Computer Security - Can my ISP see my NNTP traffic?

Author

Can my ISP see my NNTP traffic?

Regal

2004-04-07, 10:46 am

I want to take part in discussions which I don't want my ISP
snooping around in.

Can my ISP see my Usenet traffic to the extent that the ISP can see
if I post to or download from a given newsgroup if I use a
newsserver which is not operated by them?

For example, I use BTopenworld as an ISP in the UK. If I post this
Usenet message via the independent Astra newsserver then can
BTopenworld see what I have read/posted by examining the traffic
passing through their server. Can they tell which newsgroups I
used to post or read?

If they CAN do this they how EASY and how LIKELY is it for them to
actually do it?

---

And what about for protocols used by Kazaa and other file sharing
prgrams?

Stephen K. Gielda

2004-04-07, 10:46 am

In article <94C495766E51A628D1@64.62.191.200>, smith@yahoo.com says...
> I want to take part in discussions which I don't want my ISP
> snooping around in.
>
> Can my ISP see my Usenet traffic to the extent that the ISP can see
> if I post to or download from a given newsgroup if I use a
> newsserver which is not operated by them?
>
> For example, I use BTopenworld as an ISP in the UK. If I post this
> Usenet message via the independent Astra newsserver then can
> BTopenworld see what I have read/posted by examining the traffic
> passing through their server. Can they tell which newsgroups I
> used to post or read?
>
> If they CAN do this they how EASY and how LIKELY is it for them to
> actually do it?

Yes, your ISP can easily see traffic going across their network. They
can easily see and save the contents of said traffic when it is
unencrypted. If you want your ISP to be unable to see the contents of
your usenet traffic, find a service that offers SSL with their usenet.

/steve
--
Protect yourself on-line. Hide your identifying details in e-mail,
usenet, and more. A privacy service like no other.
No one gives you more control over your e-mail than we do!
http://www.cotse.net/servicedetails.html

kulm_nd

2004-04-07, 10:48 am

They have every packet going through their servers so of course they could
see what you are doing. The odds are slim, most ISP's could care less where
you go or what you post until they get a subpoena. It can be done easily as
the Feds have shown but must be targeted by IP or username.
--

****************************************
********

g-w

"Regal" <smith@yahoo.com> wrote in message
news:94C495766E51A628D1@64.62.191.200...
> I want to take part in discussions which I don't want my ISP
> snooping around in.
>
> Can my ISP see my Usenet traffic to the extent that the ISP can see
> if I post to or download from a given newsgroup if I use a
> newsserver which is not operated by them?
>
> For example, I use BTopenworld as an ISP in the UK. If I post this
> Usenet message via the independent Astra newsserver then can
> BTopenworld see what I have read/posted by examining the traffic
> passing through their server. Can they tell which newsgroups I
> used to post or read?
>
> If they CAN do this they how EASY and how LIKELY is it for them to
> actually do it?
>
> ---
>
> And what about for protocols used by Kazaa and other file sharing
> prgrams?

Frank Slootweg

2004-04-07, 10:49 am

Regal <smith@yahoo.com> wrote:
[deleted]
> For example, I use BTopenworld as an ISP in the UK. If I post this
> Usenet message via the independent Astra newsserver then can
> BTopenworld see what I have read/posted by examining the traffic
> passing through their server.

It (the traffic) does not "pass through their server", or or least not
through a "server" in the normal meaning of that term. Your system (PC)
does have a 'direct' TCP/IP connection to the Astra newsserver, i.e.
there are no intermediate servers (as there for example *might* be for a
web-browser connection).

> Can they tell which newsgroups I
> used to post or read?
>
> If they CAN do this they how EASY and how LIKELY is it for them to
> actually do it?

Yes, I'm sure they can monitor the TCP/IP traffic and hence the NNTP
traffic which travels on top of that. Whether they do it and whether
they are *allowed* to do it, is probably a matter of their ToS (Terms
of Service) or/and UK law.

[deleted]

Allan Birnbaum Ditlevsen

2004-04-07, 10:50 am

sorry to bother you kulm_nd but is subpoena?
allan
"kulm_nd" <kn@NOISP.net> skrev i en meddelelse
news:0LTcc.9163$X44.4752@newssvr32.news.prodigy.com...
> They have every packet going through their servers so of course they could
> see what you are doing. The odds are slim, most ISP's could care less
where
> you go or what you post until they get a subpoena. It can be done easily
as
> the Feds have shown but must be targeted by IP or username.
> --
>
> ****************************************
********
>
> g-w
>
>
> "Regal" <smith@yahoo.com> wrote in message
> news:94C495766E51A628D1@64.62.191.200...
>
>

Lassi Hippeläinen

2004-04-07, 11:47 am

"Stephen K. Gielda" wrote:

>... find a service that offers SSL with their usenet.

If the messages appear on a public newsgroup anyway, what's the purpose
of encrypting it in flight?

SSL doesn't make sense, unless it goes via an anonymizer. Even then the
really paranoid would want a random-delayed anonymizer to prevent
identification by timing.

-- Lassi

kulm_nd

2004-04-07, 12:35 pm

A subpoena is a court issued order to turn over certain information such as
who the person behind the username really is and their address etc. There
needs to be probable cause to believe a law has been violated or there is
evidence of a crime before the court issues a subpoena (except under the
Patriot Act which can use a special secret court). The Feds can get a
subpoena to attach what used to be called Carnivor (hardware and software
attachment) to watch the traffic of a single user.

