5 ms·

> That said, I consider it a different matter when it comes to the Googles and Facebooks of this world pinching my data without paying for it What makes you th

> That said, I consider it a different matter when it comes to the Googles and Facebooks of this world pinching my data without paying for it What makes you think they are not scraping your public activity from other sites?

Aromasin 8y ago
From what I've read they can still gather your public data, but to a lesser degree than they can from the direct use of their services. The second-hand scraping is a lot less specific - "he visits X website, at X time, X times a day" as opposed to "he works at X, is featured in X type of photo, shares X type of content, has close relations with X people, is likely to click X type of advert". They can extrapolate a lot more accurate assumptions about someone from the latter set of data. I'm sure they're much better at data scraping then they were when I read that last though. Thankfully people much more intelligent than myself are making it easier to obfuscate this activity. I've had a lot of luck using the advice below: https://web.archive.org/web/20181107150700/https://iotdarwinaward.com/post/improve-your-privacy-in-age-of-mass-surveillance/ https://web.archive.org/web/20181107150700/https://iotdarwin...
- rhn_mk1 8y ago
  > "he works at X, is featured in X type of photo, shares X type of content, has close relations with X people [...] There's nothing preventing anyone to scrape that kind of info from public sources either. Some of this may be available here on HN (shares that kind of content, works at X), others on competitor's social networks (Twitter, Mastodon, Reddit, GitHub, forums). In fact, this is part of Google's core business model, and you can most likely see this in their database already: "google" yourself. Admittedly, no one will be able to scrape click rates, but that's relatively insignificant compared to the amount of info we already publicly share.
  - hilbert42 8y ago
    > There's nothing preventing anyone to scrape that kind of info from public sources either. Absolutely correct, if you read my posts then you'll see that I expose both myself and my ideas to quite some considerable degree. I'm under no illusion that all my attempts at blocking Google's spying will not work here. I've never had the need to hide myself on the web, rather it's that I've been forced to, or at least to try to hide parts of my private data—none of which I'm ashamed about. It's the underhanded and egregious way Google, Facebook, et all have gone about it that hurts and which I find so objectionable.
hilbert42 8y ago
rhn_mk1 9 hours ago | parent | on: Limiting Your Digital Footprints in a Surveillance... > That said, I consider it a different matter when it comes to the Googles and Facebooks of this world pinching my data without paying for it. >What makes you think they are not scraping your public activity from other sites? I assume and expect Google et al to be monitoring and incessantly cross-referencing my web activity as well as extracting and distilling my personal information. Also, I assume the dossiers they produce on my activities are growing larger by the day. I consider their monitoring to be a hostile, unwanted, invasive and egregious act on their part. I also know I've small resources and can only mount a limited defense against these attackers and that anything I do will only be partially effective. As I said in my reply to vcavallo, one can only go so far or one ends up wasting hours doing little else except tweaking security settings. Even so, I reckon I push my security systems hard and I demand a lot from them, perhaps more so than most other users do. The best I can do is to make it as hard as is possible for Google and cronies to steal my data but I do so only up to the point where I reckon the Law of Diminishing Returns sets in. If I increased my protection any further then it would cause me undue extra work not to mention increased difficulty for me to navigate the web. It's impractical for me to list all of these protections here but here are a few of the key ones. Anyway, judge for yourself (and tell me what I've missed). 1. I've advised friends and my well-known contacts who have Gmail accounts that they will only get brief and or limited (and innocuous) data sans personal data and important information from me in replies to their Gmail account emails—and that this is specifically because they're using spyware Gmail! Offline, eyeball-to-eyeball, I amplify these concerns by strongly advising them that whenever they (a) send me emails, or (b) forward my emails and other details to other Gmail accounts, etc., and (c) whenever they even mention me in Gmail messages, either to me or to others, then they are violating my privacy and to do so only as a last resort. Right, I actively embarrass them for being stupid enough to let Google 'rape' them of their personal information (remember, we're in a war with Big Tech for our personal data so we can't be too nice). 2. I do not use web mail as it's easier to track—here we have the JavaScript problem again. (All my mail clients are POP/SMTP or IMAP.) 3. I do not respond to unsolicited emails from Gmail accounts when the sender is unknown to me. Most of these messages are deleted forthwith. In infrequent cases where I have to open them, I do so either offline or take other measures to ensure scripts don't 'phone home' to Google, et al. 4. If I have to send or receive emails to Gmail accounts then I ensure their content contains essentially innocuous data. I tell Gmail users not to include my personal data or other important information in the emails they send to me, or if they have to then for them to use other means such as a standard POP/SMTP account, or if it's important information then to use PGP or other obfuscating means. 5. If I have to send any information other than innocuous data to Gmail users then I do so by an encrypted PDF attachment. In cases where no key has been agreed upon beforehand, I send multi-valued prompts for the keys along with the PDF that only the recipient can answer (I'm aware this isn't very secure but it is likely—at least partially anyway—to put the kibosh on much of the automatic indexing.) 6. When responding to messages from Gmail accounts instead of replying directly with 'reply' I create new messages and also ensure that the Google message IDs are fully scrubbed out in replies (this likely stops some linking). I do this with all replies, CCs and or forwards to Gmail accounts even if they come via POP/SMTP accounts. 7. Although I've used Gmail in the past, I do not use Gmail nowadays and have no active accounts. Even when I did so, I never used them for regular email but rather email testing etc. or to only get access to the Google store, and even then the accounts only ever used alias IDs generated without using or supplying my telephone number. (BTW, I don’t like web mail and I've rarely ever used it even on other non-Google websites.) 8. There is no Google account on my smartphone. Furthermore, the phone is rooted with LineageOS installed but WITHOUT any Gapps installed (I just don't need them, as there's many alternatives)! Also, wiping the original OS also means the phone manufacturer doesn’t get a look-in either, as its own apps are no longer used, it too can no longer spy on one). 9. If I have to use Google's apps store for any reason(which is very rare) then I'll access it via Yalp Store with an account set/defined by Yalp and the phone type and model also obfuscated. For apps, I normally use F-Droid's store. 10. To stop ads on the few smartphone apps that I've installed that use them (as well as any other smartphone apps that 'phone home'), all unsolicited outgoing traffic (i.e.: traffic that I don't actually generate myself) is routed via a VPN that goes nowhere. In addition, either Xposed Framework with XPrivacyLua or the equivalent Magisk configurations are installed, these provide very solid obfuscation. There are other fallback protections too: the browser has JavaScript blocked by default, cookies automatically deleted, the User Agent randomized and set to the commonest browser types, and the hosts file is edited to block common tracking sites etc. Oh, and also the advertising ID is regularly reset. 11. PC browsers get essentially the same protections as smartphones, (see 8 & 9), except script, ad blocking and browser type (User Agent) obfuscating are more elaborate. During testing, Panopticlick and Steve Gibson's ShieldsUp give good results for privacy. There are various other protections too such as router and firewall blacklists, etc. (too many to detail here). As I proposed at the beginning, it would be stupid of me to suggest that these protections fully protect me from Google's clutches but I figure they are better than nothing is.

