Web Privacy

Threat modeling

You can’t hide from everyone, so decide who you are hiding from. I start with every entity that has a pure profit motive. They want your data and want to organize it to make money.

Your data is every choice you make on the web: where you go, when, with what browser, how long you stayed, what you put in your cart and took out. You can’t hide that from the site you’re on. You can hide who is browsing.

If you’re logged in to a store shipping to your real address with your real card, that’s fine. They need it. But if a site doesn’t need you logged in, don’t let companies follow you across the web.

The browser fingerprint

Your browser tells sites a lot even when you’re logged out: screen size, fonts, language, plugins. Data brokers combine that logged-out browsing with logged-in services and tie it to your name.

The padlock (HTTPS) doesn’t stop this. It only protects the connection between you and the site, so someone on your Wi-Fi can’t snoop. The site and your ISP still know you’re there.

The ISP problem and DNS

Your ISP sees what it can. That includes your DNS requests. DNS is the phonebook of the internet: you type “example.com” and your computer asks a server for the address.

You  -> "Where is example.com?"  -> ISP DNS server
You  <- "192.0.2.1"              <- ISP DNS server
You  ==========================> Website (ISP still sees the connection)

What to do about it

• Encrypted DNS: Quad9 or ControlD, set in your browser or router. Your ISP can no longer read your lookups. It can still see the addresses you connect to, so this is one layer, not invisibility.
• A VPN you trust: It hides your traffic from your ISP, but the VPN company then sees it instead. Pick one that is paid, independently audited, and open source.
• Browser extensions: uBlock Origin stops third-party tracking scripts from loading, which breaks cross-site tracking.
• A second browser: Keep a signed-out one for reading.

Reading past the ads

Search results begin with sponsored links. Think of them as the kiosks in the middle of a mall. Scroll past to the actual stores: the organic results.

When a site breaks

Sometimes uBlock stops a tracker and the site throws a fit. Think of uBlock as a bouncer at the door.

1. Wait 5 seconds.
2. Click the uBlock power button to pause it for that site.
3. If it still fails, it’s the site’s fault. Try later.