Stop your ISP from tracking your Net usageBy: Mark Dyer
Posted on: Thursday 04th Jun 2009, 12:45 PM
Alarmingly, ISPs now have the tools to log, analyze, and respond to every bit of data you send and receive.Proxy services can’t prevent ISPs from snooping, but encryption can — although you need to know about some significant limitations.
Confidential business data may need protection Last year, Charter Communications, a major U.S.-based Internet service provider, started using the data it was collecting regarding its clients’ online behavior in order to target specific ads to users. Rumblings from Congress helped kill that plan, and NebuAd — the company Charter was working with on the project — recently closed its doors.
While both Congress and the FCC — as described by the Cable360.net site — are considering Internet privacy regulations, no laws yet exist in the U.S. to adequately protect against similar schemes.
Meanwhile, another targeted-advertising firm named Phorm is doing good business in the U.K. and claims to have been assured by the British government that its service is legal.
According to a recent Associated Press story, Phorm has "struck partnerships with three access providers reaching 70% of Britain’s broadband market — BT Group PLC, Virgin Media Inc., and Carphone Warehouse Group PLC’s TalkTalk … BT has completed its trial of Phorm’s ad-targeting service and expects to deploy it this year." Phorm claims to ask for the consumer’s explicit approval to receive targeted ads.
While U.S. service providers don’t (yet) seem to be actively selling information about your Internet usage, there are no guarantees that clones of NebuAd won’t surface. The profit potential for ISPs in this entirely new revenue stream is just too huge for them to ignore.
According to a NoDPI.org
report, other firms seeking to use ISP data for marketing purposes include KindSight, Experian Hitwise, FrontPorch, and Adzilla.
Even if Congress ends up banning deals with such targeted-advertising firms for privacy reasons, many providers are now using the same deep-packet inspection (DPI) tools for other purposes that may infringe on your Internet usage — such as bandwidth throttling and capping.
For example, an Ars Technica article states that in Canada "just about every major ISP in the country has admitted to regulators that it uses DPI gear to throttle traffic, often singling out P2P protocols."
There are also no guarantees that governments themselves will not seek to use DPI in surveillance or censorship efforts. At worst, this can lead to human-rights abuses — already a reality in many countries, as
reported by the OpenNet Initiative and NoDPI.org. At best, there’s yet another database floating around with your information in it, waiting to be compromised.
Many people have perfectly legal needs for confidentiality, including those who’ve signed nondisclosure pacts or are working on undisclosed mergers and acquisitions. The only way to truly ensure your online privacy in these and other such situations is to take matters into your own hands.
Proxy servers provide a false sense of security Given the very real use of deep-packet inspection by ISPs, what can law-abiding Internet users do to protect themselves against possible snooping of their e-mail and Web-surfing habits?
Many people believe that using a proxy server is enough to keep their activities private. Corporations, schools, and libraries often use proxy servers to filter content and provide security. In reality, proxy servers alone do nothing to prevent ISPs from monitoring your data transmissions.
Proxy servers work by putting an intermediate IP address — a "proxy" — between you and the sites you visit. If you do all your surfing through a proxy, your URL requests go through the proxy server before being passed to the sites you visit.
This hides your IP address from the target Web site, which sees only the proxy’s address. This means sites that record IP addresses won’t be able to identify you or pass on your address to others, including government agencies or the Recording Industry Association of America (RIAA), which is always on the prowl for what it considers copyright infringement.
Conversely, proxy servers hide the URL of the target site from a governmental, corporate, or school firewall. This lets you surf to sites that the organization may be blocking, such as Facebook. (It’s been widely reported that China blocked access to YouTube, Flickr, Twitter, Hotmail, and numerous other sites beginning June 2, two days before the 20th anniversary of the Tiananmen Square massacre, as described by the
Huffington Post).
When you use a proxy server, all the organization’s firewall sees is the URL of the proxy. This is why proxy servers are frequently used by file sharers. However, eluding the RIAA is not the same thing as protecting your legitimate need for privacy and unfettered Net access.
Even with a proxy server, all your surfing still has to go through your ISP, which can use packet filtering to log that data. For true privacy, the entire data path needs to be protected, not just the upstream portion.
Most proxies are operated by fleeting and anonymous entities: only 25% of the nearly 32,000 proxy servers listed on the Proxy.org site are actually working, and a mere handful are labeled as "recommended."
Not one of the proxy sites Proxy.org lists is run by a big-name company that the average person would have heard of or would have reason to trust.
The fleeting nature of proxy sites is partly due to necessity, since proxy servers quickly get put on block lists. But the here-today-gone-tomorrow nature of proxies can make them unreliable and somewhat dangerous to use. (You can check out the ever-changing roster of proxy servers at Proxy.org, but note that your security software may flag this site as unsafe).
Encrypted proxy servers like Proxify.com and the
Tor Project can shield your traffic from your ISP. But they don’t encrypt traffic between their servers and your final destination.
Even worse, public proxy servers are attractive fronts for cybercrime. Operators can easily read all traffic passing through their servers, redirect your URL requests to phishing sites, or inject malware into downloads.
The Tor Project itself, which depends on volunteer proxy hosts, warns that "malicious or misconfigured Tor exit nodes can send you the wrong page or even send you embedded Java applets disguised as domains you trust."
Finally, if the proxy or VPN service keeps logs — although many claim not to — a subpoena or government-agency order could force the service to disclose information about you.
Bottom line: There’s just no way to be sure such services are legitimate, or even that they work at all. File sharers likely won’t care, but anyone who has a legitimate concern about privacy and safety certainly will.
What you can do now to safeguard your online privacyGiven all these caveats, is there any real solution for protecting your Internet activities from prying eyes? For true online privacy, you need to encrypt all your Internet traffic from end to end, making deep-packet inspection tools fail. DPI tools that can crack strong encryption may become a reality in the future, but it’s not going to happen any time soon.
Fortunately, for most people who aren’t named Barack Obama, end-to-end encryption is overkill. If you’re not hiding from law-enforcement agencies or foreign intelligence services, you can get all the protection you need by combining a reliable VPN service — one that prevents ISP data collection and hotspot snooping — with an encryption-enabled e-mail client.
Paid VPN services like the well-known Witopia.net, which provides an encrypted tunnel between you and a VPN server, generally cost a few dollars a month. The services work not only for Web browsing but for all your Internet traffic, including e-mail, chat, and automatic software updates. Once turned on, VPN services work transparently, and the paid services are usually pretty fast. Such networks are especially popular with Wi-Fi hotspot users, since they also protect against wireless snooping.
Gmail and other major webmail services offer encrypted Secure Sockets Layer (SSL) access, which is indicated by the URL prefix
https. But like a VPN or encrypted proxy, SSL works only between your computer and the mail server. Data leaving your provider’s servers is unencrypted.
For most people, this level of protection is sufficient. However, very sensitive e-mails and chat sessions require end-to-end protection, such as PGP (Pretty Good Privacy) and other public-key encryption software. In order to read your messages, however, your correspondent will need to use the same software, which can be a hassle.
For occasional use, an easier encryption method is to send a password-protected Word, PDF, or .zip file as an e-mail attachment, then deliver the password to the recipient by a separate channel, such as a phone call or text message.
The Skype VoIP service is encrypted by default, which makes it the best way to chat securely with no added effort. Google, for its part, is currently testing built-in support for PGP in Gmail. This would make end-to-end encryption much easier to use in that service. Look for PGP support as a
Gmail Labs topic soon.
If you want or need more privacy than that — well, you probably shouldn’t be using the Internet for sensitive communications at all.
