Tuesday, July 03, 2012

Basic Privacy Precautions on the Web

As vividly described in a Wall Street Journal article, nearly every action you take on the Web is being monitored by companies you've never heard of, attached to your real identity, and sold. A Firefox plugin lets you watch as these companies track you across the web, with the conscious (and paid-for) assistance of many websites you frequent. What they know includes the exact times you click on links, what you buy, and what you type into search bars and other text boxes. If you need more discussion about why this is a bad thing, here's an excellent analysis of the threat of web tracking for anyone who is politically active. These companies are learning what political causes you care about, what your guilty pleasures are, what you're afraid of, what medical conditions are on your mind, who your friends are, and what types of advertising best trigger you to buy something.

That's unless you take a few steps to fight the most common methods of tracking. You can implement all of these within a few minutes, for free, and without changing your browsing experience much. However if you find that a website isn't working properly, you could always use a different browser to see if one of these modifications was the problem.

1. Use Firefox as your web browser. It's popular, which means that it has a large number of custom plug-ins available (like the ones I talk about below), and it is open source, which means that its inner workings are accessible to experts to review it for security and privacy problems. This open source property probably also attracts more privacy-minded people to write plug-ins for it.

2. Block third party cookies. Third party cookies are the most common way that advertising companies track you from site to site, by placing a little piece of text on your computer that identifies you when you pop up on the next site (and which is connected to your real identity if one of the sites requires you to enter your real name or password) As of the present version of Firefox, go to File -> Preferences, choose the Privacy tab, and uncheck Accept third party cookies.

3. Delete all cookies when closing Firefox. This provides some protection from websites recognizing you on returning to them. For example, if you buy something from Amazon.com, you may want to return to the web page to browse items without Amazon being able to associate the pages you view with your real identity. It also protects a little from your logged-in facebook or google account following you from page to page. You can of course clear your cookies at any given time (under the Privacy tab), but an easy automatic way to take care of that is to clear cookies when you restart the browser, File -> Preferences, choose the Privacy tab, and where it says "Keep until:" choose "I close firefox". The downside is that you will have to log into websites again when you reopen Firefox, but that can be a security advantage, and you can always use "Remember password for this site" which doesn't pose the same privacy risk as cookies.

4. Fight Flash cookies. This are a hidden type of cookie that is used by websites to track people who are deliberately trying not to be tracked, by deleting cookies. Therefore they represent a clear indication that companies will never respect people's wishes about being tracked, and it will always be an ongoing arms race. But Better Privacy for Firefox can fight them in a sophisticated way, allowing them to live for a little while (making web pages usuable), and then kill them, severing the link between your browsing before and after. It also deletes a hidden list of all the flash-bearing sites you have visited, that is still there even if you Clear History! There may be other types of "supercookies", involving Java and more arcane technologies rather than Flash, that I don't yet understand or know how to counteract.

5. Fight web bugs (aka beacons). These are little bits of another company's web page that are embedded in a webpage you are viewing, that allow that company to tell that you're visiting that web page at a particular time and to follow you across the web. They may take the form of invisible images on the page, or something visible, like Facebook "Like" buttons (even if you don't have a facebook account). These are hard to block completely, but the plugin Disconnect will block tracking by that means by Facebook, Google, and Twitter. Adblock Plus is an example of a program that should block many of the other cross-site web bugs, although you have to install a good filter list - one study recommended either Easylist+EasyPrivacy, or Fanboy's Ads+Tracking+Annoy (all done with a couple of clicks once Adblock is installed). An alternative, Ghostery, has the nice feature of giving you a report on the tracking technologies on a page as well as blocking them, although it should remain under scrutiny for being a prong of the advertising industry's campaign to avoid regulation.

6. Consider not using Google for searches. My searches are some of the most personal things I do on the Web, and Google is a company that is hell-bent on connecting that information with my real identity - or at least my gmail identity - and with my travels across the web. It is building giant, permanent dossiers on all of us. I don't know which is more disturbing, the possibility that it is selling this information to hundreds of advertising companies, or that it is keeping them for its own unspecified future purposes. But in any case, here's proof from Google's own promotional pages that, for example, they use the fact that you are searching about a particular city - or are visiting web pages related to it! - to guess that you live there, or are planning a visit there, and to show ads that are tied to that city. Google is probably the best search engine out there, but they are primarily an advertising company, and they are eager to know what's on your mind.

