8

In the past year, I've noticed a strangely increasing incidence of advertisements on various web sites being for products that I was browsing for elsewhere.

This makes me extremely uncomfortable. It doesn't seem to be cookie-driven, nor does it seem to be Google.

I took a look at one of the ads and traced it back to some marketing company, whose name I will not mention as I don't want to give them the satisfaction of a link, but I will say that their front page slogan is the rather eerie "Discovery: Information Finding People", and their about page is equally creepy. They also describe themselves as "the world's leading content discovery platform, serving 300B recommendations to over 750M unique visitors each month on the web's most innovative publisher sites, including NBC, USA Today, The Weather Channel, The Atlantic and Fox Sports." No doubt there are other companies providing this service as well; I only looked at one ad.

Also, Adblock does not seem to block these ads by default. I've added a pattern but I'm not confident that it's doing anything more than simply preventing me from seeing the ads.

I realize I probably can't stop this in general (e.g. I suspect they don't care about "do not track"), but maybe I can somehow stop it one content-provider at a time.

I am certain that this is not merely paranoia. In fact, I am fairly loose in my views on personal privacy. But there is something disconcerting and uncomfortable about looking around for a product, or for, say, books on a subject, then seeing advertisements for precisely what I was looking for on unrelated web sites the following day.

Even more troubling is sometimes the ads I see are for products that I was browsing on unpopular, low quality web sites that surely weren't employing these marketing companies for tracking in the first place, so I'm not even sure how this information was tracked. It would be one thing if I was looking on Amazon, but having targeted ads show up for things I was looking for on, say, independent local business web sites, is another thing entirely.

What can I do? How can I find out how these people are tracking my browsing history and stop it? What techniques are usually used by these companies when gathering information and what can be done to counter it?

  • I actually don't mind those ads all that much... sometimes I forget to buy a product, and they pop up reminding me to buy it. Creepy, but whatever. :X Still, your concerns are valid... and I'll respond to them. – Mark Buffalo Feb 12 '16 at 19:12
  • 2
    For a very extensive overview of techniques usable for client identification see chromium.org/Home/chromium-security/…. – Steffen Ullrich Feb 12 '16 at 19:18
  • @SteffenUllrich Might want to remove %u200B from that url :P – Mark Buffalo Feb 12 '16 at 19:18
  • 1
    @MarkBuffalo I click the ads sometimes to. That's the thing, heh. On a personal level I resent that I've been sucked in. I refuse to be placated by a few useful ads here and there. Defeat may be inevitable but I'm not going down without a fight. 8-) – Jason C Feb 12 '16 at 19:18
  • A clickable version of @SteffenUllrich's URL: chromium.org/Home/chromium-security/… – Jason C Feb 12 '16 at 19:23
7

There are several ways I can think of:

  1. Browser-fingerprinting. To stop browser-fingerprinting, use Random Agent Spoofer correctly.

  2. Your IP address. To stop this, use a VPN such as Private Internet Access, and connect to a random IP every time.

  3. Your free accounts. When you connect to free accounts such as Gmail, YouTube, etc., they sell your information to third parties. Associating your fingerprint and known IP addresses helps people track you down. To stop this, quit logging into your free services on your current IP, including VPNs.

  4. Third-party Cookies. Don't allow third-party cookies, like ever. And on some sites, simply don't allow them to use cookies at all.

  5. Canvas-fingerprinting.

  6. Javascript that tracks you. You can disable Javascript, or find an add-on that prevents tracking scripts from loading. Usually, uBlock will do this.

  7. Flash LSO objects. Use an addon such as Better Privacy.


There's a lot of different ways to track you...

Apparently, there are a lot of things I haven't considered. Check Steffen Ullrich's suggested reading.

Also, you should be using uBlock origin.


Wear an advertisement-based Tinfoil Hat

I would suggest a mix of the above, but probably take it a step further: set up a virtual machine (such as VirtualBox) that connects to a different host, and use your "free" services on the virtual machine's web browser.

If it's online, and it's free, then the majority of the time, you're the product. How do you think these companies survive by providing free products while having a LOT of staff members? It isn't because of their good nature.

Don't forget to clear all of your cookies.