The RIAA has tried them to find out who is downloading and uploading music
files through civil not criminal proceedings.
--

****************************************
********

g-w

"Allan Birnbaum Ditlevsen" <abditlevsen@mail.dk> wrote in message
news:40740c6e$0$252$edfadb0f@dread12.news.tele.dk...
> sorry to bother you kulm_nd but is subpoena?
> allan
> "kulm_nd" <kn@NOISP.net> skrev i en meddelelse
> news:0LTcc.9163$X44.4752@newssvr32.news.prodigy.com...
could[color=darkred]
> where
> as
>
>

Stephen K. Gielda

2004-04-07, 1:45 pm

In article <40741682.340AB164@welho.compromised.invalid>,
lassi.hippelainen@welho.compromised.invalid says...
> "Stephen K. Gielda" wrote:
>
>
> If the messages appear on a public newsgroup anyway, what's the purpose
> of encrypting it in flight?
>
> SSL doesn't make sense, unless it goes via an anonymizer. Even then the
> really paranoid would want a random-delayed anonymizer to prevent
> identification by timing.

It certainly does make sense, your downloads aren't ending up on a
public newsgroup. Most people who ask about this are more concerned
with what they download or read and not what they post.

/steve
--
Check out Cotse's Privacy Watch.
A comprehensive information resource.
http://www.cotse.net/privacy/

James

2004-04-07, 6:33 pm

"Frank Slootweg" <this@ddress.is.invalid> wrote in message
news:40740ade$0$64611$4a441750@news.wanadoo.nl...
> Regal <smith@yahoo.com> wrote:
> they are *allowed* to do it, is probably a matter of their ToS (Terms
> of Service) or/and UK law.

It is UK law to require traffic data to be retained for a lengthy period -
this is the reason why times of downloads in UK have increased markedly in
recent years. Some interpretations of the law include content data as well
and it is still undecided whether this offends against any rights of privacy
introduced by the Human Rights convention. As you may know there is no real
concept of privacy in the UK other than that imposed by EU directives and
the UK government is widely known as the most nosey and paranoid in the
world.

James

Rowdy Yates

2004-04-07, 10:36 pm

"kulm_nd" <kn@NOISP.net> wrote in
news:7vVcc.9208$BA4.7488@newssvr32.news.prodigy.com:

> A subpoena is a court issued order to turn over certain information
> such as who the person behind the username really is and their address
> etc. There needs to be probable cause to believe a law has been
> violated or there is evidence of a crime before the court issues a
> subpoena (except under the Patriot Act which can use a special secret
> court). The Feds can get a subpoena to attach what used to be called
> Carnivor (hardware and software attachment) to watch the traffic of a
> single user.
>
> The RIAA has tried them to find out who is downloading and uploading
> music files through civil not criminal proceedings.

there is NO anonymity on the internet. subpoena or no subpoena. just about
every single system/hw device/whatever on the net logs. have you any idea
how many for those things your traffic goes through?

a hacker may escape detection. if you are posting your question on public
ng's, you have no chance. so whatever you are doing online, if it's
illegal, just don't do it. don't be stupid.
--
Rowdy Yates
-------------------------------
"the man who tried and failed"

Barry Margolin

2004-04-08, 2:33 am

In article <Xns94C4DFDAEF900rowdyyates2lycoscom@66.185.95.104>,
Rowdy Yates <rowdy_yates2@remove.lycos.com> wrote:

> there is NO anonymity on the internet. subpoena or no subpoena. just about
> every single system/hw device/whatever on the net logs. have you any idea
> how many for those things your traffic goes through?

While it's normal for servers to log their activity, it's very unusual
for routers to keep detailed traffic logs. Most ISP routers have the
ability to log these details, but the overhead makes it prohibitive to
use it except when there's something specific you're looking for
(typically when you're trying to troubleshoot network problems).

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA

Frank Slootweg

2004-04-08, 5:38 am

James <Jakub.Klein@unbekkent.de> wrote:
> "Frank Slootweg" <this@ddress.is.invalid> wrote in message
> news:40740ade$0$64611$4a441750@news.wanadoo.nl...
>
> It is UK law to require traffic data to be retained for a lengthy period -
> this is the reason why times of downloads in UK have increased markedly in
> recent years. Some interpretations of the law include content data as well
> and it is still undecided whether this offends against any rights of privacy
> introduced by the Human Rights convention. As you may know there is no real
> concept of privacy in the UK other than that imposed by EU directives and
> the UK government is widely known as the most nosey and paranoid in the
> world.
>
> James

I am not an UK-resident [1], but I think you are mistaken. What is
retained is traffic *related* data, not (all) traffic itself. With
broadband services it is (effectively) *impossible* to log all traffic,
especially all download traffic and all 'foreign' traffic (i.e. traffic
from/to servers outside the ISPs domain). So an ISP (i.e. BTopenworld in
this case) might log things like "*My* customer A has downloaded/posted
articles X/Y/Z from/to *my* server B.", but it will not log things like
"*My* customer A has downloaded/posted articles X/Y/Z from/to *ISP_B's*
(i.e. Astra in this case) server B.". Of course these things can change
when there is a (founded) suspicion of a crime (and associated court
order), but that is other than regular/default monitoring, which is what
the OP is referring to. I think an (UK) ISP will get into trouble if it
retains/views/snoops_in foreign traffic (for other than technical/
diagnostic purposes).

[1] I live in The Netherlands and AFAIK our (ISP etc. related) laws are
similar to the UK ones.

Jeremy Paxman

2004-04-11, 3:07 pm

On Thu, 8 Apr 2004 12:52:13 +0100, "James" <Jakub.Klein@unbekkent.de>
wrote:

>:"Frank Slootweg" <this@ddress.is.invalid> wrote in message
>:news:407516ba$0$64619$4a441750@news.wanadoo.nl...

