10 ms·
Noiszy – A Chrome plugin that creates meaningless web tracking data
- yarapavan 10y agoHere is the author's guest post providing background for this plugin - https://mathbabe.org/2017/03/31/guest-post-make-your-browsing-noiszy/ https://mathbabe.org/2017/03/31/guest-post-make-your-browsin...
- jstapels 10y agoNot to sound pessimistic, but as more and more people get forced into metered bandwidth, how is using a plugin that generates extra random traffic "sticking it to the 'man'"? Edit: Yes, I know this is supposed to mask your actual viewing habits. But security through obscurity has never really panned out for anyone in the end.
- arekkas 10y agoAdding variance always messes with statistical models and thus anything related to big data analytics, which internet surveillance is all about.
- russdpale 10y agoIndividually it doesn't do much. The bigger point is the render the data as useless.
- dullgiulio 10y agoThis is not security through obscurity, this is obfuscation. Like everything in security, it's not all-or-nothing. It adds valuable noise, it won't hide your tracks.
- threepipeproblm 10y agoIs 'it uses bandwidth' really a valid criticism of this? I would say no. It's also not really "security by obscurity", which I believe refers to situations where techniques uses to secure a system are kept quiet in the hopes no one will figure them out. Here we have a system that is already breached and the point is to defeat analysis. Most analytic techniques I can think of would be defeated by the right kind of "noise", despite the fact that there may awareness that the noise is in there.
- deleted 10y ago[deleted]
- arekkas 10y agoThis is exactly what I had in mind when Snowden happened. I never wanted to take this on, because of multiple reasons. Very awesome to see this, installed it immediately.
- iask 10y agoAn interesting way to look at this, but wouldn't it be possible to pluck this pattern out from relevant data?
- danbruc 10y agoIt most likely is because it is incredible hard to create realistic fake traffic. The moment you start using such a tool is probably very easy to detect due to a sudden jump in traffic. Then you can use prior data to figure out what you were actually doing - sites you visit, times you are active times, how you switch between sites, how long you stay on sites, and so on. Randomly following links will show very different distributions. You have to fake your browsing behavior with pretty high accuracy but if you do that, you defeat the entire purpose, you just created a copy of your browsing behavior. Maybe if there is no prior knowledge of your browsing behavior and the fake traffic is human-like enough, but even in that case it seems not too unlikely that one could separate the two traffic sources. If you want to hide your browsing behavior, the fake traffic must be different from yours. But if there is a difference, the difference can potentially be exploited to separate the sources.
- state_less 10y agoI was thinking the same thing, real sessions might be separable from fake. This smells like an adversarial problem, where one AI makes fake traffic and one tries to detect it. Perhaps the fake session creation bot could mingle on the same sites as the real sessions to make it harder to distinguish.
- jerf 10y agoIf I were writing this, I would try to get it into as many hands as possible, and do some sort of backfeeding of data to generate "real" profiles of user activities, then send back down suitably randomized profiles of other real users that you use for some period of time. It's important to conceive of this as an arms race, and I think one of the underappreciated things about arms races is that if you successfully anticipate the next three things your opponent will do and counter them, you can end up discouraging them from even fighting in the arms race. I don't know how random the page visits are, but if they are random in, well, almost any sense, eventually they will be something the trackers can filter out. "Well, this person shows a really strong signal for football, and weak signals for anime, robotics, accounting, and a hundred other things. Show them the football ads." Even today that wouldn't necessarily pose much of a challenge. By contrast, if you get profiles from volunteers that are real, and then start mixing them up so that everybody downloading this extension shows ten or fifty equally strong signals of interest, of which only one is real, that'll scramble the data being collected something fierce, and require the data collectors to jump straight to very sophisticated teasing out of what's really true, which initially won't even be worth it until a lot more people are using this stuff. There's a lot of elaborations you can think of from there (temporal correlations, i.e., college basketball interest should be spiking now, vs. football), etc. I have no idea what this extension is doing, because I can't seem to find any data about what it is doing, so maybe it's doing some of this stuff, but I expect they'd be talking about at least the data they'll need to collect to make this really work if it was going to work this way, so I assume without proof that it is not this. In general, it's worth pointing out that a lot of systems can't be fooled by uniformly random data, because all real-world systems already have to be able to filter that out because all real-world systems experience noise, of which at least a significant component is probably more-or-less uniformly random. If you really want to scramble a system you need to be more clever.
