The Webs We Weave

Most people just don’t realize how wide and vast this tracking network really is. The best way I know to explain the pervasiveness of web tracking to you is to use a nifty little web tool called Lightbeam .⁶ When you go to a website, the content you see is often provided by multiple different companies. Think of a web page as more of a patchwork quilt, with each panel coming from many sources. In addition to the first-party site (the website you actually intended to visit), there are often many other third-party websites that provide ads and other images—and also track what you’re doing. To see these third-party relationships, Lightbeam draws a graph that shows you all the third-party sites that are associated with the first-party site you visited. (I know, all this “party” stuff sounds like legalese. It sorta makes your brain want to tune it out. But bear with me here.)

Let’s try a real-life example and graph the relationships behind some popular websites and their hidden third parties. We’ll start our browsing with Wikipedia (Figure 7-2).

In Figure 7-2, you’ll see the first-party site as a circle—in this case, the one with a W in it, which is wikipedia.org. The little white triangle next to that is a third-party website that is associated with the site we visited. However, in this case, the third-party site is just wikimedia.org, which is directly associated with Wikipedia (i.e., it’s not a third-party advertising or tracking site). It’s not uncommon for the third-party sites to just be extensions of the first-party site. And it’s also not uncommon for the third-party sites to be perfectly normal other websites that provide things like web tools, images, and other harmless content. However, many of them are marketing firms and other “Big Data” companies whose sole purpose is to build a portfolio on you.

Now, let’s go to Yahoo.com (Figure 7-3).

Our little graph (Figure 7-3) has now grown substantially. While Yahoo.com was our primary target (the big white circle at the left with the “Y” in it), we can see that we’ve also triggered a few dozen other sites, almost all of them tracking sites. Note that there is no intersection here between the two main websites—no common third parties. Wikipedia—since it doesn’t track you—is actually pretty boring in this regard, so from here on, we’ll just cut them out of our picture.

Now let’s move to Amazon.com (Figure 7-4).

You can see in Figure 7-4 that loading Amazon’s website also caused you to communicate with several other third-party websites. Now we can see the overlapping third-party sites. Those are all tracking sites. And they now know that you went to Yahoo and then to Amazon, and they quite likely know a lot about what you did there. Starting to get the idea?

Let’s go for the jugular now…let’s go to CNN’s website (Figure 7-5).

The graph in Figure 7-5 is so crowded now that you can’t really even read it. It’s hard to tell, but there are 183 third-party websites there. You’ve visited just four websites so far. The triangles that have multiple connections are the tracking sites.

So, just exactly how is it that they track you? The details would make your eyes glaze over. It’s very technical, and the techniques are legion and myriad. But essentially it boils down to somehow marking you in a way that can later be recognized if they (or someone they know) see you again. These markers come in many forms. One of the most popular tracking devices is called a cookie. A cookie is a small bit of data that websites give to your computer, asking your browser to save it off and then repeat it back to them later when they ask for it. This is sort of like a medical chart—the information is kept on you, and when you interact with another party, they look at it to refresh their memories of you. These cookies were originally used by the first-party website to help keep track of your login, your personal preferences, your shopping cart contents, and so on. However, third parties have used them to mark people as they move around to different websites, tracking all sorts of stuff about you. That’s the key point here…first-party cookies are between you and the site you intended to visit, which tends to be mutually beneficial; third-party cookies are things you generally didn’t ask for and may not even be aware of, and it’s almost completely for the benefit of the third party.

Let’s try an analogy to explain how this works. Let’s assume that your local mall wants to gather information on the people who shop there, and all the merchants agree to participate in the program. It’s time for you to go Christmas shopping, so you park your car and walk in via the Macy’s door. As you walk through the door, a silent little blowgun shoots a sticky dart that attaches to your back. This dart contains a little homing beacon that puts out a unique identifier, specific to you. They don’t know who you are (yet), but they want to be able to distinguish you from all the other people wandering the mall. This ID is logged in a special computer system, along with a little note: “Customer 4372 entered mall via Macy’s East door on first floor.” This entry in the log automatically notes the time and date, as well. You walk through Macy’s and into the mall proper. As you do, you walk by another sensor that detects your tag: “Customer 4372 left Macy’s without buying anything.” Since the time of entry and time of departure were so close, they could probably also conclude that you didn’t even look at anything.