<snipped>

>:> [1] I live in The Netherlands and AFAIK our (ISP etc. related) laws are
>:> similar to the UK ones.
>:
>:I would like to agree with you, but I have actually examined some of the
>:logs which are kept in UK and there is plenty (!) of content - most recently
>:I saw some interesting chat room conversations retained in network logs. UK
>:ISPs are aware that they are required as part of their good practice
>:policies to maintain such records as will "facilitate investigation" by the
>:boys in blue. Keeping the info is not difficult just expensive.
>:
>:But the principal point I'm making is that despite the beneficent impetus
>:from EU Directives to protect the privacy of the individual and his/her
>:communications, the UK goes much, much, much further than necessary in
>:pursuit of the qualificatino of "preventing crime" and has little if any
>:regard for rights of individual privacy at all. The Netherlands, on the
>:other hand, has a long tradition of protection of individual rights and
>:freedoms. There is a huge gulf between the attitudes of both nations.
>:
>:regards
>:James
>:

This message was sent via an encrypted tunnel. I live in the UK. I
would love to see the logs of my ISP. It will just be apparent
randomn garbage, of course. They will only know that it is encrypted
data and it is going to an SSH2 enabled host server in Hong Kong. I
use this server for all my web browsing, usenet postings/downloading
and Email.

It must be very frustrating for some busybody.

2004-04-11, 3:07 pm

On Thu, 08 Apr 2004 21:23:51 +0100, Jeremy Paxman <> wrote:
>
>
> On Thu, 8 Apr 2004 12:52:13 +0100, "James" <Jakub.Klein@unbekkent.de>
> wrote:
>
>
><snipped>
>
>
> This message was sent via an encrypted tunnel. I live in the UK. I
> would love to see the logs of my ISP. It will just be apparent
> randomn garbage, of course. They will only know that it is encrypted
> data and it is going to an SSH2 enabled host server in Hong Kong. I
> use this server for all my web browsing, usenet postings/downloading
> and Email.
>
> It must be very frustrating for some busybody.
>
>
>

Except, of course, that they can read your posts on the Usenet like I am
doing right now.

No problem for them to obtain the IP address of this server in Hong Kong
and determine what it is doing. Take a few seconds.

man nmap
man traceroute
man whois
man host

etc...

They can discover that server's connection to any other server, such as a
newsserver, in a blink.

If *I* could, they could, and more...

Here's your headers, for the Archives:

Path: newsspool2.news.pas.earthlink.net!stamper.news.pas.earthlink.net!stamper.news.atl.earthlink.net
!elnk-atl-nf1!newsfeed.earthlink.net!newshosting.com!nx02.iad01.newshosting.com!post01.iad01.newshosting.com
!not-for-mail
From: Jeremy Paxman
Newsgroups: alt.computer.security,comp.security.misc,alt.censorship,alt.privacy
Subject: Re: Can my ISP see my NNTP traffic?
Date: Thu, 08 Apr 2004 21:23:51 +0100
Message-ID: <prcb70h4b1jsqh83k18vq13sju45qmdq8p@4ax.com>
References: <94C495766E51A628D1@64.62.191.200> <40740ade$0$64611$4a441750@news.wanadoo.nl>
<c51ul3$ht0$1@news7.svr.pol.co.uk> <407516ba$0$64619$4a441750@news.wanadoo.nl>
<c53ekj$96q$1@news6.svr.pol.co.uk>
X-Newsreader: Forte Agent 1.91/32.564
X-No-Archive: yes
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 41
Organization: Newshosting.com - Highest quality at a great price! www.newshosting.com
X-Complaints-To: abuse@newshosting.com
Xref: news.earthlink.net alt.computer.security:49115 comp.security.misc:83730 alt.censorship:202841
alt.privacy:155198
X-Received-Date: Thu, 08 Apr 2004 13:24:03 PDT (newsspool2.news.pas.earthlink.net)

Why you want to cheat the archives of your useful posts, I don't know.

KK

Jeremy Paxman

2004-04-11, 3:07 pm

On Thu, 08 Apr 2004 20:58:47 GMT, KK <kk11@hotmail.com> wrote:

>:On Thu, 08 Apr 2004 21:23:51 +0100, Jeremy Paxman <> wrote:

<snipped>

>:> This message was sent via an encrypted tunnel. I live in the UK. I
>:> would love to see the logs of my ISP. It will just be apparent
>:> randomn garbage, of course. They will only know that it is encrypted
>:> data and it is going to an SSH2 enabled host server in Hong Kong. I
>:> use this server for all my web browsing, usenet postings/downloading
>:> and Email.
>:>
>:> It must be very frustrating for some busybody.
>:>
>:>
>:>
>:
>:Except, of course, that they can read your posts on the Usenet like I am
>:doing right now.
>:
>:No problem for them to obtain the IP address of this server in Hong Kong
>:and determine what it is doing. Take a few seconds.
>:
>:man nmap
>:man traceroute
>:man whois
>:man host
>:
>:etc...
>:
>:They can discover that server's connection to any other server, such as a
>:newsserver, in a blink.
>:
>:If *I* could, they could, and more...
>:
>:Here's your headers, for the Archives:
>:
>:Path: newsspool2.news.pas.earthlink.net!stamper.news.pas.earthlink.net!stamper.news.atl.earthlink.net
>: !elnk-atl-nf1!newsfeed.earthlink.net!newshosting.com!nx02.iad01.newshosting.com!post01.iad01.newshosting.com
>: !not-for-mail
>:From: Jeremy Paxman
>:Newsgroups: alt.computer.security,comp.security.misc,alt.censorship,alt.privacy
>:Subject: Re: Can my ISP see my NNTP traffic?
>:Date: Thu, 08 Apr 2004 21:23:51 +0100
>:Message-ID: <prcb70h4b1jsqh83k18vq13sju45qmdq8p@4ax.com>
>:References: <94C495766E51A628D1@64.62.191.200> <40740ade$0$64611$4a441750@news.wanadoo.nl>
>: <c51ul3$ht0$1@news7.svr.pol.co.uk> <407516ba$0$64619$4a441750@news.wanadoo.nl>
>: <c53ekj$96q$1@news6.svr.pol.co.uk>
>:X-Newsreader: Forte Agent 1.91/32.564
>:X-No-Archive: yes
>:MIME-Version: 1.0
>:Content-Type: text/plain; charset=us-ascii
>:Content-Transfer-Encoding: 7bit
>:Lines: 41
>:Organization: Newshosting.com - Highest quality at a great price! www.newshosting.com
>:X-Complaints-To: abuse@newshosting.com
>:Xref: news.earthlink.net alt.computer.security:49115 comp.security.misc:83730 alt.censorship:202841
>: alt.privacy:155198
>:X-Received-Date: Thu, 08 Apr 2004 13:24:03 PDT (newsspool2.news.pas.earthlink.net)
>:
>:Why you want to cheat the archives of your useful posts, I don't know.
>:
>:KK

