Your browser has ad tech's fingerprints all over it, but there's a clean-up squad in town

There are few tech deceptions more successful than Chrome's Incognito Mode. Alongside its fellow travellers in other browsers offering Private Browsing and the like, the name and the impression is given that this is some sort of cloaking mode that shields us from the myriad privacy mosquitoes on the web, drinking the blood of …

[Anonymous Coward]

"not something your grandma would glom onto"

Not sure she would have needed to obscure her web browsing.

She wouldn't have taken to "onto" but the "glom" might have appealed to her gaelic heritage.

Somehow I can't imagine her ever needing to clicking the "I'm over 18 " button on an adult crochet^† site.

_{† unless it was perhaps called the happy hookers.}

[JessicaRabbit]

Re: "not something your grandma would glom onto"

Seems the focus is on evading surveillance capitalism rather than hiding your visits to naughty websites.

[Anonymous Coward]

Re: "not something your grandma would glom onto"

I just like to hide a bit because I find it objectionable being tracked and who knows what it might be used for in future. I'm ok with ads, it's fair for free sites but not being tracked. It also pains me the complexity of logging in on some sites now, it's becoming time consuming needing MFA or receiving emails / sms just to view something innocuous - I wish they'd separate security levels. On my banking site sure, I get that. It seems to be tied to the inability to fingerprint me and/or changing systems. I guess my fingerprint changing spooks them and they want to verify they're tracking the same person!

[hoola]

Re: "not something your grandma would glom onto"

It is also the lifespan of many of the tracking cookies, years. It is just insane.

The bit that really annoys me is all the (il)legitimate interest shite. Hundreds if not thousands of partners all collecting data link and sharing stuff. All on by default.

Now the new one I am starting to see where you go to a site and reject all the cookies only to be present with a screen saying "Sign Up to continue or all ow all cookies to have free access".

Now how the *** believes that signing up (and paying) is going to stop all those tracking cookies and adverts???????

[Ken Hagan]

Re: "not something your grandma would glom onto"

Surely you just allow the cookies, secure in the knowledge that your browser drops them on the floor as soon as you close the page.

[Mr Dogshit]

Re: "not something your grandma would glom onto"

My grandma can't even turn a computer on.

To be fair, she died thirty years ago.

[Ball boy]

Re: "not something your grandma would glom onto"

The Happy Hookers?

You, Sir, absolutely win the Internet today :-)

[Anonymous Coward]

Re: "not something your grandma would glom onto"

I had to look glom up to see if Granny was indeed a Ho ;-)

Feels like a GenZ word.

[zimzam]

"its non-Tor, even more obscure sibling, the Myllvad browser"

It'll stay obscure if you keep calling it that.

[that one in the corner]

Re: "its non-Tor, even more obscure sibling, the Myllvad browser"

Mullvad, Myllvad - close enough for government work*

* Wot, us track you?

[alain williams]

Kasm web site needs javascript

Javascript is one of the first things that I disabled as it is a great way of fingerprinting me. I would feel much happier with Kasm if I could look at their web site without having to enable javascript.

[Anonymous Coward]

Re: Kasm web site needs javascript

If you want a bit more protection from rampaging javascript, maybe give this a watch (but watch to the end to see other options): https://www.youtube.com/watch?v=YnVKAntXwUc

[Ellipsis]

Re: Kasm web site needs javascript

My favourite example of this is that GCHQ‘s site requires JavaScript…

[Anonymous Coward]

Re: Kasm web site needs javascript

Well, they definitely want to track you!

[Anonymous Coward]

Re: Kasm web site needs javascript

I can't believe we're still hearing this after 30 years. If you only ever visit websites that do nothing more than display static non-interactive pages, then great, turn off JavaScript. If you then notice that all your sites are crap and you can't do anything remotely interactive then you probably shouldn't whine about it.

[Anonymous Coward]

Re: Kasm web site needs javascript

A great many websites are indeed abusing JS for no good reason. They would work perfectly well if rewritten to not load:

-> CSS

-> Images

-> Successive paragraphs of text

.. and a giant container ship of other things that really truly have no business being loaded by JS, because all that does is:

a) enable tracking and

b) increase the overall processing cost both on the client *and the server* to deliver the same content.

Instead you have a 30mb pile of minified (~~ obfuscated) Javascript to "run an app" to load... maybe 30kb of text and another 300kb or so of images to show... a page or two for "Dave's Hometown Bakery", which maybe changes content once a month.

