Hacker News new | past | comments | ask | show | jobs | submit login

> Because you are not a unique and special snowflake. If you regularly go to /r/The_Donald, it says something specific about your politics (probably). Same for /r/LateStageCapitalism or /r/trees. It might not say much, but it adds up to a profile of who you are and what you think about.

They won't be collecting that information though. They'll only see that you visited reddit.com in all those cases.




Bad news for https://howtoopenanumberedaccount.com visitors (Host header in plaintext) and people who click on links to http://ponies.net from https://reddit.com/r/LaunderYourCash (Referer header in plaintext)


AFAIK browsers will not provide a referrer if the previous page in case you go from https to http. Firefox has an option to disable https to https referer sharing btw.


Presumably the non-https assets which get pulled in when the main request is fulfilled could also act as a "fingerprint" of the page you are visiting?


Excuse my ignorance but won't they have access to the whole URL?


From the article: "Those ICRs in effect serve as a full list of every website that people have visited, rather than collecting which specific pages are visited or what's done on them."

And from another site on the same issue: "When you visit a website you usually start at the websites homepage such as www.bigbrotherwatch.org.uk/ the Government define this part of a website address (the part before the first forward slash) as communications data which they consider to be non-intrusive information." (https://www.bigbrotherwatch.org.uk/wp-content/uploads/2016/0...)


In fairness the law mandates they record the domain, it doesn't say anything about capturing more it just sets a standard for the minimum.

Given that the ISP's have now been given cart blanche to collect data that is very commercially valuable I can see some of them doing it with the hope they can sell it later.


For http sites they have access to whole url and everything that is submitted, for example all commments you write.

For https sites (green lock icon) they only know domain name, for example reddit.com


As long as the site uses https (reddit does), then the path is encrypted, the only part of the URL thing they'll have access to is the host.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: