this that ISPs are installing this without clear declaration of the fact to their users (no having it hidden in paragraph 39 of page 18 of the TOS (that you know 99% of users never read) does not constitute CLEAR disclosure. But really what ISP is going to say “oh, yes, before I give you this cable modem would you please sign this waver giving us total permission to monitor, scan, store, and sell (yes, they are selling your info and your privacy to these companies) everything you do.. unless you encrypt it.”
IMHO this is a privacy nightmare waiting to happen. Am I a bit alarmist? Perhaps. Were the people that were alarmist about search engines and privacy correct? yes.. 100% so.
The bottom line is that our privacy is our right and we all individually need to take steps to protect it. By writing the privacy commissioner about your concerns, by writing your ISP about your concerns, by doing everything possible on you home network and PC’s to ensure that these schemes fall flat on their collective faces.
(I hope to write a blog entry on hardening you computer and Internet activities against these threats soon. I wrote one related to Phorm earlier but as this threat is growing I think a more in-depth Blog entry is necessary)
Tags: gibson, nebuad, phorm, podcast, privacy, security
episode #149 and the upcoming episode #151 of Security Now! cover Phorm and others. Probably most people that read my blog will already know of this controversy as I have covered it before. I am VERY happy to see Steve Gibson using his reach to get the word out about this growing trend, and to alert people to the threat to their privacy. Way to go Mr. Gibson.
I’ve only heard the first part #149, but given Steve Gibson’s skill at bringing technical issues to the masses I’m sure both Episodes will be worth listening to and directing others to.
Tags: i2p, nebuad, phorm, privacy, reclaim, ssl, tor
So Considering all this I spent much of the day mulling ways that users can protect their privacy. I have so far come up with the following suggestions:
Flush Cookies on each browser close:
Although it won’t stop them watching what you click it will help to prevent them from getting a good picture as they will not have month or years of you browsing tied to a single UUID.
Use as much SSL as possible:
They can’t use their DPI (deep packet inspection) on encrypted connections, so find ways to be as encrypted as possible. If you use web mail make sure the entire session is encrypted (not just the log on). Better yet, use an email client that supports secure connections and a email provider that supports them Google, Yahoo Canada, fastmail, etc. Using an e-mail client with TLS/SSL not only encrypts the connection it takes cookies out of the picture.
Use an Encrypting Proxy:
Set up and use a VPN or SSL encrypted proxy. This will make your entire session unreadable. There it the problem of trust. Encrypting systems like TOR, and I2P may just expose you to even more tracking from evil exit nodes. JAP may be backdoored (but according to Wikipedia this is not/no longer the case). Similarly “Open” proxies on the net may not be trustworth.
The best solution I can think of for this problem is to have a trusted friend in another counrty set up a VPN, private SSL proxy or Psiphon node for you, and you could do the same for them. Even if his ISP was sniffed by NebuAd and your’s by Phorm it would muddy the waters. Which bring us to
Find ways to hide your traffic. You could run a TOR or I2P exit node (lots of HTTP traffic for them to sniff none of it yours).
Find alternate ways to get webpages you don’t want sniffed like web2mail.
So those are some of my thoughts on the matter. I’ll post more as I come up with them. If any readers know of good HTTPS services on the web like secure Wikipedia or Secure WikiBooks, etc Please post them in the comments
Thoughts and comments always welcome