187

One possible explanation is that DuckDuckGo is using the headers that are sent in your request to determine their display. For example, it is very common to use the Accept-Language header to determine in which language a webpage should be displayed. This header is set by default in all modern browsers based on the language preference settings. My browser, ...


97

Don't do it If you are targeting unsafe regimes, the consequences can be severe. For example, in Iran, condemned homosexuals are usually sentenced to death by hanging. It would only take the slightest lapse on the part of your site, or one of your users for this to be incriminating evidence. Can you imagine the guilt you would feel that your well-...


58

From the card itself, the Merchant gets the track data, which includes card number, expiration date, and cardholder name. If the Merchant requires zip code verification, they'll get your zip code, obviously. (Card-Not-Present Merchants often get address data for billing/shipping purposes, but you asked about physical stores... and they get that from the ...


48

I had the same problem: Google always responding in my native language, even though I used a VPN elsewhere in the world. I wiped all cookies and so on....to no avail... and then I found that I had an IPv6 leak! Google was using IPv6, and saw my home IP as usual. It wasn't "tracking" me, I just contacted Google straight around my VPN. Do the test here: ...


46

Revealing your IP address doesn't compromise the security of your machine. If an attack on your machine is untargetted (i.e. the attacker just wants to use it to send spam or fishing emails, or as a proxy for targetted attacks), your machine will be scanned at random, not based on the IP address that may be posted in a forum. If the attack is targetted, the ...


43

Perhaps it's worth mentioning that the impact of resizing your browser on your privacy heavily depends on what window size you set. Maximizing Tor browser on a screen with a standard resolution like 1280x1024 or 1080p is not too bad - lost of people have screens like that, and you probably won't end up being the only one with that resolution. The adversary ...


33

Data dealers often buy data from multiple sources and aggregate it to generate an all-compassing user-profile from it. For example: xyz company sold your telephone number and what the conversation was about. social network which asks for your phone number for password recovery sold your telephone number and your ip address at some point in time. ...


29

The email includes references to an externally-hosted images, like http://example.com/[tracking_id].png, where the tracking company controls the server hosting the image. The company records how and when each unique image URL is loaded by a mail client. As you've noted, print operations can be logged by a tracking image in the @media print CSS directive. ...


28

This is because Skype displays Google Ads. So Skype isn't getting information from Google about you. They are displaying Google hosted ads which are based on your Google search history. The search based ads shown are not based off your overall history but recent history by design as it is likely you are currently exploring the market for the product. Where ...


28

This is not an easy thing to do. There are a few different ways to get something like what you want. First, use HTTPS. This stops anyone from seeing the data being transferred other than the server and user (which I am assuming are both clean). This does not stop external people from seeing that the user has visited the site, only the exact data that is ...


25

Your requirements as stated are physically impossible. Think of it like this. If you were posting a letter to someone in another country and wanted to be sure a powerful dangerous group was both unaware of the content of the letter and unaware the recipient got a letter from you how would you do it ? The security on your side could be fantastic but ...


23

They track opens the same way every other email sending/analytics company does it: by inserting a tracking pixel within the HTML of the email. If your email client blocks image loading by default, then you won't be tracked. If you load the images, or your client automatically downloads the images (iPhone email client) then you're being tracked. You can see ...


22

In general, it is always best to reduce your attack surface. No system is ever perfect and your deactivation protocol will be no exception due to both programmatic and potential human error. Risk 1: Let's say all your terminated employees accounts have been properly de-activated, for example via altering their role in the employee table in the database (or ...


18

In a nmap -D scan, for scanning to return any result, your real IP address must be used amongst the pool of decoys. Without your real IP being used, you will not be able to receive any response from your target server, and nmap scanning would not work. The -D option creates confusion by introducing decoy IP addresses. So, if the target server is logging ...


18

Users are tracked because the collected information can be sold. A major reason why data is collected from users is due to the simple fact that people will pay for the data. There are many companies that broker collected data, such as Intellius, to virtually anyone with a deep enough pocket. What buyers do with this personal information, however, is up to ...


