Hacker News new | ask | show | jobs
by mtmail 1318 days ago
It's in their interest to be vague but at the same time claim lots of source.

Some United States ISP sell anonymous browsing data. The data is still grouped by home connection. With SSL these days that only contains domain names but in the past it contained full URL. One was able to correlate if somebody searched for a product on shop A but then finished checkout on shop B. 15 years ago I dealt with such data, kind of scary. So you can correlate that people who visit one domain regularly also visit certain others.

DPS sounds like data processing, so intermediary that resells data or summaries. For example they might have data from browser toolbars, widgets on multiple websites or anybody else who sells user data.

Google Analytics: when you crawl pages you can extract the GA id and some companies use the same id on multiple domain. Thus you correlate they have the same owner. Similar with any other type of id or apikey one might use on the website, e.g. Google Maps API key.

Add some data on domain-to-IP address to see if a two websites are hosted on the same server.

> How can ISP's provide the data?

In the US it's part of the terms of service

https://www.netzero.net/start/landing.do?page=www/legal/your...

"we have collected the following categories of personal information from its consumers within the last twelve (12) months: "

- "Age (40 years or older), marital status (title), sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions)."

- "Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement."

- "Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes."

"We share your personal information with the following categories of third parties:

    Service providers.
    Advertisers.
    Affiliates.
    Partners."
I'd argue all information an ISP has no business with.
1 comments

Thanks for your feedback mtmail

Just to brainstorm:

Would they buy advertising results via vendors, e.g. https://developers.google.com/third-party-ads/googleads-vend...?

Or/And approach popular browser extensions; popular plugins with an offer to buy data, via GA or other tools?

Regarding ISP's, currently with SSL, i don't see how they do it unless the ISP's are using a man-in-the-middle HTTPS proxy against websites with non-pinned SSL certificates - but that is ilegal, correct? So, i'm still puzzled

There's a whole industry of data brokers buying data https://www.cbsnews.com/sanfrancisco/news/verizon-att-end-lo... It can be deals with apps/widgets/website/software-libraries or even buy-out of an app. https://www.denverpost.com/2019/07/28/online-data-for-sale-p...

You're right with ISPs. These days they'd only be able to see the domain name. That part of the HTTP header is unencrypted. Man-in-the-middle won't work, as you said, due to certificate pinning.