Oh, yes, I am well aware of what my headers say. But what I didn't
say (and will be careful about revealing) is how I connect to that
server in Hong Kong. Also, nobody knows who I am because I did not
subscribe to that server, nor to the news server. I use them
because they are available to me. Next time I might use a different
one.

I will not keep this Nym, perhaps next time use something different.

Maybe yours?

I trust you are retreiving your hotmail.com messages via either SSL or
a tunnel. Not sure if you can use SSL all the way into hotmail -
never liked using it.

Dave Bird

2004-04-11, 3:07 pm

In article<40740c6e$0$252$edfadb0f@dread12.news.tele.dk>, Allan Birnbaum
Ditlevsen <abditlevsen@mail.dk> writes:
>sorry to bother you kulm_nd but is subpoena?

Court Order. It begins with sub poena dare -- i.e. under penalty
of paying (amount of fine) -- you will do whatever is ordered in it.

--
"If I have seen further than other men, (0_
it is because I have been surrounded (o. | (o. (o.
by pygmies." /\ //\ /\ /\
\/_ V_/_ \/_ \/_

Rowdy Yates

2004-04-11, 3:07 pm

Barry Margolin <barmar@alum.mit.edu> wrote in
news:barmar-30307B.02180008042004@comcast.ash.giganews.com:

>
> While it's normal for servers to log their activity, it's very unusual
> for routers to keep detailed traffic logs. Most ISP routers have the
> ability to log these details, but the overhead makes it prohibitive to
> use it except when there's something specific you're looking for
> (typically when you're trying to troubleshoot network problems).
>

yes. but as you state, "have the ability to log".

i also tell my users that auditing is too resource intensive and i don't
audit, even when i am actually doing it.

Rowdy Yates
"the man who tried and failed miserably"
--
Visit Rowdy's Home Page
http://rowdy_yates2.tripod.com/

Barry Margolin

2004-04-11, 3:07 pm

In article <Xns94C5E23D52CEErowdyyates2lycoscom@66.185.95.104>,
Rowdy Yates <rowdy_yates2@remove.lycos.com> wrote:

> Barry Margolin <barmar@alum.mit.edu> wrote in
> news:barmar-30307B.02180008042004@comcast.ash.giganews.com:
>
>
> yes. but as you state, "have the ability to log".

Actually, I'd like to qualify my statement. The logging that can be
done with routers is often quite limited. For instance, on a Cisco
router you can use "debug ip packet detailed" to get packet traces, but
it doesn't show the payload; you can get addresses, port numbers, and
TCP flags, but not the application data (which is where the newsgroup
information would be).

However, it may be possible to install an RMON module in a router to
perform full packet capture.

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA

LeDiver

2004-04-11, 3:08 pm

On Thu, 08 Apr 2004 21:23:51 +0100, Jeremy Paxman wrote:

: :On Thu, 8 Apr 2004 12:52:13 +0100, "James" <Jakub.Klein@unbekkent.de>
: :wrote:
: :
: :>:"Frank Slootweg" <this@ddress.is.invalid> wrote in message
: :>:news:407516ba$0$64619$4a441750@news.wanadoo.nl...
: :
: :<snipped>

: :This message was sent via an encrypted tunnel. I live in the UK. I
: :would love to see the logs of my ISP. It will just be apparent
: :randomn garbage, of course. They will only know that it is encrypted
: :data and it is going to an SSH2 enabled host server in Hong Kong. I
: :use this server for all my web browsing, usenet postings/downloading
: :and Email. =20
: :
: :It must be very frustrating for some busybody.
: :
: :
Does not look frustrating at all.

1. What is usenet?
Here are some links with a LOT of good information:
http://www.usenet.org/
http://www.faqs.org/usenet/
http://www.hypernews.org/HyperNews/get/ usenet.html

Civil Investigations
Newshosting will not release a customer's personal information or usage =
information to investigators, attorneys, or agencies unless we are
directed to do so by a court of competent jurisdiction in the matter. If =
there is a hearing in court, the customer will be notified so they
will have an opportunity to contest the surrender of personal =
information.

Criminal Investigations
Newshosting cooperates fully with law enforcement agencies, yet there =
must still be a court order before Newshosting surrenders customer
information. The Fourth Amendment to the US Constitution requires a court=
order to conduct a search and seizure. Newshosting will, when
requested by law enforcement entities, acknowledge the existence of =
personal customer information, and when requested, provide the technical
language to include in the court order, "particularly describing ... the =
property to be seized." In a criminal investigation Newshosting is
under a duty not to divulge the fact of the investigation to the customer

Pricing

10G/month
$10

25G/month
$20

50G/month
$30

60G/semi-annual
$50

150G/semi-annual
$100

300G/semi-annual
$150

=20

Retention

binary
99%+
~18 days

text
99%+
~180 days

Questions & Answers

2. What newsgroups do you carry?
A complete list can be found at http:// =
www.newshosting.com/support/util/groups/.

Anonymous

2004-04-11, 3:08 pm

> I would like to agree with you, but I have actually examined some of the
> logs which are kept in UK and there is plenty (!) of content - most recently
> I saw some interesting chat room conversations retained in network logs.
UK
> ISPs are aware that they are required as part of their good practice
> policies to maintain such records as will "facilitate investigation" by the
> boys in blue. Keeping the info is not difficult just expensive.
>
> But the principal point I'm making is that despite the beneficent impetus
> from EU Directives to protect the privacy of the individual and his/her
> communications, the UK goes much, much, much further than necessary in
> pursuit of the qualificatino of "preventing crime" and has little if any
> regard for rights of individual privacy at all. The Netherlands, on the
> other hand, has a long tradition of protection of individual rights and
> freedoms. There is a huge gulf between the attitudes of both nations.
>
> regards
> James

I think this is upside down. I though it was Europe who are desperately trying
to establish data retention laws..or was that more Tony Bliar spin ?