Now you walk into a jewelry store. You look around, find the perfect gift—a diamond tennis bracelet—and go to the register to buy it. Your entry to the store was of course logged, but now you’ve also made a purchase. They now know quite a bit more about you. If the store is trying to be nice, they may only log that you are a white male in his mid-50s who lives nearby (based on your credit card billing address) and that you bought an expensive piece of jewelry. From this, other retailers in the mall (who can see all of this information) may well assume that you are married and have an above-average income level.

You leave the jewelry store and head down to Victoria’s Secret, where you make a very different purchase on a rarely used credit card. Marketing data analysis may suggest that you have not just a wife but also a mistress. You now walk into an electronics store. The store personnel can see from your records that you’re in a buying mood today and you have plenty to spend, so they ignore other customers who show less promise and focus on you. They steer you to higher-end equipment, and given that you probably have a wife, they test your interest in kitchen appliances and push hard for you to get a store credit card.

This is all just from a single trip to the mall. Think about all the other places you’ve been and purchases you’ve made—what could they tell about you? How detailed would your profile be? And would you want that profile to be shared with every store you walk into?

The key here is that all the stores have contracted with the same tracking company. They have a common set of sensors that are all networked together, creating a central place to log your activity. While you might think it’s entirely reasonable for a given store to keep information on previous buying and shopping activity, how do you feel knowing that information is being shared with many other retailers (and credit bureaus, potential employers, insurance companies, etc.)? It may be that this tracking company hordes the juiciest bits of information and gives only partial information to each store owner (depending on what level of service they’ve paid for). But it’s important to realize that even with the best of intentions, the fact of the matter is that that information exists somewhere—and therefore it can be stolen, abused, or even compelled by the government.

Enter the Panopticon

But we’re just getting started! There are several other tracking mechanisms, as well. People have gotten wise to the third-party cookie tracking method and have learned how to block them, so marketing companies have come up with other ways to track you—ways that can be difficult to avoid. If they can convince (or trick you) into installing a browser extension, they can potentially access all of your web surfing data. Even those social media buttons such as Facebook’s Like, Pinterest’s Pin It, and Twitter’s Tweet can be used to track you—even if you don’t click them! Sometimes they use tiny little one-pixel images with unique names…when your browser loads that image, they know you’ve been there. Sometimes they use invisible web form fields. The list goes on and on, and the exact techniques change all the time.

Some really clever folks have figured out ways to “fingerprint” your web browser. To help websites present themselves optimally, your web browser gives up all sorts of general information about your computer and web browser configuration: what plugins you have installed (even if they’re disabled), all the fonts you have on your computer, computer screen dimensions, what type of operating system you’re running, and what type of browser you have. The idea behind browser fingerprinting is that few people will have the exact same combination of these items.

Unlike regular cookies and other forms of tracking, there is no way to know that browser fingerprinting is happening to you, and it’s very hard to prevent. It’s just not easy to disguise yourself as you traverse the Internet. In this case, your best defense would be to look like everyone else—blend into the crowd. Unfortunately, many of the measures you might take to increase your online security and protect your privacy also tend to make you stand out because so few of us take the time to install these tools. Finally, this is just one technique—if you combine this technique with others (even just looking at your IP address), it becomes extremely difficult to hide your tracks.

By the way, the name Panopticlick is based on an 18th century surveillance and behavioral conformance concept dubbed a Panopticon . An English philosopher by the name of Jeremy Bentham pioneered the design of an institution in the shape of a circle. The residents would be in cells on the rim, facing in, and the guards would be in a watchtower in the center, with a view into all the cells. (See Figure 7-6.) The genius of this design was that the watchees couldn’t see the watchers, and therefore they could never know for sure when they were being monitored. Even though a handful of watchmen couldn’t actually observe everyone at once, each inmate had to assume that they were being watched at any given moment. This effectively forced all inmates into constant compliance.

You’re being tracked much more often in the physical world now, too. The mall tracking analogy I used before is actually happening in real life—except it’s not a tracking dart, it’s your cell phone. Our smartphones are constantly broadcasting wireless signals, looking for things to connect to via Wi-Fi or Bluetooth. These signals include a unique ID to be used for communication, but that unique ID can also be used to recognize your phone (and therefore you). Mobile phone makers started using ever-changing, random IDs to combat this.

