News for hackers. Stuff that matters.
Re:How can I protect myself from government snoopers? by nicktelford on Friday November 25, 2016 @07:05AM (#13036112)
What truly terrifies me about this is how little control most users have over the websites they "visit". This law requires ISPs to log the domain name of websites users connect to. All it takes is one dodgy advert on an otherwise ordinary website to incriminate you. Worse, you might not even know this has happened, as the ad itself might be completely innocuous. But by virtue of being hosted on a website the government considers suspect, you find yourself on a list.

I don't know if this actually happens in practice, but I have heard stories of bad actors using adverts to distribute malware - it doesn't take a stretch of the imagination to see the same bad actors using adverts to generate false positives to the authorities.

Ad blockers are going to become more important than ever.

Re:How can I protect myself from government snoopers? by planetjones on Friday November 25, 2016 @07:49AM (#13036349)
A dodgy advert, an image embedded in an online forum, a malicious link on reddit. I agree this sounds worrying.
Re:How can I protect myself from government snoopers? by nicktelford on Friday November 25, 2016 @07:54AM (#13036366)
Wow that's a good point: in the era of false news, getting someone to visit a site that covertly logs them as having visited suspicious domains would be pretty trivial.

Just publish some really divisive fake news about Brexit and that'll rack up the UK hits on Facebook.

Christ, it's even worse than I thought.

Re:How can I protect myself from government snoopers? by SomeStupidPoint on Friday November 25, 2016 @10:18AM (#13037278)
It's so disgustingly trivially easy, I don't feel comfortable making even basic comments about how Id do that.

But I am going to try a few PoC ones later today. (On a private network, using all domains and computers I control.)

I... View a lot of use of digital records as the witchtrials of the modern era (eg, cases where people got charged for child porn because a coworker used their machine, but the logs say it was them!). The conclusions don't logically hold up, but reveal something about our reverance for technology (and assuming it worked right).

Re:How can I protect myself from government snoopers? by dualogy on Friday November 25, 2016 @01:55PM (#13039004)
> in the era of false news

How did we get here? Many folks have surfed the web for 20 years, even more for 15, most for 10 --- now in 2016, surprise surprise, fake news abound! /s Almost as if coinciding with the calls for (or introductions of) related legislation..

Re:How can I protect myself from government snoopers? by Nadya on Friday November 25, 2016 @02:00PM (#13039040)
Just a narrative being peddled [0]. The mainstream media lost their grip on "the people" so now need to brand anything that isn't themselves as "fake news". Google Trends shows how blatantly obvious the narrative crafting is. It's only suddenly an issue because the MSM needs it to be. So within a very short amount of time you see MSM like the NYT or WaPo posting articles about 'Fake News' and getting everyone to start talking about it.

[0] http://i.imgur.com/lWjnRqt.png

Re:How can I protect myself from government snoopers? by pcwalton on Friday November 25, 2016 @02:25PM (#13039194)
Fake news started spiking in Google Trends around the election because that is when fake news became profitable.

We are talking about blatant spam sites in which the owners openly admitted to making up stories out of whole cloth.

Re:How can I protect myself from government snoopers? by dualogy on Friday November 25, 2016 @02:05PM (#13039067)
Sure. Exactly. I just added a /s to my post.. ;)
Re:How can I protect myself from government snoopers? by grzm on Friday November 25, 2016 @02:00PM (#13039036)
The number of people online, the level of engagement, and the money being made in online advertising, is unprecedented. I don't know what impact it had on the election, but it was definitely something that has attracted more attention due to the campaigns. It's not unusual for a problem that has existed for a relatively long-time to suddenly come to the attention of the legislature when it rises in prominence.
Re:How can I protect myself from government snoopers? by pcwalton on Friday November 25, 2016 @02:31PM (#13039241)
Fake news became profitable right around the time when a major candidate ran on a platform that peddled conspiracy theories. What a surprise!
Re:How can I protect myself from government snoopers? by grzm on Friday November 25, 2016 @02:38PM (#13039274)
Fakenews/webspam has been profitable for years. I've seen articles with titles like "Martin Sheen dead!" for a lot longer than the 2016 US Presidential campaign (which, granted, seemed like it lasted forever)
Re:How can I protect myself from government snoopers? by yclept on Friday November 25, 2016 @08:33AM (#13036596)
DNS or html bowser prefetching... oh my
Re:How can I protect myself from government snoopers? by ischm on Friday November 25, 2016 @09:09AM (#13036799)
Lets face it: in the end, mass surveillance like this is a tool of terror, not of gaining knowledge. It's about injecting fear into society. And it already starts to work, obviously.
Re:How can I protect myself from government snoopers? by treerock on Friday November 25, 2016 @07:18AM (#13036189)
Yeah I was curious about what level of detail will be recorded. According to the article: "The law forces internet service providers to keep a record of all the websites – not the actual pages – you visit for up to a year."

