[JohnTHaller]

It's worth nothing that the vast majority of Americans have their internet setup as defaulted. So, every DNS request goes to the ISP's DNS servers (your ISP knows every single domain you visit regardless of association with Google/Facebook) and every domain name that doesn't exist winds up at the ISPs own search/not found landing page. Plus if you use your ISP's email server (like my mom) who knows if they're reading your email, too.

[bretpiatt]

They are reading your emails and selling that data too, Yahoo is now owned by Verizon: https://www.fastcompany.com/90229354/yahoo-and-aol-are-readi...

[JohnTHaller]

For some stats behind this, the most recent estimate of websites with Google Analytics is around 40 million (1). A rough estimate of the number of websites would be around 1.5 billion (2).

1. https://trends.builtwith.com/analytics/Google-Analytics

2. https://news.netcraft.com/archives/2018/06/13/june-2018-web-...

[908087]

Not sure if you're trying to be intentionally misleading to "win" an argument here, but look at the stats for the top 1M, 100k, and 10k sites if you want to be honest about the portion of actual web traffic Google is able to capture detailed data on.

The fact that "Uncle Joe's Fishing Blog" with a total of 5 hits that weren't crawlers or Uncle Joe doesn't include GA, doesn't really mean much in the context of this discussion. The vast majority of traffic on the web goes to a very small portion of those 1.5B sites.

[JohnTHaller]

I was simply providing context for the point. It's also worth pointing out that quite a few of the top 1M, 100k, 10k sites do not use Google Analytics or Facebook.

[908087]

DNS requests only give the hostname. Google/Facebook's analytics services get them pretty much everything about the users' interactions with sites that include them.

I'm not arguing that ISPs aren't a privacy risk or that they shouldn't be fought. I'm pointing out that Masnick damages his own credibility by making stupid claims that, in order to be believed, would require either a technically unskilled reader or one who is willing to pretend the modern web/internet works differently than it does.

Masnick attempts to frame this debate in a way where everyone who doesn't join him in ignoring/defending the privacy violations of Silicon Valley tech companies is "on the other side". It's a dishonest and shitty way to frame things, and doesn't reflect reality in any way.

ISPs have plenty of black marks against them. Lying in order to pretend ISPs are the only ones we should be fighting isn't helping anything.

[snowwrestler]

It's a shame you're getting downvoted because you are correct. The dramatic acceleration of TLS adoption means that your ISP is getting less and less info about their customers' behaviors.

But if your browser has ever logged into something like Facebook or Google, then any site with embedded content will be sending info about your behavior back to them. A LOT of sites carry pixels from those companies, but anything can do it: an embedded tweet, a YouTube player, a "like" button, etc. This is on top of the info they collect from your direct interactions with them.

[bretpiatt]

He's not correct which is why he's being downvoted. As TLS rolls out further I suspect you'll see more ISPs move from firewall/router devices being deployed with their service to an edge proxy under the guise of additional security, "our new routers terminate all connections before they reach your computer directly allowing us to block malware and other dangerous packets" -- while that statement is 100% true what it doesn't say which is also true is "...and allows us to see all of the information on all of your sessions and process that per the terms of our privacy policy".

[908087]

Your argument is that I'm wrong because of some theoretical situation which hasn't happened, and would be near impossible for ISPs to implement without massive backlash from pretty much the entire internet/world?

[tedunangst]

Which browsers are going to trust an ISP signing cert?

[bretpiatt]

As the ISP I'd pop up a reply asking you to load my certificate into your browser, example for Chrome: https://support.google.com/chrome/a/answer/3505249?hl=en

With a notice informing you if you refuse you won't get the malware blocking and scanning services to protect you. Depending on the laws the ISP may require you to accept the certificate in order to pass TLS traffic.

[jrockway]

You are debating a different argument than the comment you replied to makes. The argument is not "who is worse? they're both bad", it's a numerical analysis positing that the number of websites without domain names is smaller than the number of websites without Google Analytics. Your ISP tracks you every time you visit a website with a domain name. Google Analytics only tracks you when you visit a site that's enabled Google Analytics.

[xg15]

Then again, with Chrome, there is at least the technical possibility of Google tracking every single website you visit just as well (including http, https and now even sites that just sit on your LAN and don't hit the ISP at all)

I don't say they do, but my trust in Google not to do this isn't that much higher than ISP s not doing this.

(Though, to be fair, code doing this would probably be found rather quickly in the Chromium code. So they'd have to add it to the Chrome binary directly.)

[mrkstu]

Well they do, in point of fact. I was debugging our corporate proxy and tailing the logs for a particular site- when using chrome I matched the site string despite it being directed to bypass proxy- but not going to the site, but to google, despite putting a full url in.

Anyone wanting to truly understand what chrome is doing should run an ssl decrypting proxy on their web traffic for awhile- it is eye opening.

[jrockway]

Perhaps more interesting is that Chrome is happy to send data to google.com without checking the certificate. I'd file a bug.

[mrkstu]

Yep, their not pinning that cert, but I think this is purposeful to continue to function in corporate environments like ours where we deploy our own Cert chain infrastructure. So the OS and transitively the browser is seeing a 'valid' certificate if you're browsing from a company computer.

Firefox on the other hand, you have to import the whole CA chain into the app itself for it to work transparently, since it won't reference the OS cert store.