- glenneroo 10y agoI've been thinking about building something similar since the first Snowden leaks. I figured encrypted traffic to various locations would be useful considering that security agencies store everything until they can decrypt it at a later date. Unfortunately I'm not well-versed enough in implementing proper encryption and I'd probably just end up shooting myself in the foot. Has anyone else ever thought about doing this?
- codydh 10y agoI don't mean to be a curmudgeon, but why put out this kind of privacy-minded plugin for Chrome, one of the browsers I'd probably least trust to respect my privacy?
- aleeds 10y agoDifferent levels of trust. Some might feel that Google has established a baseline level of trust, while companies like ATT and Verizon have not.
- siegecraft 10y agoPut it where it will have the most impact / get adopted, then that can cultivate a desire to have it for other browsers, and someone may get motivated to write those versions.
- gingerbread-man 10y agoGoogle has actually blocked similar "noise generation" apps from the Chrome Store in the past. As I recall, there were a few extensions out there that would 'click' on every ad displayed. Obviously that would have created serious problems for Google, so they nixed it.
- wincy 10y agoAd Nauseam does this. It was removed from the chrome web store and I had to install it as a developer plugin, so it nags me to disable it as it could "damage my computer" every time I restart Chrome. It estimates since I installed it that I've cost advertisers $460 in clicks. https://adnauseam.io/ https://adnauseam.io/
- deleted 10y ago[deleted]
- literallycancer 10y agohttps://adnauseam.io/ https://adnauseam.io/ I wasn't convinced it was very useful and thought it would only take some easy heuristics to filter out when I first saw it, but if Google removed it from the store, it must have been a pain to deal with. Maybe I'll even end up using it.
- accountface 10y agoDoesn't seem like the best idea when it comes to environmental sustainability.
- dullgiulio 10y agoVery marginal effect, especially if you factor in the impact of Bitcoin and the other crypto currencies.
- deleted 10y ago[deleted]
- monochromatic 10y agoWhat does one have to do with the other?
- accountface 10y agoBandwidth has a physical cost
- monochromatic 10y agoI assume it's de minimis, but do you have a reason to think otherwise?
- ajuc 10y agoUsing this will raise some flags (your online behaviour will be different from most).
- deleted 10y ago[deleted]
- En_gr_Student 10y agoradar detector detectors ... they are going to eventually happen here. sadly.
- amelius 10y agoWill this not be counterproductive, i.e. distribute your personal data to even more websites? By the way, I once got blocked by Google after installing a plugin that did automatic random searches in the background.
- siegecraft 10y agoIt's a nice marketing stunt -- not meant to be perjorative, I hope it inspires more innovation in this space. But I find it ironic that a plugin that purports to make it harder to track you has google analytics.
- TeMPOraL 10y agoDogfooding, I guess :D.
- stevespang 10y agoJust curious, how did you determine this plugin has Google Analytics ? I'm wondering why they just don't post the plugin for everybody - - rather than insisting you pony up your email in order to receive the plug in ? Usually marketers want your email.
- akirayamaoka 10y agoTraffic filters easily remove any plugin attempts to make a noise.
- liotier 10y agoDistributed spidering for a community-fed search engine index would provide comparable end-user benefits while being considerably more socially useful.
- cauterized 10y agoWhat an awesome idea!
- cfarre 10y agoI agree
- rishabhparikh 10y agoYou win buzzword bingo
- jdormit 10y agoHow else would you describe the system liotier is talking about?
- logicallee 10y ago"Peer-to-peer web spidering for a crowdsourced search engine would create socially responsible end-user value."
- striking 10y ago"Littered with buzzwords" and "interesting" are not necessarily mutually exclusive...