  • 1
    +1 on uBlock Origin. So far Raymond has shown laudable integrity. – Deer Hunter Feb 12 '16 at 19:29
  • 1
    Thanks. I've spent a lot of my life not caring about my online privacy on this level. I am part of the 35-40 year old generation that carelessly perused the web during its early days without the foresight to see what it would become. This will be a challenge. I will have to figure out how much I want to balance convenience with privacy. (I will give this question some time to attract other answers.) – Jason C Feb 12 '16 at 19:32
  • 1
    One more thing: you should not trust the pre-activated lists since they come with some sites whitelisted. – Deer Hunter Feb 12 '16 at 19:32
  • re: #1, changing User Agent will not have much impact on device fingerprinting since there are usually several high-entropy vectors accessible to web sites. Tor is a good answer to fingerprinting as it has built-in safeguards specifically to combat fingerprinting. – pseudon Feb 13 '16 at 13:55
  • re: #2, Tor is also a reasonable solution to continuously vary your IP address. – pseudon Feb 13 '16 at 13:56
6
+100

Intro

There are so many ways they are tracking you, you will almost need a specialization in Infosec to thwart only most of them. The big thing to remember is that security, privacy, and anonymity are a process, not a toggle switch. Here is a brief overview of the subject, with links for you to get more info and get started.

Disclaimer if it wasn't obvious: This is not comprehensive, merely the tip of the iceberg. I'm not affiliated with anything below, and I haven't tested all of the software I mention, nor am I related to or liable for anything you do.

enter image description here

Image from Concurring Opinions, which has a good article on the topic too.

You need to add layers to your onion-cake in an effort to thwart adversaries. Depending on your adversaries and the consequences for failure, you may need substantially more layers than other people might. For example, nation states and LEOs may bust down your door, while advertisers may simply sell information to said nation states and LEOs so they know which door to bust down or target with a drone missile. Extreme example to prove a point.

You are not alone in trying to keep your personal stuff personal, nor are you crazy or inherently bad, and there is good reason to do so.

Step 0, because in computer-land we start counting with 0

Before the technology, you need to change what tracks you leave on the web. You'll have to understand how you are really paying for those free services, and which free services that you will give up. For example, even if you disable ads on Facebook, they can still track you by any links you click on while on their site. Or by the Like button embedded into web pages. This guy has articles, a web page, and a few videos going pretty in depth into the topic. Don't put personal information into any random website. Have separate silo's for different access/browsing (i.e. multiple email addresses). Unsubscribe from those retail email mailing lists. Stop posting pictures of your kids. No seriously, it probably has a GPS tag embedded in it.

You will need to forcefully manage many of the underlying technologies that you use, most of which you may not even be aware of unless you have technical proficiency in computers, networking, and software development. The assaults on our privacy, security, and anonymity are so thorough and widespread, you may give up after realizing the enormity of it all. Never fear, for there are plenty of people who are working on this problem.

You will also need to manage lots of technology by installing and configuring lots of different software within your browser and on your machine to plug the pervasive holes that you bleed information and metadata out of.

Browser

  1. JavaScript - You will need to manage the JavaScript that runs in your browser. In today's world, there is so much JavaScript that you can't just point blank period turn it off. NoScript is an example of an extension to do this.
  2. Cookies - You need to be the anti-cookie monster. Disable 3rd party cookies. Self destructing cookies is an example of how you can manage other cookies automatically. You may also need to manage flash cookies.
  3. HTTPS - Some sites support HTTPS but don't have it turned on by default. HTTPS Everywhere will catch those and force the connection to upgrade to HTTPS.
  4. Remove ads - All the time, every time. Ads are delivered by tracking networks and are a vector for malware. I understand that people want and deserve to get paid, but they need to fix their stuff. UBlock, Adblock Plus, etc. I think ABP's idea to white list some ads is a good idea, but you may not. Also, ABP on Android will break MMS (picture messages).
  5. Certificates - You will want to remove extraneous certificates installed by 3rd or 4th parties to prevent things like Superfish. Oh, BTW, Superfish was an ad company. Same concept applies to the system level or the browser level, as those certificate stores may be the same, or may be different. Carnegie Mellon has made a decentralized certificate verification system, but I am not sure if I can trust them, given the attack on Tor (link).
  6. DNS - You can leak a lot of information just by DNS lookups. Don't use Google's DNS servers, even if they are easy to remember. Don't use your ISP's either. Your commercial VPN provider should offer DNS, or you can go so far as to purchase DNS from OpenDNS (they have a free option too) to manage ads and get DNSec (Maybe they stopped offering that product, but this company still offers it). You can always DIY with a SOHO router, pfSense and/or Privoxy (or other tools).
  7. Reputable software author turning malicious or greedy - Google is an ad company. They want to track you. Don't use Chrome. Microsoft is following Google's lead with tracking (Windows 10, link, link), so don't use IE or Edge. Etc. Vett your software companies.
  8. Security patches - Stay up to date. But watch out for Microsoft style malware and backdoors coming down that pipe. Realize that auto updates may slip past your VPN if the VPN is software, either because of misconfiguration or it making a connection while it starts up or crashes. There are plenty of logs that adversaries would like.
  9. Passwords and authentications - Use a secure password manager like KeePass or Lastpass. Each password for every account needs to be unique and difficult to remember. Unless you are in DoD-level secure areas, you should not need to rotate through passwords.
  10. Misc addons - Privacy Badger, Ghostery, and other extensions will help enhance your privacy, security, and anonymity in the browser. WebRTC is a great idea from a technology perspective. And will leak your real address under certain circumstances even if you are using a VPN. You can use an extension to plug that hole.
  11. Search - Use an alternative search provider like DuckDuckGo, Disconnect, or similar.

