12 ms·

Don’t Let Facebook, or Any Tracker, Follow You on the Web

318 points by jerheinze 8y ago

rosser 8y ago
Do you really need the Tor browser to do this? I just sign into Facebook, Google, &c services using one browser, and do everything else in another — all of which all have µBlock Origin, Privacy Badger, whitelist-based cookie managers and the like installed. EDIT: One advantage of this approach is potentially significantly raising the noise floor in Tor traffic. That, by itself, is a win. EDIT 2: Also IP-level tracking and fingerprinting. See below...
- noncoml 8y ago
  Do they not try to match you based on your IP? After all if they know it is a residential IP, they probably know that no matter the user-agent, traffic belongs to the family. And I assume they know who all your family members are.
  - rosser 8y ago
    That's also a good reason, thanks! If I'm blocking trackers from those sites in all of my browsers, though, are they ever even seeing my IP outside the traffic I deliberately send them?
    - errantmind 8y ago
      Not all trackers are client-side
      - rosser 8y ago
        And people wonder why some of us talk about the unclean hands of the online ad/tracking/modeling/&c industry...
  - notjtrig 8y ago
    When you use tor it says not to maximize the window because sites can use your screen resolution to track you. More realisticly they could match operating system from the user agent with other data. I remember chrome being acused of putting serial number like strings in the user agent. Why would they not?
    - noncoml 8y ago
      Completely agree. And moreover they don’t need to match you with 100% level of confidence. Even something as low as 10% is probably enough.
    - codingowl 8y ago
      These are the basic basics for tweaking FF's about:config. There are many more. Try these and see how you fare... layout.css.visited_links_enabled set to false; geo.enabled set to false; media.navigator.enabled set to false; media.peerconnection.enabled (WebRTC) set to false; network.http.sendRefererHeader set to 0; privacy.resistFingerprinting set to true; privacy.firstparty.isolate set to true; network.dns.disablePrefetch set to true; network.prefetch-next set to false; webgl.disabled set to true Don't forget to also use something like uBlock Origin, Token Tracker Stipper, and Decentraleyes. Pass is all through a Pi-hole and VPN and you're pretty safe. Make sure your VPN does not expose your NAT'd IP with WebRTC. Both uBlock Origina and ScriptSafe can help with this, as FF will sometimes crap all over its about:config settings with updates.
      - jerheinze 8y ago
        A VPN does not offer privacy-by-design, it's at best a privacy-by-policy product.
      - TheRealPomax 8y ago
        Note that this also has some insane side effects, eg setting resist fingerprint also breaks anything that assumed JavaScript date objects actually reflect local time. Like Gmail. Surprise!
      - anticodon 8y ago
- jerheinze 8y ago
  In that setup your browser fingerprint alone is enough to uniquely identify you, and it doesn't protect you from tracking by the first-party domains themselves. See as well: https://www.torproject.org/projects/torbrowser/design/ https://www.torproject.org/projects/torbrowser/design/ > Site-specific or filter-based addons such as AdBlock Plus, Request Policy, Ghostery, Priv3, and Sharemenot are to be avoided. We believe that these addons do not add any real privacy to a proper implementation of the above privacy requirements, and that development efforts should be focused on general solutions that prevent tracking by all third parties, rather than a list of specific URLs or hosts. > Implementing filter-based blocking directly into the browser, such as done with Firefox' Tracking Protection, does not alleviate the concerns mentioned in the previous paragraph. There is still just a list containing specific URLs and hosts which, in this case, are assembled by Disconnect and adapted by Mozilla. > Trying to resort to filter methods based on machine learning does not solve the problem either: they don't provide a general solution to the tracking problem as they are working probabilistically. Even with a precision rate at 99% and a false positive rate at 0.1% trackers would be missed and sites would be wrongly blocked. > Filter-based solutions in general can also introduce strange breakage and cause usability nightmares. For instance, there is a trend to observe that websites start detecting filer extensions and block access to content on them. Coping with this fallout easily leads to just whitelisting the affected domains, hoping that this helps, defeating the purpose of the filter in the first place. Filters will also fail to do their job if an adversary simply registers a new domain or creates a new URL path. Worse still, the unique filter sets that each user creates or installs will provide a wealth of fingerprinting targets.
  - gregw134 8y ago
    In practice IP address is the most important component of browser fingerprinting. Browser fingerprinting can tell advertisers things like: person x has a 2011 MacBook Pro, is running Firefox, and has installed these 3 plugins. If that person visits a coffeeshop, clears their cookies, then revisits the same coffeeshop they will be easy to identify because they're linked by an IP address and a fairly unique configuration. Once you take IP address and city out of the equation browser fingerprinting becomes much harder, because the chances that someone else in the world has the same configuration becomes much higher.
- mark_l_watson 8y ago
  I also use the two browser approach, plus a vpn, to get some tracking protection.
codingowl 8y ago
You don't need Tor to do this. Tor is slow and frustrating. I use a heavily-modified Firefox instance over a VPN with uBlock Origin, Privacy Badger, Disconnect, No Coin, Script Safe, Token Tracker Stripper, Neat URL and too many about:config edits to mention. I do recommend disabling http/s referrer, CSS visited links, and others as can be learned online. In addition, I pass all of this through a remote computer with a Raspberry Pi/Pi-hole instance. This has worked well for me for a couple of years. As I have no real social media accounts, I'm not building any meaningful profiles. Accounts like HN or Slashdot don't get any real info. I also don't add any apps to my iPhone. The apps that ship with the device are all I need. I can pass all of my phone's traffic through the VPN/Pi-hole instance and keep relatively safe. Being with T-Mobile means I get unlimited data so I don't need to connect to potentially hostile Wi-Fi. I rather enjoy the "cold war" between the corporations and the security-minded. There are so great add-ons to uBlock and other add-ons that completely bypass the complaint scripts of using adblock. Another quick way to get past fake paywalls or complaining pages is to use Startpage's proxy or even Google's cached link. I've set up so many people to use this set up and they are thrilled. I am thinking of setting up remote desktops that can be accessed by friends and family that are VPN'd, Pi-holed, and with other security features that hide their real IPs, etc.