[Anonymous Coward]

Tor

The point with Tor and other really effective privacy and ad-blocking applications is that quite a number of big web sites block access to anyone using them.

For instance, in my experiences, Google's web sites often block Tor traffick. Cloudflare often hampers access for websites they handle, even when just using Firefox.

So, in addition to protecting your privacy per web site, you need to look for replacement web resources, or switch browser for certain tasks, eg, banking.

I find that using Firefox with privacy enhancing ad-blocking extension together with Tor generally a good compromise. I had not much luck with ad-blocking VPNs or DNSSEC, but that might be my clumsiness.

[Long John Silver]

Re: Tor

Seemingly, almost every measure taken to protect privacy can invoke one of those damnable captchas.

Also, the future looks bleak. Various governments, making demands for age verification, may be laying the ground for more general use of identification by all before accessing the Internet. This may have workarounds, but privacy-seeking netizens may have a worse overall experience than now.

[Anonymous Coward]

Re: Tor

About Tor, I have a question, or a doubt.

I fully believe in the Tor software, but the exit points are paid by "interested third parties". When I was looking at Tor many moons ago (access to the BBC for Cbeebies for my son) there were several large persistent exit points in the UK that worked rather well. If they're not run by GCHQ I want to know why! Surely all the spy agencies host large Tor routers to have the privilege of sifting through the traffic?

[Anonymous Coward]

Re: Tor exit point

"but the exit points are paid by "interested third parties"."

Tor exit points can see the target site, but not the origin. Just like the entry points can see the origin of the http request, but not the target url.

What exit points can do is spy on the data exchange with the target url. That's why using only httpS connections is so important. Without encrypted data, the exit points could see how you log in to a service, what is watched or read and could deduce your identity. With https, that is not possible.

Basically, Tor has been set up so even the individual nodes in the network cannot see who is going where on the internet and what they are doing.

Although, Tor is not perfect privacy, there is currently no better system available that is secure and useable. More secure systems quickly become unworkable or require special, and very expensive, hardware.

[doublelayer]

Re: Tor

Yes, they probably do. They will be able to see the traffic going through, but they don't know where it is going. If that traffic is encrypted, then they'll have much less to go on, though of course there is still some information about what server you're talking to and how much which can be used to spy on you. There is basically no way of avoiding that because the traffic has to arrive at the server from somewhere which can look at it, that is unless the site itself implements better encryption, for example the BBC news Tor site*. I'm guessing that doesn't have what you wanted though because they don't feel the need to help encrypt traffic to their more UK-focused sites. You can also choose specific exit nodes to forbid and try to find a subset you trust more, though how you do that is up to you.

* I tried to post a link to it, but either El Reg doesn't want to post Tor links or I somehow broke something, because it started reporting any attempt at HTML as invalid. I can still post the domain though:

https://www.bbcnewsd73hkzno2ini43t4gblxvycyac5aw4gnv7t2rccijh7745uqd.onion

[Anonymous Coward]

Re: Tor

You should try using more secure phones. You get messages about the phone being rooted and not safe. So when I have to call and the helpdesk tells me I can do it online, I enjoy saying I can't because your site doesn't like secure phones that stop you tracking my location.

[garble]

My gran would have an idea what to do with the Mullvad browser rather than this product. I appreciate the article was about technologies like this product but even so.

[Anonymous Coward]

You! Yes, you behind the bikesheds.

Stand still, laddie!

[Anonymous Coward]

Re: You! Yes, you behind the bikesheds.

Yes, it's way easier if you stand up, and stand still ... (great YT there, hiding behind the "favourite" link)

[Roj Blake]

Re: You! Yes, you behind the bikesheds.

If you don't eat your meat, you can't have any pudding.

How can you have any pudding if you don't eat your meat?

[Long John Silver]

An excellent and helpful article

I prefer options which reside wholly on my devices.

Careful use of the configurable Bleachbit can tidy up after the event.

[scot stockwell]

Here is the real dilemma

Check it: https://www.amiunique.org

The more effort you put into being Anonymous online, the more unique your fingerprint becomes.

[Ellipsis]

Re: Here is the real dilemma

I liken this to walking around town wearing camouflage. By trying not to be seen, you stand out. What’s really needed is to appear indistinguishable from everybody else…

[m4r35n357]

Shoo-in?

Any realtion to the archaic "shoon", for shoes?

See e.g. https://gutenberg.org/cache/epub/8778/pg8778.txt (The Water of the Wondrous Isles by William Morris)

[rafff]

Re: Shoo-in?

"Any realtion to the archaic "shoon", for shoes?"