14

One approach is to analyse the TTL field on the packets. Time to live is an IP feature to mitigate routing loops. Every packet starts with a certain TTL value, usually 64, and each routing hop reduces the TTL by one. If the TTL gets to zero then the packet is dropped, and an ICMP "TTL expired in transit" message is returned. The traceroute utility uses the ...


14

At the very least, they can get the card number. Most receipts will even have the last few digits of the card number printed on them, but the system will have had the full number at some point, and may well hold a tokenised version of the card number which is allowed under PCI (think of it being a random value which can be linked back to the card number by ...


13

The way an investigator would trace a multi-hop connection to the original source is to follow each hop, and examine either the logs (if the connection is closed) or the network state (if the connection is ongoing) to see where the next hop goes. This can get very difficult if the hops cross political or jurisdictional borders, since the cooperation of ...


13

Client-side code (JavaScript) on a web site you visit has access to screen resolution and other settings. Often the combination of these settings are unique enough to match your current session (which may be protected by tor) with some other session that is not protected by Tor. Following the fingerprint analogy, if you use Tor but have a non-default ...


12

Will hiding behind proxies protect you? Using a browser-based VPN plugin can betray you if you have Flash, Java, or even other plugins installed. Anything that can get read/write access to your file system will betray your presence. There has also been a recently-discovered exploit that affected users of private internet access, a VPN provider. It's also ...


12

Geo-ip location accuracy varies wildly from country to country and from provider to provider. Some smaller countries have very accurate internal mappings of IP's to postal addresses but this type of data is generally not available to the public. Note: Different Geo-IP address databases may also have different location data for the same IP address so you ...


11

The whole discussion of privacy issues today has turned to matters of profiling and patterns, think, prediction. Prediction is the big thing these days. "You might also be interested in xyz..." This is because others who did searches on abc and Wxyz ALSO were interested in xyz, and you also looked for some of these terms, you get classified as a target for ...


11

To understand this, one first needs to understand what a cross-site request forgery is. A Cross-Site Request Forgery is when the attacker has some script or embedded media on a website they control which makes any visitors to that website request a resource from a different site. That request appears to that other site in the context of the user. I could, ...


10

Directly, no. Indirectly, it's possible. One way: Have a web server, whose access log you control, up and running. Send your chat partner a unique hyperlink pointing to that web server, have them click the link. For example: http://yourdomain.com/JohnDoe.html (the web page does not have to exist, throwing a 404 is fine). Check your web server's access log ...


10

This is not very uncommon. Unfortunately you have no single solution, unless the individual is in the same locale as you (in which case you may be able to take legal action if he is causing you to incur costs) Generally, there is no technical solution, as this is a human problem. They could be doing it deliberately, as Pacerier suggests, or they may just ...


10

I think @punpun1000 is right, you can easily test your browser language by visiting this website - https://browserleaks.com/ip or just simply run this JavaScript code: alert(navigator.language);//works both in Mozilla and chrome alert(navigator.language);//works both in Mozilla and chrome alert(navigator.userLanguage);// Works in IE More about regions and ...


10

The simple yet complicated answer is Because of data. In addition to what schroeder said (tracking users for a commercial optimization,profiling and targeted marketing...), by profiling you, a company can anticipate your needs and actions. Today we hear that by allowing a company to track you, it helps in “personalizing” your browsing experience :) meaning ...


9

It's equivalent to security through obscurity. If you rely on being secure by not revealing your IP address, you are in big trouble. When securing your machine you must assume that the attacker already knows the IP address, since one way or another it's fairly easy to get... You leak it like crazy, every time you connect to a website, every time you send an ...


8

If you have suffered some sort of harm from the calls (e.g. death threats or harassment), it is in theory possible to do this but it is an incredible amount of work, and is in practice near impossible unless your police get involved, which they will not do unless it is a serious matter. You would need to obtain court orders from each ISP or telephony ...


Only top voted, non community-wiki answers of a minimum length are eligible