- andy_ppp 10y agoThat is an awesome idea - a browser that is also a node in a search engine; it would be possible to build an experimental search engine then without a £40 million + investment to even get started.
- edem 10y agoHow is this supposed to work? If I click on `Start` it loads a page then nothing happens. I have to click `Start` repeatedly to make it visit new pages despite that it says it is `Running`.
- doodpants 10y agoTurns out it's only for Chrome, and the front page doesn't even mention this. Could we at least change the HN title from "A browser plugin..." to "A Chrome plugin..."?
- stevespang 10y agoAlso, why do they FORCE you to turn over your email in order to get info on the plug in - - or to receive the plug in ? Why not post the plug in and allow mass distribution ? I suspect these folks are just going to use my email for more of the same as the marketers . . . I guess I could register a "burner" email that is useless except for Noiszy . . . .
- chasingtheflow 10y ago@stevespang they don't force you to. There's a button labeled "get the plugin" that takes you to the chrome plug in store. Then below that there's a for labelled "Connect" which allows you to subscribe to their mailing list.
- jchw 10y agoIt's hosted on Chrome Web Store, but otherwise it could very well work just fine in Edge, Opera and even possibly Firefox. They're all converging toward supporting WebExtensions, a mostly-Chrome compatible API.
- throwaway2048 10y agoCould? or does?
- jchw 10y agoDidn't try. It almost definitely will work on Opera since Opera is based on Chrome and there's ways to install straight from the Chrome App Store. If the author released a direct download, it'd be easy to test in Firefox and Edge.
- sctb 10y ago
- cfarre 10y agoSeems a nice idea
- romanovcode 10y agoinb4 it gets removed from Chrome Web Store!
- watty 10y agoIt's kind of funny their website includes TypeKit, SquareSpace, and Google Tag Manager scripts - all of which can (and probably are) tracking various things. They may not be connected to "you", may be anonymized, may be unique number representing you.
- noiszytech 10y agoHi - Noiszy creator here. You're right about the scripts - we're using GTM and Google Analytics. I think it's 100% legit for sites (like mine) to want to know how much traffic they're getting - this to me is a good use of data. I work in the analytics field and actually I love data - I just don't like AI using data in creepy ways. The thing is, there is a big moral grey area between "count visits" and "creepy targeting based on everything you do". My hope is that by disrupting the data, we can make the conversation happen about the right things to do with algorithms. I don't have the answers but I hope to be a part of the discussion.
- spenczar5 10y agoYour website appears to also be sending data to facebook with App ID 314192535267336. This might be some squarespace thing. It qualifies as "creepy" to me that you're tracking more than you even know, and it's connected back to my facebook identity!
- watty 10y agoI get it. Everyone, everywhere, is collecting data - whether it's CNN.com or Noiszy.com or Google Analytics. While you may be using Google Analytics for basic tracking of anonymous visitors, Google may be using it for "creepy targeting based on everything you do". I'm really not opinionated (I think the plugin is interesting and am completely ok with being tracked) I just found it a bit hypocritical to create a product against tracking while simultaneously providing tracking data to Google.
- noiszytech 10y agoI think of it as a product to deter AI processing of your data, not a product against data itself. I, too, am ok with being tracked - but being ok with data collection =/= blanket approval of all data processing & use. Thanks for raising this point.
- IgorPartola 10y agoWhat exactly is the point? If the FBI suspects you in a case of the international heist of carrots and your search history includes "consealed carrot transportation" and "circumventing carrot museum security", it doesn't matter what else you googled. It only matters that this is included in it. Edit: it was a 24-carrot job.
- chasingtheflow 10y agoI don't think it's about hiding from FBI inquiries but obscuring the value of data that ISPs, Google, Facebook, et al are collecting and selling without your consent.
- bognition 10y ago> Read and change all your data on the websites you visit While I applaud the authors for trying to solve a problem, I will not install this plugin unless its open source. There is no way I'm going to grant the above permission to some random plugin just because they tell a compelling story.
- sandmarq 10y agoI have to agree with you, an open source solution will be better, but at least it's a start.