- Osiris 8y ago
  Where do you host your review Raspberry Pi?
  - codingowl 8y ago
    Most of the time in the Netherlands. Sometimes in Texas with IT friends. We do VPN sharing and passthroughs to mix it all up. Hence my wanting to set up more permanent solution like hosted, heavily VPN'd remote desktops with revolving IP addresses changed with a cron job. but one standard set maintenance port that never changes and likewise never used for joyriding. That IP would be accessed via OpenSSH authenticating to Radius/Kerberos.
- qwerty456127 8y ago
  >> You don't need Tor to do this. Tor is slow and frustrating. > I use a heavily-modified Firefox instance... So do I and it is slow and frustrating too.
keyle 8y ago
I have a portable browser just for Twitter/Facebook etc. And a separate browser with just ad blocker and blocked 3rd party cookies. Do I really need Tor?
- conception 8y ago
  Do you mind your ISP knowing what sites you are using?
  - keyle 8y ago
    Nope, not really.
- 3pt14159 8y ago
  Tor isn't the answer, it's broken. What's needed is a replacement for the modern web. At the protocol level it's busted in so many ways it isn't salvageable. The sooner we recognize that the sooner we'll be able to create its replacement.
  - mrep 8y ago
    How would you design a replacement for the modern web then?
    - 3pt14159 8y ago
      I'm working on a prototype. It's (obviously) hard. But there are a couple must haves: 1. No more "any device can talk to any device" it won't work. It leads to horrible hacks like half the internet relying on cloudflare and email centralizing in an oligopoly. We need a web-of-trust at the connection layer robust enough to be embeddable in our network gear. 2. No more "I'm a packet from xyz because I say so" and of course no more untrusted, unsigned, unencrypted streams (ie, no plain UDP). 3. No more third party connections. We don't really need them. Just put whatever data you want in the URL like we do with OAuth. Everything else is adware or malware or trackware. I'm not blaming people, I understand how incentives shape behaviour. They shape mine too. We exist in the paradigm that we find ourselves in. But I envision a better world. 4. Simplified character sets within contexts. No more zero-width characters where we don't expect them (see zachaysan.com/zero for more info) or any of that shit. 5. I don't know how to fix JavaScript, but it needs fixing. JSON is cool, but it needs a complete / strict formalization to stop some edgecases. 6. No stupidness with PDFs. It's not worth it. There will be 0days in PDFs for as long as we use them. They're too fucking complicated. Just use HTML, SVG, or images. CSS is smart enough to make print formats for A4 and Letter. 7. Ideally either make a new HTML that is JSON based instead of XML based and either way make the web-of-trust default to downgrading trust on entities that pass malformed documents. Parsing broken XML is bug prone. 8. DNS is so fucking dumb it's painful. Just use the WoT and fallback trust nodes for when calamity hits (someone steals your keys). There is more to it, but I'm just getting back from a comedy show and I've had a couple and I already feel like I'm not being as coherent as this topic deserves so I'll end it there. If you're interested in being part of a beta group contact me.
qwerty456127 8y ago
I just wish more web sites would provide official TOR and/or i2P addresses (so we wouldn't need exit-nodes) yet nobody among them seems interested in visitors they can't track. Both the fact there are hardly any non-illegal websites maintaining native TOR/i2P presence and the fact every major WWW site demands you to agree to be tracked now as GDPR doesn't allow this to be done silently suggests this.
- tlrobinson 8y ago
  FYI Facebook, NYTimes, Wikipedia, and a few other prominent sites operate hidden services: https://en.m.wikipedia.org/wiki/List_of_Tor_hidden_services https://en.m.wikipedia.org/wiki/List_of_Tor_hidden_services
ThomPete 8y ago
Honest question why wouldnt i let them track me? Arent there a bunch of benefits to being tracked too?
- craftyguy 8y ago
  Care to name some benefits? I don't want to be tracked because information gathered can and will be used in ways I don't expect. Websites will game me on pricing, etc based on where I've been on their site and other sites. I could easily fall into a filter bubble, where I am only given results based on previous preferences. I would have zero control over the information gathers regarding my habits, and any conclusions they make based off of this data. And it will get stolen. And it will be used against me. So I take as many steps as I can to prevent websites from tracking me.
  - SquareWheel 8y ago
    >Care to name some benefits? Improved ad targeting may increase revenue for the website, and will improve ad relevance for the end-user. This was historically seen as a win-win; particularly if it allows a service to remain free to use. I often get ads for programming IDEs, which I don't mind that much. I'd rather have them than beauty products, or other irrelevant items. Not that it's actually possible to discuss the pros and cons of targeting anymore. It's become a religious issue to too many people.
    - rosser 8y ago
      Not to imply that there aren't strong feelings around the subject, but don't you think calling it a "religious issue" might preemptively poison discussion a bit?
      - SquareWheel 8y ago
        I agree it might have been too snippy, but I was hoping to offer pause before somebody jumped in to explain how black and white the issue really is. I hope that addressing these strong feelings may help temper the issue, rather than poison it.
etaioinshrdlu 8y ago
Related question: What is the impact of IPv6 on regular users privacy?
- Scarbutt 8y ago
  The same as ipv4.