Generally, I obviously have to agree with many of these posts that a vast amount
of data can be and is logged at multiple locations. But I also feel that there
has not been really any cases of this logged data getting into the public domain
which I find highly surprising.

We've seen in the UK high profile celebrity sting operations (like with Pete
Townsend) who was accused (apparently the FBI tipped off UK authorites) that
he had accessed material from a child porn website.

We've seen cases like Gary Glitter where he stupidly walked into PC world with
a load of child porn filth on his machine

It would be nothing for a lowly/or pissed off ISP employee to be approached
by a journalist looking for dirt on a celebrity/politican to dig around the
logs and get some juicy info. And even if this were illegal and intrusive it
would *still* get into the public domain and slip out gradually about what
sort of porn celebrities and politicans were viewing, and compromising emails
that were exchanged etc. Even the Police in the UK are very very fond on leaking
celebrity dirt stories to the press (Towsend, Leslie) etc.

The fact that this hasn't really happened yet is very surprising. Maybe they
use Cotse or a similar service but to be honest I doubt that.

In any event, UK or EU laws, people really never understood the threat that
Tony Bliar and his corrupt rotten government posed to the fabric of the UK

privacy fan

Nomen Nescio

2004-04-11, 3:08 pm

Don

2004-04-11, 3:08 pm

"Anonymous" <Use-Author-Supplied-Address@[127.1]> wrote in message
news:3DQAI93138087.6335763889@anonymous.poster...

trying[color=darkred]
> to establish data retention laws..or was that more Tony Bliar spin ?

> In any event, UK or EU laws, people really never understood the threat
that
> Tony Bliar and his corrupt rotten government posed to the fabric of the UK

It is Tony Bliar spin. The whole thrust of relevant EU directives is to
protect personal privacy. But this really sticks in the throat of our Fuhrer
and his cronies who want complete information and complete control.

regards
Don

Rowdy Yates

2004-04-11, 3:08 pm

Barry Margolin <barmar@alum.mit.edu> wrote in news:barmar-
A6A419.01173309042004@comcast.ash.giganews.com:

>
> Actually, I'd like to qualify my statement. The logging that can be
> done with routers is often quite limited. For instance, on a Cisco
> router you can use "debug ip packet detailed" to get packet traces, but
> it doesn't show the payload; you can get addresses, port numbers, and
> TCP flags, but not the application data (which is where the newsgroup
> information would be).
>
> However, it may be possible to install an RMON module in a router to
> perform full packet capture.
>

pro. cisco guys tend to kick serious butt at comp. networking. i am pretty
sure they have more than a few tricks up their sleve they can use if they
were asked to implement a solution by a law enforcement agency.

Rowdy Yates
"the man who tried and failed miserably"
--
Visit Rowdy's Home Page
http://rowdy_yates2.tripod.com/

Michael Sherman

2004-05-05, 4:34 pm

Can they not use Secure nntp over port 563? I have not done this, so
I am unsure, but just a thought?

On Sat, 10 Apr 2004 22:50:06 +0200 (CEST), Nomen Nescio
<nobody@dizum.com> wrote:

>UK
>
>
>I think this is upside down. I though it was Europe who are desperately trying
>to establish data retention laws..or was that more Tony Bliar spin ?
>
>Generally, I obviously have to agree with many of these posts that a vast amount
>of data can be and is logged at multiple locations. But I also feel that there
>has not been really any cases of this logged data getting into the public domain
>which I find highly surprising.
>
>We've seen in the UK high profile celebrity sting operations (like with Pete
>Townsend) who was accused (apparently the FBI tipped off UK authorites) that
>he had accessed material from a child porn website.
>
>We've seen cases like Gary Glitter where he stupidly walked into PC world with
>a load of child porn filth on his machine
>
>It would be nothing for a lowly/or pissed off ISP employee to be approached
>by a journalist looking for dirt on a celebrity/politican to dig around the
>logs and get some juicy info. And even if this were illegal and intrusive it
>would *still* get into the public domain and slip out gradually about what
>sort of porn celebrities and politicans were viewing, and compromising emails
>that were exchanged etc. Even the Police in the UK are very very fond on leaking
>celebrity dirt stories to the press (Towsend, Leslie) etc.
>
>The fact that this hasn't really happened yet is very surprising. Maybe they
>use Cotse or a similar service but to be honest I doubt that.
>
>In any event, UK or EU laws, people really never understood the threat that
>Tony Bliar and his corrupt rotten government posed to the fabric of the UK
>
>privacy fan
>
>
>

nemo

2004-05-30, 10:21 am

Regal <smith@yahoo.com> wrote in message
news:94C495766E51A628D1@64.62.191.200...
> I want to take part in discussions which I don't want my ISP
> snooping around in.
>
> Can my ISP see my Usenet traffic to the extent that the ISP can see
> if I post to or download from a given newsgroup if I use a
> newsserver which is not operated by them?
>
> For example, I use BTopenworld as an ISP in the UK. If I post this
> Usenet message via the independent Astra newsserver then can
> BTopenworld see what I have read/posted by examining the traffic
> passing through their server. Can they tell which newsgroups I
> used to post or read?
>
> If they CAN do this they how EASY and how LIKELY is it for them to
> actually do it?
>
> ---
>
> And what about for protocols used by Kazaa and other file sharing
> prgrams?

