Can my web accesses be known by individuals?

Question

Someone, I think it was on Charlie Rose, said that anybody who wants to can currently discover what websites have been visited by some person of interest. That assertion was possibly made as a way of saying that one should not worry about the government doing what private citizens are already doing. It used to be that my Internet access was via a university account. As part of its normal daily operations, the university posted a list of all outgoing connections by user name. So if somebody had wanted to know whether I was accessing some juicy site they could just access the university's website, navigate to their log, and search for my name. As far as I can determine, the university in question is no longer posting this information. However, in the past that is one way of stalking individuals that could have been used. Perhaps there are still ways to access such information.

Was the security specialist's assertion true when he claimed that any Internet user's web accesses can be learned by private individuals? (I'm just trying to get an educated view on the hubbub over recent disclosures. Might as well be educated before shooting off my big mouth.)

Answer 1

A private individual would have trouble, but many private companies know what you do online. Your ISP certainly knows. Marketing companies that have deals with large numbers of websites can track you from one site to another if they have agreements with those sites. Websites themselves can also tell what IP address you connected from. If you use single signons like using your Facebook account on multiple sites, then Facebook can tell a decent amount about where you go. There are also hints about where you have gone left on your computer unless you clear your cache, temp files, cookies and history, though someone would have to have access to your system to make use of it.

If the security "expert" was claiming that any person can tell what any other person is doing on the Internet, they were extremely mistaken however and are not an expert at all.

Answer 2

One potential way to do this is to emulate what advertisers do with cookies. A user connects to your website and accepts your cookie. Your cookie can then be used to record where that user goes as long as you also have code on the sites they visit after they leave your site.

This sort of thing has been done by Facebook, even after the user had supposedly logged out of Facebook.

This is NOT the same as a wholesale gathering of data on an individual, and it requires various factors to be in place (user visits the site and accepts and keeps the cookie). But, it is possible for 'average people' and is legal (though a little on the grey side, as Facebook found out).

Answer 3

The short answer is no. It is not possible for the average citizen to track the internet usage of a person of interest. Unless they have the ability to load software on the systems that the latter uses to access the internet.

Tracking that does occur relies on the fact that web sites often serve up content from common sources. Advertising material, for example, or the Facebook and Twitter icons that appear on many sites. Tracking can be done in an number of ways:

Cookies. These are small amounts of information written to your hard drive by your browser that can be set by a web site and can contain a unique value that can tie all of your interactions with that site together.

Browser uniqueness.There is a range of information your browser makes available to the web site, which taken together is like a fingerprint that identifies your system. See https://panopticlick.eff.org/index.php?action=log&js=yes for details on this.

Both of the above techniques can tie together interactions by a system for sites within the control of the tracker (which will be far from a complete record), although they don't know how many people are using the device.

Similarly an ISP will not know how many people are using a given Internet connection, so cannot tie down logs to an individual. This is what makes the prosecution of people for torrenting based on an IP address so troublesome.