Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Someone, I think it was on Charlie Rose, said that anybody who wants to can currently discover what websites have been visited by some person of interest. That assertion was possibly made as a way of saying that one should not worry about the government doing what private citizens are already doing. It used to be that my Internet access was via a university account. As part of its normal daily operations, the university posted a list of all outgoing connections by user name. So if somebody had wanted to know whether I was accessing some juicy site they could just access the university's website, navigate to their log, and search for my name. As far as I can determine, the university in question is no longer posting this information. However, in the past that is one way of stalking individuals that could have been used. Perhaps there are still ways to access such information.

Was the security specialist's assertion true when he claimed that any Internet user's web accesses can be learned by private individuals? (I'm just trying to get an educated view on the hubbub over recent disclosures. Might as well be educated before shooting off my big mouth.)

share|improve this question
add comment

3 Answers

A private individual would have trouble, but many private companies know what you do online. Your ISP certainly knows. Marketing companies that have deals with large numbers of websites can track you from one site to another if they have agreements with those sites. Websites themselves can also tell what IP address you connected from. If you use single signons like using your Facebook account on multiple sites, then Facebook can tell a decent amount about where you go. There are also hints about where you have gone left on your computer unless you clear your cache, temp files, cookies and history, though someone would have to have access to your system to make use of it.

If the security "expert" was claiming that any person can tell what any other person is doing on the Internet, they were extremely mistaken however and are not an expert at all.

share|improve this answer
    
It was weird enough when the university was making the sites faculty/staff connected to public. It would be really strange if AOL or some other ISP were doing that kind of thing. I guess I should track back through the webcasts of that show and see whether I can figure out which "expert" it was, and what he actually said. –  Tim O'Tie Jun 12 '13 at 23:48
add comment

One potential way to do this is to emulate what advertisers do with cookies. A user connects to your website and accepts your cookie. Your cookie can then be used to record where that user goes as long as you also have code on the sites they visit after they leave your site.

This sort of thing has been done by Facebook, even after the user had supposedly logged out of Facebook.

This is NOT the same as a wholesale gathering of data on an individual, and it requires various factors to be in place (user visits the site and accepts and keeps the cookie). But, it is possible for 'average people' and is legal (though a little on the grey side, as Facebook found out).

share|improve this answer
    
"Your cookie can then record where that user goes even after they leave your site, and then reports back." -- can you clarify this? A cookie is just a tidbit of data, the browser or the server receiving the cookie can take action. Additionally, your browser should only send cookies to servers that share the same domain as the cookie, i.e. your browser won't send a .facebook.com cookie to a .google.com server (unless that google page is hosting a .facebook.com iframe or ad). –  u2702 Jun 12 '13 at 21:14
    
My wording is unclear - I will alter it. –  schroeder Jun 12 '13 at 21:52
    
It might be worthwhile to have a chart someplace that indicates the various threats to one's data security, the "cost" to the interloper to approach through each avenue, protective measures, and post-exploit methods to clear out bugs, worms, etc. It's been said that, as regards internal security, your data security is only as good as the IT staff you hire. Maybe the individual needs to have some independent defenses from exploits both internal and external. –  Tim O'Tie Jun 13 '13 at 0:16
    
@u2702 So if the site you are going to has one of those little Facebook icons on it, served up by Facebook, they get a copy of the cookie and knowledge of the site you are on, and can therefore track you. They can do so even if you don't have a Facebook account, they just won't be able to tie your movements to a rich information source about you. –  DodgyG33za Jun 17 '13 at 8:05
    
@DodgyG33za - Right, but only if the 3rd-party page I visit has embedded a reference back to Facebook. I was commenting on the wording "cookie can then record where the users goes..." that Schroeder made more clear. –  u2702 Jun 26 '13 at 16:02
add comment

The short answer is no. It is not possible for the average citizen to track the internet usage of a person of interest. Unless they have the ability to load software on the systems that the latter uses to access the internet.

Tracking that does occur relies on the fact that web sites often serve up content from common sources. Advertising material, for example, or the Facebook and Twitter icons that appear on many sites. Tracking can be done in an number of ways:

Cookies. These are small amounts of information written to your hard drive by your browser that can be set by a web site and can contain a unique value that can tie all of your interactions with that site together.

Browser uniqueness.There is a range of information your browser makes available to the web site, which taken together is like a fingerprint that identifies your system. See https://panopticlick.eff.org/index.php?action=log&js=yes for details on this.

Both of the above techniques can tie together interactions by a system for sites within the control of the tracker (which will be far from a complete record), although they don't know how many people are using the device.

Similarly an ISP will not know how many people are using a given Internet connection, so cannot tie down logs to an individual. This is what makes the prosecution of people for torrenting based on an IP address so troublesome.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.