Global Privacy Control vs ISPs

[mjp66]

@Steve

1. In Security Now #869, you talked about Global Privacy Control. Do ISP's need to (also) abide by an enabled GPC flag and not snoop / re-sell your data, as that data transitions through them?

2. I wrote "Ubiquiti Home Network" document, You mentioned it in SN#641 and SN#649. See own link farm. Probably time for another SN mention, given current state of IOT devices and need for their isolation. Document has about doubled in size since then.

Thanks,
-Mike Potts

 

[PHolder]

as that data transitions through them?

It would be a very poor web site that doesn't use SSL in this day in age. In the case of SSL all the ISP could "see" is IP addresses, and while that tells them something (meta data about WHO you are interacting with) it gives them no clue about the content. There are also DNS lookups, which would default to your IPS's DNS, but you can easily change that with DNS over HTTPS other enhancements.

 

[mjp66]

@Steve @PHolder

But isn't he first handshake (including GPC / flag (header) in the Clear? i.e. before the encryption is started?

 

[PHolder]

first handshake

The first handshake is merely a negotiation of capabilities. None of the site's content would make an appearance. There would be no more information gained than knowing the site you were going to, and possibly the quality of their encryption, and that would already be known if your communications were being monitored.

Here's a colloquial description of the handshake. https://d1smxttentwwqu.cloudfront.net/wp-content/uploads/2015/07/SSLTLS_handshake.png

 

[miquelfire]

I think SNI would include the DNS hostname in plain text in the first step of that image.

 

[PHolder]

SNI would include the DNS hostname

It would, but they changed that in recent TLS implementations, so I decided to not mention it to avoid the extra confusion.

https://www.cloudflare.com/en-ca/learning/ssl/what-is-encrypted-sni/