  - DINKDINK 8y ago
    Use of NAT to cope with IPv4 issues has an unintended privacy benefit. IPv6 obviates NAT and the privacy benefits.
    - teddyh 8y ago
      But IPv6 also adds IPv6 privacy extensions (used by default by many systems).
- CKN23-ARIN 8y ago
  Less NAT means less household/workplace/etc-level traffic mixing means less plausible deniability for users.
  - lokedhs 8y ago
    Address randomisation should give you the same level of deniability. The only part of your address that doesn't change is the same part that is unchanged in the IPv4 case. Unless you have CGNAT of course, but I don't think anyone would argue that that thing is a good thing to have.
    - tedunangst 8y ago
      A random address may make it harder to track individual devices over time, but if two sites see the same IPv6 it will be harder to argue that it's two different devices.
- 8y ago
systematical 8y ago
Tor is too slow for general browsing. I only use it for security related stuff. I wish it was faster.
- djsumdog 8y ago
  It's a tradeoff. You can't easily have both.
fulyscentedking 8y ago
I use Pi-hole, a DNS level blocker, + uBlock Origin. This combo should provide a much better protection against tracking.
- forapurpose 8y ago
  How does that protect you against trackers and against identifying you based on your IP address and browser fingerprint?
partycoder 8y ago
The innovations that make trackers possible are: - browsers cache results - cookies If you do neither of these things trackers become much harder to implement.
- szc 8y ago
  I think this list is missing: - HTML5 "local storage" - Plugin detection - Javascript (particularly xml-rpc) - fetching embedded content based on a URL (images, movies, css, javascript, ...) - Hidden frames and/or WebRTC - can scan your local network There are probably more. [Edited: Updated to clarify that local network scanning can be done with hidden frames or WebRTC. A followup comment from me gives a public example of how]
  - voxadam 8y ago
    Do you have any more information on the local network scanning?
    - danShumway 8y ago
      Not sure if this is what grandparent is referring to, but DNS rebinding[0] is what springs to mind. It's simultaneously kind of smart and also really stupid. Basically, you give a valid 3rd-party domain multiple IPs, one of them normal and one of them resolving to a local IP. Then you cut off the normal one and the browser just allows you to make calls to whatever local interface you want. There was a good defcon video about this a while back[1]. It's a much bigger problem than most people realize. This is why it's good practice to have at least some security around devices even if they're only connected to your LAN. [0]: https://www.twistlock.com/2018/02/28/dear-developers-beware-dns-rebinding/ https://www.twistlock.com/2018/02/28/dear-developers-beware-... [1]: https://www.youtube.com/watch?v=stnJiPBIM6o https://www.youtube.com/watch?v=stnJiPBIM6o
    - szc 8y ago
      Here is an example. Start at https://mycloud.com/setup https://mycloud.com/setup. Load the web inspector, find and read scanner.js. The Javascript isn't minimized and there are some comments.
polyvisual 8y ago
4 weeks ago I found an injured pidgeon, took it a rescue place and got chatting to the owner about chickens. I came home, searched for chicked coops on my business laptop. This laptop runs Firefox, uBlock and Ghostery. Last night, my wife has Facebook adverts for chicken coops pop up on her laptop. We've not spoken about chicken coops since, I've not searched for chicken coops since the original search, she's not searched for chicken coops on her laptop and she's not used my work laptop. Creepy. If they want to track you with a "normal" browser, they'll find a way of doing it.
- djsumdog 8y ago
  Doesn't Ghostery allow in certain trackers if they're paid? I remember there was some controversy about their funding model. I use uBlock Origin + uMatrix currently. Your tracking situation doesn't seem out of the realm of possibility though. 1. You searched for Chicken Coops at a place. 2. That same laptop connects to your home Wi-Fi. 3. The user (you) who searched for chicken coups is connecting from a new IP. 4. Some ad engine rule says that IP belongs to a household (this probably doesn't matter; makes me wonder if people in a Starbucks get ads intended profiled against other customers). 5. Now let's just advertise chicken coupes to everyone in that house. So in theory, this tracking attempt can be done with just a cookie and selling sets of IP+search word data, right?
  - polyvisual 8y ago
    "Your tracking situation doesn't seem out of the realm of possibility though." Indeed. That's what's so invasive about tracking - anything that can be done to track you, will be done. What if my search had been something more personal? Something I didn't want my wife to know about? There's no way to opt-out of all this. We're being force fed this for the benefit of some corporation, somewhere.
  - Vinnl 8y ago
    > Doesn't Ghostery allow in certain trackers if they're paid? I remember there was some controversy about their funding model. The controversial thing was that you could opt-in to sending Ghostery data about what things it blocked, and Ghostery would then sell statistics about what things got blocked most often so publishers could update their website to replace the blocked items.
tpaschalis 8y ago
It's kinda weird, that some of the greatest minds in the world, are gathered in Silicon Valley, solely working on how to make us click on more advertisements on the internet. As far as hiding your online fingerprint, I feel that having a clean-slate browser container[1], while certainly a hassle, can go some way towards protecting yourself, but...these great minds will find another way. [1] https://tpaschalis.github.io/sandboxed-browser-with-docker/ https://tpaschalis.github.io/sandboxed-browser-with-docker/
- albertgoeswoof 8y ago
  > greatest minds in the world I wouldn't be so generous.
  - andrewmcwatters 8y ago
    Yeah, a lot of these individuals are "just people" at the end of the day.
    - ska 8y ago
      It's hyperbole, sure, but there is a kernel of truth (as is often the case) It seems entirely plausible from where I sit that some of the technology companies with the highest average talent (for some hand-wavy) in engineering are spending a ton of that talent , and wealth, and time focusing on problems that don't have very compelling value in a broader societal sense. While at the same time some interesting and clearly important problems are severely under-resourced. I suppose that's part of free-ish market capitalism's feature set - if above is right it should eventually re-balance but nothing says that has to happen in one generation, or even several.
