The 200+ Sites an ICE Surveillance Contractor is Monitoring

[email protected]

Yep we're fucked

[email protected]

Thanks for the list. Unfortunately, they list "Fediverse" which likely means they're scraping ActivityPub. They're also going after your Steam account, Twitch, YouTube, and porn.

In other words, this is so much worse than the headline makes it out to be.

Surprisingly, Reddit is NOT on the list.

Here's the full list of names:

4chan Archives

Discord Archives

21Buttons

500px

about.me

AllMyLinks

AllTrails

Amazon

Ameba

Amino

AnimePlanet

Apple Music

Artists&Clients

Asciinema

AudioJungle

AudiUSA

BabyCenter

Baidu

BeReal

Bigo Live

Bing

Biolink

BitChute

BlackPlanet

Blogger

Bluesky

Bodybuilding

BookCrossing

Breaches

BuyMeACoffee

Cash App

CastingCall Club

Chaturbate

Chess.com

Cigar Dojo

CityXGuide

CloutHub

Cocolog

Companies House

Cozy.tv

Cracked

Creema

Dailymotion

Danbooru

Dark Web

DeepL

DeviantArt

Disqus

DLive

Dot.cards

Douyin

Drum

DuckDuckGo

Duolingo

E621

eBay

Eporner

Etsy

Facebook

Fansly

FastPeopleSearch

Fediverse (likely ActivityPub - possibly DMs between servers)

FetLife

Fiverr

Flickr

FlightAware

Foursquare

FriendFinder

FurAffinity

Gab

Gaia Online

GameFAQs

Gelbooru

GeneralMotors

Geocaching

GeoEstimation

Gettr

Giphy

GitHub

Glassdoor

GoFundMe

Goo

Google

Goodreads

Gravatar

Guancha

GunBroker

Habbo

Hackaday

Hatena

Honda

Hubski

ILoveGrowingMarijuana

ImageShack

Imgur

IMVU

Indeed

Instagram

Instructables

JudyRecords

Jugem

JustForFans

Keybase

Kick

Kik

Last.fm

LibraryThing

Lichess

Likee

Line

Linktree

LiveIn

LiveJournal

Lobsters

Mail.ru

Malgari

MapMyTracks

Marshmallow

MarTech

Massage Anywhere

Medium

MeetMe

Mercari Jp

MeWe

Minds

Minecraft

Mix

Mixlr

ModDB

Mughosts

MyFitnessPal

Myspace

MySubaru

Naijapals

Nextdoor

NissanUSA

Odysee

OFAC Sanctions List

OkCupid

OK.ru

OnlyFans

Pandia

Pandora

Passes

Pastebin

Patreon

PayPal

PCGamer

Peloton

PGP

Plurk

Poal

Popl

Pornhub

Poshmark

Product Hunt

ProtonMail

PSNProfiles

Reblogme

RedGifs

Replit

ReverbNation

Roblox

Rule34.xxx

Rumble

Rutube

ScoutWiki

Seesaa

Seneporno

Signal

SkipTheGames

Skype

SlideShare

Snapchat

Sogou

SoundCloud

SourceForge

Spiceworks

Spotify

Sprashivai

Steam (fuck off you fucking fucks)

StellantisEU

StellantisUSA

Strava

Stripchat

Substack

TechNet

Tellows

Tesseract OCR

Threads

TikTok

Tinder

TinEye

ToyotaUSA

Trakt

Triller

TripAdvisor

TrueCaller

TruthSocial

Tumblr

Twilio

Twitch

Twitter

Untappd

Venmo

VidLii

Vimeo

Vine

VirusTotal

VK

Volkswagen

VSCO

WatchMeMore

Weibo

Wire

Wordfeud

Xbox

xHamster

XING

XVideos

Yahoo

Yandex

Yappy

YCombinator

Yelp

YouTube

Zhihu

Zillow

ZoneH

[email protected]

Surprisingly, Reddit is NOT on the list.

If they’re slurping all these other sites, I highly doubt they’re not slurping Reddit, too, even if it’s not on the list.

Fediverse (likely ActivityPub - possibly DMs between servers)

They would have to hack the individual servers to get at the DMs, because they’re encrypted in transit. All the public stuff is trivial to scrape.

