DOCSLIB.ORG

Privacy Badger Take a Bite out of Tracking

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Privacy Badger Take a Bite out of Tracking <location, date> Privacy Badger Take a Bite Out of Tracking Cooper Quintin [email protected] @cooperq <location, date> Electronic Frontier Foundation ● Non-Profit defending civil liberties in the digital world ● Impact litigation, activism, technology ● Projects like HTTPS Everywhere, Let's Encrypt, Panopticlick and Privacy Badger ● I am a staff technologist at EFF – This means I'm a programmer; I can't answer your legal questions <location, date> What We Are Going to Talk About ● Browser Tracking — It's a Bigger Problem Than You May Think ● Why Online Privacy Matters ● Who Is Tracking Us ● How Are They Doing It ● What Can We Do To Stop It <location, date> Your Browsing Is Being Tracked ● Most Websites Include Third-Party Trackers – These are resources which come from a domain other than the one you intended to visit ● This is big business — A Multi-Billion Dollar Industry <location, date> Who is tracking you online? <location, date> Who is Tracking You Online ● First Parties Like Amazon, Facebook, Google – Tracking and privacy are a bit hard to define here ● Malware and Spyware – You may have installed it on purpose – Stopping this is mostly about user education and security ● Third Parties… <location, date> Some Key Players in the Industry <location, date> Third Party Trackers ● Non-consensual ● Ubiquitous ● Hard to avoid ● Strong financial incentive <location, date> Third Party Tracking is Also Useful For Spies ● “NSA uses Google cookies to pinpoint targets for hacking” - Washington Post ● “How the NSA Piggy-Backs on Third-Party Trackers” - Slate.com ● “SECRET ‘BADASS’ INTELLIGENCE PROGRAM SPIED ON SMARTPHONES” - The Intercept <location, date> But, Privacy Is Dead! <location, date> <location, date> <location, date> <location, date> Why Should You Care About Privacy? ● You May Want to Read Things That Are Controversial or Embarassing For Research or Just General Interest ● Data Which May Be Embarassing When Put Together – A search for health insurance quotes and then looking up a disease on Web MD for example ● Chilling Effects <location, date> Privacy lets us make mistakes, play with ideas, and grow as individuals—it gives us the space to discover who we are. <location, date> How Does Online Tracking Work? <location, date> IP Address <location, date> Cookies <location, date> Super Cookies <location, date> Fingerprinting <location, date> How Can Online Tracking be Stopped? <location, date> Adblockers ● Usually only block ads, not necesarilly trackers by default ● Arms race problem <location, date> Incognito Browsing ● Vulnerable to fingerprinting – And some super cookies ● Tor Browser – Unfortunately not usable as main browser for many people <location, date> Policy Work — Do Not Track ● W3C standard ● Opt in to DNT – advertisers will not track you – Really they only don't tell you they are tracking you ● Classic example of design by committee ● Low level of adoption ● Considered a failure <location, date> A Combination of Tech and Policy <location, date> Privacy Badger ● Browser Plugin ● Open Source ● Focuses on completely blocking trackers ● Tries to solve the arms race problem – Uses an algorithm instead of a blacklist – Can cause false positives and false negatives <location, date> How Does Privacy Badger Work? ● Send a DNT=1 header ● Watch for requests to third party domains ● If a third party domain sets a high entropy cookie, add it to a list of potential trackers ● If the tracker is seen on multiple sites – block it ● Of course, there are false positives <location, date> How Does Privacy Badger Work? ● Entropy in Information Theory – The information contained in a message, usually in units such as bits. – A 2 bit message would have 2 bits of entropy or 1 in 4 ● Low entropy cookie: – lang=es; /*About 8 bits of entropy or 1 in 255 */ ● High entropy cookie: – utmz=32c3e3f09a23 /* About 48 bits of entropy */ – Approximately 1 in 281.5 trillion <location, date> How Does Privacy Badger Work? ● Occasionally a tracker can't be blocked without creating significant