But you can’t change your face. Video cameras are everywhere now. While these systems were originally used for anti-theft monitoring and short-term recordings to be used in case of a robbery, they are now being connected to facial recognition systems to track where you go, how long you look at that end cap sale, how often and when you come to the store, and so on. And like web tracking, these systems’ third-party companies correlate this data across multiple stores and locations. These systems are all over the place in China and the United Kingdom. People in China can pay for food at vending machines and ride public transit simply by presenting their faces.

Several companies are now marketing systems that will use high-resolution video cameras to scan a scene to find all the license plate numbers it can see. The system records each plate number along with the time and place it was seen. These cameras are being mounted on utility poles, traffic lights, overpasses, and even police squad cars as they patrol. This information is hoovered up and shared with other agencies, creating a massive database of millions of cars. The timestamp and location information can be used to track where you go, identify your travel patterns, and even (potentially) track who you associate with. While this could obviously be useful finding who was near the scene of a crime and where those people live and work, it could just as easily be used to track an ex-wife, patrons of a gun show or a Planned Parenthood, or people attending a political protest.

I know it sounds hyperbolic, but we are truly living in an era of constant, global surveillance. Our “institution” is not just the virtual world, but increasing the real world, as well—and the watchmen are numerous. Unlike the 18th century, we have the computing power to actively monitor a large swath of the populace in real time. And with massive data storage facilities, our watchmen can record massive quantities of our activity, review it later at their leisure, and store it effectively forever.

We all have aspects to our lives that are private. Why are there doors on bathrooms? Why do people sing in the shower? Why do we have bumper stickers that say “dance like no one is watching”? Privacy is a basic human right and is fundamental to any healthy society. We act differently when we’re watched—not because we’re doing anything wrong but because we all need safe spaces to express ourselves. And as a famous Roman poet once said: Quis custodiet ipsos custodes, which roughly translates to “who watches the watchers?”.

If you’d rather read than watch a video, then check out world-renowned security expert Bruce Schneier’s essay on the value of privacy:

https://www.schneier.com/blog/archives/2006/05/the_value_of_pr.html

Most Secure Browser

Let’s just get this out of the way now: it’s almost impossible to know which browser is the most secure. This is largely because all of these browsers are constantly rolling out new security-related features, fixing security-related bugs, and generally trying to claim the title of “most secure.” That’s a good thing—they’re competing to be the best, so we all win. There are dedicated hacking contests to reveal bugs in browsers, but it’s hard to say whether the number of bugs found in these contests really reflects the security of the browser. How likely were bad guys to find these bugs? How severe were the bugs? What about the bugs they didn’t find? These hackathons also don’t address factors like how quickly the browser maker fixes their bugs and whether the browser is smart enough to self-update (because if you don’t have the latest version, you don’t have the bug fixes). It’s really hard to compare the relative security of web browsers.

However, if I had to pick a winner here, I’d probably have to choose Chrome. Google is doing some fantastic work in the realm of computer and web security. That said, I think Firefox and Safari are also very secure browsers. And you could argue that because Firefox is open source, it can actually be audited by cybersecurity experts—unlike the other three major browsers. Ideally, this third-party vetting leads to less bugs.

Most Private Browser

Unlike security, there are significant and important differences between the four major browsers when it comes to privacy. And this (to me) is the real deciding factor.

While Google has been a true leader in terms of security, it’s pretty much the worst in terms of privacy. Its whole business model revolves around advertising (Google makes about 90 percent of its money from ads¹⁰). And that leads to an enormous conflict of interest when it comes to protecting your personal data and web surfing habits. Apple has gone out of its way to basically be the anti-Google, making it a point of pride to collect as little data on their users as possible (and causing a collective freak-out by advertisers because of technology that limits tracking). But Firefox is also doing some great work in this area, and adding more privacy features all the time.

So, who’s the winner in terms of privacy? Today, I’d say it’s a toss-up between Firefox and Safari, with Chrome being dead last. Edge is somewhere in between, but with Microsoft’s recent penchant for collecting user data, I would put it closer to Chrome. Chrome has been trying to tame obnoxious ads with a built-in ad-blocking technology, but it’s important to note that it does nothing, really, to prevent tracking. And even if Google were protecting you from other companies tracking you, you should assume that anything you do in the Chrome browser is known to Google. In fact, as of June 2020, Google is being sued for continuing to track its users while in “incognito mode.”¹¹

And the Winner Is…

Based on everything I’ve found in my research, I personally choose Firefox as my go-to browser. No browser is 100 percent secure, and it’s hard for even the most erstwhile browser to completely protect your privacy. But I think Firefox, on balance, is the best of the bunch.