[email protected]

They would have to hack the individual servers to get at the DMs, because they’re encrypted in transit. All the public stuff is trivial to scrape.

Nope, ActivityPub DMs are not encrypted between servers - if it's on the feed, it's public- or at least it was as of six months ago. I found this out when I attached a Wordpress site to a Mastodon instance and suddenly found i could read anyone's DMs to users on other servers. Totally unencrypted. I actually paused development and working with ActivityPub because of it.

This doesn't mean that messages to users on the same server are necessarily exposed, but the potential is there if you don't have a filter for local publishing only engaged on your Mastodon instance.

[email protected]

Reddit is right there in your list.

Also:

Gaia Online

Thanks. Brings back memories.

[email protected]

ActivityPub DMs are not encrypted between servers

It is insofar as TLS/SSL/HTTPS encryption is used in transit. That’s what I mean by encrypted in transit.

i could read anyone’s DMs to users on other servers

If you’re an administrator for (WordPress) ActivityPub server A, you can see all the DMs coming to and leaving from your server, yes. And they’re not encrypted at rest, so you can read them any time. But how would you see DMs going between server B and server C, when your server isn’t involved in the transaction?

[email protected]

Aww man seriously DuckDuckGo is on the list? Fuckin' traitors...

[email protected]

Proton

Signal

What are they gonna do? Download gibberish?! Lol, it's all end-to-end encrypted with the decryption keys stored locally.

[email protected]

Maybe they got a backdoor

[email protected]

.............If that is the case, I...am concerned. o_o

[email protected]

I mean Sweden asked for a backdoor recently, maybe they're jealous of the US lol

[email protected]

It apparently scrapes everything on the public feed. So when I subscribed to users on Mastodon server A from Wordpress, DMs from Mastodon server A going to Mastodon server B became visible.

I had a separate account on Mastodon server A to confirm that I couldn't see these DMs as Mastodon user on server A, and that the Wordpress scrape was grabbing messages normally not meant for public view.

This was using the ActivityPub plugin for Wordpress about six months ago.

[email protected]

Probably just whatever the public metadata is.

[email protected]

Duckduckgo is not the problem. They are using publicly scrapable information. So for instance if they have fingerprinted your device they see you go to duckduckgo, then they see you access a site about buying guns, it becomes trivial to determine what you searched for. They would not have direct access to what you search on duckduckgo and duckduckgo is not giving them access. They are using various methods to collect data based on habits. You can use literally any service you want and they could do the same thing.

[email protected]

Lol yeah I heard about that. Apparently they also preemptively made post-quantum encryption illegal? Yeah, I don't like the US, but I'm not sure I'd wanna live in Sweden, that's for sure.

[email protected]

Oof, yeah I forgot about the metadata... What you say is certainly true and is worrisome.

Plus, most people who use email don't use encrypted email so even if they can't get a transcript of a conversation from my account, they can certainly get everything from the other account if they also scrape that platform.

[email protected]

Oh shit.

Well that clears things up. Thanks for the explanation. thumbs-up

[email protected]

Reddit is there.

[email protected]

If that's true, why bother "monitoring" a search engine? This whole list screams of somebody who knows nothing about tech put out a vague RFP and a contractor pulled a list of "top sites" and used it to justify an egregious proposal cost.

DOGE, if you're looking for waste and fraud, perhaps here's a good source.

[email protected]

Thank you sir - I've posted an edit with a credit to your astute eye.

agnos.is Forums

The 200+ Sites an ICE Surveillance Contractor is Monitoring

Here's the full list of names:

Fediverse (likely ActivityPub - possibly DMs between servers)

Steam (fuck off you fucking fucks)

Here's the full list of names:

Fediverse (likely ActivityPub - possibly DMs between servers)

Steam (fuck off you fucking fucks)

Here's the full list of names:

Fediverse (likely ActivityPub - possibly DMs between servers)

Steam (fuck off you fucking fucks)

Here's the full list of names:

Fediverse (likely ActivityPub - possibly DMs between servers)

Steam (fuck off you fucking fucks)

Here's the full list of names:

Fediverse (likely ActivityPub - possibly DMs between servers)

Steam (fuck off you fucking fucks)

Here's the full list of names:

Fediverse (likely ActivityPub - possibly DMs between servers)

Steam (fuck off you fucking fucks)