problems for the user – Youtube, Google Maps, AWS, Paypal, etc. ● For these we block cookies – HTTP and Javascript – Supercookies in the future <location, date> How Does Privacy Badger Work? ● Users can see and adjust what is blocked, greylisted and allowed ● Can disable privacy badger entirely for certain sites if they wish. ● Can opt back in to third parties for certain uses (e.g. Disqus, Youtube comments) <location, date> But what about third party sites that legitimately do not wish to track users? <location, date> The Policy Side — A New DNT ● EFF is working on a new do not track policy ● States that users sending DNT will not be tracked ● Blocking sites that don't respect DNT creates an incentive to respect DNT <location, date> The Policy Side — A New DNT ● User identifiers will be discarded ● Logs will not be kept longer than necessary ● Data can be kept for debugging or security ● Data can be anonymized and aggregated for analytics ● Sites adopting it get automatically whitelisted by Privacy Badger <location, date> The Policy Side — A New DNT ● Right now we have a discussion draft and preliminary policy – https://www.eff.org/dnt-policy ● We Are In Talks With Some Major Internet Companies to Adopt It ● Other Tracker Blocking Software Companies May Adopt it as Well <location, date> What Still Needs to Happen ● Better tracker detection algorithms ● Detect supercookies and fingerprinting ● Localization / UI ● More DNT adoption from third parties <location, date> How You Can Help ● Use Privacy Badger ● Submit a bug report / pull request – https://github.com/EFForg ● Respect users who send DNT header ● Help draft / adopt our DNT policy ● Donate to EFF! <location, date> We Still Need Better Tools ● Browser Improvements – Double Keyed Cookies – Harden browsers against fingerprinting – Better controls for blocking and clearing supercookies <location, date> We also need new business modles for the web ● Memberships ● Donations ● Crowd Funding ● Micropayments ● Non-Intrusive Advertising <location, date> Is advertising the best way to fund the web? It's hard to say. <location, date> But if we are going to live with advertising, it must stop violating users' privacy without their consent. <location, date> Thanks! Questions? [email protected] Twitter: @cooperq https://eff.org/privacybadger PGP: 75FB 9347 FA4B 22A0 5068 080B D0EA 7B6F F0AF E2CA.
Load more

Recommended publications
  • A Usability Evaluation of Privacy Add-Ons for Web Browsers
    A Usability Evaluation of Privacy Add-ons for Web Browsers Matthew Corner1, Huseyin Dogan1, Alexios Mylonas1 and Francis Djabri2 1 Bournemouth University, Bournemouth, United Kingdom {i7241812,hdogan,amylonas}@bournemouth.ac.uk 2 Mozilla Corporation, San Francisco, United States of America [email protected] Abstract. The web has improved our life and has provided us with more oppor- tunities to access information and do business. Nonetheless, due to the preva- lence of trackers on websites, web users might be subject to profiling while ac- cessing the web, which impairs their online privacy. Privacy browser add-ons, such as DuckDuckGo Privacy Essentials, Ghostery and Privacy Badger, extend the privacy protection that the browsers offer by default, by identifying and blocking trackers. However, the work that focuses on the usability of the priva- cy add-ons, as well as the users’ awareness, feelings, and thoughts towards them, is rather limited. In this work, we conducted usability evaluations by uti- lising System Usability Scale and Think-Aloud Protocol on three popular priva- cy add-ons, i.e., DuckDuckGo Privacy Essentials, Ghostery and Privacy Badg- er. Our work also provides insights into the users’ awareness of online privacy and attitudes towards the abovementioned privacy add-ons; in particular trust, concern, and control. Our results suggest that the participants feel safer and trusting of their respective add-on. It also uncovers areas for add-on improve- ment, such as a more visible toolbar logo that offers visual feedback, easy ac- cess to thorough help resources, and detailed information on the trackers that have been found. Keywords: Usability, Privacy, Browser Add-ons.