- stephengillie 8y ago
  I saw the best minds of our generation writing spam filters. - Neal Stephenson We wanted flying cars, instead we got 140 characters. - Peter Thiel
  - 8y ago
a_imho 8y ago
Also consider using obfuscation instead. E.g. AdNauseam and Noiszy are two examples I'm aware of.
- drewmol 8y ago
  I used to feel for smaller companies who buy ads, concerning the damage possible caused by tactics like AdNauseam regarding outragous advertising bills. Now I think it's likely the best weapon available which can be easily wielded by the average user.
FreekNortier 8y ago
How good is Brave browser at blocking tracking?
ehecatl 8y ago
On the totem pole of tech nous, I am very close to the bottom. So can someone explain to me "remote browsing" is not a thing? Login to your VPS (or whatever), start and encrypted X session, and browse away. That is very unusual traffic, of course, and others connecting from my inet-facing IP probably make it even more so: Steam after school, missus hitting the foreign news sites in the AM, the traffic peaks and troughs at certain times of day... we're fucked.
- jacques_chester 8y ago
  They can identify you a number of ways without your knowledge or consent. One is timezone allocation. Another effective way is browser fingerprinting. IP addresses. Browsing patterns. Device screen size. Privacy on the web is an information theoretic arms race with tremendously deeply asymmetric stockpiles of information.
- gm-conspiracy 8y ago
  Take a look at this library: https://github.com/Valve/fingerprintjs2 https://github.com/Valve/fingerprintjs2
eklavyaa 8y ago
its an irony that on accessing the link in Chrome, it warns me about privacy error, "blog.torproject.org normally uses encryption to protect your information. When Google Chrome tried to connect to blog.torproject.org this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be blog.torproject.org, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Google Chrome stopped the connection before any data was exchanged. You cannot visit blog.torproject.org right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later."
seolucky 8y ago
yes, we must avoid all trackers
rurban 8y ago
There are many chrome extensions disabling Facebook tracking. I use "Disconnect Facebook™ pixel & FB™ tracking". It tracks not only by cookie or fingerprints, also by 1x1 pixel. And with the phone app even more, but nobody in his privacy aware mind should use the 2 apps anyways. Their constant recording of audio drains the battery too much, and their m. and mbasic. web urls are good enough.
JesusTheGod 8y ago
I need a genuine advice. I own Google Pixel 2 because I needed a good mobile camera, I also have a Chromebook with Cruton as I needed a cheap Linux notebook. I use Google Maps, Gmail, WhatsUp, Google Photos, Google Drive, Messenger ( the only thing I don't have is a FB app). Given all this information how I am supposed to disconnect from all of this? Cause surely simply having something blocking tracking of you in a desktop browser is not enough? Also, I really enjoy services provided by Google, why should I give it all up and replace everything with "safe" alternatives? I know I am a product and my personal info and preferences are all of over the place. But I always understood this to be the price I pay for using this services ( taking about Google mainly ).
orschiro 8y ago
For me it's the combination of uBlock origin [1], uBlock Extra [2], and Decentraleyes [3]. [1] https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm https://chrome.google.com/webstore/detail/ublock-origin/cjpa... [2] https://chrome.google.com/webstore/detail/ublock-origin-extra/pgdnlhfefecpicbbihgmbmffkjpaplco https://chrome.google.com/webstore/detail/ublock-origin-extr... [3] https://chrome.google.com/webstore/detail/decentraleyes/ldpochfccmkkmhdbclfhpagapcfdljkj https://chrome.google.com/webstore/detail/decentraleyes/ldpo...
- doubt_me 8y ago
  Umatrix (same guy) + privacy badger (eff) Have been using it since it was called HTTPS switchboard. Uorigin is my go to install on all of my customers fresh installs or people who don't want to break their web experience. Works great.
  - orschiro 8y ago
    - I tried Umatrix but it was too much configuration for me. ublock provides me with a sane out of the box experience. - I am not sure whether privacy badger and decentraleyes are mutually exclusive.
    - ealhad 8y ago
      I don't think they are. For example, you can choose to enable a Google-hosted library (say, jQuery) on a certain domain, because you want it to work, and then decentraleyes will do its part.
- forapurpose 8y ago
  Those add-ons provide some privacy, but they have a different effect than Tor. As examples, despite using the above add-ons, your ISP still knows which domains you visit, as anyone else who can see the network traffic and as does your DNS provider; and the domains you visit know who you are.
auslander 8y ago
1. Always-on VPN - kills main tracking feature, your IP 2. uBlock Origin in medium mode - kills 3p scripts and 3p frames 3. Private windows/tabs by default - kills 3p cookies and storage That's all kids :)
garryc-1304 8y ago
Garry cole GREETINGS EVERYONE, are you looking for a LEGIT and Trustworthy HACKERS with 100% Guarantee and you want to get your job done urgently withing one Hour or you are face with delay and unnecessary excuses and error on your job?. Then Worry no more because easyhackingguru@gmail.com are the Best Bet in any hacking Services. They are ready to render and attend to your job with swift response and No delay at all. Their services are outlined as follows: . LONG TIME LOAN GIVING . PROFESSIONAL in SCHOOL GRADE hanging . WHATSAPP Hack . FACBOOK hack . PROFESSIONAL in any BANK ACCOUNTS TRANSFER . TWITTERS hack . EMAIL,YAHOOMAIL and HOTMAIL ACCOUNTS hack . WEBSITE CRASHED hack . SERVER CRASHED hack . SALES OF SPYWARE and KEYLOGGER SOFTWARE . RETRIVAL OF LOST FILES and DOCUMENTS . ERASE and EXPUNGE of CRIMINAL RECORDS . DATABASE hack . SALES of ATM CARDS in WHITE . SKYPE hack . PAYPAL hack . DROPBOX ACCOUNT hack and Lots more.......... CONTACT: their services at easyhackingguru@gmail.com and you will be glad you did whatsApp contact- +12168104481