Beyond the Big Four

The Brave browser is a relatively new, open source browser built for privacy, with built-in ad blocking and tracking protection. However, in a move to try to acknowledge the need for ad-based revenue, it also has a mechanism to insert its own ads, which opens up a lot of issues.

The Tor Browser is all about privacy. In fact, it tries to achieve true anonymity (though that is extremely difficult to do in practice). It’s based on Firefox and builds in several kick-butt privacy tools that are too technical to sum up here. But if you really need to surf privately, you should give the Tor Browser a serious look.

Tip 7-1. Install Firefox

Choosing a good web browser is important. For me, the clear choice to maximize both security and privacy is clear: Firefox. While Google’s Chrome browser is very secure, they have a severe conflict of interest with regard to your privacy. Google potentially has access to everything you do in that browser, and that should give you the creeps. Google already knows way too much about us.

Tip 7-2. Configure the Security and Privacy Settings on Firefox

To get the best protection, you need to change some default settings. If you already have Firefox installed, then just double-check these settings.

1. 1.

   Open the Firefox menu at the upper-right corner of the browser window. Click Preferences (Mac) or Options (Windows) (Figure 7-7).

    

1. 2.

   Select the Privacy & Security tab at the left. Under “Enhanced Tracking Protection”, you can either select “Strict”, or you can create a custom set of security and privacy settings. I personally use “custom” so I can block all third-party cookies. This is slightly more strict than “Strict” (Figure 7-8).

    

1. 3.

   I would always send the “Do Not Track” signal just to register your desire to be left alone, but realize that this is mostly symbolic—most websites that want to track you will ignore this, sadly (Figure 7-9).

    

1. 4.

   Under Logins and Passwords, be sure to uncheck “Ask to save logins and passwords”—we’ll be using LastPass for this. And if there are any saved passwords under “Saved Logins…” be sure to remove them all (after you copy them to LastPass, of course). LastPass will also handle filling in mailing addresses for you, so you can uncheck the “Autofill addresses” option, as well (Figure 7-10).

    

1. 5.

   Under the History section, you can feel free to use whatever settings you’re most comfortable with here. To the best of my knowledge, Mozilla does nothing with this saved information. You probably don’t want to always use “private browsing mode”, but only as needed. This is discussed in Tip 7-10 (Figure 7-11).

    

1. 6.

   Next, find Permissions (Figure 7-12). There are several settings here, and you should look at each of them individually. By far the safest thing is to block all requests to access your location, camera, and microphone. However, that will break some websites. Firefox will ask you for permission whenever a website requests access to these items, so you can leave these settings at the default. Just know that you can permanently deny or allow any site here. Below the Permissions settings, you should check all three boxes. This may require you to restart Firefox.

    

1. 7.

   Find “Firefox Data Collection” (Figure 7-13). You can decide what you want here. For maximum privacy, you should share nothing. But for Mozilla to improve its products, it has a legitimate need for some user data. But maybe they can just get that from someone else.

    

1. 8.

   Finally, find the section “Deceptive Content and Dangerous Software Protection” under the “Security” section (Figure 7-14). I’m not sure how effective this is, but it’s worth a shot. I would check all the boxes.

    

1. 9.

   Finally, under “Certificates”, you should have it ask you every time and query OCSP servers. This is protection against bad certificates, which we discussed in the chapter (Figure 7-15).

    

1. 10.

   Finally, go back to the “General” tab at the left of the Preferences/Options page. Check the box to have Firefox automatically install updates (Figure 7-16).

    

Tip 7-3. Remove All Unnecessary Add-ons

Web browsers have become very flexible, allowing you to add all sorts of fun and useful features via plugins, add-ons, and extensions. Unfortunately, these extras, many of which are free or get installed with other software, can open security holes and seriously invade your privacy. Avoid them unless you really need them. (In the next tip, I’ll give you some add-ons that will significantly enhance your security and privacy.) If you have any trouble removing an add-on, try searching for remove <add-on name> in your web browser. Some of these add-ons are tenacious and hard to remove (and these are the ones you most assuredly need to remove).