- TjWallas 10y agoSame here with a tiny twist: opensource and has a SHA512 mentioned somewhere in the repo that could be verified against whatever comes from the chrome appstore.
- throwaway2048 10y agoWould be meaningless because the chrome store auto-updates addons.
- TjWallas 10y agoQuestionable action but, one could freeze extensions via extended file system attributes & permissions or work around the auto-updates through the hosts file or other means... https://serverfault.com/questions/354606/where-do-i-find-the-update-url-for-google-chrome-extensions/354635#354635 https://serverfault.com/questions/354606/where-do-i-find-the... .. Or even a combination of the above.
- tyingq 10y agoIt doesn't imply any particular licensing, but it is trivial to view the source of a chrome extension. You can do it with curl or similar to download it, but there's a chrome extension that does the work for you: https://chrome.google.com/webstore/detail/chrome-extension-source-v/jifpbeccnghkjeaalbbjmodiffmgedin?hl=en https://chrome.google.com/webstore/detail/chrome-extension-s...
- xyz-x 10y agoIs this plugin available for Firefox?
- JustSomeNobody 10y agoSo, it's going to be noise among a patterned world. How will they not be able to filter this out? People are creatures of habit. Example: I read HN with my coffee every morning. Interjecting meaningless data doesn't prevent them from finding my patterns.
- disiplus 10y agoso we need a plugin that creates a patterns. could we crowd siurce a patterns also. lets say i share my pattern with everybody and you share yours.
- JustSomeNobody 10y agoI bet the ML guys and gals would be able to suss out my pattern from a fake pattern.
- snerbles 10y agoStart an arms race, use ML to generate fake traffic.
- always_good 10y agoReminds me of a comment I once saw on HN where someone suggested they avoided timing attacks by adding a random sleep.
- _wmd 10y agoThere have been a few of these plugins floating around recently, and really everything that needs said about them appears in the comments already. Fake traffic is wasteful, hard to make look authentic, and only serves to create more records of the end user around the web rather than less (e.g. your laptop IP was generating fake traffic? That probably means you had the lid open and were doing something with it at that time) I'd much rather see a browser with some kind of built-in distributed cache, something along the lines of FreeNet, but trading perfect anonymity for performance. Given a large chunk of disk space, and a handful of browsers talking to each other in a local area (e.g. same ISP), it should be viable to concoct a scheme where after a handful of browsers request a particular page, the remaining browsers are confident enough that the data cached in their local group is representative of the data sourced from the origin network. There are a million issues to iron out with a scheme like that, e.g. bad actors injecting crap into the cache, handling staleness, interactions with dynamic content and API endpoints etc., but I think something like this would have a much greater privacy benefit by denying at least some traffic to the origin networks, or simply by keeping some of that traffic within the boundary of the local ISP's network (and if the local ISP is evil, requests between the nodes could be encrypted as in FreeNet).
- ntaylor 10y agoDistributed caching is challenging enough to get right when you know the segmentation parameters; inferring these accurately from any old website would be incredibly difficult. Still, it's a neat idea.
- eecc 10y agoI'm hacking at an article repository for that, bloody difficult... Maybe I should try with https://github.com/ipfs/ipfs https://github.com/ipfs/ipfs
- _jal 10y agoNot quite what you're describing, but the venerable Squid cache can do distributed caching. Something, at least, to play with with your nerdy friends.
- Sir_Cmpwn 10y agoThis would probably be better as a daemon, not a browser plugin.
- mtkd 10y ago"creates meaningless web tracking data" or creates a massive botnet which will eventually be used for some nefarious PPC scam or worse you decide ...