    [Show full text]
  • Downloading Additional Components of the Webpage
    Towards Seamless Tracking-Free Web: Improved Detection of Trackers via One-class Learning Muhammad Ikramy1, Hassan Jameel Asghary, Balachander Krishnamurthy Mohamed Ali Kaafary, Anirban Mahantiy AT&T Labs–Research, USA 1 School of EET UNSW, Australia y NICTA, Australia Abstract—Numerous tools have been developed to aggressively and tailor advertisements on websites to the browsing history block the execution of popular JavaScript programs in Web and web activities of users [1], [2], [3]. The class of tools browsers. Such blocking also affects functionality of webpages (including web browser plugins), developed in an attempt to and impairs user experience. As a consequence, many privacy preserve user privacy (e.g., NoScript [4], Ghostery [5], and preserving tools that have been developed to limit online tracking, Adblock Plus [6]), aims to block JavaScript programs and other often executed via JavaScript programs, may suffer from poor components of a webpage that may compromise user privacy performance and limited uptake. A mechanism that can isolate JavaScript programs necessary for proper functioning of the and enable tracking. However, aggressive blocking can hinder website from tracking JavaScript programs would thus be useful. proper functioning of the website and impact user’s browsing Through the use of a manually labelled dataset composed of 2,612 experience [7], [8] (See AppendixE for an example of how JavaScript programs, we show how current privacy preserving a tool blocks content necessary for proper website function.). tools are ineffective in finding the right balance between blocking A mechanism that can properly isolate JavaScript programs tracking JavaScript programs and allowing functional JavaScript necessary for “legitimate” web functioning of the website from code.
    [Show full text]
  • Privacy Badger One-Pager-1
    EFF DEVELOPS SOFTWARE TO ENHANCE PRIVACY AND SECURE COMMUNICATIONS ONLINE Stop Creepy Online Tracking with Privacy Badger • Some companies quietly track you as you browse the web, recording what webpages you visit, for how long, and more—even if you’ve opted out by using Do Not Track! • Privacy Badger is a browser add-on that automatically stops these “third-party” trackers. To the trackers, it's like you suddenly disappeared from the web. • Privacy Badger is different from other add-ons like Disconnect, Ad-Block Plus, and Ghostery because Privacy Badger focuses on blocking tracking, not blocking ads (though some ad-blocking may occur if the tracker is actually an advertiser.) How Does Privacy Badger Work? • As you browse the web, Privacy Badger observes which third-party sources ask to load possible tracking content in your browser. • If the same source shows up repeatedly across multiple different websites asking your browser to set unique tracking cookies, Privacy Badger flags that source and tells your browser not to load any more content from it. • When your browser stops loading content from a source, that source can no longer track you. Voila—you’re now free from creepy tracking. Get Privacy Badger Today! • Visit https://www.eff.org/privacybadger to download Privacy Badger for Chrome or Firefox, or to learn more. • Also check out our other awesome add-on, HTTPS Everywhere. https://www.eff.org/https-everywhere Support EFF’s creation of even more tools to enhance privacy and security online by becoming a member today! https://www.eff.org/join .
    [Show full text]
  • A Deep Dive Into the Technology of Corporate Surveillance
    Behind the One-Way Mirror: A Deep Dive Into the Technology of Corporate Surveillance Author: Bennett Cyphers and Gennie Gebhart ​ A publication of the Electronic Frontier Foundation, 2019. “Behind the One-Way Mirror: A Deep Dive Into the Technology of Corporate Surveillance” is released under a Creative Commons Attribution 4.0 International License (CC BY 4.0). View this report online: https://www.eff.org/wp/behind-the-one-way-mirror ELECTRONIC FRONTIER FOUNDATION 1 Behind the One-Way Mirror: A Deep Dive Into the Technology of Corporate Surveillance Behind the One-Way Mirror A Deep Dive Into the Technology of Corporate Surveillance BENNETT CYPHERS AND GENNIE GEBHART December 2, 2019 ELECTRONIC FRONTIER FOUNDATION 2 Behind the One-Way Mirror: A Deep Dive Into the Technology of Corporate Surveillance Introduction 4 First-party vs. third-party tracking 4 What do they know? 5 Part 1: Whose Data is it Anyway: How Do Trackers Tie Data to People? 6 Identifiers on the Web 8 Identifiers on mobile devices 17 Real-world identifiers 20 Linking identifiers over time 22 Part 2: From bits to Big Data: What do tracking networks look like? 22 Tracking in software: Websites and Apps 23 Passive, real-world tracking 27 Tracking and corporate power 31 Part 3: Data sharing: Targeting, brokers, and real-time bidding 33 Real-time bidding 34 Group targeting and look-alike audiences 39 Data brokers 39 Data consumers 41 Part 4: Fighting back 43 On the web 43 On mobile phones 45 IRL 46 In the legislature 46 ELECTRONIC FRONTIER FOUNDATION 3 Behind the One-Way Mirror: A Deep Dive Into the Technology of Corporate Surveillance Introduction Trackers are hiding in nearly every corner of today’s Internet, which is to say nearly every corner of modern life.
