
Don’t Let Facebook, or Any Tracker, Follow You on the Web - jerheinze
https://blog.torproject.org/dont-let-facebook-or-any-tracker-follow-you-web
======
tpaschalis
It's kinda weird, that some of the greatest minds in the world, are gathered
in Silicon Valley, solely working on how to make us click on more
advertisements on the internet.

As far as hiding your online fingerprint, I feel that having a clean-slate
browser container[1], while certainly a hassle, can go some way towards
protecting yourself, but...these great minds will find another way.

[1] [https://tpaschalis.github.io/sandboxed-browser-with-
docker/](https://tpaschalis.github.io/sandboxed-browser-with-docker/)

~~~
stephengillie
_I saw the best minds of our generation writing spam filters._ \- Neal
Stephenson

 _We wanted flying cars, instead we got 140 characters._ \- Peter Thiel

~~~
forapurpose
> We wanted flying cars, instead we got 140 characters. - Peter Thiel

Well, don't forget mass surveillance.

------
rosser
Do you really need the Tor browser to do this?

I just sign into Facebook, Google, _& c_ services using one browser, and do
everything else in another — all of which all have µBlock Origin, Privacy
Badger, whitelist-based cookie managers and the like installed.

EDIT: One advantage of this approach is potentially significantly raising the
noise floor in Tor traffic. That, by itself, is a win.

EDIT 2: Also IP-level tracking and fingerprinting. See below...

~~~
noncoml
Do they not try to match you based on your IP?

After all if they know it is a residential IP, they probably know that no
matter the user-agent, traffic belongs to the family. And I assume they know
who all your family members are.

~~~
notjtrig
When you use tor it says not to maximize the window because sites can use your
screen resolution to track you. More realisticly they could match operating
system from the user agent with other data. I remember chrome being acused of
putting serial number like strings in the user agent. Why would they not?

~~~
codingowl
These are the basic basics for tweaking FF's about:config. There are many
more. Try these and see how you fare...

layout.css.visited_links_enabled set to false; geo.enabled set to false;
media.navigator.enabled set to false; media.peerconnection.enabled (WebRTC)
set to false; network.http.sendRefererHeader set to 0;
privacy.resistFingerprinting set to true; privacy.firstparty.isolate set to
true; network.dns.disablePrefetch set to true; network.prefetch-next set to
false; webgl.disabled set to true

Don't forget to also use something like uBlock Origin, Token Tracker Stipper,
and Decentraleyes. Pass is all through a Pi-hole and VPN and you're pretty
safe. Make sure your VPN does not expose your NAT'd IP with WebRTC. Both
uBlock Origina and ScriptSafe can help with this, as FF will sometimes crap
all over its about:config settings with updates.

~~~
anticodon
FF also has an extension for always opening Facebook in an isolated container:
[https://github.com/mozilla/contain-
facebook](https://github.com/mozilla/contain-facebook)

------
orschiro
For me it's the combination of uBlock origin [1], uBlock Extra [2], and
Decentraleyes [3].

[1] [https://chrome.google.com/webstore/detail/ublock-
origin/cjpa...](https://chrome.google.com/webstore/detail/ublock-
origin/cjpalhdlnbpafiamejdnhcphjbkeiagm)

[2] [https://chrome.google.com/webstore/detail/ublock-origin-
extr...](https://chrome.google.com/webstore/detail/ublock-origin-
extra/pgdnlhfefecpicbbihgmbmffkjpaplco)

[3]
[https://chrome.google.com/webstore/detail/decentraleyes/ldpo...](https://chrome.google.com/webstore/detail/decentraleyes/ldpochfccmkkmhdbclfhpagapcfdljkj)

~~~
doubt_me
Umatrix (same guy) + privacy badger (eff)

Have been using it since it was called HTTPS switchboard. Uorigin is my go to
install on all of my customers fresh installs or people who don't want to
break their web experience. Works great.

