2

I'm not sure if this is the right community for this kind of question, but here goes.

When I browse the web, here is what I do:

  • I always use uBlock
  • I usually use Self-Destructing Cookies to delete residual cookies from YouTube, Amazon, etc. after I log out.
  • I use HTTPS Everywhere to protect against eavesdropping on public networks.
  • Flash is disabled whenever it is not in use
  • If I'm looking something up quickly on a public computer, I use private browsing mode so that form entries are not logged.
  • I carry a USB stick that has a portable version of Firefox with the above addons installed.

Do these tools (ad blocking, deleting cookies) actually do anything to protect my privacy, or do they give a false sense of security?

I am aware that Google, Facebook, etc. track my activity regardless of what I do on my local system. However, since their ads never actually reach me (meaning that I never click on ads), wouldn't this information be useless to them?

  • Do you use write-protected flash drive? You can enable write protection by hardware modification of your flash drive by soldering a switch in between a certain pin and its land. This should protect you from malware. But beware BadUSB! – KOLANICH Dec 22 '16 at 23:21
  • @KOLANICH That would probably be a good idea. I'm not sure if my flash drive has hardware write protection (I'll look for the solder bridge). Unfortunately, I'm not sure write protection would be practical, as I use the flash drive to store other applications (including a full cygwin installation). That is my "utility" flash drive that I don't use for personal files. – Caleb Reister Dec 22 '16 at 23:34
  • Have you disabled JavaScript? – defalt Dec 23 '16 at 5:02
5

Let's see:

I always use uBlock

This improves your privacy protection. Note that some ads are only not shown, but still running in background (thus they still can get some info about you such as IP).

Ad blocking also makes you more secure from malware - for example, ad blocking protects you from some malwertising, which is a major infection vector nowadays. This could also be used as argument for blocking in some "ad blocking ethics" disputes.

I usually use Self-Destructing Cookies to delete residual cookies from YouTube, Amazon, etc. after I log out.

I suggest also to clear your ALL browser cookies once a month or so. If you don't clear all of them, they can still keep tracking you using a cookie from a third party website under their control.

And of course don't forget to log out of services like Google if you don't want all your searches to be

I use HTTPS Everywhere to protect against eavesdropping on public networks.

Helps a bit (only if the web site actually supports HTTPS)

Flash is disabled whenever it is not in use

Good for security as well as privacy.

If I'm looking something up quickly on a public computer, I use private browsing mode so that form entries are not logged.

Doesn't affect your privacy in general, as you have a single browsing session and could be tracked within it. Ironically, using public computer and NOT clearing your cookies could improve your privacy (by poisoning Google and other profiles), but of course comes with obvious security risks.

Note that there are many other risks using a public computer, such as installed malware or keylogger (including hardware keylogger).

I carry a USB stick that has a portable version of Firefox with the above addons installed.

This is a bit helpful, but again the main issue with public computer is (lack of) security, and possibility to have keyloggers, from which your portable firefox won't protect.

I am aware that Google, Facebook, etc. track my activity regardless of what I do on my local system.

However your actions make it harder for them. If you do google search while logging in, they KNOW it is you. If only your IP matches, it might or might not be you, so the profiling degree is less confident.

And regarding Google, make it a habit to spend 15 minutes a week to "poison" your profile, by searching for something you would never search or never be interested in, and by sending out emails in Gmail (to your other or non-existent accounts) using topics/keywords as far away from your interests as possible.

  • I generally use public computers for only a few minutes, and these computers often have deep freeze. Also, as I mentioned previously, I use private browsing mode so that autofill and form history are deleted once I close the window. – Caleb Reister Dec 22 '16 at 23:40
  • Could you please elaborate on the last point? What you are trying to achieve with this? As long the majority of your online activity seen by Google is related to the stuff you're interested in, this measure makes no sense at all in my eyes. I'd rather think about not using a Google account or even their services at all whenever it's possible. – Noir Dec 23 '16 at 1:15
  • It depends on how much you use google/gmail; for me 15 minutes a week can fully compensate for it. I mostly use google through startpage.com - so it doesn't see any IP/cookies and thus no profiling, so it doesn't take much time to counter that. – George Y. Dec 23 '16 at 3:36
  • Self destructing cookies deletes all cookies as soon as you close the tab. No need for any additional monthly cookie deletion, except you let your firefox run all the time and never close all tabs. – allo Jan 30 at 14:47
2

A few additions to what has already been mentioned in other replies.

Don't use googles search engine, use duckduckgo or startpage.

