Let’s establish some scope here. The objective of this article is to help you prevent third parties from obtaining information about you using legal methods. Out of scope is protecting you against those using illegal means: phishing, viruses, worms, etc. Hopefully everyone knows how to protect themselves from the latter category: run anti-virus, don’t give out your password, update/patch all software, and drink plenty of fluids.
With the upcoming IPO of Facebook it seems that online privacy is the topic du jour. I’ve been hearing a lot of talk and some mischaracterizations in these news pieces. It’s occurred to me that a lot of what’s being discussed about online privacy is not widely understood by most of us. This being (the) one topic I’m somewhat qualified to speak on, I’d like to take a crack at helping those unfamiliar with this subject understand it a little better (and protect themselves in the meantime).
This is a huge topic, and I could easily write pages about each of the items I touch upon so distilling them into something brief yet understandable is difficult. Some of what I’m writing is a significant simplification, but done so as to make this more digestible for everyone. Additionally, I broke each section into “What it is” and “How to stop it” sections in case you want to skip to the important parts.
The way I see it, most of the information you’re hemorrhaging to third parties on the internet is coming from about five main sources:
Cookies
With the upcoming IPO of Facebook it seems that online privacy is the topic du jour. I’ve been hearing a lot of talk and some mischaracterizations in these news pieces. It’s occurred to me that a lot of what’s being discussed about online privacy is not widely understood by most of us. This being (the) one topic I’m somewhat qualified to speak on, I’d like to take a crack at helping those unfamiliar with this subject understand it a little better (and protect themselves in the meantime).
This is a huge topic, and I could easily write pages about each of the items I touch upon so distilling them into something brief yet understandable is difficult. Some of what I’m writing is a significant simplification, but done so as to make this more digestible for everyone. Additionally, I broke each section into “What it is” and “How to stop it” sections in case you want to skip to the important parts.
The way I see it, most of the information you’re hemorrhaging to third parties on the internet is coming from about five main sources:
Cookies
What it is
Cookies are pieces of data that your browser sends to a web server whenever you request a page. They are specific to a web site, so any cookies you have for www.google.com will only be sent to pages in google.com. They’re a slight of hand to make the stateless internet feel stateful. It’s okay if that sounds like nonsense, the point is that its data your computer is sending to a website every time you type in a URL. It was told to store that data by some webpage within that site on a prior visit.
Here’s an example of a cookie:
Cookies are also exceptionally good at helping companies track your movement across the internet. Here’s how:
Something you may not realize, is that even if you don't have Facebook or haven't signed into it on your current computer/browser, Facebook still tracks you through these sites. Instead of associating the traffic to you, John Bumbletuck, they create a placeholder account and log the traffic to that account. I heard an NPR commentator refer to it as a "shadow account" which has just the right sinister fear-mongering tone I think.
Cookies are pieces of data that your browser sends to a web server whenever you request a page. They are specific to a web site, so any cookies you have for www.google.com will only be sent to pages in google.com. They’re a slight of hand to make the stateless internet feel stateful. It’s okay if that sounds like nonsense, the point is that its data your computer is sending to a website every time you type in a URL. It was told to store that data by some webpage within that site on a prior visit.
Here’s an example of a cookie:
- www.SomeSite.com username=JSMITH
Cookies are also exceptionally good at helping companies track your movement across the internet. Here’s how:
- You type in a URL, let’s say it’s www.SomeSite.com
- That website returns to your browser a webpage. It’s really only sending back text and information on how to display it (no images or videos usually). Within that text are the URLs to other resources you’ll need to view the web page (like pictures, videos, and scripts). Your browser will go out and download them all. Every time it requests one of those items, it’ll pass all the cookies it has for that website with its request.
- Pretend one of those resources is “www.MeanNastyWebTracker.com/SomeImage.gif”
- When you request that image, part of your request header tells the website you’re requesting the image from “www.SomeSite.com”
- Mean nasty web tracker notices you don’t have a cookie for their website, so they create a random identifier for you (say, 293), puts it in a cookie, and returns it to you along with the image you requested.