~~~
orschiro
\- I tried Umatrix but it was too much configuration for me. ublock provides
me with a sane out of the box experience.

\- I am not sure whether privacy badger and decentraleyes are mutually
exclusive.

~~~
ealhad
I don't think they are.

For example, you can choose to enable a Google-hosted library (say, jQuery) on
a certain domain, because you want it to work, and then decentraleyes will do
its part.

------
polyvisual
4 weeks ago I found an injured pidgeon, took it a rescue place and got
chatting to the owner about chickens. I came home, searched for chicked coops
on my business laptop. This laptop runs Firefox, uBlock and Ghostery.

Last night, my wife has Facebook adverts for chicken coops pop up on her
laptop. We've not spoken about chicken coops since, I've not searched for
chicken coops since the original search, she's not searched for chicken coops
on her laptop and she's not used my work laptop.

Creepy.

If they want to track you with a "normal" browser, they'll find a way of doing
it.

~~~
djsumdog
Doesn't Ghostery allow in certain trackers if they're paid? I remember there
was some controversy about their funding model.

I use uBlock Origin + uMatrix currently.

Your tracking situation doesn't seem out of the realm of possibility though.

1\. You searched for Chicken Coops at a place. 2\. That same laptop connects
to your home Wi-Fi. 3\. The user (you) who searched for chicken coups is
connecting from a new IP. 4\. Some ad engine rule says that IP belongs to a
household (this probably doesn't matter; makes me wonder if people in a
Starbucks get ads intended profiled against other customers). 5\. Now let's
just advertise chicken coupes to everyone in that house.

So in theory, this tracking attempt can be done with just a cookie and selling
sets of IP+search word data, right?

~~~
senorjazz
> makes me wonder if people in a Starbucks get ads intended profiled against
> other customers)

unlikey, at your home location, usually it is just the same few people all the
time.

At a coffee shop there might a couple of the same people every time, but also
lots of other random people. So would be easy to ID home location / office
location / public space location.

Or perhaps they know the location is a coffee shop from their facebook
location ID.

but they will know somehow

~~~
sten
Two ways I'm aware of. If your time at the coffee shop is regular (arrive at
3:15 because that's when your break is from work) they can place you with
other regulars (you go there with your wife every day after work, you get dark
roast and she gets a tea). Second if you're a black hole of privacy features
and everyone else around you is not... well you get identified that way. Like
herd immunity there is a risk if your behavior makes you an outlier.

Imagine for a moment though that they can't serve you ads directly. I wonder
if anyone has done research into saturating adds in a coffee shop for all the
patrons? Everyone sees the same add for the Dallas Cowboys and triggers a
conversation about football. Now you didn't see the add but everyone around
you is talking about football.

------
qwerty456127
I just wish more web sites would provide official TOR and/or i2P addresses (so
we wouldn't need exit-nodes) yet nobody among them seems interested in
visitors they can't track. Both the fact there are hardly any non-illegal
websites maintaining native TOR/i2P presence and the fact every major WWW site
demands you to agree to be tracked now as GDPR doesn't allow this to be done
silently suggests this.

~~~
tlrobinson
FYI Facebook, NYTimes, Wikipedia, and a few other prominent sites operate
hidden services:
[https://en.m.wikipedia.org/wiki/List_of_Tor_hidden_services](https://en.m.wikipedia.org/wiki/List_of_Tor_hidden_services)

------
JesusTheGod
I need a genuine advice. I own Google Pixel 2 because I needed a good mobile
camera, I also have a Chromebook with Cruton as I needed a cheap Linux
notebook. I use Google Maps, Gmail, WhatsUp, Google Photos, Google Drive,
Messenger ( the only thing I don't have is a FB app).

Given all this information how I am supposed to disconnect from all of this?
Cause surely simply having something blocking tracking of you in a desktop
browser is not enough? Also, I really enjoy services provided by Google, why
should I give it all up and replace everything with "safe" alternatives? I
know I am a product and my personal info and preferences are all of over the
place. But I always understood this to be the price I pay for using this
services ( taking about Google mainly ).

------
systematical
Tor is too slow for general browsing. I only use it for security related
stuff. I wish it was faster.