What are the plausible alternatives? Bing is actually quite good, and though it is also tied to another giant, creepy company that owns an advertising network (Microsoft), at least you can be pretty sure that they won't be sharing information with Google. Better, from a privacy standpoint, is Duck Duck Go, which advertises completely anonymous searches: not remembered, not tied to your identity in any way. I made it my home page, and also added it to the search bar in the upper right hand search bar of Firefox, which you can do by simply visiting  Duck Duck Go, clicking the icon in the search bar, and choosing "Add Duck Duck Go". I have found its search results to be about 80% as good as Google, which is good enough for many purposes. And for the purposes where it isn't, adding "!g" to the beginning of the query will automatically go to Google. Duck Duck Go is also helpful for another worrisome non-privacy-related issue called "the filter bubble".

If you can't stand using the alternatives, at least take these steps:
* On your Google account settings, turn off Web Historyopt out of targetted ads  and set the doubleclick opt out cookie.
* If you use GMail (and believe me, I am trying to figure out a good alternative), try to use it in a separate browser than the one you do your google searches in (e.g. Chrome or Safari if your main browser is Firefox). If your gmail address appears on the top right of www.google.com, then it explicitly knows who you are and is associating you with your searches (unless you trust that Google respects the opt-outs in the previous step). Click on it to sign out.

7. Take a lot of care with your social media participation. Keep in mind the quote by Andrew Lewis "If you're not paying for something, you're not the customer; you're the product being sold." Apart from the obvious (and not-so-obvious) real-life problems caused by oversharing, anything you post in public is being eagerly scanned by multiple companies and associated with you as much as possible, and actions you take that should be only visible to your friends on services such as Facebook are still being scanned by the hosting company and sold to advertisers, in particular your network of friends and acquaintances. (I wouldn't be surprised if they're recording whose FB pages you visit most often, so that algorithms can guess at who you have a crush on - maybe before you've guessed it yourself)

With my privacy concerns, I probably shouldn't be on Facebook at all, and I'm scaling back my participation, but I do get a lot of enjoyment out of it, so for now the creepiness is worth it. But besides the hazards of Facebook knowing about you, the company has a habit of continually changing the privacy settings to publicly expose things you don't think you're making public, so do a search to find the latest settings to maximize privacy, in posts like this one. There are other social media hazards you might not have thought of, such as information about your location hidden in photos taken on your smartphone and uploaded. I would think long and hard about *any* service that involves posting information about your location. (I would even recommend keeping your phone's GPS turned off unless absolutely needed, but that's another post)

***

What about "Private Browsing" mode? This provides protection against some, but not all tracking. It is somewhat effective at severing the link between what you do within the private session and outside of the private session (although it does not affect Flash cookies I believe), but if you link that session to your identity, for instance by logging into Gmail or Facebook, without other precautions your subsequent actions will also be linked to your identity.

***

These steps can't guarantee anonymity on the Web, in fact there are several known methods for tracking your identity across the net such as browser fingerprinting and clickprinting that are even harder to understand and combat. Another big vulnerability is your IP address, which identifies your location to the city level and, when combined with only a little more info, can identify you - and it is tricky to conceal. But the 7 steps will help, and it makes me angry that most browsers don't have them on by default, so that it's a piece of cake to follow people's every Web move (and the software makers know exactly what they're doing). That means 99.99% of people have no protection, including your mom and dad and your little cousin (unless you help them)

But for those who care, and who have the technical ability to at least follow this and other such guides, it will be an ongoing battle. Perfect protection is only possible against companies that don't keep up with the cutting edge of tracking. Unfortunately that doesn't include Google, the sneakiest of them all and the biggest overall privacy threat. But no matter how the tactics change, two things will remain a constant: companies will always misrepresent the extent of their tracking, the anonymity of it, and what they're using it for (which makes the "pretty please don't track me" option that is now available in many browsers of doubtful use); and noble privacy researchers will always be discovering and exposing them. So if you are still attached to the idea of being able to surf the web without every click being monitored and tied to your real identity, check out the latest battlefronts on websites such as the Stanford Center for Internet and Society, the Wall Street Journal (for some reason) and the Electronic Frontier Foundation. They're doing god's work.