Do a Google search on the words "Astra newsserver " with quotes.

You'll see that it's not only your ISP that can see your Usenet traffic!

I posted a message complaining about a crap boss I had and it turned up the
head of the list in Google if you did a search on his name.

Being a vain man, I'd dare say he did such a search fairly often and saw my
nasty post! Oh dear - how sad - never mind!

Nemo the newbie.

Chester

2004-05-30, 4:49 pm

Your ISP can see everything you do if they want. Although it's not likely
they will zero in on you unless they get a complaint. Everything means
mail, surfing, news, and everything else.

Most ISP's are routinely logging all customers accounts as I've read. You
need to use a good privacy service:
www.privacy.li
www.cotse.net
www.anonymizer.com
Only thing is if you want this protection you will have to pay for it. Hope
this helps.

"nemo" <nemo@naughtylass.wet> wrote in message
news:VEkuc.1113$XY1.11679970@news-text.cableinet.net...
>
> Regal <smith@yahoo.com> wrote in message
> news:94C495766E51A628D1@64.62.191.200...
>
> Do a Google search on the words "Astra newsserver " with quotes.
>
> You'll see that it's not only your ISP that can see your Usenet traffic!
>
> I posted a message complaining about a crap boss I had and it turned up
the
> head of the list in Google if you did a search on his name.
>
> Being a vain man, I'd dare say he did such a search fairly often and saw
my
> nasty post! Oh dear - how sad - never mind!
>
> Nemo the newbie.
>
>

Qintin

2004-06-03, 4:49 pm

I don't understand. ISPs do not keep copies of e-mails surely? So why
would they keep NNTP traffic?

I thought the storage directive in the UK was voluntary and the ISPs were
refusing to sign-up to it?

"nemo" <nemo@naughtylass.wet> wrote in message
news:cm6vc.1666$OT4.15688903@news-text.cableinet.net...
> The last I heard was they keep a record of what everyone has posted for a
> couple of months, but because of storage restrictions only keep a record
of
> what they've looked at for a week or two if that.
>
> The security services scan all communications using key words to select
what
> to store and follow up, like Bin Laden, names of explosives, weapons,
names
> of extremist groups etc. but these days I don't think anyone would object
to
> that.
>
> Anyway, last night, Channel 4 proudly announced that since a judgement
under
> the Human Rights Act some months ago, which the media and the
pro-censorship
> lobby have pointedly ignored up to now, hard-core adult porn is now
> perfectly legal in the UK. So unless you're a really sick puppy like
Jacko,
> they can't nick you now anyway!
>
> Mary Whitehouse must be turning in her grave!
>
> http://news.bbc.co.uk/1/hi/uk/1673170.stm
>
> I met her once. She was the sort of person where you only had to say hello
> and you'd realise she was barmy! My cousin met Margaret Thatcher once too.
> Same diagnosis! Anyone on here met Dubya???? :o)
>
> Nemo
>
> PS: Ganja is more-or-less legal over here now too, so we're not doing too
> bad, even with a git like Tony B'Liar for PM.
>
>
> Chester <all-mail@is-trashed.com> wrote in message
> news:40ba13ea$0$77348$450c70f1@news.privacy.li...
likely[vbcol=seagreen]
You[vbcol=seagreen]
> Hope
traffic![vbcol=seagreen]
up[vbcol=seagreen]
saw[vbcol=seagreen]
>
>

Leythos

2004-06-03, 4:49 pm

In article <c9kquc$rlj$1@newsg1.svr.pol.co.uk>, nope@peowfj.com says...
>
> I don't understand. ISPs do not keep copies of e-mails surely? So why
> would they keep NNTP traffic?
>
> I thought the storage directive in the UK was voluntary and the ISPs were
> refusing to sign-up to it?

The point is that an ISP or anyone along the path to you/them, can track
what you are doing if they want to. Just live with it, it won't change.

--
--
spamfree999@rrohio.com
(Remove 999 to reply to me)

Bill Unruh

2004-06-04, 11:50 pm

Lassi =?iso-8859-1?Q?Hippel=E4inen?= <lahippel@ieee.orgies.invalid> writes:

]"T. Sean Weintz" wrote:
]>
]> Bill Unruh wrote:
]>
]> > ]> > >
]> > ]> > > You'll see that it's not only your ISP that can see your Usenet
]> > ]traffic!
]> > ]> > >
]> > ]> > > I posted a message complaining about a crap boss I had and it turned
]> > ]up
]> > ]> > the
]> > ]> > > head of the list in Google if you did a search on his name.
]> >
]> > A usenet post is SUPPOSED to be readable by everyone in the world. That is
]> > what usenet is all about. And Yes, google does also search over usenet.
]> >
]>
]> Yup. Google groups is great. I love seeing my name all over it.

]Used to be called Dejanews, before Google acquired it.

Still called dejanews.
www.dejanews.com still gets there.

]> Yeah.
]> all the way back to '96. 8 years of garbage it's collected on me.
]> Flame wars and all.

]It is quite regular to check the newsgroups before recruiting people. A
]good way of finding out what kind of candidates you have.

]-- Lassi

Frank Slootweg

2004-06-11, 6:29 pm

Dystopia <dystopia@eutopia.po> wrote:
> ["Followup-To:" header set to alt.computer.security.]
> * On Thu, 03 Jun 2004 10:07:55 GMT, Lassi Hippeläinen wrote:
>
> Yeah a good reason to use pseudonyms and X-No-Archive. What I do in my
> spare time is no ones business.

As long as you realize that Google (Groups) is about the *only*
archive which honors "X-No-Archive: Yes".