On your NIC/network:

  1. Network (VPN, Tor, IP Sec, etc.) - Tor and a commercial VPN are different technologies with different use cases. Learn about them and use them. You should almost always be running a VPN, preferably a pfSense box putting all of your network traffic through the VPN. Legislation and technology can be enemies, even if technology can technically thwart legislation. There are a number of sites and pages to assist you in choosing a VPN provider. Pay anonymously (Crypto currency, gift card, cash) and vett the provider. Make sure they put their money where their mouth is. Examples include by donating to the EFF, running a blog that doesn't pull punches, or has a proven track record (i.e. not HideMyAss).
  2. DNS - You can leak a lot of information just by DNS lookups. Don't use Google's DNS servers, even if they are easy to remember. Don't use your ISP's either. Your commercial VPN provider should offer DNS, or you can go so far as to purchase DNS from OpenDNS (they have a free option too) to manage ads and get DNSec (Maybe they stopped offering that product, but this company still offers it). You can always DIY with a SOHO router, pfSense and/or Privoxy (or other tools).
  3. IP blocking - You can roll this into a proxy or firewall if you like, but the basic idea is to never connect to known bad actors. It's 1 layer in your defense, and probably a small one, but still worthwhile. Torrenters use this technology to prevent themselves from being caught. You might use this technology to prevent yourself from going to a malicious website before it gets taken down.
  4. Security patches - Stay up to date. But watch out for Microsoft style malware and backdoors coming down that pipe. Realize that auto updates may slip past your VPN if the VPN is software, either because of misconfiguration or it making a connection while it starts up or crashes. There are plenty of logs that adversaries would like.
  5. IPv6 surprisingly still breaks a lot of stuff (It was specified in 1998!). Like OpenVPN DNS leaks, or just not working at all. Unless you have a need or expertise in the matter, you're probably better off turning off IPv6 on all your machines.

On your machine

  1. Encrypted storage - Something like Trucrypt, Veracrypt, etc. Don't use hardware based drive encryption unless it is vetted. I thought I had read that manufacturers have been able to decrypt it, which defeats the point, but I can't seem to find a link. you can reference the Clipper Chip for the same concept/
  2. Physical security - Without this you have no security. Keep your devices close and don't share them. Your computer is like your underwear. You don't share that, do you (#88)?
  3. Passwords and authentications - Use a secure password manager like KeePass or Lastpass. Each password for every account needs to be unique and difficult to remember. Unless you are in DoD-level secure areas, you should not need to rotate through passwords.
  4. Reputable software author turning malicious or greedy - Google is an ad company. They want to track you. Don't use Chrome. Microsoft is following Google's lead with tracking (Windows 10, link, link), so don't use IE or Edge. Etc. Vett your software companies.
  5. Security patches - Stay up to date. But watch out for Microsoft style malware and backdoors coming down that pipe. Realize that auto updates may slip past your VPN if the VPN is software, either because of misconfiguration or it making a connection while it starts up or crashes. There are plenty of logs that adversaries would like.
  6. Certificates - You will want to remove extraneous certificates installed by 3rd or 4th parties to prevent things like Superfish. Oh, BTW, Superfish was an ad company. Same concept applies to the system level or the browser level, as those certificate stores may be the same, or may be different. Carnegie Mellon has made a decentralized certificate verification system, but I am not sure if I can trust them, given the attack on Tor (link).
  7. Keeping the machine free from infection - Easier said than done. Commercial Antivirus/Antimalware might work for you. Having your ear to the ground and being in tune with your system is a requirement. Don't be afraid to reformat and reinstall, regardless of what device it is.
  8. Encrypted communications - Use programs and apps that have built in security, privacy, and anonymity features. Signal is cross platform voice, messaging, and video calling; Threema is mobile; PGP/GPG do email on all platforms; or you can go with sneakernet (wiki).
  9. Backup - Backup anything important. Cryptoransomware will hold it hostage if you get infected. I don't know of many softwares that would rate this kind of list, but Crashplan, Goodsync, and a self hosted Seafile server might fit the bill.
  10. Root, jailbreak, or otherwise own your device - You don't have to build everything from source, but find some open source stuff that you like to use and replace your OS. It's pretty easy nowadays, and you can enhance your security posture with the right apps, add-ons, and configurations that would not otherwise be possible with a poorly supported stock ROM.