Monday, January 09, 2012

Should you switch over to e-books?

You already know the big reasons to get an E-Book - which I can
summarize by saying I'm reading the brand new 900 page Stephen King book
on something that weighs less than a paperback, and it cost less than
the paperback will when it's released months from now - but maybe you're
still not sure about buying one, or at least not sure about making it
your primary way of reading books. I'm very much considering making a
nearly-complete transition, as a result of the trauma of my last move. I
still haven't been reunited with the couple-dozen wine cases full of
books I painfully packed up and moved to my friend's basement, and the
idea of accumulating more of that weight of *stuff* is awful to me. Like
my laptop carries every album I've bought in the last 2 years, my Kindle
Touch currently holds 50 novel-length books, and could hold hundreds and
hundreds more.

It feels good to be travelling light, but if reading is as important to
you as it is to me it's a huge step, and you don't want to make it
lightly. I want to lay out some very real cons that you may not have
thought of, but then also provide pros you might not have thought of to
counteract them.

But first I want to deal with an invalid con: "I just love the
look/feel/smell of books" Do you really? Or do you love them because
they are *associated* with the texts you love? If you had never heard of
Catch-22 and there was an empty notebook with the cover art and cover
text, would you buy it and revere it? We're fond of books as objects
because of the words they contain. But once there's an alternative it's
easy to see lots of things you don't like about them: much of the sf I
like to read gets covers that are terrible paintings of spacey stuff
that has nothing to do with the contents. Paperbacks are kind of damaged
by reading them even once, especially big ones; they get dirty and can't
be cleaned. They often have garish promotional material all over the
covers, and university library books often have writing inside. And for
people with asthma, being in a room full of books is the worst thing.
Basically most modern mass produced books are not that beautiful as
objects, and there's nothing stopping you from buying the ones that are
to keep around as ornaments, like turn of the century cigarette cases.
If you love reading you'll embrace whatever is the most direct route to
wonderful books.

My Kindle Touch is not particularly beautiful, but it does what it needs
to do which is stay out of your way and not feel like a computer. With
the e-ink display the e-book is just about as pleasant as reading a
paper book (though the contrast isn't as high, so it's somewhat like
reading on light grey paper) It doesn't hum or pop things up, and it
lasts for at least a month on a single charge.
Ok now for the real ones, focusing on the Kindle Touch since it's what I
know.

CON: You don't own the book in the same way.
Amazon.com sells books encumbered by digital rights management, meaning
it can't be used on non-amazon devices, can't be copied freely, and will
probably not be readable in 10 years. That sucks, and hopefully will go
away some day like the DRM on the iTunes store, but I can understand why
they do it at least initially, since books are insanely easy to pirate.
The lower price helps a bit, and some books are set up to be able to lend to friends 
lend books out to friends with Kindles (although only 2 out of the 8 in my library
I looked at), and unlike lending real books,
you can be on the other side of the country, and it comes back to you
automatically. It's also the case that if a book you bought is
accidentally deleted, or your Kindle is stolen, you can get it from
Amazon again.




PRO: Public domain books are free and instantly available.

Do you like Edgar Allen Poe, Somerset Maugham, PG Wodehouse, Arthur
Conan Doyle, Jane Austen, HP Lovecraft, L Frank Baum, Lewis Caroll,
Joseph Conrad, Herman Melville, Mark Twain, Henry David Thoreau,
Voltaire, Shakespeare, H.G. Wells, or any other author who wrote before
1920? Well now you can can carry around *all* of them with you for free.
Amazing when I think about the hundreds of dollars I spent buying books
by these authors. There are also tons of free modern books, by sf writer
Cory Doctorow and many many people you've never heard of, plus lots of
great sales. One more point is that many public libraries now have
e-book collections. My library in a medium big town has thousands of
books, including very new ones, basically equivalent to a large airport
bookstore. Holds on popular books take longer to become available than
the corresponding paper copies, and the terms of borrowing are not quite
as good, but there's no picking them up, and no remembering to return
them - it's literally impossible to get an overdue fine, they just
disappear from your device.