I believe the origin is in horse racing where the race has been fixed. Damon Runyan uses the expression that way .

[m4r35n357]

Re: Shoo-in?

Cheers - I have only ever seen is spelled as "shoe-in"!

[Rusted Girder]

Re: Shoo-in?

It's literally "Shoo in."

https://www.etymonline.com/search?q=Shoo-in

"shoo-in(n.)

"easy winner" (especially in politics), 1939, from earlier sense of "horse that wins a race by pre-arrangement" (1937), from the verbal phrase shoo in "allow to win easily" (1908); see shoo (v.) + in (adv.)."

[Helcat]

So the alternative to being anonymous is to flood the trackers with random searches and page calls. Open a dozen or so tabs, search for random stuff, keep safe search on (just in case) and mess up their analytics and algorithms.

Flip side: Put up with the adverts for stuff I honestly don't need, want or care about. Which is to say almost any advert I'd see regardless of it I want to be incognito or not (and with adblockers running, too, I should add).

Meh: If you can't beat them, drown them in meaningless data.

[TFL]

Ad Nauseum, perhaps?

There's a Firefox extension that pretty much does this for you. I don't think it ran with ad-blockers though, so you would have to pick your poison.

https://addons.mozilla.org/en-CA/firefox/addon/adnauseam/

[JulieM]

There's no reason for any of your deliberate page accesses and random searches to be visible, though! They can all take place safely behind the scenes, with falsified browser signatures and altered cookies; the better to mess with advert-slingers, and poison the data they are trying to acquire.

[Anonymous Coward]

Firefox Privacy Mode

I always find Firefox "privacy mode" odd. Why does it still remember a Microsoft Login to office.com between sessions?

[HXO]

Re: Firefox Privacy Mode

> Firefox "privacy mode"

Not sure if it is the same as "Enhanced Tracking Protection", but ETP blocks third party cookies and fingerprinters.

First party cookies are allowed, and FF password manager relies only on the domain.

A neat side effect of ETP is, that almost all ad networks refuse to show ads...

[doublelayer]

Re: Firefox Privacy Mode

Do you mean private browsing mode? Because if you do, it shouldn't keep a session cookie, and mine doesn't. I can log into office.com in a private browsing window, close the session, and next time, I have to log in again.

If you mean tracker blocking, that isn't intended to delete all cookies. Ones to remember logins are intentionally kept because they think you might want them, but you can change the settings to disable that.

Perhaps we're talking about different things?

[Throatwarbler Mangrove]

Mullvad

Mullvad has been running a huge advertising blitz where I live for their VPN and browser. Anyone have any experience with them?

[DS999]

Fingerprinting only works

Because Google has been able to poison the well by corrupting the HTML standards to permit passing information like "list of extensions loaded", "amount of system RAM" and other stuff that websites have ZERO business knowing.

If all that unnecessary crap (and other stuff they are trying to bully Apple into supporting like USB device access via the browser) was cut out the window for fingerprinting would be a lot smaller.

That's what happens when a company that makes over 100% of its profit from advertising has a near monopoly on client browsers - Apple's ban on third party browser engines on iOS is the only roadblock that remains to get that monopoly. They want to get rid of cookies, not because they want to improve our privacy though. Its a double con. They fool some people into thinking they are doing a good thing, but they're simultaneously making it harder for some of their competition to advertise as effectively - which allows them to jack up their rates!

[Anonymous Coward]

Not so fast.

user@system ~ % dig +short mx kasmweb.com

0 kasmweb-com.mail.protection.outlook.com.

No thanks, I'm out.

[doublelayer]

Re: Not so fast.

If that's a dealbreaker for you, I won't try to convince you otherwise. I don't see people using Office365 email as indicative of fundamental problems with the software they write.

[Anonymous Coward]

Re: Not so fast.

If you want to offer security, you have to address that holistically and not take any shortcuts. As soon as you start taking shortcuts, you have a weakness. And a corporate culture issue, which is probably worse.

It's a basic principle - if you want to build a tower, make sure you have solid foundation or you only end up as a tourist attraction which needs lots of support to remain standing..

[brp]

I am surprised that nobody has mentioned the browser Duck Duck Go, that has a number of benefits, What am I missing?

[oneeye]

I gave up trying for ultra privacy online. It's Enough to block ads and trackers. Obscure location. Toss in VPN use here and there. And create enough white noise, to confuse them more than a bit. Not to mention, using several different browsers, for certain dedicated purposes. Mainly, I use Firefox with several extensions, Brave, and Tor on occasion. Chrome very rarely. And one or two others.

