News for hackers. Stuff that matters.

A comment on How can I protect myself from government snoopers?. Parent comment

Re:How can I protect myself from government snoopers? by treerock on Friday November 25, 2016 @07:18AM (#13036189)
Yeah I was curious about what level of detail will be recorded. According to the article: "The law forces internet service providers to keep a record of all the websites – not the actual pages – you visit for up to a year."

If they aren't recording the pages, I'd doubt they've be recording the ads embedded on the page.

But who knows, I imagine it's down to how the ISPs implement the legislation.

[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by nicktelford on Friday November 25, 2016 @07:34AM (#13036272)
They're logging the hostname of every "site visited". However, an ISP won't be able to distinguish between a URL you entered in the address bar, and a URL requested by an iframe, img or script tag embedded on a page.

They'll just know that you visited the host.

[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by redcalx on Friday November 25, 2016 @07:21AM (#13036206)
They can't record the pages if the request is over https, as per most web sites these days. The IP address is known because it's necessary for routing traffic, but the content of each HTTP request and response is encrypted, and that's where the rest of the URL lives.
[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by nicktelford on Friday November 25, 2016 @07:33AM (#13036265)
They can (usually) extract the hostname of the site though, TLS includes it in plaintext.
[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by Warp__ on Friday November 25, 2016 @07:23AM (#13036222)
Gov't can easily MITM HTTPS connections.
[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by redcalx on Friday November 25, 2016 @08:05AM (#13036432)
True. Anyone know if this new IP law allows the gov to do this? I.e. if they tried to prosecute and it came to light that the logs were obtained using a MITM attack, would the evidence be nullified?
[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by tehmaco on Friday November 25, 2016 @09:26AM (#13036898)
It would probably come under the "Equipment Interference" section, which legalises hacking of devices.
[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by Warp__ on Friday November 25, 2016 @08:17AM (#13036499)
I don't know.

I imagine that MITM on a large scale is par for the course for GCHQ.

[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by redcalx on Friday November 25, 2016 @09:37AM (#13036967)
Sure, but can data obtained by that be used in a court of law. I /think/ those are two different things (but not sure).
[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by martin-adams on Friday November 25, 2016 @07:34AM (#13036270)
I did not know this. How do they do that?
[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by Warp__ on Friday November 25, 2016 @07:37AM (#13036284)
http://security.stackexchange.com/questions/143387/is-there-...

That's pretty clear. It does depend of what level/technology is used in the Encryption, but broadly, against nation state actors with full virtual and physical hardware access, you are to put it bluntly, stuffed.

[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by herge on Friday November 25, 2016 @09:23AM (#13036887)
To anyone reading this, the link says: "It is unclear whether such rules would apply to companies which don't operate directly in the UK", so it is literally not pretty clear.
[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by Warp__ on Friday November 25, 2016 @09:54AM (#13037083)
The _legality_ isn't clear. The technical methodology is quite clear.
[ Parent | on HN ]
Re:How can I protect myself from government snoopers? by doc_holliday on Friday November 25, 2016 @07:21AM (#13036205)
From my interpretation they are logging the IP address and ports data transfered from.

So theoretically if you transfer data from insert bad orgs IP address here from within another innocent website you'd be logged for that.

[ Parent | on HN ]