- Now you visit another completely unrelated website. “www.SomeOtherSite.com” and the same process happens again. The page they return also refers to that image. Only this time when you request SomeImage.gif, MeanNastyWebTracker sees your ID (293) and now knows whoever 293 is has visited both these web pages.
Something you may not realize, is that even if you don't have Facebook or haven't signed into it on your current computer/browser, Facebook still tracks you through these sites. Instead of associating the traffic to you, John Bumbletuck, they create a placeholder account and log the traffic to that account. I heard an NPR commentator refer to it as a "shadow account" which has just the right sinister fear-mongering tone I think.
How to stop it
Let’s start with your first line of protection: AdBlock. AdBlock is available for Chrome, Firefox and probably a bunch of other browsers you shouldn’t be using. Remember when we typed in the URL “www.SomeSite.com” and got back information with the text, layout information, and the list of other resources needed to display the page? AdBlock culls through that list of other resources first, and removes requests to advertiser content. No more ads on your pages and MeanNastyWebTracker never knows you visited SomeSite. AdBlock maintains a giant list of URLs of advertisers and trackers, so they know what resources to shoot down and which to allow.
It’s also expandable, you can custom block certain sites if you’d like or use some others have made. Go into options for AdBlock, then to Filter Lists, and you can enter this URL:
Most modern browsers have a second line of defense as well: private mode (Firefox)/incognito mode (Chrome). Among other things, this tells the browser not to persist these cookies. It’s a big hammer because you lose the good stuff cookies do (like remember passwords) but a lot of the time you don’t need this. If you’re planning on researching divorce procedures and don’t want your credit to suffer, this will guarantee privacy. Google and Facebook will see you doing stuff, but without those cookies they won’t know you’re the same person.
Network Sniffing
What it is
Network sniffing is using tools to inspect web traffic. Google and Facebook wouldn’t do this, but your employer or ISP (Internet Service Provider) probably does. Let’s introduce an inappropriate metaphor: if the internet is the US postal service, your unencrypted HTTP web traffic is a post card. Anyone who handles your postcard can read its contents easily (like your ISP or the Gateway/Proxy Server at your office).
Let’s start with your first line of protection: AdBlock. AdBlock is available for Chrome, Firefox and probably a bunch of other browsers you shouldn’t be using. Remember when we typed in the URL “www.SomeSite.com” and got back information with the text, layout information, and the list of other resources needed to display the page? AdBlock culls through that list of other resources first, and removes requests to advertiser content. No more ads on your pages and MeanNastyWebTracker never knows you visited SomeSite. AdBlock maintains a giant list of URLs of advertisers and trackers, so they know what resources to shoot down and which to allow.
It’s also expandable, you can custom block certain sites if you’d like or use some others have made. Go into options for AdBlock, then to Filter Lists, and you can enter this URL:
- http://www.squirrelconspiracy.net/abp/facebook-privacy-list.txt
Most modern browsers have a second line of defense as well: private mode (Firefox)/incognito mode (Chrome). Among other things, this tells the browser not to persist these cookies. It’s a big hammer because you lose the good stuff cookies do (like remember passwords) but a lot of the time you don’t need this. If you’re planning on researching divorce procedures and don’t want your credit to suffer, this will guarantee privacy. Google and Facebook will see you doing stuff, but without those cookies they won’t know you’re the same person.
Network Sniffing
What it is
Network sniffing is using tools to inspect web traffic. Google and Facebook wouldn’t do this, but your employer or ISP (Internet Service Provider) probably does. Let’s introduce an inappropriate metaphor: if the internet is the US postal service, your unencrypted HTTP web traffic is a post card. Anyone who handles your postcard can read its contents easily (like your ISP or the Gateway/Proxy Server at your office).
