Can I prevent my neighbors, whom I pay for shared internet (WiFi), from seeing the sites I've visited?

Question

I pay my neighbors to use their WiFi. They have listed me as Guest with a separate password from theirs. Is there any way to prevent them from seeing the sites I've visited? My browser history clears automatically. Since they're in charge of the router, can they always see in real time what I'm browsing as I'm browsing? I'm assuming they won't be able to see where I've been since my history clears.

Answer 1

Yes they can but unless your neighbor has the required technical expertise, its highly doubtful.

To view incoming and outgoing traffic you need specific software to monitor network packets and the tech knowledge to actually do it. Most routers only keep a syslog and unless they are using software like wireshark to monitor/capture your packets, they cannot view the sites you have visited.

So unless he is a geek or a hacker (however amateur) there is usually nothing by default that records your traffic.

*Side Note: Clearing your browsing history is completely restricted to your local system and if they can/are monitoring, it will do you no good.

Alternatively, if your neighbor does have the required software and skills to monitor your traffic, you can use a proxy. By doing so the monitoring software will only show a lot of outgoing and incoming connections between you and the proxy, so even though they will know you are using a proxy, they can't see what sites you visited.

EDIT: as lorenzog correctly mentioned in the comments, for true sense of security and privacy, one should use a SSL Proxy to encrypt data sent and also tunnel DNS queries (which can be monitored by the router administrator) through the SSL proxy.

Answer 2

If you get a VPN and use that for browsing, that will hide all your traffic from both your neighbour and their ISP.

Answer 3

What about using tor? Keep in mind that your speed will be affected.

As other people said, using any private mode in your browser is not going to be of any help.

EDIT :

The slowdown heavily depends on the network topology, the number of nodes, how much traffic the nodes are handling and what you are downloading. Here you can find some explanations about tor performances. Although old, it may be interesting.

Answer 4

Yes they can actually. What it boils down to is that they can see which websites you are running by looking at:

• Clear HTTP traffic
• DNS requests sent

One thing you could do is purchase an encrypted VPN and run all your internet traffic through the VPN. This way your neighbours will not be able to see what you are doing.

Answer 5

In practice, it depends on the router they're using (and, specifically, on the firmware it's running). Basically all home WiFi routers have the technical ability to log visited URLs, as long as their firmware includes such a feature (and it's not exactly a complicated one). The main questions are:

1. whether the router firmware supports such a logging feature, and
2. whether the router's normal admin interface exposes it, e.g. as a "parental monitoring" function.

If you happened to know the manufacturer and model of your neighbors' WiFi router (which you might be able to determine just by typing its IP address — often 192.168.0.1 or 10.0.0.1 — into your browser's address bar), it should be possible to find its manual online and see if it provides such features. Otherwise, we can only guess.

(Note that, if your neighbors are using a separate DSL / Cable router and WiFi access point, either of those could be logging your web browsing habits. Also, if they wanted to, and had the necessary technical skills, they could route any traffic between the DSL and WiFi boxes through an ordinary computer that could certainly log any and all traffic passing through it. However, the most common home WiFi setup these days tends to involve a single integrated DSL+WiFi router, which would make it the only part of the connection between you and the ISP under your neighbors' control.)

As for hiding your web browsing habits from nosy neighbors, you'd basically have to tunnel it through the router in such a manner that the router can't see it. Some options for this include:

• running a VPN client that connects to a server outside your neighbors' control;
• configuring your browser to pass all web requests through a proxy server (which itself should be using HTTPS, otherwise your neighbors can still see all the traffic between your browser and the proxy);
• setting up an SSH tunnel to a server you have SSH access to, and configuring your browser to use it as a SOCKS proxy;
• configuring your browser to use the Tor anonymizing network (or using the Tor Browser Bundle).

Note that, with all of these options, whoever runs the VPN / SSH / proxy server you're connecting to could still see which sites you visit and, if you're not also using HTTPS, any content you're posting / accessing. This is even true for Tor, although, in that case, the server that actually sees your web traffic will be a random Tor exit node that should not, because of the "onion routing" design, have any idea who you are (unless, of course, the content of your web traffic itself reveals it).

Also note that simply using HTTPS as much as possible (e.g. with the help of HTTPS Everywhere), even without a VPN / proxy, will help your privacy somewhat: even with HTTPS, your neighbors can still see which sites you visit, but not the specific URLs or content of the pages you access on each site (at least as long as you don't accept any bogus certificates).

Finally, even if your HTTP(S) traffic is transmitted securely through a VPN or a proxy, your browser could still be leaking information about the sites you visit through DNS requests. A decent VPN client should take care of this for you, but if you're using a proxy server or an SSH tunnel, you may need to configure your browser correctly to prevent such DNS leaks. Fortunately, I've never actually seen a home WiFi router that would log DNS requests (or, at least, that would expose such logging through the normal admin tools), so monitoring those would require some extra tech skills from your neighbors.

Ps. If your neighbors aren't too tech savvy, there's always the possibility that they might've left their WiFi router's admin password at its default value. If so, and you're feeling unscrupulous enough, you could just look it up and try to log in with it to see if they have monitoring enabled (and, potentially, to monitor their web usage) — not to say that I'd condone doing any such thing, or that it would even be legal. Besides, if they've left the password unchanged, they'll probably have left the WiFi network unsecured too, in which case anyone else nearby with a WiFi-enabled computer could do the same. If that's the case, it might be more in your interests to carefully hint that they really ought to secure their network better, even if it'll cut down your (illegitimate) access too.

