1

It's very unclear what '12 months' browsing history being kept by network provider' actually means to an uninformed person. Thunderbird? VPN? Startpage searches? Bit-torrent downloads? Epic browser (in Windows)? Proxy browsing? Proxy browsers eg xombrero? Can anyone clarify? Does using firefox security addons like noscript change what they can see? Thanks a lot!

  • 3
    Can you provide links with the details of what they're proposing for those outside the UK so we can interpret them. Australia has tried to do something similar... and I can assure you that the people who created the policy have less of an understanding than you... – thexacre Nov 1 '15 at 1:01
6

Currently, the measure is just an idea. It is not even an idea by a politician. It is an idea by the UK police. The exact wording for such a law is not made yet, so we can just guess how it could look.

However, this article by The Guardian gives the impression that the idea is to have the internet service providers do the snooping:

Senior officers want to revive the measures similar to those contained in the“snooper’s charter”, which would force telecommunications companies to retain for 12 months data that would disclose websites visited by customers

So the rest of this answer focuses on the question what information can your internet service provider collect about your internet activity?

Web browsing in general

A web browser has two ways to request websites. The unsecure http:// protocol and the secure https:// protocol. Not all websites support both modes of operation. Stackexchange is one which does. Which mode is used can be seen in the address bar.

When you read this text via http, your internet service provider will know that you just visited http://security.stackexchange.com/questions/104284/what-browsing-history-exactly-would-police-have-under-proposed-uk-law-change-pl. They would also be able to log the complete content of the text your read right now.

When you browse this website with https, the data trail is a lot smaller, because the communication with the webserver was encrypted. All your ISP just learned about you is that you requested something from https://security.stackexchange.com, how many bytes you sent and how many bytes you received. But they can not infer from this information that you read this exact question.

Thunderbird?

Email can be accessed encrypted or unencrypted. Check the server settings in your account settings to see what security mode Thunderbird is using (should be "SSL/TLS" or "STARTTLS"). When encryption is enabled, all your ISP can learn is which email provider you use, how often you check your email and how much email (in byte) you send and receive.

However, even if you access your email encrypted, the exchange of the emails between mailservers might have been unencrypted. Generally, email should not be considered a secure medium. Encryption addons for email (like PGP) can protect the content, but not the meta-information (sender and receiver address).

Startpage searches?

startpage.com always uses https, so they will learn when you used it, but not what you were searching for and what results you received.

Many search engines always use https, by the way (Google, DuckDuckGo and Yahoo do, Bing does it only on request).

Keep in mind that when you actually visit one of the search results, that request might or might not use https (see "Web browsing in general" above).

Bit-torrent downloads?

Bit Torrent is always unencrypted. An eavesdropper can learn what files you share and who you are sharing them with. In order to do that, they don't even need to be an ISP, by the way. Joining the same torrent swarm as a client is enough. Information obtained that way is frequently used by companies to press legal actions against filesharers who violate their copyrights.

Proxy browsing?

Proxy servers can be encrypted or unencrypted. Unencrypted proxy browsing doesn't affect the eavesdropping capabilities of the ISP at all. When the connection to the proxy is encrypted, they know that you used the proxy, but not what information you accessed through it. However, if an attacker can also monitor the outgoing traffic of the proxy server, they might be able to correlate it with your requests based on timing.

VPN?

Internal traffic inside a virtual private network is always encrypted. When you use a VPN as a proxy to access websites, then the situation is identical to an encrypted proxy server.

noscript?

Sometimes Javascript applications on otherwise encrypted websites can cause the web browser to make unencrypted requests. Under some circumstances this might provide an eavesdropper with additional information.

Epic browser (in Windows)? xombrero?

I am not familiar enough with these products to provide a good answer, but I don't think they can do anything which is not already covered by the points mentioned above.

  • Before someone comments that with https the ISP would only learn that you accessed 198.252.206.16: Remember that there will be a DNS query before the HTTPS request, and that in most cases the DNS server will also be under the control of the ISP. – Philipp Nov 1 '15 at 2:40
  • 3
    Not only DNS but browsers use SNI so the name of the target host is actually contained in each SSL handshake in clear and can be easily extracted with passive sniffing. – Steffen Ullrich Nov 1 '15 at 5:19
  • Thunderbird is an IMAP client and technically doesn't access websites. Almost every mail server these days has a webserver/webmail interface, but if you want to hold the b@5turds to the letter of the law, reading email over IMAP is /not/ visiting a website. – Petro May 21 '18 at 21:53
  • An ISP would definitely be aware of when a person is using a VPN service, but without directed effort wouldn't know what is being done behind the VPN. – Azxdreuwa May 22 '18 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.