318 points by jerheinze 8y ago

Do you really need the Tor browser to do this? I just sign into Facebook, Google, &c services using one browser, and do everything else in another — all of which all have µBlock Origin, Privacy Badger, whitelist-based cookie managers and the like installed. EDIT: One advantage of this approach is potentially significantly raising the noise floor in Tor traffic. That, by itself, is a win. EDIT 2: Also IP-level tracking and fingerprinting. See below...

noncoml 8y ago
Do they not try to match you based on your IP? After all if they know it is a residential IP, they probably know that no matter the user-agent, traffic belongs to the family. And I assume they know who all your family members are.
- rosser 8y ago
  That's also a good reason, thanks! If I'm blocking trackers from those sites in all of my browsers, though, are they ever even seeing my IP outside the traffic I deliberately send them?
  - errantmind 8y ago
    Not all trackers are client-side
    - rosser 8y ago
      And people wonder why some of us talk about the unclean hands of the online ad/tracking/modeling/&c industry...
- notjtrig 8y ago
  When you use tor it says not to maximize the window because sites can use your screen resolution to track you. More realisticly they could match operating system from the user agent with other data. I remember chrome being acused of putting serial number like strings in the user agent. Why would they not?
  - noncoml 8y ago
    Completely agree. And moreover they don’t need to match you with 100% level of confidence. Even something as low as 10% is probably enough.
  - codingowl 8y ago
    These are the basic basics for tweaking FF's about:config. There are many more. Try these and see how you fare... layout.css.visited_links_enabled set to false; geo.enabled set to false; media.navigator.enabled set to false; media.peerconnection.enabled (WebRTC) set to false; network.http.sendRefererHeader set to 0; privacy.resistFingerprinting set to true; privacy.firstparty.isolate set to true; network.dns.disablePrefetch set to true; network.prefetch-next set to false; webgl.disabled set to true Don't forget to also use something like uBlock Origin, Token Tracker Stipper, and Decentraleyes. Pass is all through a Pi-hole and VPN and you're pretty safe. Make sure your VPN does not expose your NAT'd IP with WebRTC. Both uBlock Origina and ScriptSafe can help with this, as FF will sometimes crap all over its about:config settings with updates.
    - jerheinze 8y ago
      A VPN does not offer privacy-by-design, it's at best a privacy-by-policy product.
    - TheRealPomax 8y ago
      Note that this also has some insane side effects, eg setting resist fingerprint also breaks anything that assumed JavaScript date objects actually reflect local time. Like Gmail. Surprise!
    - anticodon 8y ago
jerheinze 8y ago
In that setup your browser fingerprint alone is enough to uniquely identify you, and it doesn't protect you from tracking by the first-party domains themselves. See as well: https://www.torproject.org/projects/torbrowser/design/ https://www.torproject.org/projects/torbrowser/design/ > Site-specific or filter-based addons such as AdBlock Plus, Request Policy, Ghostery, Priv3, and Sharemenot are to be avoided. We believe that these addons do not add any real privacy to a proper implementation of the above privacy requirements, and that development efforts should be focused on general solutions that prevent tracking by all third parties, rather than a list of specific URLs or hosts. > Implementing filter-based blocking directly into the browser, such as done with Firefox' Tracking Protection, does not alleviate the concerns mentioned in the previous paragraph. There is still just a list containing specific URLs and hosts which, in this case, are assembled by Disconnect and adapted by Mozilla. > Trying to resort to filter methods based on machine learning does not solve the problem either: they don't provide a general solution to the tracking problem as they are working probabilistically. Even with a precision rate at 99% and a false positive rate at 0.1% trackers would be missed and sites would be wrongly blocked. > Filter-based solutions in general can also introduce strange breakage and cause usability nightmares. For instance, there is a trend to observe that websites start detecting filer extensions and block access to content on them. Coping with this fallout easily leads to just whitelisting the affected domains, hoping that this helps, defeating the purpose of the filter in the first place. Filters will also fail to do their job if an adversary simply registers a new domain or creates a new URL path. Worse still, the unique filter sets that each user creates or installs will provide a wealth of fingerprinting targets.
- gregw134 8y ago
  In practice IP address is the most important component of browser fingerprinting. Browser fingerprinting can tell advertisers things like: person x has a 2011 MacBook Pro, is running Firefox, and has installed these 3 plugins. If that person visits a coffeeshop, clears their cookies, then revisits the same coffeeshop they will be easy to identify because they're linked by an IP address and a fairly unique configuration. Once you take IP address and city out of the equation browser fingerprinting becomes much harder, because the chances that someone else in the world has the same configuration becomes much higher.
mark_l_watson 8y ago
I also use the two browser approach, plus a vpn, to get some tracking protection.

codingowl 8y ago

You don't need Tor to do this. Tor is slow and frustrating. I use a heavily-modified Firefox instance over a VPN with uBlock Origin, Privacy Badger, Disconnect, No Coin, Script Safe, Token Tracker Stripper, Neat URL and too many about:config edits to mention. I do recommend disabling http/s referrer, CSS visited links, and others as can be learned online. In addition, I pass all of this through a remote computer with a Raspberry Pi/Pi-hole instance. This has worked well for me for a couple of years. As I have no real social media accounts, I'm not building any meaningful profiles. Accounts like HN or Slashdot don't get any real info. I also don't add any apps to my iPhone. The apps that ship with the device are all I need. I can pass all of my phone's traffic through the VPN/Pi-hole instance and keep relatively safe. Being with T-Mobile means I get unlimited data so I don't need to connect to potentially hostile Wi-Fi. I rather enjoy the "cold war" between the corporations and the security-minded. There are so great add-ons to uBlock and other add-ons that completely bypass the complaint scripts of using adblock. Another quick way to get past fake paywalls or complaining pages is to use Startpage's proxy or even Google's cached link. I've set up so many people to use this set up and they are thrilled. I am thinking of setting up remote desktops that can be accessed by friends and family that are VPN'd, Pi-holed, and with other security features that hide their real IPs, etc.