- Insanity 10y agoMaybe I am being too naive, but could someone explain to me why just using a VPN would not be good enough to hide your traffic from these companies / governments? I understand that perhaps they _could_ ask the VPN provider to give logs (depending on the provider, if they keep logs or not). But that would not work for the algorithms used to target you as an individual. Could someone please explain that to me? :-)
- deleted 10y ago[deleted]
- jehna1 10y agoVPN commonly only hides your IP for the time you're using it. There are many other factors that can be used to track you. First is cookies. Say you log in to Facebook with your browser from your own IP address and a hour later you fire up VPN to browse the web. One of the websites you load has Facebook's tracking pixel and - unless you cleared your cookies - boom: Facebook knows you have visited that site. Even if you clear your cookies, you may have some long-living stuff (like Flash cookies etc) that can be used to track your browser. And even if you clear everything or use incognito, sites can use some clever heuristics (CPU power, enabled plugins, timezone, browser version, webrtc, etc.) to track your browsing and to match that it's you.
- Insanity 10y agoWell, for the first part, just restrict internet access without turning the VPN on. (For me, I can not access any website when the VPN is not active). The last part of which you wrote is incredibly interesting. I had no idea they could find out the CPU power or the enabled plugins. Though, to be fair, I think I'd fall in a pretty large pond to match. And either way, that information does not seem very useful (to me) for targetted advertisements. Thank you for your answer :-)
- programd 10y agoThe EFF lets you see all the fun ways you can be tracked by your browser fingerprint: https://panopticlick.eff.org/ https://panopticlick.eff.org/
- scotchio 10y agoSomewhat related: A long time ago I tried to delete my Facebook and realized it only deactivates until next login. You have to specifically request that they permanently delete it or something. And, it's not even clear if FB still doesn't store your info or not after that whole process (little sketch to be fair...). So I came up with this idea that I'd make a service called socialfacewash.com that just completely trashes your digital profile (liking random things, changing your info, and just basically obfuscating what FB thinks they know about you). I never built it though, but I kind of wish I did. Still own domain if someone wants it. Trend seems to be that we're not going to have protections over our own digital privacy/data for a very long time. Maybe a service that could at least mask, lie, trash, obscure our footprint for everyone else would be nice to have.
- bartkappenburg 10y agoSomeone already created that: http://suicidemachine.org/ http://suicidemachine.org/ The even got a cease and desist letter from FB.
- marvinkennis 10y agoI created something similar yesterday afternoon [0]. Instead of opening a new tab, it just requests pages through a hidden iFrame and drops the headers so the request goes through. It doesn't click on anything, because it would be awkward if this by chance started sharing things on logged-in Facebook profiles etc. I plan on adding sequential requests over the weekend so the traffic is more realistic. It's open source and on Github, so you can download, install and modify it from there if you wish [1]. [0] https://chrome.google.com/webstore/detail/decoy-requests/aehfkpmplnnelkljnpekbbiddaigocmf https://chrome.google.com/webstore/detail/decoy-requests/aeh... [1] https://github.com/marvinkennis/Decoy-Requests https://github.com/marvinkennis/Decoy-Requests
- noiszytech 10y agoCool! I really think this is a "the more the merrier" space. More tools = good.
- lowonkarma 10y agoFinally a DDOS solution for the Chrome browser
- akerro 10y agohttps://github.com/dhowe/AdNauseam https://github.com/dhowe/AdNauseam does the same but for ad-tracking. It hides ads from webbrowser but clicks them in background (just sends request to tracking server that user clicked the ad).
- neuralFatigue 10y agoI think Google removed it from the Chrome Web Store recently. Bummer.
- akerro 10y agoso at least we know it works!
- lcfcjs 10y agoI have a live one of these, my 7 year old.
- Animats 10y agoIt generates meaningless tracking data by doing meaningless browsing automatically. So it sucks bandwidth. That's not a good solution. Returning fake responses to tracking cookies is more efficient. For phones, returning bogus info to app requests for contact lists and location is especially effective.
- fjdlwlv 10y agoIt sucks far less bandwidth than advertising traffic or video content
- noiszytech 10y agoIt does suck some bandwidth - and your point is well taken, that would be a great technique too. It loads about one new page per minute, so it shouldn't be a crazy amount (unless pages contain video, for example). The thing is, anything less than visiting from your own browser on your own machine and doing user-like things (like waiting and then clicking again) is easily filter-out-able for most tracking tools. The idea here is to purposefully associate the "noise" with your online footprint.
