Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Many companies use HTTP cookies, flash cookies, and other analytics to track visitors on the web and classify them. How can I find out what my web profile is currently, and what these trackers are currently classifying me? I understand there is not one canonical profile as different sites may have access to different data but how can I know more about how they might be classifying me?

share|improve this question

migrated from webapps.stackexchange.com May 18 '13 at 9:04

This question came from our site for power users of web applications.

5  
They think you are hawt obviously. –  Terry Chia May 18 '13 at 9:05
    
@TerryChia, I know, I just like to be reminded. –  highBandWidth May 19 '13 at 16:46

3 Answers 3

Information is overwhelming

As someone who writes these sort of applications for a living I can tell you that you are protected by anonymity in numbers. Most companies see the sea of people, not the individuals.

If you're talking about a web stalker or researcher, the main question shouldn't be "What do web trackers know about me." Assume they know everything. Almost all information is public record these days (in the States):

  • Where you bought your house? (public record)
  • Where you went to school? (facebook, reunion sites, etc)
  • How old you are? (facebook, linked in, stack exchange, reunion sites)
  • Who are you related to? (facebook, ancestry.com)
  • What's your e-mail address? (online and offline surveys, anywhere it's posted on the web)
  • Your home address? (facebook, foursquare, public record, magazine subscriptions, e-mail subscriptions, reverse phone look-up)
  • Were you arrested? (public record)
  • Were you convicted? (public record)
  • Where do you work? (linkedin, facebook, company website)

Search for your name, your phone number, your home address on Google. Want to see a satellite image of your house? What your house looks like from the road?

What can you do to prevent someone from finding you?

  • live off the grid (cash only)
  • provide disinformation
  • use IP phones like magicjack
  • use a PO box
  • use anonymous e-mail accounts
  • don't complete surveys
  • complete surveys incorrectly
  • don't verify information cold callers (eg. Caller ID says "Unknown"... "Hello, Mr. Jones?")

If you're concerned about companies sharing your information, they already do. The profile for each companies depends on what they're interested in. Most companies try to stick with their corporate mandate or charter.

For instance a company that you may use at work for business travel isn't necessarily concerned with your buying habits on Amazon.com, however they may be part of the same network of advertisers that show that you also go to Amazon. The advertisers use this to try and sell their services to other companies. They won't specifically single you out. They may show you ads for places that you frequent when you're on a partner site. So if you visit Delta Airline's website and check for ticket prices, you may see an ad on Amazon, Google, Yahoo, Youtube, etc... You might get offers for luggage on Amazon (or suntan lotion if you searched for tickets in a tropical environment). Luckily they don't do this at the moment because user experience tracking tells them people freak out about this stuff.

Anytime you see third party cookies, these are transmitting information to a server that keeps track of your "profile" off of the site you're visiting.

It's not only online. Another place that people don't think of that tracks all of their purchases is their credit card company. Companies like Visa, Mastercard, Paypal, and American Express all have records (many times multiple records) for the same account holder and their purchase patterns, histories and frequencies.

One of the scariest profiles out there can be found by creating a Google Plus account. Google (Microsoft and Apple) see everything that is transmitted over their devices and software, whether it's an android (or apple) phone, a browser, a web search, or a DNS lookup (8.8.8.8,8.8.4.4). It's all logged in some form or fashion.

Most browsers keep your cache, history, and saved passwords as features. Also they store cookies. If someone wanted to exploit a browser it would be easy to have it forward all of this information to one centralized location. Your computer and your personal electronics have the most information about you on them. Guard them for they are your identity in the modern age.

When I write an application for a client we usually try to pair their existing history (prior to a personal identifier) with the profile after they've provided some bit of information. If I submit a cookie to the end user, they likely don't know it. Then every time they connect from the same device using the same browser I can keep track of their actions. At the point they log in with another device or browser I can document the device, or a new browser, and pair that information with the existing info. If they send a link to a colleague I can track the colleague too. If they provide an address or a company name I can search online directories and build a deeper profile for a client. If they subscribe to a mailing list and I send them weekly emails I can tell whether they travel or not. (By the ip address of the device they check their email on, you can already do this by data-mining e-mail thread headers in your inbox as well).

I'm one of the good guys. Ethically it would be bad to try and exploit any of the information available. If I did this once I would risk all of my clients who depend on me for my professional services.

So you have two options... live off the grid for fear of the worst case scenario... or enjoy life because you have nothing to worry about. Bad things happen to people all the time. They usually don't involve your web profile.

share|improve this answer
    
Thanks! That's a good summary of all the different ways we are leaking information to them. –  highBandWidth May 19 '13 at 16:54

Well they know what you like and what products you like. For instance if you look at amazon pages you can be sure the next few days you will get google ads to show you exactly the products you looked at but did not buy. The same with facebook, if you are not in a relationship it will show you dating advertisements. Now how they classify you? Well that's not really what they want to release since that's what they are making money of.

share|improve this answer

So far, I've been able to find two tools that give any idea.

  1. If you're signed in to google, then https://www.google.com/settings/u/0/ads/ tells you which "interests" google's ads services thinks you have.

  2. Also, the collusion plugin will tell you the trackers and which websites they are following you on.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.