These days it seems like everyone is looking at what you do online. Online advertisers make money from the ads placed on your site, but they also gather statistics about all your visitors for their own purposes. Search engines store information for a variety of reasons. Social networks contain more information on our past than most of us can probably remember. With the rise in popularity of the internet and it’s change from a place for geeks, hackers, and nerds to a place for the whole family it seems that the idea of anonymity online has almost disappeared. The internet has gone from the dark back-row in a movie theater to the digital equivalent of Orwell’s 1984.
I’ve always been skeptical about the idea of an intertwined real and internet life. When I was growing up and chatting to the sounds of a modem, I remember being told not to post my name online, not to tell people what school I went to, or my birthday. What are the first few questions when you register for Facebook? Who can see those? Obviously Facebook is a bit different than someone you meet in a chatroom, but it is interesting to think how freely we give out information we used to keep more protected. The reason richo set up the first psych0tik IRC server was that we didn’t like having conversations monitored by the guys running the messenger services. proxyElite was born from a desire to have reliable access to web proxies and aide in anonymous access. But I digress.
There are aspects of this problem that I simply don’t want to address. Social networks, photo-sharing sites, and blogging all seem to be inevitable parts of daily life. These are however known leakages. You don’t post to your blog or update your Facebook status with the idea that it’s just for your records. This is an issue as end-users we can do little more than educate ourselves on. Look at the Privacy Policy of websites and check your settings for options to disallow other users from viewing your content.
Beyond all these information giants are the internet’s motion detectors. Silent scripts and hidden images along with tracking cookies follow your movement, constantly reporting back to their creator’s servers. A recent post by the EFF shows that even your browser’s headers can be used as a unique identifier the majority of the time. [They provide a page that shows the entropy lost by each field checked, see the references below.]
In such a complex environment as the internet it can be quite difficult to tackle a problem as large as this, but with a mixture of configuration changes, Firefox Add-ons, and using proxy solutions it is possible to add to the difficulty of tracking your online activities.
Reducing and eliminating tracking cookies is a great place to start.
Configuring Firefox to delete private data when you close it is a great way to effortlessly limit the duration a tracking cookie is present. Many antivirus solutions also have an option to search for tracking cookies and remove them. This provides an external method to clear these, independent of the browser.
I use a multitude of Firefox Add-ons to not only protect my browser from malicious content, but also to help eliminate as many of the tracking technologies as possible. NoScript and Ghostery help to block scripts that might secretly send information back. RequestPolicy is great for defending against embedded tracking images (as well as CSRF); however, it is a bit over-zealous. User-Agent switcher allows me to adjust the entropy of some of my headers to be more “standard.”
Finally, using web proxies, Tor, or services like GoogleSharing it’s possible to cloak yourself even further. These services work to either distribute your connection across other machines or to reroute it through another. The Firefox TorButton Add-on also helps to mask your headers to make your session less unique. GoogleSharing is unique in that it doesn’t proxy all requests. Rather, only requests made to non-authenticated Google services like Google’s search. The requests are routed through a GoogleSharing server (via a Firefox Add-on), normalized, and passed through. Other users using the same proxy would add to the terms and add more chaff to deter monitoring by Google.
The Frankenstein of security that is now my browser with these assorted Add-ons and changes isn’t exactly as fluid or functional as before. A lot of sites break until I sort out which Add-on has blocked which critical script. Proxies and Tor make requests run more slowly. The web is definitely a more complicated place, but isn’t the effort worth it? You wouldn’t casually walk down a dark alley filled with dangerous looking folk without some protection. All the family friendly, Web 2.0 sites and services make the internet look like a lovely place, but let’s not forget that the dark alleys exist and are often in between all the “safe havens” we travel to.
References:
EFF’s Panopticlick Research Project on Determining Browser Entropy
