Acacia Innovations Technology (AIT)’s Post

Transcript

Can my ISP monitor my Internet connection? Hi everyone, Leo Notenboom here for askleo.com. Here's an example of a question that I get, well, fairly often. Can't employees at a local ISP read my emails and monitor my web surfing and tell others about what they read and see? Yeah, yes, they can. Absolutely. Your ISP can see basically everything that you're up to, everything that flows across the connection that they provide to you to get to the Internet. Now the real question is why would they? Are they? Ohh, I'd probably not. And yet there are some new concerns that in some cases, yeah, they could be even required to. So let's have a look at what it means. And why? It's not as huge an issue as most people are concerned about and why it might become a little bit of an issue for some and what to do about it if it is so your ISP, Well, whatever connection you have to the Internet, it is provided by someone. That someone is your ISP. Normally we think of that someone as being the business that we are paying every month to get our connection at home or at work. But in reality, if you go to the library while they suddenly become your ISP, if you go to a coffee shop and use open Wi-Fi. They suddenly become your ISP. So the nature of what it means to provide Internet gives that person or that company actually an interesting view into exactly what you're up to. If they choose to look, they don't. I mean, unless there's some reason for them too, and they're rarely is, they don't. They've got more than enough other things to do. Now one of the things that scares people is location. Based on your IP address, which of course the ISP knows. I've got many, many articles on why that's not a thing. But the most important thing here is that yes, your ISP, especially the one at your home, knows where you live and it knows your IP address, so it could put the two of them together. They know where to send the bill, so they do not give that information to anyone without a court order or generally without some kind of. Government interaction, depending on the country you happen to be living in. But here in the United States, they need a court order. They're not gonna tell anybody where that IP address goes to unless they're faced with a court order. So unless you'll find yourself in a legal situation where this might be important, it's really nothing to to worry about. Can they monitor what's going on? Well, of course they can see all of the data going back and forth from your equipment to their equipment. That's the nature of what it means to connect to the Internet. They have equipment that gives you the connection. Would they? I just, I really still don't think weird, that interesting again, unless you're in trouble with the law. And again, I guess again, perhaps if you're in some country where surveillance is more significant deal, maybe there's an issue. But by and large, no, they're just not looking. They've got better things to do. However, what if you still want to protect yourself? Well, there are a couple of ideas that I have that you can do to protect yourself to varying degrees. The number one thing is HTTPS. Now, originally HTTPS was not everywhere. If you're using an HTTP connection, then all of the data that goes between you and the website can be viewed by anybody who's looking in, including your ISP, so they can see the request. Sending to the website, they can see the web pages that are coming back and so forth. However, any connection that uses HTTPS for secure is encrypted, so nothing that goes back and forth is visible to anybody other than you and the website you're talking to. However, your ISP can still see that you are connecting to that website. That part is not obfuscated, only the conversation you're having. That website and you can go to another extreme and use anonymous web serving services like Tor which will encrypt you. It will basically bounce your information all over the planet and in an effort to basically completely make your location and who you are anonymous as it can be two things to know about that. One is the people at the other end, the people that you're connecting to. They probably have a reason to know who you are for. Example, if I were to use Tor to connect to my bank, well nobody in between would have an any idea who I was, where I was coming from. But of course the bank does, because I'd have to log in part of logging in as telling it who I am. So there's definitely a caution. And of course Tore tends to be painfully slow, but Tor is the other extreme. Encrypted e-mail is kind of a middleman in the sense that e-mail is generally sent via HTTPS or SSL connections, but it doesn't have to be. And if your e-mail is stored anywhere for any length of time, even temporarily, that e-mail is not encrypted. It's only the connection that's encrypted, but what it's actually stored. On some servers hard drive, there's no additional encryption. That means you would need to encrypt the contents of your e-mail. In order to keep it safe, that tends to be painful as well. Now, the most common response to this topic is that you should be using a VPN. And while a VPN is a very, very good solution, it actually replaces one problem with another. Here's the thing. When you connect to a VPM, your ISP at home or at work or whatever, they cannot see what you're doing. They can see that you've connected to a VPN, but they can't see anything beyond that. They can't see what sites you go to. They can't see what data is exchanged. They can't see any of the Internet traffic that's traveling over that VPM. But in a very real sense, that VPN provider is now providing you. With the connection to the Internet, in other words, they became a kind of Internet service provider for you. And yes, the VPN provider could in theory see everything you're doing, just like any ISP. So what that means is that yeah, a VPN is a good solution, especially if you don't trust your local ISP, but you have to trust your VPN. It's a good solution for many situations, but. It is not a perfect solution. I don't think there is a perfect solution. Now there's one, I'll call it an open question that I think is just an area of concern. And that is simply that various governments around the world have started to either require or even just think about requiring that ISP's collect a certain amount of data about their customers. How much that is, what that is, we really have no way of knowing in some places. That you can't use a VPN or you're actually playing a game of whack A mole to find out how to connect to your VPN because your local government keeps blocking it off. But the bottom line here is that for the most part, we don't really know necessarily what your government may be requiring of your ISP's. In most cases, it tends to become very public very quickly, as you suddenly are unable to do certain things. Ultimately, there's really no way to know for sure. So what does it all mean? What? You, you and I. What should you and I be doing about all this? Well, it really all comes down to a pragmatic risk assessment. Most of us, we're not really at risk. But if you're doing something sensitive, if you're doing something that is, you know, nuclear codes, company secrets, all that kind of stuff, then yeah, you may want to consider some of the ways you can keep your connection more private than it is by default. But by and large, you and I. Really don't need to be worried about our ISPs. For updates for comments, for links related to this topic and more, visit askleo.com slash 3004. I'm Leo Notenboom and this is askleo.com. Thanks for watching.