[Roj Blake]

/e/OS

My /e/OS phone tells me that Firefox has 167 trackers in the app, but that they're all blocked.

So that's something, I suppose.

[hoola]

Cross-App & Cross Device Linking

Not strictly relevant to web browsers and Chrome in particular but a similar concept.

On Sunday I received a WhatsApp message (yes I know, I detest it but until others move I am lumbered) from the mother of someone I teach. In they give me the sad news that the Father had unexpectedly died. A short while later I had a LinkedIn update (I try not to use this as well be we are obliged to by the business) with someone posting about how a family member or the son of a co-worker had died. There was no actual link between the people I knew and the person who had posted.

Coincidence?

I really struggle to believe that and it takes me full circle, there is simply so much linking and access to everything by software like Web Browsers on computers and most mainstream Apps on mobile devices it really feels like we are pissing into the wind on this.

The expectation is that all these companies just grab everything. The WhatsApp end-to-end encryption (and any other similar) winds me up. At the point the content is being read it is not encrypted. Anything on that device could be capable (mostly likely is) of scraping that content.

[I could be a dog really]

Re: Cross-App & Cross Device Linking

I received a WhatsApp message (yes I know, I detest it but until others move I am lumbered) from the mother of someone I teach

You should be worried, very worried.

IMO, you are breaking the law. You cannot have WhatsApp installed on your phone without giving it access to all your contacts - and it will then slurp the lot up and send it "somewhere". I will guarantee that you don't have explicit permission from everyone in your contacts to upload their personal data to "somewhere". As a teacher, you are involved with a business activity - and are therefore covered by GDPR.

GDPR is very clear, you cannot do that.

You aren't relying on consent, because I will guarantee you do not have free and informed consent. So you must be relying on another ground for collection and processing, so lets look at the main ones :

Contract. WhatsApp isn't the only means of messaging - so it's use is not required to fulfil a contract.

Law. There's nothing the law requires you to do that can't be done another way.

To provide a service: Again, there are non-slurping options available so you can't rely on that.

So you, and your employer, are processing personal information (and probably at times, sensitive personal information) in ways which GDPR explicitly forbids. And that is illegal.

Unfortunately, or fortunately for the schools concerned, I don't have much of a say with the grandkids' schools. If I did, I'd be laying into them big time. And if that means prosecutions, well it seems that's the only way to bring some organisations into compliance with the law.

[Ken Hagan]

Re: Cross-App & Cross Device Linking

If your analysis us correct then WhatsApp are equally guilty of accepting such data and they are a much more tempting target for anyone who wants to play with lawyers.

I'm sure El Reg will cover the story when it happens. Until then, I won't hold my breath.

[doublelayer]

Re: Cross-App & Cross Device Linking

In practice, even if your legal interpretation was correct, and you'll have to make some changes if you take it to court, nothing will happen. If something was going to happen, it would happen to Meta first. It hasn't, and there has been years in which it could have. Either that means this isn't actually illegal under GDPR or it means regulators don't care to enforce it, but either way, there's little reason for individual users to fear.

WhatsApp claims not to be collecting everything in plaintext for Facebook's advertising. You may not believe them. I don't know whether I would either, which is one reason I don't use WhatsApp. However, unless you can disprove it, that can be used as a defense as they suggest that they aren't processing the data, which is what your GDPR argument is based around. If you have an eye to creating another NOYB, you'll want to check these things to ensure your cases are valid. NOYB has the record it does of consistently winning these cases because they're very knowledgeable about the law and what companies are doing rather than assuming what happens and the ways it is justified.

[doublelayer]

Re: Cross-App & Cross Device Linking

I don't have any problem believing that's a coincidence. The evidence of linking is that two posts about someone dying appeared on the same day. One of them you had to receive because it was directly relevant to you. That means we're building this entire thing on LinkedIn choosing to send you a thing involving death on that day. A lot of people die every day, and from the sound of it, the person who died in the second case was Linkedin-close to you, meaning you never knew them and wouldn't have any reason to but LinkedIn doesn't care.

In my experience, LinkedIn will spam you as frequently as you let it and it assumes that anyone who is connected to someone you're connected to is a valid source for those messages. Since this was a third-order person who died, that means anyone within a three-generation community of interest dying is enough to do that. It seems quite easy to have that happen by random chance.

[Blackjack]

Unfortunately not everyone has the skills and the right Linux distro to compile Otter Browser from source, but if you can it is great.