10 ms·

Please do post your research when it's cooked. It sounds like useful stuff. Firefox, ABE, NoScript, Request Policy, Ghostery, HTTPS-everywhere, hygiene. The i

by quesera 13y ago

Please do post your research when it's cooked. It sounds like useful stuff. Firefox, ABE, NoScript, Request Policy, Ghostery, HTTPS-everywhere, hygiene. The irony of my militant approach toward privacy is that I probably make myself more interesting to would-be eavesdroppers by my carefulness than I would if they could see it all -- I'm just not that interesting. On the plus side, the LCD of legitimate-threat hostiles is greatly increased. I'm fairly boring even to neighbors and law enforcement and copyright holders and scam artists and advertisers. I imagine I'm pretty stultifying to nation-state actors. :) Still, I'd like everyone else to join me so that I can get lost in the crowd. The untracked, encrypted, well-rested crowd. Come on in, the water's fine.

dunham 13y ago
I use Ghostery/Adblock, but I have found that it breaks some web sites (whose javascript expects the tracking code to be loaded). BTW, if you're using Chrome, you might also want to look into the "Users" section of preferences. You can create multiple user profiles with separate history, cookies, cache, etc. You can have a different user profile per window at the same time. (After you create a second user, there will be an icon in the top right corner of the window to open a window as another user.) I like to use this to protect against CSRF. (I do financial stuff as another profile and facebook as another profile.) It's also useful for QA if you need to be logged in as multiple people at the same time.
- deleted 13y ago
  [deleted]
rosser 13y ago
My approach is similar to yours. I also take the step of using services I'm persistently logged into in different browsers than the one I do my general browsing in. I also share your concern that my (lack of a) footprint makes me an outlier, and thus inherently more interesting to an adversary with the power and reach of No Such Agency. There's precisely zero I can do about that, without compromising my local objective of not being followed by every damned website, though, so I just carry on.
bigiain 13y ago
Idea: A service to allow people to anonymously "share" Google tracking cookies. Perhaps a local transparent proxy that MITMs all your cleartext Google requests, and re-writes the tracking codes on the fly, submitting the ones you've been given and retrieving other "real" ones from a service (probably a TOR hidden service?)
sdoering 13y ago
Greetings. I nearly have the same policy, regarding surfing and my addons. I would only advise against Ghostery, as they whitelist some trackers, if being paid. With every update I had to reselect these trackers. And Evidon (Ghostery's mothership) selling usageinformation really bugs me: http://venturebeat.com/2012/07/31/ghostery-a-web-tracking-blocker-that-actually-helps-the-ad-industry/ http://venturebeat.com/2012/07/31/ghostery-a-web-tracking-bl... I would recommend the FF-addon Diconnect: https://addons.mozilla.org/en-US/firefox/addon/disconnect/ https://addons.mozilla.org/en-US/firefox/addon/disconnect/ Does anybody have an idea, how I could make my own sites secure in a relatively cheap way? Just a personal site with not that much traffic, so spending much money seems a bit off to me. Ideas?
- quesera 13y ago
  Yes, Ghostery's origin story and reconfigure-on-update dance is bothersome. Thanks for the pointer to Disconnect, I will check it out. Regarding your sites' security, what sort of advice are you looking for? OS-level hardening? Service config?
- byoogle 13y ago
  This. I work on Disconnect. I don't understand why any hacker would still put Ghostery on their machine: * Ghostery is run by former ad execs (7/9ths of their executive team): http://www.evidon.com/our-team http://www.evidon.com/our-team * They make their money (I've heard tens of millions of dollars per year) selling user data to ad co's and data brokers: http://www.evidon.com/#block-views-from_our_partners-block http://www.evidon.com/#block-views-from_our_partners-block
  - quesera 13y ago
    So this is awesome, Ghostery has been a unsettling compromise for years now. I'm very happy to learn that you guys are doing it right. Thank you! I've never been able to detect any nefarious network traffic caused by Ghostery (and I've looked), but I don't like the games they play, so I'll be pleased to ditch them without ceremony.
    - 13y ago
r0h1n 13y ago
I would replace Ghostery in your list with Disconnect. I would also add the 'Self-destructing Cookies' browser plugin. In its settings, whitelist a very limited set of sites you want to allow persistent (or session) cookies.
- deleted 13y ago
  [deleted]
- gorhill 13y ago
  I don't know about either... https://github.com/gorhill/httpswitchboard/wiki/How-does-HTTP-Switchboard-compares-to-Ghostery-or-Disconnect-concerning-privacy%3F https://github.com/gorhill/httpswitchboard/wiki/How-does-HTT...
  - byoogle 13y ago
    I work on Disconnect and don't quite understand what your page is getting at (you probably ought to be disclosing that this is your page and project, btw). If you consider the Guardian page, for instance, all the domains you've listed as third parties except Google and Twitter actually look to be first parties serving content for the page. In other words: If you go to the Guardian, you're going to be tracked by the Guardian. If you'd like, you can also prevent their pages from working properly by blocking some secondary domains they use.
    - gorhill 13y ago
      > "look to be first parties serving content for the page" "look to be"? How would javascript code know that? I measured something, and that is the result of my measurement. People can make an informed decision with proper information. I found that the page served well without all the extra requests that Ghostery and Disconnect allowed. Given the results, I am quite surprise you would say "look to be first parties serving content for the page". > "If you go to the Guardian, you're going to be tracked by the Guardian" * facebook-web-clients.appspot.com * guardian-notifications.appspot.com * related-info-hrd.appspot.com * static-serve.appspot.com * cdnjs.cloudflare.com * ajax.googleapis.com * discussion.guardianapis.com * s.ophan.co.uk Aside `discussion.guardianapis.com`, others are clearly 3rd-parties. It's seems my definition of "3rd party" aligns more with that of the EFF: https://www.eff.org/deeplinks/2013/06/third-party-resources-nsa-leaks https://www.eff.org/deeplinks/2013/06/third-party-resources-... Now you focused on the Guardian, how about the two other cases I measured? I'm sure you don't like the result, but this is what came out when I decided to audit. Your response: You don't think it is a problem. That is settled.
goooderybucket 13y ago
I also recommend installing them and running the extra mile by changing your default search engine to DuckDuckGo (HTML SSL) without javascript (use NoScript). They temporarily track you and HTML one gives you direct links as opposed to redirects. You can even modify you Firefox by changing values in about:config geo.enabled ---> false keyword.URL ---> Your Search engine query url browser.urlbar.trimURLs ---> false noscript.ABE.wanipCheckURL ---> 0 network.http.sendReferheader ---> 0 network.http.sendSecureXSiteReferrer ---> false ^these ones break some site functionality that rely on it. It's rare at least.
salient 13y ago
It doesn't really matter if you're "interesting" or not. They're using keyword filters anyway, so if you don't encrypt your stuff, and say something that they consider suspicious, you'll probably show up in their alert system anyway. Welcome to the surveillance state and self-censorship. I'd say it's worse to not have your data encrypted.
reginaldjcooper 13y ago
> Still, I'd like everyone else to join me so that I can get lost in the crowd. The untracked, encrypted, well-rested crowd. There's this add-on called Blender that is supposed to make your browser send headers like the average browser, you might be interested in that.
tunap 13y ago
ABE, NoScript, HTTPS Everywhere, Blender. Run em all in Sandboxie for pr0n and spelunking. Like to point out what may be obvious to some but not others, when using NoScript you may want to remove Goog, Yahoo, etc from the default whitelist. Before Blender I used various iterations of FF for testing & different surfing types(Waterfox/PaleMoon/ESR), but it appears I'll only be doing that for testing purposes anymore. https://addons.mozilla.org/en-US/firefox/addon/blender-1/?src=search https://addons.mozilla.org/en-US/firefox/addon/blender-1/?sr...
reginaldjcooper 13y ago
What is this hygiene add-on?

