News for hackers. Stuff that matters.

A comment on One of the Most Alarming Internet Proposals I've Seen. Parent comment

Re:One of the Most Alarming Internet Proposals I've Seen by quotemstr on Sunday February 23, 2014 @06:55PM (#7288303)
> http:// means that the endpoint has not been verified using the CA system and is using a self-signed certificate (and is thus trivially vulnerable to a MITM should certificate keys not be independently checked).

Right. I understand that. The lack of certificate verification for the http scheme means that ISPs can MITM HTTP traffic with or without this proposal, just like they can with HTTP/1.1.

So how does this proposal make things worse?

> new plans in Austin that charge an extra $30/month if you do NOT agree to them inspecting and data-mining all of your web browsing and selling it to advertisers

Really? That's a special kind of evil and should be illegal.

[ Parent | on HN ]
Re:One of the Most Alarming Internet Proposals I've Seen by pktgen on Sunday February 23, 2014 @07:39PM (#7288462)
> Really? That's a special kind of evil and should be illegal.

Nah, no need to make it illegal. He's referring to AT&T's "GigaPower" gigabit service in Austin... the same service that's available from 2 other providers for the same, or cheaper, as what AT&T's charging for their data-mined bullshit.

AT&T will have a fun time getting customers when Google and Grande point that out in their attack ads. :D

[ Parent | on HN ]
Re:One of the Most Alarming Internet Proposals I've Seen by Amezarak on Sunday February 23, 2014 @09:04PM (#7288711)
Unless Grande and Google eventually decide to do the same thing. Why not, from their perspective?
[ Parent | on HN ]
Re:One of the Most Alarming Internet Proposals I've Seen by mirkules on Monday February 24, 2014 @10:33AM (#7291293)
Frankly, I would be surprised if this was not in Google's ToS from the start, considering that Google's core business model is mining of big data. I suspect there wouldn't be an option to turn it off, not even by paying extra.
[ Parent | on HN ]
Re:One of the Most Alarming Internet Proposals I've Seen by Filligree on Monday February 24, 2014 @04:19PM (#7293473)
Google doesn't need to, your encrypted traffic is to their servers.
[ Parent | on HN ]
Re:One of the Most Alarming Internet Proposals I've Seen by nandhp on Sunday February 23, 2014 @07:51PM (#7288505)
One other provider. Neither Google (1 Gbps, "by mid 2014") nor Time Warner (300 Mbps, "by the fall of 2014") is yet offering comparable service. Only AT&T and Grande have any actual ultra-high-speed customers at this time.
[ Parent | on HN ]
Re:One of the Most Alarming Internet Proposals I've Seen by tbrownaw on Monday February 24, 2014 @03:47PM (#7293333)
The lack of certificate verification for the http scheme means that ISPs can MITM HTTP traffic with or without this proposal, just like they can with HTTP/1.1.

Can they really? At least some of those connections should have the certificates verified out of band, so I'd imagine they would get caught fairly quickly. And then loudly accused of conspiring with the CAs (to stifle competition) or the NSA (to steal your data), or the competitors of whatever site/product was being used, or someone I haven't thought of.

[ Parent | on HN ]