Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA uses Google cookies to pinpoint targets for hacking

washingtonpost.com

Post reply on HN
Print view View original

81–90 of 178 posts

Re: NSA uses Google cookies to pinpoint targets for hacking

#81

Post by byoogle »

lemming wrote: post #79
byoogle wrote: post #47

Earlier quoted context omitted.

This. I work on Disconnect. I don't understand why any hacker would still put Ghostery on their machine: * Ghostery is run by former ad execs (7/9ths of their executive team): http://www.evidon.com/our-team * They make their money (I've heard tens of millions of dollars per year) selling user data to ad co's and data brokers: http://www.evidon.com/#block-views-from_our_partners-block

So I just tried Disconnect. A few comments: * I can't seem to see a list of all Google trackers. Some sites have multiple Google trackers, but if I click on the icon to see them it just turns off blocking for them. I'm assuming sites don't have 6 GA trackers, what are the others? * I can't seem to turn off Content trackers for all sites. Configuring this site-by-site seems clumsy, to say the least.

Thanks.

#2 first: Code to block everything marked as content with one click was either just checked in or is about to be.

For #1: Disconnect groups tracking requests by company. If you want to see all the Google services that Disconnect filters, you could look through the filter list (services are grouped by category and company here, so start at lines 33, 1,882, and 2,326): https://github.com/disconnectme/disconnect/blob/b27abbf033c6....

Re: NSA uses Google cookies to pinpoint targets for hacking

#82

Post by byoogle »

dictum wrote: post #80
byoogle wrote: post #47

Earlier quoted context omitted.

This. I work on Disconnect. I don't understand why any hacker would still put Ghostery on their machine: * Ghostery is run by former ad execs (7/9ths of their executive team): http://www.evidon.com/our-team * They make their money (I've heard tens of millions of dollars per year) selling user data to ad co's and data brokers: http://www.evidon.com/#block-views-from_our_partners-block

Why is the Disconnect trackers list ( https://services.disconnect.me/disconnect.json , referenced in https://github.com/disconnectme/disconnect/blob/master/firef... ) an encrypted blob? That seems to go against the OS nature of the project.

See the commit message at https://github.com/disconnectme/disconnect/commit/691897e21d....

The unencrypted list is at https://github.com/disconnectme/disconnect/blob/b27abbf033c6....

And formatted as JSON at https://disconnect.me/services-plaintext.json.

The encrypted list is also trivial to decrypt with the SJCL code in https://github.com/disconnectme/disconnect/blob/master/firef....

Re: NSA uses Google cookies to pinpoint targets for hacking

#84

Post by andrewcooke »

byoogle wrote: post #61
znowi wrote: post #59

Earlier quoted context omitted.

Sadly, Disconnect detects less trackers than Ghostery (e.g. 5 vs 7 on washingtonpost.com). I also like how Ghostery provides URLs for each tracker source (actual payload) that you can easily view on their site. There's also a database with short description, affiliations and privacy terms for each tracker (e.g. https://www.ghostery.com/apps/google_analytics ). I really appreciate an ethical alternative to tainted Gho…

Not true, Disconnect detects 13 trackers on http://www.washingtonpost.com/ . If you're running multiple filtering extensions all at the same time, install order matters as far as which extension sees which HTTP requests.

oh, interesting - can you explain the details? is it simple or random? if i install disconnect and then ghostery wil ghostery help with anything disconnect misses or is it more complicated than that? thanks!

Re: NSA uses Google cookies to pinpoint targets for hacking

#85

Post by andrewcooke »

fixanoid wrote: post #75
sdoering wrote: post #41

Earlier quoted context omitted.

Greetings. I nearly have the same policy, regarding surfing and my addons. I would only advise against Ghostery, as they whitelist some trackers, if being paid. With every update I had to reselect these trackers. And Evidon (Ghostery's mothership) selling usageinformation really bugs me: http://venturebeat.com/2012/07/31/ghostery-a-web-tracking-bl... I would recommend the FF-addon Diconnect: https://addons.mozilla.or…

Hi sboering, how are you? Ghostery does what the user tells it to do. If you are seeing unblocked trackers, most likely, its because we've added new trackers and you didn't select "block" by default for the new trackers when the list gets updated. You can change this preference by going into Ghostery options, Advanced, and review the "auto-update" section. And heres a full explanation as to what Evidon gets and what…

folks please don't downvote people when they're giving useful info. there is a button in the advanced section that makes blocking work by default on new data. that's useful to know - i've just enabled it, and you should too.

just because you don't like someone (likely based on one comment on a web site...) doesn't mean that they should be downvoted...

Re: NSA uses Google cookies to pinpoint targets for hacking

#86

Post by dictum »

byoogle wrote: post #82
dictum wrote: post #80

Earlier quoted context omitted.

