Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA uses Google cookies to pinpoint targets for hacking

washingtonpost.com

Post reply on HN
Print view View original

1–10 of 178 posts

Re: NSA uses Google cookies to pinpoint targets for hacking

#4

Post by misiti3780 »

chroem wrote: post #3

Hah, the joke is on them: I browse with cookies disabled. Of course, I'm sure they have some other way to pwn me, but it's nice to know that I was doing something right.

if you browse with cookies disabled, that means you cannot successful browse arounds sites logged in - correct ? you basically do a ctrl+shift+N in chrome every time you open a new window ?

Re: NSA uses Google cookies to pinpoint targets for hacking

#6

Post by chroem »

misiti3780 wrote: post #4
chroem wrote: post #3

Hah, the joke is on them: I browse with cookies disabled. Of course, I'm sure they have some other way to pwn me, but it's nice to know that I was doing something right.

if you browse with cookies disabled, that means you cannot successful browse arounds sites logged in - correct ? you basically do a ctrl+shift+N in chrome every time you open a new window ?

I have a select few sites whitelisted, but they're disabled by default.

Also, I'm on Iceweasel/ Firefox instead of Chrome. It's probably nothing to worry about, but you can never be too careful these days.

Re: NSA uses Google cookies to pinpoint targets for hacking

#7

Post by Smerity »

There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites.

Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far have GA on them[2].

That means that you're basically either on a site that has Google Analytics or you've likely just left one that did.

If the page you're on has Google Analytics and isn't encrypted, the Javascript request and response is in the clear. That JS request to GA also has your referrer in it, in the clear.

The aim of my research project is to end with understanding what proportion of links either start or end in a page with Google Analytics. If it starts with Google Analytics, your present "location" is known. If the link ends with Google Analytics, but doesn't start with it, then when you reach that end page, the referrer sent to GA in the clear will state where you came from. All of this is then tied to your identity.

If people are interested when I get the results of my research, ping me. I'll also write it up and submit it to HN as it would seem to be of interest.

[1]: http://trends.builtwith.com/analytics/Google-Analytics

[2]: http://www.youtube.com/watch?v=pkoIUmP5ma8 (GA specific results at 1:20)

Re: NSA uses Google cookies to pinpoint targets for hacking

#8

Post by psbp »

gress wrote: post #5

So all that paranoia about being tracked by Google... wasn't paranoid at all. Yes, I know Google likely didn't cooperate in this, but they built a giant tracking engine, so it's not surprising to see it repurposed.

"I know Google likely didn't cooperate in this"

I'm sure they have plausible deniability.

Re: NSA uses Google cookies to pinpoint targets for hacking

#10

Post by bottled_poe »

In my opinion, browsers should block all third party website content by default. Yeah, I know, the interwebs will break if they actually did this. Well perhaps someone should come up with some kind of website quality rating which indicates that a site can be viewed withing worrying about the prying eyes of FaceBook, Google, Twitter, LinkedIn, etc.
Post reply on HN