by quesera 13y ago

dunham 13y ago

I use Ghostery/Adblock, but I have found that it breaks some web sites (whose javascript expects the tracking code to be loaded). BTW, if you're using Chrome, you might also want to look into the "Users" section of preferences. You can create multiple user profiles with separate history, cookies, cache, etc. You can have a different user profile per window at the same time. (After you create a second user, there will be an icon in the top right corner of the window to open a window as another user.) I like to use this to protect against CSRF. (I do financial stuff as another profile and facebook as another profile.) It's also useful for QA if you need to be logged in as multiple people at the same time.

deleted 13y ago
[deleted]

rosser 13y ago

My approach is similar to yours. I also take the step of using services I'm persistently logged into in different browsers than the one I do my general browsing in. I also share your concern that my (lack of a) footprint makes me an outlier, and thus inherently more interesting to an adversary with the power and reach of No Such Agency. There's precisely zero I can do about that, without compromising my local objective of not being followed by every damned website, though, so I just carry on.

bigiain 13y ago

Idea: A service to allow people to anonymously "share" Google tracking cookies. Perhaps a local transparent proxy that MITMs all your cleartext Google requests, and re-writes the tracking codes on the fly, submitting the ones you've been given and retrieving other "real" ones from a service (probably a TOR hidden service?)

sdoering 13y ago

Greetings. I nearly have the same policy, regarding surfing and my addons. I would only advise against Ghostery, as they whitelist some trackers, if being paid. With every update I had to reselect these trackers. And Evidon (Ghostery's mothership) selling usageinformation really bugs me: http://venturebeat.com/2012/07/31/ghostery-a-web-tracking-blocker-that-actually-helps-the-ad-industry/ http://venturebeat.com/2012/07/31/ghostery-a-web-tracking-bl... I would recommend the FF-addon Diconnect: https://addons.mozilla.org/en-US/firefox/addon/disconnect/ https://addons.mozilla.org/en-US/firefox/addon/disconnect/ Does anybody have an idea, how I could make my own sites secure in a relatively cheap way? Just a personal site with not that much traffic, so spending much money seems a bit off to me. Ideas?