If they aren't recording the pages, I'd doubt they've be recording the ads embedded on the page.

But who knows, I imagine it's down to how the ISPs implement the legislation.

Re:How can I protect myself from government snoopers? by nicktelford on Friday November 25, 2016 @07:34AM (#13036272)
They're logging the hostname of every "site visited". However, an ISP won't be able to distinguish between a URL you entered in the address bar, and a URL requested by an iframe, img or script tag embedded on a page.

They'll just know that you visited the host.

Re:How can I protect myself from government snoopers? by redcalx on Friday November 25, 2016 @07:21AM (#13036206)
They can't record the pages if the request is over https, as per most web sites these days. The IP address is known because it's necessary for routing traffic, but the content of each HTTP request and response is encrypted, and that's where the rest of the URL lives.
Re:How can I protect myself from government snoopers? by nicktelford on Friday November 25, 2016 @07:33AM (#13036265)
They can (usually) extract the hostname of the site though, TLS includes it in plaintext.
Re:How can I protect myself from government snoopers? by Warp__ on Friday November 25, 2016 @07:23AM (#13036222)
Gov't can easily MITM HTTPS connections.
Re:How can I protect myself from government snoopers? by redcalx on Friday November 25, 2016 @08:05AM (#13036432)
True. Anyone know if this new IP law allows the gov to do this? I.e. if they tried to prosecute and it came to light that the logs were obtained using a MITM attack, would the evidence be nullified?
Re:How can I protect myself from government snoopers? by tehmaco on Friday November 25, 2016 @09:26AM (#13036898)
It would probably come under the "Equipment Interference" section, which legalises hacking of devices.
Re:How can I protect myself from government snoopers? by Warp__ on Friday November 25, 2016 @08:17AM (#13036499)
I don't know.

I imagine that MITM on a large scale is par for the course for GCHQ.

Re:How can I protect myself from government snoopers? by redcalx on Friday November 25, 2016 @09:37AM (#13036967)
Sure, but can data obtained by that be used in a court of law. I /think/ those are two different things (but not sure).
Re:How can I protect myself from government snoopers? by martin-adams on Friday November 25, 2016 @07:34AM (#13036270)
I did not know this. How do they do that?
Re:How can I protect myself from government snoopers? by Warp__ on Friday November 25, 2016 @07:37AM (#13036284)
http://security.stackexchange.com/questions/143387/is-there-...

That's pretty clear. It does depend of what level/technology is used in the Encryption, but broadly, against nation state actors with full virtual and physical hardware access, you are to put it bluntly, stuffed.

Re:How can I protect myself from government snoopers? by herge on Friday November 25, 2016 @09:23AM (#13036887)
To anyone reading this, the link says: "It is unclear whether such rules would apply to companies which don't operate directly in the UK", so it is literally not pretty clear.
Re:How can I protect myself from government snoopers? by Warp__ on Friday November 25, 2016 @09:54AM (#13037083)
The _legality_ isn't clear. The technical methodology is quite clear.
Re:How can I protect myself from government snoopers? by doc_holliday on Friday November 25, 2016 @07:21AM (#13036205)
From my interpretation they are logging the IP address and ports data transfered from.

So theoretically if you transfer data from insert bad orgs IP address here from within another innocent website you'd be logged for that.