~~~
djsumdog
It's a tradeoff. You can't easily have both.

------
etaioinshrdlu
Related question:

What is the impact of IPv6 on regular users privacy?

~~~
djsumdog
In theory you can track individual devices in a household instead of grouping
everyone in one house, small business, building, etc. as one IP.

Currently, even with the limitations of IPv4, most trackers can use cookies
and browser fingerprints (your browser's headers, fonts, etc.) to individually
identify you even behind NAT. But with IPv6, ad engines could potentially
identify that you're running two different browsers on the same laptop or
device, and associate both of those browsers to _you_ (some type of single
targeting profile).

They also have a more precise way to track you without a browser fingerprint.

~~~
stephen_g
Note that 95% of people browsing with IPv6 are probably using SLAAC with
privacy extensions, so all your devices IPs should be frequently changing (at
least every day, but you can lower the timeout). Only the subnet would stay
the same, similar to a NAT’ed IP.

~~~
spystath
As it's evident from NAT they can track even behind a single IPv4. As long
they know your prefix the privacy extensions don't really help. Of course one
could have a dynamic prefix similar to dynamic IPs residential ISPs use. It's
funny, in the past a static IP was considered a valuable feature for a
residential internet connection. Nowadays, I'm wondering if dynamic IPs are
more viable from a privacy perspective.

------
ehecatl
On the totem pole of tech nous, I am very close to the bottom. So can someone
explain to me "remote browsing" is not a thing? Login to your VPS (or
whatever), start and encrypted X session, and browse away.

That is very unusual traffic, of course, and others connecting from my inet-
facing IP probably make it even more so: Steam after school, missus hitting
the foreign news sites in the AM, the traffic peaks and troughs at certain
times of day... we're fucked.

~~~
jacques_chester
They can identify you a number of ways without your knowledge or consent. One
is timezone allocation. Another effective way is browser fingerprinting. IP
addresses. Browsing patterns. Device screen size.

Privacy on the web is an information theoretic arms race with tremendously
deeply asymmetric stockpiles of information.

------
rurban
There are many chrome extensions disabling Facebook tracking. I use
"Disconnect Facebook™ pixel & FB™ tracking".

It tracks not only by cookie or fingerprints, also by 1x1 pixel. And with the
phone app even more, but nobody in his privacy aware mind should use the 2
apps anyways. Their constant recording of audio drains the battery too much,
and their m. and mbasic. web urls are good enough.

------
eklavyaa
its an irony that on accessing the link in Chrome, it warns me about privacy
error,

"blog.torproject.org normally uses encryption to protect your information.
When Google Chrome tried to connect to blog.torproject.org this time, the
website sent back unusual and incorrect credentials. This may happen when an
attacker is trying to pretend to be blog.torproject.org, or a Wi-Fi sign-in
screen has interrupted the connection. Your information is still secure
because Google Chrome stopped the connection before any data was exchanged.

You cannot visit blog.torproject.org right now because the website uses HSTS.
Network errors and attacks are usually temporary, so this page will probably
work later."

------
FreekNortier
How good is Brave browser at blocking tracking?

------
keyle
I have a portable browser just for Twitter/Facebook etc.

And a separate browser with just ad blocker and blocked 3rd party cookies.

Do I really need Tor?

~~~
3pt14159
Tor isn't the answer, it's broken. What's needed is a replacement for the
modern web. At the protocol level it's busted in so many ways it isn't
salvageable. The sooner we recognize that the sooner we'll be able to create
its replacement.

~~~
snomad
Completely agree about broken protocol. Unfortunately, I doubt their will ever
be a real impetus to abandon it; we will just keep muddling along strapping
ever more duct tape.