    [Show full text]
  • People's Tech Movement to Kick Big Tech out of Africa Could Form a Critical Part of the Global Protests Against the Enduring Legacy of Racism and Colonialism
    CONTENTS Acronyms ................................................................................................................................................ 1 1 Introduction: The Rise of Digital Colonialism and Surveillance Capitalism ..................... 2 2 Threat Modeling .......................................................................................................................... 8 3 The Basics of Information Security and Software ............................................................... 10 4 Mobile Phones: Talking and Texting ...................................................................................... 14 5 Web Browsing ............................................................................................................................ 18 6 Searching the Web .................................................................................................................... 23 7 Sharing Data Safely ................................................................................................................... 25 8 Email Encryption ....................................................................................................................... 28 9 Video Chat ................................................................................................................................... 31 10 Online Document Collaboration ............................................................................................ 34 11 Protecting Your Data ................................................................................................................
    [Show full text]
  • BIG DATA Handbook a Guide for Lawyers
    W BIG DATA Handbook A Guide for Lawyers Robert Maier, Partner, Baker Botts Joshua Sibble, Senior Associate, Baker Botts BIG DATA Handbook—A Guide for Lawyers Executive Summary BIG DATA AND THE FUTURE OF COMMERCE Big Data is the future. Each year Big Data—large sets of data processed to reveal previously unseen trends, behaviors, and other patterns—takes on an increasingly important role in the global economy. In 2010, the Big Data market was valued at $100 billion worldwide, and it is expected to grow to over $200 billion by 2020. The power of Big Data and artificial intelligence to crunch vast amounts of information to gain insights into the world around us, coupled with the emerging ubiquity of the Internet of Things (IoT) to sense and gather that data about nearly everything on earth and beyond, has triggered a revolution the likes of which have not been seen since the advent of the personal computer. These technologies have the potential to shatter the norms in nearly every aspect of society—from the research into what makes a workforce happier and more productive, to healthcare, to the ways we think about climate change, and to the ways we bank and do business. Not surprisingly, it seems everyone is getting into the Big Data game, from the expected—multinational computer hardware, software, and digital storage manufacturers—to the unexpected—real estate agents, small businesses, and even wildlife conservationists. Within a few years, every sector of the global economy will be touched in some way by Big Data, its benefits, and its pitfalls.
    [Show full text]
  • Tracking the Cookies a Quantitative Study on User Perceptions About Online Tracking
    Bachelor of Science in Computer Science Mars 2019 Tracking the cookies A quantitative study on user perceptions about online tracking. Christian Gribing Arlfors Simon Nilsson Faculty of Computing, Blekinge Institute of Technology, 371 79 Karlskrona, Sweden This thesis is submitted to the Faculty of Computing at Blekinge Institute of Technology in partial fulfilment of the requirements for the degree of Bachelor of Science in Computer Science. The thesis is equivalent to 20 weeks of full time studies. The authors declare that they are the sole authors of this thesis and that they have not used any sources other than those listed in the bibliography and identified as references. They further declare that they have not submitted this thesis at any other institution to obtain a degree. Contact Information: Author(s): Christian Gribing Arlfors E-mail: [email protected] Simon Nilsson E-mail: [email protected] University advisor: Fredrik Erlandsson Department of Computer Science Faculty of Computing Internet : www.bth.se Blekinge Institute of Technology Phone : +46 455 38 50 00 SE–371 79 Karlskrona, Sweden Fax : +46 455 38 50 57 Abstract Background. Cookies and third-party requests are partially implemented to en- hance user experience when traversing the web, without them the web browsing would be a tedious and repetitive task. However, their technology also enables com- panies to track users across the web to see which sites they visit, which items they buy and their overall browsing habits which can intrude on users privacy. Objectives. This thesis will present user perceptions and thoughts on the tracking that occurs on their most frequently visited websites.
