Source
r/networking•
Cache_Flow

FCC privacy repeal - stronger push to encryption? thoughts

As some of you may know the U.S. house of representatives has voted to repeal certain privacy rules ISP's would have had to abide by. I understand that this will make the market more competitive but as everyone probably agrees we like our privacy. The repeal is still awaiting the signature of the pres, but he's expected to sign.

Should this lead to stronger push for HTTPS, VPNs and encryption? (a past due call likely) Obviously this would help ensure privacy. Thoughts? Also anyone out there making a 2nd-amendment style will not comply statement? Curious to know what mechanisms could be used as well to gobble this information in a netflow style manner. thanks

https://www.washingtonpost.com/news/the-switch/wp/2017/03/28/republicans-are-poised-to-roll-back-landmark-fcc-privacy-rules-heres-what-you-need-to-know/?utm_term=.bded29a44072#comments

Posted Mar 29, 2017, 9:57 PM UTC

3011
Torgen_ChickenvaldIt places the packet on the wire or else it gets the hose again.•

Mark my words, within the next decade ISPs will be forced by new "anti-terrorism" laws to install root certs on customer devices as a condition of using their service so governments can continue their bulk surveillance programs. While I think many ISPs respect user privacy and don't want this liabilty hanging over their heads, there will certainly be a group of them (without a doubt AT&T for starters) that will capitalize on this by ramping up their sales of customer tracking data to advertisers. The post-Snowden push for encryption has left governments with no other recourse if they want to continue to have unfettered access to all of our communications. I hate it but I'm certain this is the direction the world is headed.

14
Cache_FlowOPYou should've enabled port-security•

There are lawmakers that want a "login" mechanism where you have to login old aol style to access internet resources so you cannot be anonymous . I guess certificates like you mention could be a way for that particular requirement.

2
cr0ft•

Well, this post will obviously get political. No way to avoid that.

There is already a strong push towards HTTPS, but that doesn't prevent metadata collection. VPN's, sure, but for the average user that is a step beyond what they're comfortable with in many cases. Home users generally can't even configure the router they have. This also depends on VPN operators being allowed to operate without handing every bit of info over to the state.

But the bigger problem is that we're allowing ever more totalitarian regimes into power. First, Wall Street destroys the economy with derivatives and other utter bullshit designed to create money out of thin air by betting on other money, and we use a fiat money system where more money is - literally - created on the spot when people go to the bank to take out a loan. The central bank thing that's privately owned (the Federal Reserve in the US is about as Federal as Federal Express, it's a private bank) literally sells the money to the state for interest, which means there is always more debt in the system than there is money. All this is insanity, and it does a lot of damage - while creating more billions to the 0.01%.

Add to that technological unemployment and capitalism starts unraveling fast.

And people's reaction to that kind of fear and uncertainty is generally to listen to bombastic would-be strongmen on the far right, and those right-wing policies then turbocharge the destruction. It's no coincidence that WW1 and WW2 happened in times of economic turmoil.

So at the end of the day, this privacy stuff is all just a symptom of a much grater malaise. America and the world is drifting right (well, in America's case, it's sprinting into full-on Nazi like bullshit, apparently) and VPN:s won't help if you live in a de facto dictatorship. Currently, America is a de facto Oligarchy, which is bad enough, but it can still slide further into right-wing hell, given a chance.

Technical solution to massive societal malfunctions won't work. Society itself has to change. Not just because of privacy, but because of things like the survival of the human species, something the fact- and science immune people in the lunatic right wing fringe are literally jeopardizing.

10
thestatic1982•

Honestly, since the government takes every opportunity to screw us over on behalf of corporations, I think a consumer union of sorts needs to be created. We need effective organization and communication strategies so that whenever unfavorable terms of service for a carrier or similar services are put in place, the consumer union can alert constituents and we can go on strike with service cancellation until our terms are agreed to. At some point this will hurt their purse enough to stop messing with us.

6
cr0ft•

It's a good thought, but unfortunately I don't think it's that easy. There is a systemic failure in capitalism that means it can't be fixed by altering details in its function. In the 200 odd years we've had individualism-based societies after the French Revolution, we're been at war 100% of the time and have had people dying in job lots continuously. Even today, tens of thousands starve to death on a daily basis in the world, all because of how we organize ourselves.

You can't make minor tweaks to a system that's innately broken. You have to go back to the drawing board and design a functional one. It's true for networking, and it's true for society.

3
Ankthar_LeMarre•

That will only help a certain amount. Most of the desired data (source and destination, date/time) will still be available. Besides, what's to stop the ISP from working with the website to share certificates and essentially become a MITM?

2
Cache_FlowOPYou should've enabled port-security•

That was under the privacy laws that were repealed. Thanks for the input.

3
Ankthar_LeMarre•

Not sure how I misread it that badly. I edited it to avoid any confusion. Sorry about that.

1
cr0ft•

I think this highlights the issue. Not even all IT pros are aware what they just lost - thanks to Trump, those common sense protections mentioned here are no longer there. Well, won't be after Trump signs it.

1
space_weasel•

I think there will be some stronger push for HTTPS, but I think most people who care about their privacy have already done whatever privacy enhancements they want. I think it's only a small number of people (relatively) actually care to be honest.

1
dark_15Drunk dual JNCIE•

It's still ridiculously easy to grab the URI that a user was going to regardless if they're using HTTP or HTTPS via the SNI option now prevalent with browsers. Also cookies/javascript code can keep an eye on what sites a user accesses.

1