Hacker News Reader

Comment by lordofgibbons | Hacker News Reader

The way I look at it is that my ISP is very open about collecting and selling "anonymized" data based on users' internet usage.

On the other hand, a reputable VPN provider has everything to lose if word got out that they collect or sell information.

The privacy calculus is: 100% chance vs some small chance.

View on HN

Even if the VPN provider is doing something naughty-ish, just decoupling netflow info from your IRL id/address/financials/probably TV habits info has value. Even if you can’t control the usage of behavior data by multiple organizations, you can try to “anonymize” it at the boundaries between them. Indirection, to minimize how much becomes associated with your identity.

Really only valid for individual company adversaries though, depends on your threat model I guess.

Edit: it’s sad that I need a threat model

Legit question: What can an ISP collect when most of the time I'm going to secure "https:" websites? I mean, they can only see the website I'm going to, but not what is going on there, right?

Is just collecting where people are going that lucrative to sell?

That + other data can be used to build a behavorial profile so it's not what your ISP is doing necessarily but what the people they sell the data to are doing with it (or the people they sell to)

There's what websites/apps you use, but also your behavior patterns. Are you a night owl? How often do you check some website or app. I'm sure there's a lot of other information they do gather based on the "metadata"

Vpns wouldn't hide the fact you're a night owl, though? The fact of traffic+time is still visible to the ISP?

VPN will hide what you’re doing at night, though.

DNS records and net flow data. They can also inject JS in http sites, hijack domaijs to do the same, do traffic shaping. But I am biased, I work for a VPN company.

Not what they can, what they MUST as required by law. Assuming US, see DTA aka CALEA - at any time little green men with a warrant can ask for tranparrent packet capture of ISP client's traffic.

Also, in many places (Europa) there is collection and retention requirements for ISPs.

The DNS data is super useful for developing a demographic profile.

For example, they could pretty trivially assert with high confidence that a pregnant woman is in your home or that you’re shopping for a car. The tinfoil hat scenarios are interesting as well.

That's assuming the financial incentivize of an intelligence agency is not sufficient to cover the risk.

Reply on news.ycombinator.com