Note that disabling an add-on may still allow it to have access to your data. But if you’re uneasy about outright deleting it, you can start by disabling it to see how Firefox works without it. If you have no problems, you can go back and delete it. (Of course, you can always just reinstall it, too, if you change your mind later.)

1. 1.

   To remove an unwanted add-on in Firefox, first open the Add-ons menu from the general Firefox menu (Figure 7-17).

    

1. 2.

   Select the Extensions tab at the left. Find the add-on that you want to remove and click the Remove button, under the little menu at the right. (If you’re not sure, just click the Disable button for now and remove it later when you’re sure.) Figure 7-18 shows an example.

    

Tip 7-4. Change the Default Search Option to DuckDuckGo

To set DuckDuckGo as your default web browser search engine, the easiest way is to just install the DuckDuckGo Privacy Essentials plugin. Not only will this make DuckDuckGo your default search engine, it will also add some great privacy-protecting features to your browser. See the next tip for help with installing this and other great plugins.

Tip 7-5. Install Security and Privacy Add-ons

Some add-ons actually enhance your security and privacy by preventing websites from loading annoying ads and installing tracking cookies. (In fact, these plugins can significantly increase page-loading speed by avoiding lots of stuff you don’t need.) I recommend installing all of the following extensions. They each perform a slightly different function, though there is some overlap. I will walk you through installing one extension. The rest will follow the same procedure.

Tip 7-6. Always Go to the Source for Downloads

It may surprise you that legitimate software download sites often install things you don’t want and didn’t ask for. Sites like Download.com, BrotherSoft, Softonic, Tucows, and SourceForge will often install trial offers, adware and other junk, along with the software you actually wanted. This is how these sites make money.

But it’s actually worse than that. There have been several cases where these bundle installers have been hacked to install nasty malware, too. It’s just not safe to use these sites anymore.

Always, always go to the source for software downloads. Find out who makes the software and go directly to their website. Or, better yet, get the app from the Apple App Store or the Microsoft Store. These apps have gone through at least some security and privacy vetting. The vetting isn’t perfect, but it’s better than no vetting.

Tip 7-7. Be Careful on “Shady” Sites

Some websites are just way worse than others when it comes to malware, and those sites tend to be associated with what some would call vices…porn, gambling, copyrighted movie and music downloading, and so on. I’m not here to judge. Just know that these sorts of sites tend to be worse than others, and the ones that are “free” are ones I’d worry about the most.

Tip 7-8. Beware of Pop-Ups Offering/Requiring Plugins

Some websites will ask/offer to install some malware checker or speed booster or video player. If you get a pop-up window that wants to install something, just close the window and walk away. If the plugin is something common like Flash, Java, Silverlight, or QuickTime, you should go directly to those websites to download and install the plugin. Then return to the original website and see if it works. The rule is: if you didn’t go looking for something or request it yourself, don’t install it.

Some of these website pop-ups will actually tell you that you’re already infected with malware or that your computer is having problems. They may sound dire and urgent, but don’t be fooled. They’re just playing on your fears. They’re almost surely scams or malware.

Tip 7-9. Opt Out Where You Can

Tip 7-10. Use Private Browsing

Firefox has a special “private browsing” mode that is supposed to remove all local traces of your surfing once you close the special window. This includes your browsing history, cookies, and anything else the browser might remember about your session. The key word here is local. While it may successfully block some history from being stored permanently, it doesn’t make you anonymous or stealthy on the Web. Its sole purpose is to hide what you’ve been doing from people who have access to your computer (your kids, your spouse, etc.). To enable this mode, follow the next steps:

1. 1.

   Open the Firefox menu and select New Private Window (Figure 7-19).

    

Tip 7-11. Change Your DNS Provider on Your Wi-Fi Router

Remember that DNS is the Internet’s “phone book”: it will convert a name (like amazon.com) to a number (an IP address). Today, most DNS lookups are not encrypted, meaning that your DNS provider—and any computers along the way—can see every website you go to. For this reason, it’s important that you choose a privacy-respecting DNS provider that supports encrypted DNS requests. By making this setting on your home Wi-Fi router, this means that all devices in your home will use this DNS service.