    [Show full text]
  • LINUX JOURNAL (ISSN 1075-3583) Is Published Monthly by Linux Journal, LLC
    Getting Started Review: the A Look at GDPR’s with Nextcloud Librem 13v2 Massive Impact Since 1994: The original magazine of the Linux community PRIVACY HOW TO PROTECT YOUR DATA EFFECTIVE PRIVACY PLUGINS GIVE YOUR SERVERS SOME PRIVACY WITH TOR HIDDEN SERVICES INTERVIEW: PRIVATE INTERNET ACCESS GOES OPEN SOURCE ISSUE 286 | MAY 2018 www.linuxjournal.com MAY 2018 CONTENTS ISSUE 286 82 DEEP DIVE: PRIVACY 83 Data Privacy: Why It Matters and How to Protect Yourself by Petros Koutoupis When it comes to privacy on the internet, 118 Facebook the safest approach is to cut your Ethernet cable or power down your Compartmentalization device. In reality though, most people by Kyle Rankin can’t actually do that and remain productive. This article provides an I don’t always use Facebook, but when overview of the situation, steps you I do, it’s over a compartmentalized can take to mitigate risks and finishes browser over Tor. with a tutorial on setting up a virtual private network. 121 The Fight for Control: 106 Privacy Plugins Andrew Lee on by Kyle Rankin Open-Sourcing PIA by Doc Searls Protect yourself from privacy-defeating ad trackers and malicious JavaScript with When I learned that our sister company, these privacy-protecting plugins. Private Internet Access (PIA) was opening its source code, I immediately wanted to know the backstory, especially since 113 Tor Hidden Services privacy is the theme of this month’s issue. So I contacted Andrew Lee, who founded by Kyle Rankin PIA, and an interview ensued. Why should clients get all the privacy? Give your
    [Show full text]
  • The Elephant in the Background: a Quantitative Approach to Empower Users Against Web Browser Fingerprinting
    The Elephant in the Background: A Quantitative Approach to Empower Users Against Web Browser Fingerprinting Anonymous Abstract—Tracking users is a ubiquitous practice in the web Furthermore, other researchers have concentrated their ef- today. User activity is recorded on a large scale and analyzed forts on creating new fingerprinting techniques, e.g. by using by various actors to create personalized products, forecast future canvas [24] and audio objects [30] or via CSS [37]. Others behavior, and prevent online fraud. While so far HTTP cookies have significantly improved known techniques with machine have been the weapon of choice, new and more pervasive learning [42] or by extracting fingerprinting features more techniques such as browser fingerprinting are gaining traction. passively via extension activity tracking [36]. Hence, in this paper, we describe how users can be empowered against JavaScript fingerprinting by showing them when, how, The sheer diversity of fingerprinting techniques available and who is tracking them. To this end, we conduct a systematic analysis of various JavaScript fingerprinting tools. Based on this to us begs the question of which techniques are really being analysis, we design and develop FPMON: a light-weight and used and which ones are not? So far, large scale studies have comprehensive fingerprinting monitor that measures and rates only uncovered specific instances of fingerprinting and these JavaScript fingerprinting activity on any given website in real- are over 5-10 years old [1,2]. In particular, we currently lack time. Using FPMON, we evaluate the Alexa 10k most popular a comprehensive view of fingerprinting activity on the web websites to i) study the pervasiveness of JavaScript fingerprinting; today.