Aromasin 8y ago

From what I've read they can still gather your public data, but to a lesser degree than they can from the direct use of their services. The second-hand scraping is a lot less specific - "he visits X website, at X time, X times a day" as opposed to "he works at X, is featured in X type of photo, shares X type of content, has close relations with X people, is likely to click X type of advert". They can extrapolate a lot more accurate assumptions about someone from the latter set of data. I'm sure they're much better at data scraping then they were when I read that last though. Thankfully people much more intelligent than myself are making it easier to obfuscate this activity. I've had a lot of luck using the advice below: https://web.archive.org/web/20181107150700/https://iotdarwinaward.com/post/improve-your-privacy-in-age-of-mass-surveillance/ https://web.archive.org/web/20181107150700/https://iotdarwin...

rhn_mk1 8y ago
> "he works at X, is featured in X type of photo, shares X type of content, has close relations with X people [...] There's nothing preventing anyone to scrape that kind of info from public sources either. Some of this may be available here on HN (shares that kind of content, works at X), others on competitor's social networks (Twitter, Mastodon, Reddit, GitHub, forums). In fact, this is part of Google's core business model, and you can most likely see this in their database already: "google" yourself. Admittedly, no one will be able to scrape click rates, but that's relatively insignificant compared to the amount of info we already publicly share.
- hilbert42 8y ago
  > There's nothing preventing anyone to scrape that kind of info from public sources either. Absolutely correct, if you read my posts then you'll see that I expose both myself and my ideas to quite some considerable degree. I'm under no illusion that all my attempts at blocking Google's spying will not work here. I've never had the need to hide myself on the web, rather it's that I've been forced to, or at least to try to hide parts of my private data—none of which I'm ashamed about. It's the underhanded and egregious way Google, Facebook, et all have gone about it that hurts and which I find so objectionable.