- troyvit 10y agoThis begs a question: how do ISPs collect this data? I thought it was intercepting and analyzing http requests as they come from the cable modem. Are you saying that rather it's at the browser level? If so how do they control that?
- ComodoHacker 10y agoI believe random noise can be filtered out easily with AI. To be effective, this gonna be AI vs AI arms race, much like AV vs malware.
- kleer001 10y agoNo need to bring a grenade to a fist fight. If the overall history data is aggregated you won't really need to filter out the noise. Random browsing will just disappear under the threshold of noise and the 'real' browsing will stand out.
- apahwa 10y agothis needs to be open source. this plugin could be very dangerous to install
- slifty 10y agoHello all! Recent creator of a similar tool that has been getting a lot of buzz, I am here to throw some constructive thoughts out there! These ideas are useless from a technical level (for all the reasons that have been mentioned already.) Where they are useful is at a social level. People are energized and ready to fight. Many of them didn't know about this issue. Many of them didn't know that there are things they can do as individuals to fight back. Your tool (and mine) are getting attention because they open eyes and tap into pain. As useless as noise might be, people understand the idea and that makes it accessible. That means people will try it, get it, and share it. We need to leverage that attention in order to teach those people things they need to understand about privacy. Our tools should be seen as a gateway into impactful approaches like Tor, VPN, HTTPS Everywhere, Privacy Badger, and the EFF at large. Tooting my own horn: that's what I've been doing with https://slifty.github.io/internet_noise/index.html https://slifty.github.io/internet_noise/index.html In all interviews I make sure to explain that while this is an amusing form or protest, it is not effective and people who care need to go take the steps outlined on the project page. A website can do this. A chrome plugin, however, risks being harmful with minimal benefit. It minimizes the potential for communication to your audience, it is also harder to access which means you are touching a more narrow audience. Here's the good news! The project I linked to is open source -- https://github.com/slifty/internet_noise/ https://github.com/slifty/internet_noise/ -- you could contribute to it directly and then update your plugin so that instead of generating noise and hijacking their browser information you just direct them to the website version of the concept.
- noiszytech 10y agoHey there - I like your project. Sounds like our tools are complementary, and you make an interesting point about the browser-vs-plugin based approach. I do think it's worthwhile to specifically browse news sites - I believe they're the worst "filter bubble" offenders right now, and this can help break that. The more efforts there are in this space, the better. Thanks for sharing your project!
- bonnaroo 10y agoI'm just going to leave this right here. https://github.com/Xodarap/Paranoid-Browsing https://github.com/Xodarap/Paranoid-Browsing
- justshashank 10y agoI have been working on something similar last night. Hack it and make some noise. No strings attached, kill it once you think its obsolete. https://github.com/shashanksurya/HaughtyDog https://github.com/shashanksurya/HaughtyDog
- soared 10y agoIMO this is taking the wrong approach. Why spread your data accross more site, when the problem is the individual sites you visit - not random ones you don't? This (dead) project of mine sends similar data to the site you are currently on - but instead of noise it is purposely malicious and will ruin the website owners tracking abilities if used at scale. https://hello-kill.github.io https://hello-kill.github.io
- grandalf 10y agoI had an idea a few years ago to make a chrome plugin that would send encrypted emails (containing a randomly generated message) to all sorts of Muslim country email addresses, helping to reduce the fruitfulness of encryption circumvention and surveillance.
- Johnny555 10y agoI'm not sure I understand the point of this -- marketers will just discard this random data that doesn't match a human access pattern. If this anonymized my tracking data for sites I visited, that would be useful, but sending a bunch of random hits doesn't seem like it will keep anyone from tracking my activity which is what I want to shield.
- nkkollaw 10y agoExcuse the ignorance, but are we safe in Europe..? Are we only talking about American ISPs? What if an American ISP had a branch in Europe, could they sell our data, or the history must have been generated on American soil, or something like that?
- MR4D 10y agoHow about a plugin that routes any request to a sdserver thru Tor? That would really screw up things for any location tracking.