Feeds

The Register Guide on how to stay anonymous (part 1)

How websites use your browser to sell you for cash

Beginner's guide to SSL certificates

Social media buttons and badges

Social media buttons are everywhere. They want you to "like" Facebook, Tweet about everything and +1 it on Google. They’re on seemingly every website, even in our demotivators. What most people don’t know is that these little buttons send back all sorts of interesting information to the social media sites in question.

At the top of this article are Facebook and Twitter icons. If you still have active login credentials to these websites, then the sites now know that you have visited this site and read this article. You can check to see if your login credentials are active by visiting the websites and seeing if they still consider you "logged in".

This information is used by social media companies to build a profile of your web activities in order to better target advertising. The more they know about you, the more valuable your information becomes to advertisers as it helps advertisers put their message only in front of those eyes most likely to pay attention.

Traditional script-killer plugins such as NoScript for Firefox will stop these buttons from broadcasting your information, but they also block everything and anything else on a website from running as well. Various Adblock plugins (IE, Safari, Firefox, Opera, Chrome) will usually defeat social media buttons. (Because of a peculiarity of how the Chrome AdBlock works, you need to tweak it to protect yourself from tracking.) This should be used with caution: blocking advertisements altogether deprives the websites you love of the revenue they need to survive.

Ghostery is a less "nuke it from orbit" choice that works on all major browsers and protects against over 500 companies for which it has built profiles. It works well, blocking social media fluff only when it poses a direct tracking risk, letting it slide when it presents itself as a non-threatening hyperlink.

Get Off My Lawn offers a more basic blocking set for Opera and Safari, while Chrome has Widgetblock.

Firefox offers an experimental plug-in called Share Me Not, which prevents tracking without removing the button functionality from the website.

Cookies

Browser cookies are an almost antiquated way of tracking users across the web. The basic principle is simple: when you visit a website, the website asks your browser for permission to store some information on your computer in the form of a text file. This information is used to allow basic functions – such as a persistent login – to function.

In general, cookies are harmless. They contain information related to your journey through a website. They may contain your shopping cart items, or simply a unique ID that serves as a pointer to the information about you the server is keeping in its own database.

Every browser that allows third-party cookies comes with built-in tools to manage them. Cookies can be individually examined, deleted, set to clear on exit or otherwise manipulated. Because of this level of control – and a general public awareness of their existence – on the whole, cookies are a beneficial element of the modern web.

But they can be misused. The biggest issue with cookies are "third party" cookies. While your visit to Joe’s Shoe Shop may require their website to place a cookie on your computer in order for the shopping cart to work properly, the advertising banners running on that site may well place cookies on your computer as well.

Wherever you go on the internet, website after website, those cookies can be read. A great example is Google Analytics. Google probably knows more about your browsing habits through the pervasive presence of Analytics on virtually every website worth going to than it ever will by analysing your search terms.

Through cross-site cookie tracking, companies can build a profile of your activities. Turning off cookies altogether breaks the web, so very few people do so. Blocking third-party cookies only is a reasonable half-way measure offered by modern browsers, but this too can cause problems with badly coded sites. Luckily, there are innumerable browser add-ons to available to combat this sort of tracking without requiring a full-blown blocking.

TACO, Beef Taco (Firefox), and Keep My Opt Outs (Chrome), make use of permanent "opt-out" cookies to inform advertising networks that the user of this browser does not want to be tracked. Along with the various browser-specific do not track flags, these are ways of ensuring many of the most prolific advertising companies will grant you your privacy.

There are however plenty of offenders who don’t play nice. They either blatantly ignore their own opt-out cookies, or don’t offer any such tool in the first place. Ghostery can help here, but tools like Privacy Block (Firefox and IE) or Cookie Culler (Firefox) are better.

The privacy issues detailed above may seem overwhelming a first blush, but these are merely the basic issues that are easily overcome. The second part of this series will cover the more difficult threats presented by poorly configured browser add-ons, locally stored objects (LSOs) and the evercookie. ®

How to stay Anonymous - A Register Guide

Part 1 How websites use your browser to sell you for cash
Part 2 The Evercookie: Like trying to kill Steven Seagal
Part 3 Browser privacy at work: The BOFHs' guide

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.