Osiris 8y ago
Where do you host your review Raspberry Pi?
- codingowl 8y ago
  Most of the time in the Netherlands. Sometimes in Texas with IT friends. We do VPN sharing and passthroughs to mix it all up. Hence my wanting to set up more permanent solution like hosted, heavily VPN'd remote desktops with revolving IP addresses changed with a cron job. but one standard set maintenance port that never changes and likewise never used for joyriding. That IP would be accessed via OpenSSH authenticating to Radius/Kerberos.
qwerty456127 8y ago
>> You don't need Tor to do this. Tor is slow and frustrating. > I use a heavily-modified Firefox instance... So do I and it is slow and frustrating too.

keyle 8y ago

I have a portable browser just for Twitter/Facebook etc. And a separate browser with just ad blocker and blocked 3rd party cookies. Do I really need Tor?

conception 8y ago
Do you mind your ISP knowing what sites you are using?
- keyle 8y ago
  Nope, not really.
3pt14159 8y ago
Tor isn't the answer, it's broken. What's needed is a replacement for the modern web. At the protocol level it's busted in so many ways it isn't salvageable. The sooner we recognize that the sooner we'll be able to create its replacement.
- mrep 8y ago
  How would you design a replacement for the modern web then?
  - 3pt14159 8y ago
    I'm working on a prototype. It's (obviously) hard. But there are a couple must haves: 1. No more "any device can talk to any device" it won't work. It leads to horrible hacks like half the internet relying on cloudflare and email centralizing in an oligopoly. We need a web-of-trust at the connection layer robust enough to be embeddable in our network gear. 2. No more "I'm a packet from xyz because I say so" and of course no more untrusted, unsigned, unencrypted streams (ie, no plain UDP). 3. No more third party connections. We don't really need them. Just put whatever data you want in the URL like we do with OAuth. Everything else is adware or malware or trackware. I'm not blaming people, I understand how incentives shape behaviour. They shape mine too. We exist in the paradigm that we find ourselves in. But I envision a better world. 4. Simplified character sets within contexts. No more zero-width characters where we don't expect them (see zachaysan.com/zero for more info) or any of that shit. 5. I don't know how to fix JavaScript, but it needs fixing. JSON is cool, but it needs a complete / strict formalization to stop some edgecases. 6. No stupidness with PDFs. It's not worth it. There will be 0days in PDFs for as long as we use them. They're too fucking complicated. Just use HTML, SVG, or images. CSS is smart enough to make print formats for A4 and Letter. 7. Ideally either make a new HTML that is JSON based instead of XML based and either way make the web-of-trust default to downgrading trust on entities that pass malformed documents. Parsing broken XML is bug prone. 8. DNS is so fucking dumb it's painful. Just use the WoT and fallback trust nodes for when calamity hits (someone steals your keys). There is more to it, but I'm just getting back from a comedy show and I've had a couple and I already feel like I'm not being as coherent as this topic deserves so I'll end it there. If you're interested in being part of a beta group contact me.

qwerty456127 8y ago

I just wish more web sites would provide official TOR and/or i2P addresses (so we wouldn't need exit-nodes) yet nobody among them seems interested in visitors they can't track. Both the fact there are hardly any non-illegal websites maintaining native TOR/i2P presence and the fact every major WWW site demands you to agree to be tracked now as GDPR doesn't allow this to be done silently suggests this.

tlrobinson 8y ago
FYI Facebook, NYTimes, Wikipedia, and a few other prominent sites operate hidden services: https://en.m.wikipedia.org/wiki/List_of_Tor_hidden_services https://en.m.wikipedia.org/wiki/List_of_Tor_hidden_services

ThomPete 8y ago

Honest question why wouldnt i let them track me? Arent there a bunch of benefits to being tracked too?

craftyguy 8y ago
Care to name some benefits? I don't want to be tracked because information gathered can and will be used in ways I don't expect. Websites will game me on pricing, etc based on where I've been on their site and other sites. I could easily fall into a filter bubble, where I am only given results based on previous preferences. I would have zero control over the information gathers regarding my habits, and any conclusions they make based off of this data. And it will get stolen. And it will be used against me. So I take as many steps as I can to prevent websites from tracking me.
- SquareWheel 8y ago
  >Care to name some benefits? Improved ad targeting may increase revenue for the website, and will improve ad relevance for the end-user. This was historically seen as a win-win; particularly if it allows a service to remain free to use. I often get ads for programming IDEs, which I don't mind that much. I'd rather have them than beauty products, or other irrelevant items. Not that it's actually possible to discuss the pros and cons of targeting anymore. It's become a religious issue to too many people.
  - rosser 8y ago
    Not to imply that there aren't strong feelings around the subject, but don't you think calling it a "religious issue" might preemptively poison discussion a bit?
    - SquareWheel 8y ago
      I agree it might have been too snippy, but I was hoping to offer pause before somebody jumped in to explain how black and white the issue really is. I hope that addressing these strong feelings may help temper the issue, rather than poison it.

etaioinshrdlu 8y ago

Related question: What is the impact of IPv6 on regular users privacy?