In your apps, programs, and services

  1. Stop using malicious services that track you, profile you, or sell you and your data as a product. There is a lot of pressure both way regarding the 3rd party doctrine and the collection (PDF), dissemination, and sale of your data (link, link).
  2. If you determine that you need to use malicious services (Facebook, Google, etc), find out what options you can turn off, do so, and periodically double check them.
  3. Stay logged out unless you need to be logged in. YouTube's ability to suggest awesome videos comes at a price, after all.
  4. Investigate the app permissions on apps.
  5. Apple products give you security vs certain threats, but also prevent you from having your way with your own hardware and software. In the future, jailbreaking these devices will probably become unfeasible.

Sites/articles with lots of info or useful test tools

  1. EFF Panopticlick - Lets you test how easy to fingerprint your browser is
  2. EFF Surveillance Self Defense - Good starting point, even for nontechies
  3. Privacy Tools IO - Explanation, links to software, recommendations, etc.
  4. Reddit /r/Privacy FAQ - Good FAQ with nontechnical discussion.

Interesting people to read/listen to

  1. Bruce Schneier
  2. Steve Gibson of Security Now
  3. The Grucq
  4. Moxie Marlinspike

Interesting projects and miscellany

  1. P.O.R.T.A.L., the project that spawned Anonabox and its ilk.
  2. Seafile - A way to set up your own replacements for cloud services.
  3. SpiderOak - Secure cloud service to synchronize files across devices.
  4. Privoxy - A proxy that enhances your privacy by doing adblocking outside of the machine. You can add it to an OpenWRT router, or pfSense (though it's not supported) (or something similar), or build your own.
  5. Guerillamail - disposable email addresses from SHARKLASERS.com How cool is a shark laser??

Final Thoughts

Be prepared to DIY and pay for things that you previously haven't. Ass, grass, or cash; you have to pay somehow. In the digital world, it's more like "Ads, DIY, or cash".

  • 1
    This... is absolutely awesome. Will be able to take more time to digest it later. I feel like I could spend days with this. – Jason C Mar 31 '17 at 23:12
  • 1
    Well, thanks man. I'll probably continue to update this for a bit. Been meaning to put all this together for a while now. – YetAnotherRandomUser Apr 1 '17 at 0:36
  • Thanks for the note about Privacy Badger I hadn't seen that one before. – OrangeKing89 Apr 25 '17 at 18:55
  • Very detailed answer with lots of resources. I was tempted to +1 it but your mention of Steve Gibson raises some red flags (as he's a pretty big fraud). – forest Feb 24 '18 at 5:22
  • @forest You keep telling me that and I still can't find anything but some buthurt 15+ years ago and circular references to broken links of web pages no longer online nor cached. – YetAnotherRandomUser Feb 24 '18 at 13:55
3

I use an extension for my browser called Ghostery that sifts the webpages you visit for trackers, beacons and other products.

https://chrome.google.com/webstore/detail/ghostery/mlomiejdfkolichcflejclcbmpeaniij?hl=en

Ghostery makes money by selling data to the website owners about what trackers are running on their website because many times they don't know about it themselves.

Personally I run it so that all those tracking programs are not slowing down my browser.

Looking at what it has found, even on this site, shows 4 different Ad tracking programs and Google Analytics.

  • Just to be clear: You are not affiliated with / the author of this extension, correct? – Jason C Mar 31 '17 at 14:51
  • 1
    I am in no way affiliated with them in any way other than running their extension. – OrangeKing89 Mar 31 '17 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.