hilbert42 8y ago

rhn_mk1 9 hours ago | parent | on: Limiting Your Digital Footprints in a Surveillance... > That said, I consider it a different matter when it comes to the Googles and Facebooks of this world pinching my data without paying for it. >What makes you think they are not scraping your public activity from other sites? I assume and expect Google et al to be monitoring and incessantly cross-referencing my web activity as well as extracting and distilling my personal information. Also, I assume the dossiers they produce on my activities are growing larger by the day. I consider their monitoring to be a hostile, unwanted, invasive and egregious act on their part. I also know I've small resources and can only mount a limited defense against these attackers and that anything I do will only be partially effective. As I said in my reply to vcavallo, one can only go so far or one ends up wasting hours doing little else except tweaking security settings. Even so, I reckon I push my security systems hard and I demand a lot from them, perhaps more so than most other users do. The best I can do is to make it as hard as is possible for Google and cronies to steal my data but I do so only up to the point where I reckon the Law of Diminishing Returns sets in. If I increased my protection any further then it would cause me undue extra work not to mention increased difficulty for me to navigate the web. It's impractical for me to list all of these protections here but here are a few of the key ones. Anyway, judge for yourself (and tell me what I've missed). 1. I've advised friends and my well-known contacts who have Gmail accounts that they will only get brief and or limited (and innocuous) data sans personal data and important information from me in replies to their Gmail account emails—and that this is specifically because they're using spyware Gmail! Offline, eyeball-to-eyeball, I amplify these concerns by strongly advising them that whenever they (a) send me emails, or (b) forward my emails and other details to other Gmail accounts, etc., and (c) whenever they even mention me in Gmail messages, either to me or to others, then they are violating my privacy and to do so only as a last resort. Right, I actively embarrass them for being stupid enough to let Google 'rape' them of their personal information (remember, we're in a war with Big Tech for our personal data so we can't be too nice). 2. I do not use web mail as it's easier to track—here we have the JavaScript problem again. (All my mail clients are POP/SMTP or IMAP.) 3. I do not respond to unsolicited emails from Gmail accounts when the sender is unknown to me. Most of these messages are deleted forthwith. In infrequent cases where I have to open them, I do so either offline or take other measures to ensure scripts don't 'phone home' to Google, et al. 4. If I have to send or receive emails to Gmail accounts then I ensure their content contains essentially innocuous data. I tell Gmail users not to include my personal data or other important information in the emails they send to me, or if they have to then for them to use other means such as a standard POP/SMTP account, or if it's important information then to use PGP or other obfuscating means. 5. If I have to send any information other than innocuous data to Gmail users then I do so by an encrypted PDF attachment. In cases where no key has been agreed upon beforehand, I send multi-valued prompts for the keys along with the PDF that only the recipient can answer (I'm aware this isn't very secure but it is likely—at least partially anyway—to put the kibosh on much of the automatic indexing.) 6. When responding to messages from Gmail accounts instead of replying directly with 'reply' I create new messages and also ensure that the Google message IDs are fully scrubbed out in replies (this likely stops some linking). I do this with all replies, CCs and or forwards to Gmail accounts even if they come via POP/SMTP accounts. 7. Although I've used Gmail in the past, I do not use Gmail nowadays and have no active accounts. Even when I did so, I never used them for regular email but rather email testing etc. or to only get access to the Google store, and even then the accounts only ever used alias IDs generated without using or supplying my telephone number. (BTW, I don’t like web mail and I've rarely ever used it even on other non-Google websites.) 8. There is no Google account on my smartphone. Furthermore, the phone is rooted with LineageOS installed but WITHOUT any Gapps installed (I just don't need them, as there's many alternatives)! Also, wiping the original OS also means the phone manufacturer doesn’t get a look-in either, as its own apps are no longer used, it too can no longer spy on one). 9. If I have to use Google's apps store for any reason(which is very rare) then I'll access it via Yalp Store with an account set/defined by Yalp and the phone type and model also obfuscated. For apps, I normally use F-Droid's store. 10. To stop ads on the few smartphone apps that I've installed that use them (as well as any other smartphone apps that 'phone home'), all unsolicited outgoing traffic (i.e.: traffic that I don't actually generate myself) is routed via a VPN that goes nowhere. In addition, either Xposed Framework with XPrivacyLua or the equivalent Magisk configurations are installed, these provide very solid obfuscation. There are other fallback protections too: the browser has JavaScript blocked by default, cookies automatically deleted, the User Agent randomized and set to the commonest browser types, and the hosts file is edited to block common tracking sites etc. Oh, and also the advertising ID is regularly reset. 11. PC browsers get essentially the same protections as smartphones, (see 8 & 9), except script, ad blocking and browser type (User Agent) obfuscating are more elaborate. During testing, Panopticlick and Steve Gibson's ShieldsUp give good results for privacy. There are various other protections too such as router and firewall blacklists, etc. (too many to detail here). As I proposed at the beginning, it would be stupid of me to suggest that these protections fully protect me from Google's clutches but I figure they are better than nothing is.