    [Show full text]
  • Haggart EFF and the Political Economy of the American Digital
    1 The Electronic Frontier Foundation and the Political Economy of the American Digital Rights Movement Abstract: As one of the world’s most prominent (if not the most prominent) digital-rights group, and one with a reputation for principled stands, EFF’s views on digital-platform regulation have an outsized influence on policy options not only in the United States, but abroad. Systematically outlining EFF’s digital political economy thus helps to highlight how it defines the issue, and whose interests it promotes. To analyze the EFF’s economic ideology, this paper proposes a five- point framework for assessing the political economy of knowledge that draws on Susan Strange’s theories of structural power and the knowledge structure. It focuses on the control of key forms of knowledge, the role of the state and borders, and attitudes toward surveillance. The paper applies this framework primarily to four years (2015-2018) of EFF blog postings in its annual “Year in Review” series on its “Deeplinks” blog (www.eff.org/deeplinks), drawing out the specific themes and focuses of the organization, including the relative prevalence of economic versus non-economic (such as, for example, state surveillance) issues. The revealed ideology – favouring American-based self-regulation, individual responsibility for privacy, relative support for corporate surveillance, minimalist intellectual property protection, and free cross-border data flows – mirrors the interests of the large American internet platforms. Blayne Haggart Associate Professor, Department of Political Science Brock University St. Catharines, Canada Research Fellow Centre for Global Cooperation Research University of Duisburg-Essen Duisburg, Germany [email protected] Paper presented at the annual International Studies Association Meeting, Toronto, ON, March 27-30, 2019 2 Draft paper.
    [Show full text]
  • Toolkit Is Supported by JANIC / NED Grant to ADA
    Privacy Online Guide This toolkit is supported by JANIC / NED Grant to ADA Written by Derek Caelin & Bejoy Joseph George Asia Development Alliance Japan NGO Center for International Cooperation (JANIC) [email protected] 2 Table of Contents ABOUT THE PRIVACY ONLINE TOOLKIT ..................................................................................................... 5 1. INTRODUCTION ................................................................................................... 7 1.1. CIVIL SOCIETY IN THE DIGITAL AGE ................................................................... 7 2. THREAT MODELING ............................................................................................. 8 2.1. THREAT MODELING AND THE CIVIL SOCIETY ACTOR .......................................... 9 2.2. WHAT CONSTITUTES RISK? ................................................................................. 9 2.3. MODELING METHODOLOGIES .......................................................................... 10 2.4. IDENTIFYING THREATS (OR THREAT INTELLIGENCE) .......................................... 11 2.5. THE 4-D THREAT MODELING PROCESS ............................................................... 12 2.5.1. WHAT ARE ‘ASSETS’? ...................................................................................... 14 2.5.2. HOW DO YOU DECONSTRUCT? ....................................................................... 14 2.5.3. THE IMPORTANCE OF DOCUMENTATION ....................................................... 14 2.5.4. DESIGN
    [Show full text]
  • Engineering Privacy and Protest: a Case Study of Adnauseam
    Engineering Privacy and Protest: a Case Study of AdNauseam Daniel C. Howe Helen Nissenbaum School of Creative Media Cornell Tech City University, Hong Kong New York University Email: [email protected] Email: [email protected] Abstract—The strategy of obfuscation has been broadly applied— tools addressing this issue, by leveraging obfuscation in an attempt in search, location tracking, private communication, anonymity—and to frustrate profiling based on interests revealed through ad clicks. has thus been recognized as an important element of the privacy Specifically AdNauseam enables users to click ads behind the scenes engineer’s toolbox. However, there remains a need for clearly articu- in order to register visits in ad network databases. The aim of the lated case studies describing not only the engineering of obfuscation software is to pollute the data gathered by trackers and render their mechanisms but, further, providing a critical appraisal of obfusca- efforts to profile less effective and less profitable. At the same time, tion’s fit for specific socio-technical applications. This is the aim of the software allows users an avenue of proactive expression, by our paper, which presents our experiences designing, implementing, actively disrupting the economic system that drives the system, and and distributing AdNauseam, an open-source browser extension that by sowing mistrust (advertisers generally pay ad networks for clicks) leverages obfuscation to frustrate tracking by online advertisers. within it. Additionally, AdNauseam makes the ads it collects available At its core, AdNauseam works like a list-based blocker, hiding to users to explore via interactive real-time displays. or blocking ads and trackers.
    [Show full text]