481
Google, Microsoft, Meta All Tracking You Even When You Opt Out, According to an Independent Audit (www.404media.co)
submitted 5 months ago* (last edited 5 months ago) by to c/privacy@lemmy.ca
43 comments fedilink hide all child comments
 

This is about cookie banners on websites

There was another time I got into a very serious ontological discussion with a fairly senior engineer about what the difference was between taxes and fines and they didn’t understand there was a difference,” he said.

you are viewing a single comment's thread
view the rest of the comments
[–] 14 points 5 months ago* (22 children)

I run all my stuff in a private tab nowadays. And nuke all cookies etc each session.

Also, make sure I have anti-fingerprinting enabled.

With a VPN.

The only annoying thing is I get a few texts/emails saying "A new device just accessed your account. Was it you?". Yes, yes it was. And I'm not relying on a cookie or fingerprinting for security.

  • permalink
  • fedilink
  • source
  • hideshow 22 child comments
    •
  • [–] 19 points 5 months ago (16 children)

    Private tabs do nothing for the backend, your ISP, browser, search engine, and any sites you visit, can still see everything you do. All private tabs do is they don't save history or cookies on your frontend.

    VPN hides your data from your ISP, but there are still workarounds. Multi-hop can make you harder to triangulate though.

    You still need to use a privacy-centric browser and search engine or else the ones you use can still send information about you back to their servers where they can build a profile on you. They won't have your real IP address as long as you never connect without a VPN, but any little data they collect on you can be collated with the rest to profile you and potentially identify you.

    Even with browsers like firefox or waterfox, you still need to enable all of the security settings or else there are gaps that can be exploited. HTTPS-only mode, DNS over HTTPS, anti-tracking extensions, etc...

    Even then, I wouldn't be surprised if there's an unseen gap somewhere. But it's a lot better than using google and microsoft and no vpn.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 16 child comments
    •
  • [–] 10 points 5 months ago (6 children)

    Also, browsers still send so much unique data that they can be reasonably well fingerprinted. I don't really know all the things, but you can combine info such as OS, browser version, window size, list of extensions, HTTP request headers, timezone, etc...
    Plus you could also track behavior.
    And even with VPN some analysis might be able to figure out what you're looking at based on traffic patterns.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 14 points 5 months ago (1 child)

    https://amiunique.org/ shows you many of the things they can check for

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 11 points 5 months ago

    Holy shit, that's a lot of data. I had no idea they could see what language packs I have installed on my keyboard. I have a pretty unique combination of languages, so that probably makes me really easy to identify across platforms.

    Is there an easy way to disable or block fingerprinting?

  • permalink
  • fedilink
  • source
  • parent
  • [–] 13 points 5 months ago (1 child)

    We need a browser extension that will add or remove a random number of dummy browser extensions per session to further obfuscate the fingerprinting

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 5 months ago

    Browsers like Tor and Mullvad have the right idea. They do all the most important privacy tweaks out of the box and encourage you not to modify it, so that way everyone using the browser has the same fingerprint which makes it much more difficult to track any one user.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 5 months ago

    Some VPN providers offer a setting that makes it harder to analyze traffic patterns. They make every packet the same size and send them at regular intervals along with extra noise. It makes everything look uniform so that AI can't match your traffic to/from the VPN server with traffic between the VPN server and your web activity.

    It might be overkill, and it adds latency and uses extra data. But for maximum paranoia, it's an option

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 5 months ago

    VPN is only blocking your IP. Every other way they track well still work. I mean what does a VPN gibe you? encryption all sites are https hide DNS from ISP there is DOT and DOH. Last one is SNI that could be fixed by ECH if sites used it.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 5 months ago* (last edited 5 months ago) (2 children)

    You still need to use a privacy-centric browser

    Check out Konform Browser. Least leaky one out there.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 5 months ago (2 children)

    Vpns are over rated.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 5 months ago

    If you trust your ISP to examine all your web traffic, and if you don't mind every site you visit knowing your real IP address, and if you're not worried about hackers and sniffers on public wifi stealing your data, then I suppose you don't need one.

    But if by overrated, you mean they only handle certain aspects of security and aren't a complete solution by themselves, then I agree. But no one who understands VPNs expects them to be a complete solution by themselves.

  • permalink
  • fedilink
  • source
  • parent
  • [–] -1 points 5 months ago (2 children)

    Your ISP and browser can see everything you do, but your search engine can only see what you're doing when you're actively on the site, and through cookies. Same with those other sites. Using incognito absolutely helps with that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 5 months ago (1 child)

    That's plain false. With a VPN enabled, the ISP can see data volume and time stamps, and what VPN server you're connected to. Nothing else.

    Your browser, depends on the browser. Chrome, Edge, etc., yeah, they're watching everything you do. An open-source privacy-focused browser with maximum privacy settings enabled is not watching as much, if anything at all.

    And incognito doesn't hide your fingerprint from search engines or websites. It's basically worthless for privacy. All it does is clear cookies, caches, and browsing history from the local device.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 5 months ago*

    I was talking about this statement:

    Private tabs do nothing for the backend, your ISP, browser, search engine, and any sites you visit, can still see everything you do. All private tabs do is they don't save history or cookies on your frontend.

    Obviously if you use a VPN your ISP can't see it.

    If you use a private browser they're not watching you, but again, your browser can easily log all that information if they are inclined to.

    I didn't say anything about fingerprinting and neither did you. Cookies are a large part of tracking, I never said it was the only way they're tracking. But if I go on one site and they fingerprint me, and then I go on another site and they fingerprint me, the first site doesn't automatically know I was on the second site because of the same fingerprint. They would know because of the cookies.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 12 points 5 months ago* (2 children)

    One of the most overlooked, underused, and still hasn't seen production release privacy settings is the ability to partition, or not decorate visited links.

    In Firefox based in about:config

    
layout.css.visited_links_enabled    

false

    In chromium based in chrome://flags

    Partition the Visited Link Database, including 'self-links'

Enabled
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 5 months ago

    Stitching is the concept of updating your profile by appending your interactions from private sessions when you approve that "Yes, it was you" accessing your account "from a new device", or when it's otherwise possible to associate your current session with previous ones in any way.

  • permalink
  • fedilink
  • source
  • parent