Scarbutt 8y ago
The same as ipv4.
- DINKDINK 8y ago
  Use of NAT to cope with IPv4 issues has an unintended privacy benefit. IPv6 obviates NAT and the privacy benefits.
  - teddyh 8y ago
    But IPv6 also adds IPv6 privacy extensions (used by default by many systems).
CKN23-ARIN 8y ago
Less NAT means less household/workplace/etc-level traffic mixing means less plausible deniability for users.
- lokedhs 8y ago
  Address randomisation should give you the same level of deniability. The only part of your address that doesn't change is the same part that is unchanged in the IPv4 case. Unless you have CGNAT of course, but I don't think anyone would argue that that thing is a good thing to have.
  - tedunangst 8y ago
    A random address may make it harder to track individual devices over time, but if two sites see the same IPv6 it will be harder to argue that it's two different devices.
8y ago

systematical 8y ago

Tor is too slow for general browsing. I only use it for security related stuff. I wish it was faster.

djsumdog 8y ago
It's a tradeoff. You can't easily have both.

fulyscentedking 8y ago

I use Pi-hole, a DNS level blocker, + uBlock Origin. This combo should provide a much better protection against tracking.

forapurpose 8y ago
How does that protect you against trackers and against identifying you based on your IP address and browser fingerprint?

partycoder 8y ago

The innovations that make trackers possible are: - browsers cache results - cookies If you do neither of these things trackers become much harder to implement.

szc 8y ago
I think this list is missing: - HTML5 "local storage" - Plugin detection - Javascript (particularly xml-rpc) - fetching embedded content based on a URL (images, movies, css, javascript, ...) - Hidden frames and/or WebRTC - can scan your local network There are probably more. [Edited: Updated to clarify that local network scanning can be done with hidden frames or WebRTC. A followup comment from me gives a public example of how]
- voxadam 8y ago
  Do you have any more information on the local network scanning?
  - danShumway 8y ago
    Not sure if this is what grandparent is referring to, but DNS rebinding[0] is what springs to mind. It's simultaneously kind of smart and also really stupid. Basically, you give a valid 3rd-party domain multiple IPs, one of them normal and one of them resolving to a local IP. Then you cut off the normal one and the browser just allows you to make calls to whatever local interface you want. There was a good defcon video about this a while back[1]. It's a much bigger problem than most people realize. This is why it's good practice to have at least some security around devices even if they're only connected to your LAN. [0]: https://www.twistlock.com/2018/02/28/dear-developers-beware-dns-rebinding/ https://www.twistlock.com/2018/02/28/dear-developers-beware-... [1]: https://www.youtube.com/watch?v=stnJiPBIM6o https://www.youtube.com/watch?v=stnJiPBIM6o
  - szc 8y ago
    Here is an example. Start at https://mycloud.com/setup https://mycloud.com/setup. Load the web inspector, find and read scanner.js. The Javascript isn't minimized and there are some comments.

polyvisual 8y ago

4 weeks ago I found an injured pidgeon, took it a rescue place and got chatting to the owner about chickens. I came home, searched for chicked coops on my business laptop. This laptop runs Firefox, uBlock and Ghostery. Last night, my wife has Facebook adverts for chicken coops pop up on her laptop. We've not spoken about chicken coops since, I've not searched for chicken coops since the original search, she's not searched for chicken coops on her laptop and she's not used my work laptop. Creepy. If they want to track you with a "normal" browser, they'll find a way of doing it.

djsumdog 8y ago
Doesn't Ghostery allow in certain trackers if they're paid? I remember there was some controversy about their funding model. I use uBlock Origin + uMatrix currently. Your tracking situation doesn't seem out of the realm of possibility though. 1. You searched for Chicken Coops at a place. 2. That same laptop connects to your home Wi-Fi. 3. The user (you) who searched for chicken coups is connecting from a new IP. 4. Some ad engine rule says that IP belongs to a household (this probably doesn't matter; makes me wonder if people in a Starbucks get ads intended profiled against other customers). 5. Now let's just advertise chicken coupes to everyone in that house. So in theory, this tracking attempt can be done with just a cookie and selling sets of IP+search word data, right?
- polyvisual 8y ago
  "Your tracking situation doesn't seem out of the realm of possibility though." Indeed. That's what's so invasive about tracking - anything that can be done to track you, will be done. What if my search had been something more personal? Something I didn't want my wife to know about? There's no way to opt-out of all this. We're being force fed this for the benefit of some corporation, somewhere.
- Vinnl 8y ago
  > Doesn't Ghostery allow in certain trackers if they're paid? I remember there was some controversy about their funding model. The controversial thing was that you could opt-in to sending Ghostery data about what things it blocked, and Ghostery would then sell statistics about what things got blocked most often so publishers could update their website to replace the blocked items.

tpaschalis 8y ago

It's kinda weird, that some of the greatest minds in the world, are gathered in Silicon Valley, solely working on how to make us click on more advertisements on the internet. As far as hiding your online fingerprint, I feel that having a clean-slate browser container[1], while certainly a hassle, can go some way towards protecting yourself, but...these great minds will find another way. [1] https://tpaschalis.github.io/sandboxed-browser-with-docker/ https://tpaschalis.github.io/sandboxed-browser-with-docker/

albertgoeswoof 8y ago
> greatest minds in the world I wouldn't be so generous.
- andrewmcwatters 8y ago
  Yeah, a lot of these individuals are "just people" at the end of the day.
  - ska 8y ago
    It's hyperbole, sure, but there is a kernel of truth (as is often the case) It seems entirely plausible from where I sit that some of the technology companies with the highest average talent (for some hand-wavy) in engineering are spending a ton of that talent , and wealth, and time focusing on problems that don't have very compelling value in a broader societal sense. While at the same time some interesting and clearly important problems are severely under-resourced. I suppose that's part of free-ish market capitalism's feature set - if above is right it should eventually re-balance but nothing says that has to happen in one generation, or even several.
stephengillie 8y ago
I saw the best minds of our generation writing spam filters. - Neal Stephenson We wanted flying cars, instead we got 140 characters. - Peter Thiel
- 8y ago

a_imho 8y ago

Also consider using obfuscation instead. E.g. AdNauseam and Noiszy are two examples I'm aware of.

drewmol 8y ago
I used to feel for smaller companies who buy ads, concerning the damage possible caused by tactics like AdNauseam regarding outragous advertising bills. Now I think it's likely the best weapon available which can be easily wielded by the average user.