quesera 13y ago
Yes, Ghostery's origin story and reconfigure-on-update dance is bothersome. Thanks for the pointer to Disconnect, I will check it out. Regarding your sites' security, what sort of advice are you looking for? OS-level hardening? Service config?
byoogle 13y ago
This. I work on Disconnect. I don't understand why any hacker would still put Ghostery on their machine: * Ghostery is run by former ad execs (7/9ths of their executive team): http://www.evidon.com/our-team http://www.evidon.com/our-team * They make their money (I've heard tens of millions of dollars per year) selling user data to ad co's and data brokers: http://www.evidon.com/#block-views-from_our_partners-block http://www.evidon.com/#block-views-from_our_partners-block
- quesera 13y ago
  So this is awesome, Ghostery has been a unsettling compromise for years now. I'm very happy to learn that you guys are doing it right. Thank you! I've never been able to detect any nefarious network traffic caused by Ghostery (and I've looked), but I don't like the games they play, so I'll be pleased to ditch them without ceremony.
  - 13y ago

r0h1n 13y ago

I would replace Ghostery in your list with Disconnect. I would also add the 'Self-destructing Cookies' browser plugin. In its settings, whitelist a very limited set of sites you want to allow persistent (or session) cookies.

deleted 13y ago
[deleted]
gorhill 13y ago
I don't know about either... https://github.com/gorhill/httpswitchboard/wiki/How-does-HTTP-Switchboard-compares-to-Ghostery-or-Disconnect-concerning-privacy%3F https://github.com/gorhill/httpswitchboard/wiki/How-does-HTT...
- byoogle 13y ago
  I work on Disconnect and don't quite understand what your page is getting at (you probably ought to be disclosing that this is your page and project, btw). If you consider the Guardian page, for instance, all the domains you've listed as third parties except Google and Twitter actually look to be first parties serving content for the page. In other words: If you go to the Guardian, you're going to be tracked by the Guardian. If you'd like, you can also prevent their pages from working properly by blocking some secondary domains they use.
  - gorhill 13y ago
    > "look to be first parties serving content for the page" "look to be"? How would javascript code know that? I measured something, and that is the result of my measurement. People can make an informed decision with proper information. I found that the page served well without all the extra requests that Ghostery and Disconnect allowed. Given the results, I am quite surprise you would say "look to be first parties serving content for the page". > "If you go to the Guardian, you're going to be tracked by the Guardian" * facebook-web-clients.appspot.com * guardian-notifications.appspot.com * related-info-hrd.appspot.com * static-serve.appspot.com * cdnjs.cloudflare.com * ajax.googleapis.com * discussion.guardianapis.com * s.ophan.co.uk Aside `discussion.guardianapis.com`, others are clearly 3rd-parties. It's seems my definition of "3rd party" aligns more with that of the EFF: https://www.eff.org/deeplinks/2013/06/third-party-resources-nsa-leaks https://www.eff.org/deeplinks/2013/06/third-party-resources-... Now you focused on the Guardian, how about the two other cases I measured? I'm sure you don't like the result, but this is what came out when I decided to audit. Your response: You don't think it is a problem. That is settled.

goooderybucket 13y ago

I also recommend installing them and running the extra mile by changing your default search engine to DuckDuckGo (HTML SSL) without javascript (use NoScript). They temporarily track you and HTML one gives you direct links as opposed to redirects. You can even modify you Firefox by changing values in about:config geo.enabled ---> false keyword.URL ---> Your Search engine query url browser.urlbar.trimURLs ---> false noscript.ABE.wanipCheckURL ---> 0 network.http.sendReferheader ---> 0 network.http.sendSecureXSiteReferrer ---> false ^these ones break some site functionality that rely on it. It's rare at least.

salient 13y ago

It doesn't really matter if you're "interesting" or not. They're using keyword filters anyway, so if you don't encrypt your stuff, and say something that they consider suspicious, you'll probably show up in their alert system anyway. Welcome to the surveillance state and self-censorship. I'd say it's worse to not have your data encrypted.

reginaldjcooper 13y ago

> Still, I'd like everyone else to join me so that I can get lost in the crowd. The untracked, encrypted, well-rested crowd. There's this add-on called Blender that is supposed to make your browser send headers like the average browser, you might be interested in that.

tunap 13y ago

ABE, NoScript, HTTPS Everywhere, Blender. Run em all in Sandboxie for pr0n and spelunking. Like to point out what may be obvious to some but not others, when using NoScript you may want to remove Goog, Yahoo, etc from the default whitelist. Before Blender I used various iterations of FF for testing & different surfing types(Waterfox/PaleMoon/ESR), but it appears I'll only be doing that for testing purposes anymore. https://addons.mozilla.org/en-US/firefox/addon/blender-1/?src=search https://addons.mozilla.org/en-US/firefox/addon/blender-1/?sr...

reginaldjcooper 13y ago

What is this hygiene add-on?