Since you already use firefox, use the sandbox feature and have one sandbox for each logged in service. Gmail/youtube in one container, facebook/instagram in one, linkedin in one and finally general surfing in a separate one without logged in accounts. This way google/facebook/microsoft wont know what pages you visit. This is better than simply deleting the cookies as they will never see your other cookies in the first place.

VPN/proxy could also be a good idea, not sure if it's possible on public PC's (lots of firefox extensions available for proxy) but at least you reduce the risk of someone on the same network stealing your stuff. If you get a new IP each time you will also confuse the tracking sites somewhat as they can't connect you to a single IP as easy. Make sure to use a payed VPN, the free ones spy on you as well.

Others tips are obviously Multi-Factor Authentication since your password can be stolen while on public PC's (not really privacy related). Also never reuse passwords. If you gmail password (with MFA) is the same as your reddit pw (without MFA) they still got your reddit account.

0

I know this doesn't answer the question directly but worth mentioning not in a comment : User Privacy on Internet

  • Use different browser for different purpose : Don't use the same browser to access your accounts like email as the one you use for search engines or online shopping.
  • If you are logged in "google.de" for instance, use "google.co.uk" to perform your search.
  • If you perform search on "google.co.uk" , block cookies for that domain.
  • Don't have a Facebook account (I know you say I'm kidding), ultimately choose one browser to access Facebook only.
  • You don't have to use a password manager, you can remember 100 passwords if you have a good password pattern, let's say my unique pattern is k1ckTHEWEBSITENAME159, so my yahoo password would be k1ckyahoo159 , you have only to remember the pattern not all passwords.
  • Don't use personal details in your passwords.
  • Change you passwords periodically, which means your password pattern also.
  • I actually think I have a slightly better password system. For some websites, I use a phrase (often in a foreign language) to describe what the site/service does. These passwords are fairly long, complicated enough to prevent routine dictionary attacks (they include compound and/or non-English words and abbreviations), and they often include special characters. – Caleb Reister Dec 23 '16 at 7:01
  • One other note: I don't think it really matters whether you put personal details in passwords. From what I understand, the password itself is never actually stored on the server (only its hash). Therefore, companies would be unable to retrieve meaningful information from the password. – Caleb Reister Dec 23 '16 at 7:04
  • @CalebReister unless you are 100% sure that your password will never be in a list of a 1million or something hacked passwords ..one day. – elsadek Dec 23 '16 at 17:57
  • 1
    Good on different domains shares the same cookies in the background. Changing passwords without knowing of an incident is not recommended anymore, as this has little benefit if the old password was strong enough and encourages weak passwords, which are easier to remember. – allo Jan 30 at 14:50
  • @allo how many password leaks have been in news long after being in hacker hands for pretty long time, changing password is indeed a preventive measure, and that where learning from experience payoff. – elsadek Jan 31 at 15:16
0

Do these tools (ad blocking, deleting cookies) actually do anything to protect my privacy, or do they give a false sense of security?

They know your IP address, otherwise you wouldn't be able to see the webpage. If you don't want them to know your IP address use a proxy.

AD blocking means that you can't see the AD (and click on it), it doesn't mean that they don't know what AD they would serve to someone based on what they do know.

If you won't save your own cookies they can save them for you, IE: we sent IP address w.x.y.z this cookie at this time, thus they would have it, had they chose to accept it.

Don't forget to block referral URLs, also some links aren't exposed to the search engines (no follow) so someone whom clicks either got lucky and typed in an URL on a particular webpage or they were visiting that webpage and clicked on one of the URLs.

wouldn't this information be useless

Not quite "useless", just less useful. They still know how many different IP addresses visited, and when; it's also possible to see if you scrolled down and where your mouse was pointing (with JS turned on, or CSS changing images on rollover).

For example a webpage about how to make backscratchers from coathangers may not be popular, even if it was ADs for backscratchers selling for a buck each is unlikely to generate much profit. So little point in having such a webpage in the first place.

But, if you had 10 different webpages about 10 different automobiles you could poll which vehicle people were most interested in. With that information the webmaster would know to approach that car manufacturer about running ADs for them, since it would cause the most ADs to be served - maybe not to you, but to everyone else.

Constantly changing your IP address with proxies or using tor and the Tor Browser will provide better privacy. Understand that there will be a slowdown and some of your blocking efforts will affect the functionality (usability) of some websites; some sites won't serve a webpage if you are blocking everything while many will politely explain that advertising pays for the site to offer it's services to you for free.

Any information collected that appears to be valid can be packaged as a statistic and sold to someone, so it has some value. You can check if you are being snooped by visiting some webpages for something you absolutely do not want (that has some value, like luxury cars or world cruises), then see if ADs appear for related products.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.