FreekNortier 8y ago

How good is Brave browser at blocking tracking?

ehecatl 8y ago

On the totem pole of tech nous, I am very close to the bottom. So can someone explain to me "remote browsing" is not a thing? Login to your VPS (or whatever), start and encrypted X session, and browse away. That is very unusual traffic, of course, and others connecting from my inet-facing IP probably make it even more so: Steam after school, missus hitting the foreign news sites in the AM, the traffic peaks and troughs at certain times of day... we're fucked.

jacques_chester 8y ago
They can identify you a number of ways without your knowledge or consent. One is timezone allocation. Another effective way is browser fingerprinting. IP addresses. Browsing patterns. Device screen size. Privacy on the web is an information theoretic arms race with tremendously deeply asymmetric stockpiles of information.
gm-conspiracy 8y ago
Take a look at this library: https://github.com/Valve/fingerprintjs2 https://github.com/Valve/fingerprintjs2

eklavyaa 8y ago

its an irony that on accessing the link in Chrome, it warns me about privacy error, "blog.torproject.org normally uses encryption to protect your information. When Google Chrome tried to connect to blog.torproject.org this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be blog.torproject.org, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Google Chrome stopped the connection before any data was exchanged. You cannot visit blog.torproject.org right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later."

seolucky 8y ago

yes, we must avoid all trackers

rurban 8y ago

There are many chrome extensions disabling Facebook tracking. I use "Disconnect Facebook™ pixel & FB™ tracking". It tracks not only by cookie or fingerprints, also by 1x1 pixel. And with the phone app even more, but nobody in his privacy aware mind should use the 2 apps anyways. Their constant recording of audio drains the battery too much, and their m. and mbasic. web urls are good enough.

JesusTheGod 8y ago

I need a genuine advice. I own Google Pixel 2 because I needed a good mobile camera, I also have a Chromebook with Cruton as I needed a cheap Linux notebook. I use Google Maps, Gmail, WhatsUp, Google Photos, Google Drive, Messenger ( the only thing I don't have is a FB app). Given all this information how I am supposed to disconnect from all of this? Cause surely simply having something blocking tracking of you in a desktop browser is not enough? Also, I really enjoy services provided by Google, why should I give it all up and replace everything with "safe" alternatives? I know I am a product and my personal info and preferences are all of over the place. But I always understood this to be the price I pay for using this services ( taking about Google mainly ).

orschiro 8y ago

For me it's the combination of uBlock origin [1], uBlock Extra [2], and Decentraleyes [3]. [1] https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm https://chrome.google.com/webstore/detail/ublock-origin/cjpa... [2] https://chrome.google.com/webstore/detail/ublock-origin-extra/pgdnlhfefecpicbbihgmbmffkjpaplco https://chrome.google.com/webstore/detail/ublock-origin-extr... [3] https://chrome.google.com/webstore/detail/decentraleyes/ldpochfccmkkmhdbclfhpagapcfdljkj https://chrome.google.com/webstore/detail/decentraleyes/ldpo...

doubt_me 8y ago
Umatrix (same guy) + privacy badger (eff) Have been using it since it was called HTTPS switchboard. Uorigin is my go to install on all of my customers fresh installs or people who don't want to break their web experience. Works great.
- orschiro 8y ago
  - I tried Umatrix but it was too much configuration for me. ublock provides me with a sane out of the box experience. - I am not sure whether privacy badger and decentraleyes are mutually exclusive.
  - ealhad 8y ago
    I don't think they are. For example, you can choose to enable a Google-hosted library (say, jQuery) on a certain domain, because you want it to work, and then decentraleyes will do its part.
forapurpose 8y ago
Those add-ons provide some privacy, but they have a different effect than Tor. As examples, despite using the above add-ons, your ISP still knows which domains you visit, as anyone else who can see the network traffic and as does your DNS provider; and the domains you visit know who you are.

auslander 8y ago

1. Always-on VPN - kills main tracking feature, your IP 2. uBlock Origin in medium mode - kills 3p scripts and 3p frames 3. Private windows/tabs by default - kills 3p cookies and storage That's all kids :)

garryc-1304 8y ago

Garry cole GREETINGS EVERYONE, are you looking for a LEGIT and Trustworthy HACKERS with 100% Guarantee and you want to get your job done urgently withing one Hour or you are face with delay and unnecessary excuses and error on your job?. Then Worry no more because easyhackingguru@gmail.com are the Best Bet in any hacking Services. They are ready to render and attend to your job with swift response and No delay at all. Their services are outlined as follows: . LONG TIME LOAN GIVING . PROFESSIONAL in SCHOOL GRADE hanging . WHATSAPP Hack . FACBOOK hack . PROFESSIONAL in any BANK ACCOUNTS TRANSFER . TWITTERS hack . EMAIL,YAHOOMAIL and HOTMAIL ACCOUNTS hack . WEBSITE CRASHED hack . SERVER CRASHED hack . SALES OF SPYWARE and KEYLOGGER SOFTWARE . RETRIVAL OF LOST FILES and DOCUMENTS . ERASE and EXPUNGE of CRIMINAL RECORDS . DATABASE hack . SALES of ATM CARDS in WHITE . SKYPE hack . PAYPAL hack . DROPBOX ACCOUNT hack and Lots more.......... CONTACT: their services at easyhackingguru@gmail.com and you will be glad you did whatsApp contact- +12168104481