4 ms·

I switched to using Private Browsing windows and tabs, which clears all tracking cookies on close. And browse via always-on VPN to hide my IP. Much safer, imho.

I switched to using Private Browsing windows and tabs, which clears all tracking cookies on close. And browse via always-on VPN to hide my IP. Much safer, imho. Still unresolved are history leaks via Referer, from things like fonts, ajax, tagmanager google.com API calls, present on all websites. Why web people link so much Google stuff in their websites is a mystery.

Godel_unicode 8y ago
They produce a lot of things that are super useful for avoiding edge cases. Consider Google fonts, for instance.
- auslander 8y ago
  Can't you host all fonts you use on your server? Why use remote google fonts?
  - fenwick67 8y ago
    Google fonts does a bunch of stuff, it looks at user-agent to determine what css to serve and there are at least 10 font files for each weight of each font you want to use. It's not impossible to replicate but using Google fonts is convenient
dgrove 8y ago
You're not inherently trusting your VPN service to: a) not track you b) not keep logs c) not disclose this information to your actual ISP You're also now just sitting behind whatever ISP your VPN uses which knows everything you're doing and sells it back to who-ever. If your not rotating your VPN services that still allows you to be tracked via that IP. At the end of the day all your data still belongs to someone and can be used for whatever. Until DNS over TLS is complete and rolled out across the board your metadata can still be used. Not to mention all of the other things associated with this. Even being connected to a VPN via your phone will still leak information like your coarse location, wifi networks and bluetooth beacons nearby which all get sent to your primary phone carrier and whatever applications you use.
- auslander 8y ago
  No VPN: - ISP has your name and history. The AdTech knows your IP's history, and most likely your Id. VPN: - VPN has your history, but no name (paid via voucher), and is other country's legal entity. My ISP only knows I'm using some VPN service (DoT enabled on my router). The AdTech is missing key identifier, IP, to link your data together (to aggregate). > ISP your VPN uses which knows everything Both ISPs know squat, just encrypted traffic from my real IP
  - dgrove 8y ago
    And all of your DNS traffic since it's not over TLS
    - auslander 8y ago
      Cmon, all DNS queries go via VPN tunnel.
      - Godel_unicode 8y ago
        ...And are trivially demasked for your VPN provider's ISP by traffic analysis (DNS requests are pretty obvious when transiting a VPN, then wait for the VPN provider to forward the packet).
  - Godel_unicode 8y ago
    Do you truly believe that a VPN provider with access to all of your traffic has no idea who you are? If so, you either have truly impressive opsec or are not considering just how much can be gained from traffic analysis. Leaving aside the giant DNS question, there's SNI to consider as well as the VPN provider knowing your source IP and times of access. Then, because you're on hn, consider what the graph of little-used services you (probably) use says about you. Work VPN/chat/webmail servers? Admin interfaces for side projects you work on? And of course good old fashioned typos in your shell.
cpv 8y ago
FF has an option to configure the Referer (lots of websites might break). Scripts/fonts can be filtered via extensions like Privacy Badger, either by blocking the cookie, or the domain completely.
- auslander 8y ago
  Though most ad-blocker extentions whitelist stuff like fonts.googleapis.com, jquery, tagmanager, ajax. They treat it like non-issue calls. Sadly leaks via Referer are under radar by most.

Godel_unicode 8y ago

They produce a lot of things that are super useful for avoiding edge cases. Consider Google fonts, for instance.

auslander 8y ago
Can't you host all fonts you use on your server? Why use remote google fonts?
- fenwick67 8y ago
  Google fonts does a bunch of stuff, it looks at user-agent to determine what css to serve and there are at least 10 font files for each weight of each font you want to use. It's not impossible to replicate but using Google fonts is convenient

dgrove 8y ago

You're not inherently trusting your VPN service to: a) not track you b) not keep logs c) not disclose this information to your actual ISP You're also now just sitting behind whatever ISP your VPN uses which knows everything you're doing and sells it back to who-ever. If your not rotating your VPN services that still allows you to be tracked via that IP. At the end of the day all your data still belongs to someone and can be used for whatever. Until DNS over TLS is complete and rolled out across the board your metadata can still be used. Not to mention all of the other things associated with this. Even being connected to a VPN via your phone will still leak information like your coarse location, wifi networks and bluetooth beacons nearby which all get sent to your primary phone carrier and whatever applications you use.

auslander 8y ago
No VPN: - ISP has your name and history. The AdTech knows your IP's history, and most likely your Id. VPN: - VPN has your history, but no name (paid via voucher), and is other country's legal entity. My ISP only knows I'm using some VPN service (DoT enabled on my router). The AdTech is missing key identifier, IP, to link your data together (to aggregate). > ISP your VPN uses which knows everything Both ISPs know squat, just encrypted traffic from my real IP
- dgrove 8y ago
  And all of your DNS traffic since it's not over TLS
  - auslander 8y ago
    Cmon, all DNS queries go via VPN tunnel.
    - Godel_unicode 8y ago
      ...And are trivially demasked for your VPN provider's ISP by traffic analysis (DNS requests are pretty obvious when transiting a VPN, then wait for the VPN provider to forward the packet).
- Godel_unicode 8y ago
  Do you truly believe that a VPN provider with access to all of your traffic has no idea who you are? If so, you either have truly impressive opsec or are not considering just how much can be gained from traffic analysis. Leaving aside the giant DNS question, there's SNI to consider as well as the VPN provider knowing your source IP and times of access. Then, because you're on hn, consider what the graph of little-used services you (probably) use says about you. Work VPN/chat/webmail servers? Admin interfaces for side projects you work on? And of course good old fashioned typos in your shell.

cpv 8y ago

FF has an option to configure the Referer (lots of websites might break). Scripts/fonts can be filtered via extensions like Privacy Badger, either by blocking the cookie, or the domain completely.

auslander 8y ago
Though most ad-blocker extentions whitelist stuff like fonts.googleapis.com, jquery, tagmanager, ajax. They treat it like non-issue calls. Sadly leaks via Referer are under radar by most.