Printable View
Hi guys, I need help...
I suspect that the internet service provider I'm using is compromising my privacy. If someone who works in the ISP company decides to check up on their customers...
1) Is it possible for them to track which websites the customer has been to?
2) If they wanted to, can they get access to the stuff that the customer types, like email passwords, or even email content?
--------------
Yes.Quote:
Originally Posted by secured20
YesQuote:
2) If they wanted to, can they get access to the stuff that the customer types, like email passwords, or even email content?
Yes, in fact there has been some controversy over ISPs selling this information to advertisers/marketeers:Quote:
1) Is it possible for them to track which websites the customer has been to?
http://antionline.com/showthread.php...ighlight=phorm
http://antionline.com/showthread.php...ighlight=phorm
Sort of. What they actually see are the packets or blocks of information that you send via their service.Quote:
2) If they wanted to, can they get access to the stuff that the customer types, like email passwords, or even email content?
So, if you send unencrypted information over an unsecured link, then it can be intercepted and read. Typically, your password would be sent over a secured link but anything you send after that isn't.
A proxy connection won't help, as the ISP is between you and the proxy.
I use GMail and I notice it uses HTTPS, and I thought that means my email name, password, and content are encrypted before sending to the ISP and to the recipient. Are you saying that only the password is encrypted, and my email name and email content is in plain text? That's horrible. Doesn't that mean that people working at ISPs can read any of their customers' emails? That's really outrageous. Please tell me I misunderstood what you wrote...Quote:
Originally Posted by nihil
Damn ISPs. Can't live with them, can't live without them.Quote:
A proxy connection won't help, as the ISP is between you and the proxy.
I don't know the intricate details, but I use Yahoo! The initial logon is over a secured connection which covers the account name and the password.
After that, the actual e-mail is unsecured. Your question would be whether G-Mail continue with the HTTPS connection or not. I suspect that they do not?
There should be a warning when you leave a secured connection, and there might be a little padlock icon at the bottom of the screen if you are still secured.
I am afraid that is what you have to assume unless you know otherwise.Quote:
Doesn't that mean that people working at ISPs can read any of their customers' emails?
Please take a look at this:
http://www.hushmail.com/
Now, what you need to know is where secure e-mail is encrypted. If you have to load an application on your PC to use it then the encryption is probably before you send it. If it is encrypted by the e-mail provider then it will be in plaintext when it reaches your ISP.
Your ISP cannot read it as the information is end-to-end encrypted. Meaning it's encrypted from your machine to Google.. Having said that.. Google is able to read your mail. They won't do that however without a court order.Quote:
Originally Posted by secured20
Yes. The email is stored on their servers. Unencrypted.Quote:
Doesn't that mean that people working at ISPs can read any of their customers' emails?
Fact of life and the reason why things like PGP/GPG exist.Quote:
That's really outrageous.
Hmmm,
The big boys have been caught before in less than democratic environments? they will sell out individuals to protect their corporate interests?Quote:
They won't do that however without a court order.
What constitutes a court order in Holland and England probably means no more than a secret policeman with a gun and an electric cattle prod where he lives?
:zap::shocked:
ISP's being the "middle-men" could theoretically view all of your data coming through (unless its encrypted), and I would imagine a good many of them do keep track of websites visited (including USA even). Email passwords or email content is generally encrypted, so unless they can break encryption algorithms (possible for govt men), then your passwords are cool.
How did these people track you when you posted anonymously on a forum? By your IP address (although, unless you can get the ISP to give you the customers info about a certain IP address by getting a warrant or something, then you can really only tell what city an IP address is from, and not who it belongs to). So if your company is spying on employees, they can at least narrrow it down to what location the perpetrator is writing from.
Jared Braverman
Secnap Network Security
"When choosing the lesser of two evils, your still choosing to be evil" MEQuote:
Originally Posted by Reaction
I got spanked by my company for once posting on an internet forum from my company computer and it was done anonymously. I think in my case the fact that my traffic went through their VPN then through their proxy server made it pretty obvious :-P
If only one of those sites was in your country, that would explain it. The website will have the IP address of posters and the ISP knows whose account was using it. OK, that doesn't prove who was actually using the computer, but:Quote:
I live in a country where personal privacy isn't all that respected. Recently, I've encountered a problem. It seems that some people are aware of some info that I posted in some sites on the internet.
:eek:Quote:
and no one else uses my computer.
If you happen to have cable or satellite then you probably have a static IP address which makes the trace even simpler.
Most companies monitor (log) internet connections from their servers. They would see the traffic going out as well. Most websites show the date and time of posts. You don't need to be a FED to figure it out from there.:DQuote:
I got spanked by my company for once posting on an internet forum from my company computer and it was done anonymously.
Just to add to what was said earlier, e-mail is typically not secure. You can change this, however. If you get an e-mail certificate and your friend gets an e-mail certificate, you can both send e-mail to each other and then import each others certificates. Once that happens, you can send encrypted e-mail to each other that can't be read by someone that might have access to it, whether it is your ISP, a hacker between you and your friend, or anyone else that might somehow gain access to the file.
http://www.comodo.com/products/certi...rtificate.html
I know the ISP I worked for here in the United States of America we had the customers: first name & last name, last 4 digits of SSN, home address and or P.O Box, telephone number, also, username/password for troubleshooting issues and email/sign in issues etc... This is usually obtained by verifying the authentication question aka 'secret question' if they wanted to they could log in and check there email and stuff like that but actually seeing what the user was doing surfing habit wise, nope the only way I know we did when we accessed there computers with remote access software but that was strictly for troubleshooting purposes and the client had to grant permission on his PC to even get it to work. But monitor customer data aka (surfing habits) I don't think so. They may store the DATA on there servers for a period of time but physically seeing the websites hell no.Quote:
Hi guys, I need help...
I suspect that the internet service provider I'm using is compromising my privacy. If someone who works in the ISP company decides to check up on their customers...
and another way would be if the FBI/CYBERSECURITY/NSA/LOCAL POLICE ETC.. supoened your ISP to hand over the information then yup you would be phucked.
1) Is it possible for them to track which websites the customer has been to?
2) If they wanted to, can they get access to the stuff that the customer types, like email passwords, or even email content?
Why you so worried about the ISP monitoring your surfing habits?
Just to answer Nihil's question about Gmail, it is only secured during login to protect the password. Anything sent after that is completely fair game.
Picking off emails is a sport of sort in Washington, D.C. My bro and I had email that ended up over at the eff-bee-eye as a result of his political affiliation years ago. Made me really paranoid for awhile.
If you run Gmail on a client (Outlook, Thunderbird, etc.), SSL is used for both incoming and outgoing mail. That makes it more secure than their web-based interface.
Try JanusVM for a quick off-the-shelf tunneling solution. I generally recommend it to folks wanting the security of a VPN but without the network resources. Be aware, it will slow your internet connection. iPIG is another one. Both would probably defeat your ISP, but who knows what lurks at those endpoints.
http://www.vmware.com/appliances/directory/1168
http://www.iopus.com/iPig/