But let's dream, what would your protocol be?

For some reason I have always had a hang up on the headers. The lack of real
concrete specs, forging clients, and now the ugly monstrosity of CSP. I love
the effect, but in my dream new protocol we have to opt into features during
some kind of app / client handshake.

~~~
djsumdog
> muddling along strapping ever more duct tape

Let's strap some sockets to HTTP and run them through a web server. We'll call
them Web Sockets.

Chat? I have this crazy idea called WebRTC. .. although our original idea was
a huge security hole and now it's pretty much just used for games .. because
browsers don't do Datagrams so let's just do some more hacking with WebRTC.

Anyone remember when Firefox was the lightweight version of Mozilla and web
browsers were used to browse the web?

I feel like all modern web browsers are in a pretty sad state of bloat, are
pretty much mini operating systems, and Javascript is taking over the world.
It's frighteningly like that parody talk about "Yavascript"

------
a_imho
Also consider using obfuscation instead. E.g. AdNauseam and Noiszy are two
examples I'm aware of.

~~~
drewmol
I used to feel for smaller companies who buy ads, concerning the damage
possible caused by tactics like AdNauseam regarding outragous advertising
bills.

Now I think it's likely the best weapon available which can be easily wielded
by the average user.

------
codingowl
You don't need Tor to do this. Tor is slow and frustrating.

I use a heavily-modified Firefox instance over a VPN with uBlock Origin,
Privacy Badger, Disconnect, No Coin, Script Safe, Token Tracker Stripper, Neat
URL and too many about:config edits to mention.

I do recommend disabling http/s referrer, CSS visited links, and others as can
be learned online.

In addition, I pass all of this through a remote computer with a Raspberry
Pi/Pi-hole instance. This has worked well for me for a couple of years. As I
have no real social media accounts, I'm not building any meaningful profiles.
Accounts like HN or Slashdot don't get any real info. I also don't add any
apps to my iPhone. The apps that ship with the device are all I need. I can
pass all of my phone's traffic through the VPN/Pi-hole instance and keep
relatively safe. Being with T-Mobile means I get unlimited data so I don't
need to connect to potentially hostile Wi-Fi.

I rather enjoy the "cold war" between the corporations and the security-
minded. There are so great add-ons to uBlock and other add-ons that completely
bypass the complaint scripts of using adblock.

Another quick way to get past fake paywalls or complaining pages is to use
Startpage's proxy or even Google's cached link. I've set up so many people to
use this set up and they are thrilled.

I am thinking of setting up remote desktops that can be accessed by friends
and family that are VPN'd, Pi-holed, and with other security features that
hide their real IPs, etc.

~~~
mehrdadn
> Tor is slow and frustrating.

> I use a heavily-modified Firefox instance over a VPN with uBlock Origin,
> Privacy Badger, Disconnect, No Coin, Script Safe, Token Tracker Stripper,
> Neat URL and too many about:config edits to mention.

That's faster for you? I guess I'm a bit of a speed freak, but I recall even
Disconnect by itself slowed down pages enough to make me uninstall it, let
alone that combination...

~~~
workaccount34
Tor speed is not is your control. Your hardware is in your control. As a
"speed freak", I find it amusing that Disconnect would be slow for you.
Interesting to see that a "speed freak" is running slow hardware.

~~~
mehrdadn
> Tor speed is not is your control. Your hardware is in your control. As a
> "speed freak", I find it amusing that Disconnect would be slow for you.
> Interesting to see that a "speed freak" is running slow hardware.

I'm not on slow hardware; you just seem to prefer to just quickly make naive
assumptions. First of all, the system naturally clocks down on battery, so I'm
not always running at max GHz. Second, I'm not pulling this out of my rear --
I actually sat down in 2014 and measured in detail how much each of my
extensions slowed the loading of Gmail, and I even still have the records.
AdBlock slowed it down by 1.8 seconds; Disconnect slowed it down by 0.7
seconds (IIRC this was on AC power but I didn't record that part). I found
both of these ridiculously unacceptable. Now, I've upgraded my laptop since,
and so in response to this discussion right now I just did another quick test
on Gmail on my current system (which I can again assure you is not slow
hardware). On AC power, Disconnect still adds 120ms. On battery, it adds
400ms. Still neither of which I find acceptable (this is my _email_ I'm
talking about, not cat videos), though it's definitely better. Feel free to
spend some time doing your own measurements and report them here if you have
disputes.

------
fulyscentedking
I use Pi-hole, a DNS level blocker, + uBlock Origin. This combo should provide
a much better protection against tracking.