Why is the Disconnect trackers list ( https://services.disconnect.me/disconnect.json , referenced in https://github.com/disconnectme/disconnect/blob/master/firef... ) an encrypted blob? That seems to go against the OS nature of the project.

See the commit message at https://github.com/disconnectme/disconnect/commit/691897e21d... . The unencrypted list is at https://github.com/disconnectme/disconnect/blob/b27abbf033c6... . And formatted as JSON at https://disconnect.me/services-plaintext.json . The encrypted list is also trivial to decrypt with the SJCL code in https://github.com/disconnectme/disconnect/blob/master/firef... .

Thanks! I was setting up a proxy for devices that can't use Disconnect or Adblock. I thought of adapting the Disconnect list to the proxy's block list, but a cursory reading of the source only showed the URL of the encrypted list.

Re: NSA uses Google cookies to pinpoint targets for hacking

#87

Post by koide »

fixanoid wrote: post #77
kissickas wrote: post #74

I see a lot of you are using Ghostery, which I've never even downloaded because they get paid to whitelist and are run by ad executives. Is there a reason why I would want Ghostery in addition to Noscript, or is all of the (privacy-protecting) functionality redundant? This news makes me happy to see there's a point to me having Google Analytics blocked the last two years. I've noticed a new thing, Google tag manager,…

Heh, Ghostery is not paid to whitelist anyone, I would know since I run the database for Ghostery. As to your question: NoScript does a different thing -- it concentrates on limiting known security issues by disabling Javscript. Tracking is accomplished in a variety of ways, and only some of them are Javascript based. Ghostery looks for all of these and lets users know who is tracking them on any given web page.

Why would you know how or why Ghostery is paid just because you run their database?

Unless you are something more than Ghostery's DBA.

Re: NSA uses Google cookies to pinpoint targets for hacking

#88

Post by dangrossman »

g8oz wrote: post #29
Smerity wrote: post #7

There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites. Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far…

Does blocking third party cookies stop Google Analytics from being used by the NSA in the way the article described?

Google Analytics uses first-party cookies. They're set and read on each website's own domain by JavaScript. Blocking third-party cookies wouldn't have any effect.

Re: NSA uses Google cookies to pinpoint targets for hacking

#89

Post by gorhill »

byoogle wrote: post #63
byoogle wrote: post #53

Earlier quoted context omitted.

I work on Disconnect and don't quite understand what your page is getting at (you probably ought to be disclosing that this is your page and project, btw). If you consider the Guardian page, for instance, all the domains you've listed as third parties except Google and Twitter actually look to be first parties serving content for the page. In other words: If you go to the Guardian, you're going to be tracked by the G…

To answer your reply to my reply: > Given the results, I am quite surprise you would say "look to be first parties serving content for the page". I believe every single domain name you listed (except the Google and Twitter domains, like I said) is a domain owned by or a CDN used by the Guardian or hosts an app run by the Guardian - prove me wrong: > facebook-web-clients.appspot.com > guardian-notifications.appspot.co…

> "prove me wrong"

This is a terrible answer: you are suggesting that Disconnect knows exactly which 3rd-party is legit when visiting a web page, and somehow you can vouch that none of these hostnames is a threat to privacy (this is what your defense of this implies).

`static-serve.appspot.com` is no different than `ajax.googleapis.com` (you didn't list this one, why?): they are 3rd-party hostnames, some are CDN which is exactly why they are not to be trusted, you can end up hitting these hostnames from other places than just the Guardian, which is the problem.

In any case, the legitimacy of their their purpose is not the point. They are 3rd-party hostnames: Unless being told, the user wouldn't know that he is also hitting these hostnames.

I will note that you completely disregarded the other results which are even more embarrassing to explain (like `simplereach.cc`: "SimpleReach tracks every social action on each piece of published content to deliver detailed insights and clear metrics around social behavior.")

Re: NSA uses Google cookies to pinpoint targets for hacking

#90

Post by dangrossman »

girvo wrote: post #52
psbp wrote: post #43

Earlier quoted context omitted.

Switching to Microsoft from Google is not an ethical accomplishment.

Despite the fact that I'm not the kind of person who "hates" Microsoft, you've got a point there: they were implicated in the NSA docs as much as Google was. In fact it sounded like they cooperated more than Google. Stick to smaller independent companies that have a good privacy track record.

If you care about e-mail privacy, you should consider desktop/native e-mail clients instead of webmail and IMAP.

Having all your mail sitting on someone else's server means it can be handed over by that company in response to a government request, legal or otherwise. After 6 months, it's not even a fourth amendment issue and no warrant is required; it's not "your" mail when it's data on someone else's server.

This doesn't require technical prowess the average person doesn't have. You can use your ISP's mail server, or a professional service like Rackspace Mail. There are free native e-mail clients for every desktop and mobile platform. You can still get instant mail notifications with IMAP Push. Just set at least one of your computers to delete mail from the server after downloading it.

Post reply on HN