Unfortunately, changing any router setting can be tricky because every router’s admin page is a little different. I can’t give you a simple step by step for every possible router. In the previous chapter, I told you how to find your router’s admin IP address—use that same address to make these changes. You’ll need to look for the configuration for your Domain Name Service (DNS) server. It should be prepopulated with a couple addresses—a primary and a backup. The first entry is the one it will try most times, but if that one fails, it will try the second one. The default addresses almost surely belong to the DNS provider used by your Internet service provider (ISP).

Once you find these settings, remove the existing entries and add one of the two pairs. The options listed here are privacy-oriented (and will avoid using your ISP’s DNS, which is almost guaranteed to log every site you go to). Note, however, that unless you’re using a VPN, your ISP will still be able to see every IP address your computer communicates with and can use that to figure out where you’re going if it bothers to do a reverse lookup.

While not used much yet, you might want to go ahead and set the IP version 6 (IPv6) versions of these servers, as well:

If you would like a different option, try Quad9: www.quad9.net.

Tip 7-12. Change Your DNS Provider on Your Laptop

If you have a laptop, you should also set your DNS settings there because when you’re out and about, you’re no longer using your home’s Wi-Fi router.

Tip 7-12a. Windows 10

The DNS settings on Windows are rather arcane, unfortunately. But follow along and you’ll be fine!

1. 1.

   Open Settings. Click Network & Internet (Figure 7-20).

    

1. 2.

   Find “Network and Sharing Center” and click it. You will then see your active networks. On a laptop, there will probably be just one (Wi-Fi), but you can (and should) change these settings for all the active networks. Just repeat this process for each listed connection (Figure 7-21).

    

1. 3.

   Click the blue link next to “Connections” to bring up the connection status. Click the “Properties” button at the lower left (Figure 7-22). Enter your admin password, if asked.

    

1. 4.

   In the Properties window, select “Internet Protocol Version 4” and click the “Properties" button under the list (Figure 7-23).

    

1. 5.

   Change the DNS server addresses to the ones you want (see the previous tip for info). You’ll need a primary and an alternate pair. In Figure 7-24 I’ve shown the Cloudflare addresses as an example. Click “OK” to save the settings.

    

1. 6.

   If you’d like to set the IPv6 DNS settings, select the “Internet Protocol Version 6” entry and click “Properties”. You can then set the IPv6 servers, using the information in the previous tip. The following example shows the Cloudflare settings. Click “OK” to save the settings (Figure 7-25).

    

Tip 7-12b. Mac OS

1. 1.

   Open System Preferences from the Apple menu. Find Network and click it.

    
2. 2.

   If necessary, click the lock icon at the lower left and enter the admin username and password to unlock.

    
3. 3.

   You may see more than one connection here. You should probably change them all, but the primary one for laptops will be the Wi-Fi adapter. Repeat the following process for every one you want to change. Start by selecting the connection you want to change. Click the Advanced button at the lower right (Figure 7-26).

    

1. 4.

   Click the DNS tab. Change the existing DNS server by clicking the little minus button at the lower left. (Note that if these entries were set automatically by your network, you can’t directly remove them—they’ll disappear when you add the new ones using the plus button.) Add two more entries: the primary and backup DNS servers you want to use (see the previous tip for choices). You can add both the IPv4 and IPv6 addresses here. The following example shows the Cloudflare values (Figure 7-27).

    

1. 5.

   Click “OK” here and then “Apply” on the previous window.

    

Tip 7-13. Use DNS Over HTTPS (DoH)

To truly make your DNS queries private, you need to encrypt them. There are a couple ways to do this, but the easiest and most popular one is to just send the DNS queries over HTTPS—the secure protocol we already use for our web surfing.

As it happens, Firefox is already building in this capability in the browser itself. You can verify these settings by opening the Options/Preferences window and searching on “DNS” (Figure 7-28).

At the bottom of the Settings window, just make sure that “Enable DNS over HTTPS” is selected (Figure 7-29). I would again recommend using Cloudflare (the default).

Mac OS and Windows are building support for DNS over HTTPS into the operating system itself, as well. You can look for these settings under the usual network preferences, when they become available. However, if your home Wi-Fi router supports DNS over HTTPS, enabling it there will cover all the devices in your home.