~~~
forapurpose
How does that protect you against trackers and against identifying you based
on your IP address and browser fingerprint?

------
auslander
1\. Always-on VPN - kills main tracking feature, your IP

2\. uBlock Origin in medium mode - kills 3p scripts and 3p frames

3\. Private windows/tabs by default - kills 3p cookies and storage

That's all kids :)

------
partycoder
The innovations that make trackers possible are:

\- browsers cache results

\- cookies

If you do neither of these things trackers become much harder to implement.

~~~
szc
I think this list is missing:

\- HTML5 "local storage"

\- Plugin detection

\- Javascript (particularly xml-rpc)

\- fetching embedded content based on a URL (images, movies, css, javascript,
...)

\- Hidden frames and/or WebRTC - can scan your local network

There are probably more.

[Edited: Updated to clarify that local network scanning can be done with
hidden frames or WebRTC. A followup comment from me gives a public example of
how]

~~~
voxadam
Do you have any more information on the local network scanning?

~~~
danShumway
Not sure if this is what grandparent is referring to, but DNS rebinding[0] is
what springs to mind.

It's simultaneously kind of smart and also really stupid. Basically, you give
a valid 3rd-party domain multiple IPs, one of them normal and one of them
resolving to a local IP. Then you cut off the normal one and the browser just
allows you to make calls to whatever local interface you want.

There was a good defcon video about this a while back[1]. It's a much bigger
problem than most people realize. This is why it's good practice to have at
least some security around devices even if they're only connected to your LAN.

[0]: [https://www.twistlock.com/2018/02/28/dear-developers-
beware-...](https://www.twistlock.com/2018/02/28/dear-developers-beware-dns-
rebinding/)

[1]:
[https://www.youtube.com/watch?v=stnJiPBIM6o](https://www.youtube.com/watch?v=stnJiPBIM6o)

------
ThomPete
Honest question why wouldnt i let them track me? Arent there a bunch of
benefits to being tracked too?

~~~
craftyguy
Care to name some benefits?

I don't want to be tracked because information gathered can and will be used
in ways I don't expect. Websites will game me on pricing, etc based on where
I've been on their site and other sites. I could easily fall into a filter
bubble, where I am only given results based on previous preferences. I would
have zero control over the information gathers regarding my habits, and any
conclusions they make based off of this data. And it will get stolen. And it
will be used against me.

So I take as many steps as I can to prevent websites from tracking me.

~~~
SquareWheel
>Care to name some benefits?

Improved ad targeting may increase revenue for the website, and will improve
ad relevance for the end-user. This was historically seen as a win-win;
particularly if it allows a service to remain free to use.

I often get ads for programming IDEs, which I don't mind that much. I'd rather
have them than beauty products, or other irrelevant items.

Not that it's actually possible to discuss the pros and cons of targeting
anymore. It's become a religious issue to too many people.

~~~
rosser
Not to imply that there aren't strong feelings around the subject, but don't
you think calling it a "religious issue" might preemptively poison discussion
a bit?

~~~
ThomPete
I am being downvoted quite heavily for asking the question so i would say it
is pretty religious.

~~~
majortennis
how do you downvote on HN ?

~~~
SquareWheel
There's a karma threshold before you're granted the ability. 500 karma, maybe?