Case in point: http://www.myispforum.com/showpost....00&postcount=10

(besides this one, I found your post in three other archives)

Homer.Simpson

2004-06-11, 6:29 pm

Frank Slootweg said
> Dystopia <dystopia@eutopia.po> wrote:
>
> As long as you realize that Google (Groups) is about the *only*
> archive which honors "X-No-Archive: Yes".
>
> Case in point:
> http://www.myispforum.com/showpost....00&postcount=10
>
> (besides this one, I found your post in three other archives)

Can you provide info (URL's) to other archives like this, that archive
newsgroups?

--
There are two theories to arguing with women. Neither one works.

nemo outis

2004-06-11, 6:29 pm

In article <40c96712$0$139$18b6e80@news.wanadoo.nl>, Frank Slootweg <this@ddress.is.invalid> wrote:
>Dystopia <dystopia@eutopia.po> wrote:
>
> As long as you realize that Google (Groups) is about the *only*
>archive which honors "X-No-Archive: Yes".
>
> Case in point: http://www.myispforum.com/showpost....00&postcount=10
>
>(besides this one, I found your post in three other archives)

I agree that, if you add X-No-Archive to your post, Google will
no longer *display* it. In my normal paranoia, however, I
strongly suspect that they still do archive it (perhaps to help
their buddies at Homeland Security :-) In any case, I'm sure
it's catalogued somewhere by somebody even if it's not available
for public retrieval.

Regards,

Jeffrey Schwartz

2004-06-11, 6:29 pm

On Fri, 11 Jun 2004 13:01:26 GMT, nemo outis@erewhon.com (nemo outis)
wrote:

>In article <40c96712$0$139$18b6e80@news.wanadoo.nl>, Frank Slootweg <this@ddress.is.invalid> wrote:
>
>
>I agree that, if you add X-No-Archive to your post, Google will
>no longer *display* it. In my normal paranoia, however, I
>strongly suspect that they still do archive it (perhaps to help
>their buddies at Homeland Security :-) In any case, I'm sure
>it's catalogued somewhere by somebody even if it's not available
>for public retrieval.
>
>Regards,

A good rule of thumb to follow is that if it is recorded somewhere it
is also saved somewhere no matter what you do. That would include
AIM's emails and NG posting.

Jeff

Leythos

2004-06-11, 6:29 pm

In article <G2iyc.732052$Ig.543570@pd7tw2no>, nemo outis@erewhon.com
(nemo outis) says...
> I agree that, if you add X-No-Archive to your post, Google will
> no longer *display* it.

The funny thing is that of anyone replies to your post and includes the
headers, then your post is archived. Only the original XNA is honored,
not a reply that contains a post that had XNA in it.

--
--
spamfree999@rrohio.com
(Remove 999 to reply to me)

Mr Nobody

2004-06-11, 6:29 pm

On Fri, 11 Jun 2004 18:43:50 GMT, Leythos <void@nowhere.com> wrote:

>In article <G2iyc.732052$Ig.543570@pd7tw2no>, nemo outis@erewhon.com
>(nemo outis) says...
>
>The funny thing is that of anyone replies to your post and includes the
>headers, then your post is archived. Only the original XNA is honored,
>not a reply that contains a post that had XNA in it.

What's 'funny' about that? To work the "X-No-Archive: Yes" has to be
either in the header or on the first line of the body of the post;
that's the way it works.

Whether a follow-up post has the same setting is up to whoever replies
(or how his newsreader is set).

--
Mr Nobody

Leythos

2004-06-11, 6:29 pm

In article <tb2kc0h35kepa5gskbb7e3vg3jd0q42455@4ax.com>, me@privacy.net
says...
> On Fri, 11 Jun 2004 18:43:50 GMT, Leythos <void@nowhere.com> wrote:
>
>
> What's 'funny' about that? To work the "X-No-Archive: Yes" has to be
> either in the header or on the first line of the body of the post;
> that's the way it works.
>
> Whether a follow-up post has the same setting is up to whoever replies
> (or how his newsreader is set).

I know that, but it would be nice if a reply that included content from
a post that had XNA included in it would also not be archived by places
that honor XNA.

--
--
spamfree999@rrohio.com
(Remove 999 to reply to me)

Mr Nobody

2004-06-11, 6:29 pm

On Fri, 11 Jun 2004 20:02:27 GMT, Leythos <void@nowhere.com> wrote:

>In article <tb2kc0h35kepa5gskbb7e3vg3jd0q42455@4ax.com>, me@privacy.net
>says...
>
>I know that, but it would be nice if a reply that included content from
>a post that had XNA included in it would also not be archived by places
>that honor XNA.

That would be difficult to do as the archive software would have to
find the referenced article (to see whether it contained the XNA
header), which might be delayed until after the reply or not turn up
at all.

\Crash\ Dummy

2004-06-11, 6:29 pm

>I know that, but it would be nice if a reply that included content from
>a post that had XNA included in it would also not be archived by places
>that honor XNA.

I just assume that anything I post in a public newsgroup will be seen by
everybody, including generations yet unborn, and ultimately can be traced to the
source, so I don't post anything I don't want seen by the F.B.I., the C.I.A., my
ISP, or my mother.
--
Dave "Crash" Dummy - A weapon of mass destruction
crash@gpick.com?subject=Techtalk (Do not alter!)
http://lists.gpick.com

John Smith

2004-06-11, 6:39 pm

On Fri, 11 Jun 2004 18:24:15 -0400, in article
<10ckc8fr1j8t168@corp.supernews.com>, "\"Crash\" Dummy"
<dvader@deathstar.mil> wrote:

>
>I just assume that anything I post in a public newsgroup will be seen by
>everybody, including generations yet unborn, and ultimately can be traced to the
>source, so I don't post anything I don't want seen by the F.B.I., the C.I.A., my
>ISP, or my mother.

By far, the best assumption IMO.