Answer 6

When my laptop is using a network I don't control (basically anything that's not home) it wears pretty red socks to reroute all traffic into the SOCKS5 proxy built into OpenSSH and then to a server I rent anyways for my website to protect my traffic. You can use tor as well but I intensely dislike tor (for reasons off topic here).

This is the socks_up script:

socks_down
ssh  -o ControlMaster=yes -S /tmp/linode-socket -fCqND 8080 ssh@linode
sudo redsocks -c /usr/local/bin/redsocks.conf 
sudo iptables -t nat -N REDSOCKS
sudo iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN
sudo iptables -t nat -A REDSOCKS -p tcp -o wlan0 -j DNAT --to 127.0.0.1:8081
sudo iptables -t nat -A REDSOCKS -p tcp -o eth0 -j DNAT --to 127.0.0.1:8081
sudo iptables -t nat -A OUTPUT -p tcp -j REDSOCKS
sudo iptables -t nat -I REDSOCKS -d 1.2.3.4 -j RETURN

You need to change the 1.2.3.4 to your server IP and ssh@linode to your server and user.

This is the socks_down script:

#!/bin/bash
sudo iptables -F
sudo iptables -X 
sudo iptables -Z
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t nat -Z
sudo killall redsocks
ssh -o ControlMaster=no -S /tmp/linode-socket -O exit localhost

This is the redsocks.conf file:

base{log_debug = off; log_info = off;
   daemon = on; redirector = iptables;}
   redsocks { 
     local_ip = 127.0.0.1; local_port = 8081;
     ip = 127.0.0.1; port = 8080;
     type = socks5;
   }

(and I know it shouldn't live in a bin directory. Oh well.)

Answer 7

They could view/log any traffic that is sent in plaintext (not encrypted) over their network. Clearing your browser history only affects your local computer, and has no impact on what has occurred on the network.

Answer 8

Unless you use a VPN to tunnel through their network, they can see your activity and the destination of your traffic, just like your ISP could. (They are effectively your ISP.)

If you want to avoid them being able to see everything you are doing, you must encrypt your communications across their network. If you use a VPN, they will be able to tell you are using a VPN, but all of your requests to the VPN will be protected and you will actually access the sites you are going to from the VPN end point which is outside your neighbor's network.

Answer 9

The only way to make it impossible for them to know what browsing you are doing is to use either a VPN or an SSL Proxy (things like Tor are a fancy form of proxy). Otherwise, they could potentially sniff the traffic as it passes through their router, and identify at least the hostnames you are connecting to, and (if it is not HTTPS) the actual URLs.

Of course, whether they have the technical knowledge or inclination to do this is another matter. Most routers will not include this sort of feature.

I'd say that, if you suspect them this much, and want to keep your usage secret, get your own Internet connection.

Answer 10

As an alternative to VPN's and bundled secure proxying solutions, you can assemble a solution using just Secure Shell (SSH) and a HTTP proxy.

1. Initiate an SSH session to a remote server where you have an account.
2. As part of the SSH session, configure port forwarding: forward a local port on your machine to the address:port of some HTTP proxy which is reachable from the remote machine.
3. Use the local port as your HTTP proxy for browsing.

Thus all you need is a remote machine with a shell account reachable by SSH, and a proxy somewhere (perhaps on that machine itself).

In Firefox, proxy settings are found on the "Advanced" configuration panel in the "Network" tab, under "Connection" ("Configure how Firefox connects to the Internet").

Answer 11

Here are the specific steps to get a simple, DIY setup running that will provide you 1) a solid approach that uses an SSL proxy and 2) will also tunnel DNS queries through the SSL proxy as well.

Bonus, you don't need to ask your neighbor to do anything (provided they're not actively blocking against this, which I'd doubt in your situation).

Here are the steps:

1. Get a Shell Account - Sign up for a shell account (there are many good & cheap ones, I pay $5 a month for mine) and a many free ones with a wide range of quality (http://shells.red-pill.eu/). IMHO, you get what you pay for with free hosts, but YMMV. Nutshell, all you need is a username, password, and shell access to server. Keep in mind you also might already have one, through school, work, web hosting, etc.

2. Get an SSH Client - On your computer, you'll need an ssh client. I use the one available on the command line of Mac OS X and Ubuntu. If you're using Windows, use Cygwin to install ssh. Either way, it's the same command and syntax:

   ssh -l username yourshellaccount.com -D 8080 -N

   (Note: 8080 is a port number, you can change this to something else if you need. Which ever number you choose, you'll need it for Step 3).

3. Get FoxyProxy - Get FoxyProxy for FireFox (free plugin). The steps to configure FoxyProxy are pretty simple and headache free. When configuring the plugin, you'll need to reference the details from Step 2 above. Nutshell here, you're telling FireFox to route it's requests through the ssh tunnel you created in Step #2. FoxyProxy also has a checkbox that allows you to "[x] Perform remote DNS lookups". Check this box to perform the DNS lookups on the remote server.

That's it. You can have all of this up and running within a matter of minutes. All traffic is encrypted between your system and the remote server, when browsing the web through FireFox. The remote server is now the one making all HTTP requests, DNS lookups, etc.

Note: I said it already, but worth highlighting, that only your Firefox web browsing is tunneled. It's not doing anything else. This, IMHO, is a benefit of this approach given what you're trying to accomplish. If you're curious about what this is doing and how it works, use this wikipedia article to get started.

Answer 12

Use uProxy to encrypt your traffic and proxy it through a trusted machine elsewhere, owned by yourself or a friend.

This is probably safer than Tor, because there's less chance of malicious exit nodes, and less chance the destination will block your traffic. And there's zero cost, unlike a commercial VPN.