CON: Whenever you connect to the wireless network, your books could be
taken away by amazon.com, or even invisibly altered.
In a feature that people didn't even know existed, Amazon has the power
to pull a book that you bought right back out of your Kindle, as it did
oh so ironically with 1984 and Animal Farm in the summer of 2009:
http://www.theregister.co.uk/2009/07/25/kindle_conundrum/
It hasn't happened again since, and it may be a good thing that it
happened relatively early and there was such a big shitstorm about it,
since that provides some protection. They've promised they won't do it
again. But since it's a corporation, that promise is worthless, and
they're unlikely to do the only thing that would make it better: make it
technologically impossible for them to take books back. Even more
frightening, if this capability exists it means it is very possible for
them to reach into your E-Book and alter the text of books after the
fact, much like Bush's Whitehouse invisibly altered transcripts on their
web page. It's already apparently common practice for authors to tinker
with the text of their book as sold on Amazon, such that people who buy
it subsequently will get a slightly different version.

PRO: The wireless connectivity means that it can act as an emergency web
device, and on my Kindle Touch the keyboard works quite well, if I
needed to send an emergency email or look up an address. Of course with
the e-ink it is incredibly clumsy to use the web, which I actually like:
it discourages the rampant multitasking I tend to do when I have a web
browser in front of me. It very much replicates the quiet, focused
feeling of sitting down with a good book.

CON: Your reading habits are being logged.
This is troubling. There is a file on your Kindle which logs the time of every page turn, and even your geographic location if yours has 3G, and this file could potentially be uploaded to Amazon:
http://www.npr.org/2010/12/15/132058735/is-your-e-book-reading-up-on-you
According to the hackers on the MobileRead forums, there is no evidence so far that the file is ever transmitted to Amazon. But that could change as easily as a tiny update to their code. I really hate the idea that my privacy in this most intimate activity could be invaded.
However there's hope on the horizon,
since someone's already found a way to jailbreak the Kindle Touch. I'm
putting it out of my mind for now, but crossing my fingers that it will
only be a matter of months before I can take control of my device and
make sure it's not acting as a spy sending whispers back to the corporation.

PRO: Books are searchable, quotable, and enlargable.
It's very cool to not only be able to carry around all your books with
you, but to quickly find exact passages. I foresee a new era of annoying
people by reading them my favourite bits. When you select a passage, not
only does it stay highlighted, but it copies the text onto a file that
is easily copied off the Kindle when connected. Bookmarks work great,
and this is going to be very helpful in the years to come, you can
instantly change the text size by pinching with two fingers, as well as
other text attributes. You can blow the text up huge!

CON: You can't read it during takeoff and landing.
I had a lot of trouble with this one, since it makes no sense. Even if
cellphones were a threat to airplanes, a Kindle with the wireless turned
off couldn't possibly pose a threat. When you're not turning pages, it's
practically a dead hunk of plastic. But I look at it two ways. First,
it's the airline's rules so they can do what they want. We are a guest.
Second, even if the flight attendants and pilot know what an e-book is,
do you think every person around you who is dying to use their iPhone
will too? Some idiot would definitely cause trouble. I just look at it
as a proving to myself that I can survive without entertainment for 20
minutes, and in fact so far it's always turned into a chance to meet my
seatmate, which has been nice.

PRO: You can read with one hand.
This is huge. This is something I've wanted my whole life. No matter how
big the book is, you can easily read it with only one hand free. In fact
I only have to graze a fingertip, knuckle, or nose across my screen and
it turns the page. I can read while eating barbecue chicken wings. I can
read while brushing my teeth. I can read while holding onto a subway
pole in a crowded car. If I'm a bit careful, I can read in a bath. And
this one really hit me: I could potentially read while running on a
treadmill. I don't plan on running on a treadmill, but that's cool.
If those cons are things that are important to you, I can completely
understand if you would not want to put all your eggs in the e-book
basket. But now that they cost less than an ipod nano, I think it should
be well worth considering along the lines of a Netflix subscription:
it's a bit creepy, sometimes frustratingly limited, but a great service
if you're into the content. But if you choose not to get one, please be
aware that it is much too late to take a philosophical stance against
e-books, in hopes that people will take you for a mysterious, supercool
free thinker.