Leythos

2004-06-11, 11:48 pm

In article <10ckc8fr1j8t168@corp.supernews.com>, dvader@deathstar.mil
says...
>
> I just assume that anything I post in a public newsgroup will be seen by
> everybody, including generations yet unborn, and ultimately can be traced to the
> source, so I don't post anything I don't want seen by the F.B.I., the C.I.A., my
> ISP, or my mother.

Very wise choice. I've felt that way since I left the shop :-)

--
--
spamfree999@rrohio.com
(Remove 999 to reply to me)

Leythos

2004-06-12, 2:49 am

Frank Slootweg

2004-06-12, 11:51 pm

Homer.Simpson <Homer.Simpson@springfieldbb.com.invalid> wrote:
> Frank Slootweg said
>
> Can you provide info (URL's) to other archives like this, that archive
> newsgroups?

(AFAIK,) Google Groups is the only (freely available) *general*
newsgroup archive, but there are many, many, other archives, which do
archive only selective hierarchies or groups, have shorter retention
times, etc., so your (general) question can not be answered.

However that is not the point. The point is that, for all intents and
purposes, "X-No-Archive: Yes" does not work. Only if you want people to
not *easily* find *your* postings (i.e. *not* postings which *quote*
(part of) your postings) then you can use "X-No-Archive: Yes".
Personally I can't think of any real reason for wanting that.

FWIW, I have encountered several strong proponents of "X-No-Archive:
Yes" who were convinced that it worked. Each time I could (easily) prove
them wrong.

Frank "'X-No-Archive: Yes', just say no!" :-) Slootweg

Homer.Simpson

2004-06-12, 11:51 pm

Frank Slootweg said

> Homer.Simpson <Homer.Simpson@springfieldbb.com.invalid> wrote:
>
> (AFAIK,) Google Groups is the only (freely available) *general*
> newsgroup archive, but there are many, many, other archives, which do
> archive only selective hierarchies or groups, have shorter retention
> times, etc., so your (general) question can not be answered.
>
> However that is not the point. The point is that, for all intents and
> purposes, "X-No-Archive: Yes" does not work. Only if you want people to
> not *easily* find *your* postings (i.e. *not* postings which *quote*
> (part of) your postings) then you can use "X-No-Archive: Yes".
> Personally I can't think of any real reason for wanting that.
>
> FWIW, I have encountered several strong proponents of "X-No-Archive:
> Yes" who were convinced that it worked. Each time I could (easily)
> prove them wrong.
>
> Frank "'X-No-Archive: Yes', just say no!" :-) Slootweg

Thanks Frank,

I understand the implications of the X-No-Archive. I was just curious if
I could see some of my old "not-arhived" posts. Not that I really care.
I always assume anything I post can come back to haunt me. This is the
only "safe" way to post.

Homer "'X-No-Archive: Yes', just say no!" Simpson.

By the way, Homer Simpson is not my real name. Suprise! ;-D

--
If electricity comes from electrons, does morality come from morons?

Frank Slootweg

2004-06-12, 11:51 pm

Homer.Simpson <Homer.Simpson@springfieldbb.com.invalid> wrote:
[deleted]
> Thanks Frank,
>
> I understand the implications of the X-No-Archive. I was just curious if
> I could see some of my old "not-arhived" posts. Not that I really care.
> I always assume anything I post can come back to haunt me. This is the
> only "safe" way to post.

In Dystopia's case, I just did a Google (not Google Groups) search on
"Dystopia" (without quotes) and the Subject: of this thread. For some
reason searching on email address does not work (in Google).

For you I could not easily find anything. When I use "Homer.Simpson",
Google removes the dot and (of course) gives too many irrlevant hits.
Also adding 'your' Organization: as a search item does not help. So I
guess you will have to try some other things for yourself.

Homer.Simpson

2004-06-12, 11:51 pm

Frank Slootweg said

[snip]
> Google removes the dot and (of course) gives too many irrlevant hits.
> Also adding 'your' Organization: as a search item does not help. So I
> guess you will have to try some other things for yourself.

hehe,

Adding my domain name was the key. "springfieldBB"

I hope Ellen Degeneres isn't reading this.

http://tinyurl.com/2z5ld

--
Don't go huntin' with a fellow named Chug-A-Lug

Frank Slootweg

2004-06-12, 11:51 pm

Homer.Simpson <Homer.Simpson@springfieldbb.com.invalid> wrote:
> Frank Slootweg said
>
> [snip]
>
> hehe,
>
> Adding my domain name was the key. "springfieldBB"
>
> I hope Ellen Degeneres isn't reading this.
>
> http://tinyurl.com/2z5ld

Yes, I also found *that* one, but (AFAICT, I don't understand Polish)
that was somebody *quoting* you, not one of your *own* postings. Did you
find one of your own postings? If so, how?

Homer.Simpson

2004-06-12, 11:51 pm

Frank Slootweg said

> Homer.Simpson <Homer.Simpson@springfieldbb.com.invalid> wrote:
>
> Yes, I also found *that* one, but (AFAICT, I don't understand Polish)
> that was somebody *quoting* you, not one of your *own* postings.

Oops, you are correct. I didn't look close enough.

>Did you find one of your own postings? If so, how?

That was the only one I found. I searched again and this appears to be
the only "google" reference in existence?

I DID find out that springfieldbb.com DOES exist. However, it's not
Springfield's Broadband provider. It's Springfields Bed and Breakfast.

LOL ;-D

When I was young and naive (in contrast to old and naive), I regularly
posted to USENET from work, with my real name in the sig, and using my
work email address. Big mistake.

Anywho, years later I was researching a subject and found a "useful"
thread from ~10 years back. Yea, I ran across my old post from 10 years
ago.

Sure, this shouldn't be surprising, but it was kind of eerie.

I find it's best to use pseudonyms and change periodically.

Maybe Bart?

--
Never, under any circumstances, take a sleeping pill and a laxative on
the same night.