Browser and WWW Security

[Chester_Pete]

Hi Guys,



Lots of PC savvy guys here, and wanted to know what people's thoughts are on security and being anonymous on the net. This is more for my kids than me and the future world they are to live in.





If you're interested in how actually anonymous you are on the internet, try this test

http://panopticlick.eff.org/

Apparently, I'm unique - which would be nice if it wasn't in the context of the WWW jungle

Yes, I know that some will say "Why are you bothered, who cares, get your tin hat etc" and thats fine.....but I'm more interested if anymore does any more than what most of us do

i.e. use a router, firewall and virus checker.



It seems the only foolproof way to anonymise/protect, is to regularly renew/change your computer, and any user ids you use on the net

However failing that extreme, is anyone using, or considering using something like Tor?

Tor is one way to anonymize/protect against the coming new wave of advertising profiling and can be downloaded here.

https://www.torproject.org/download/download-easy.html.en



The irony of course is that if only percentage of web users use "Tor", then statististically, they are more identifiable on a particular website.



Anyone got any tips apart from the usual? It seems that almost all browsers are affected.





EXTRA INFO

To activate "Private Browsing" in IE, press Ctrl+Shift+P, then use that session.

if you're checking EBAY or your email on somebody else’s computer, there's no danger of cookies lying around letting them back into your email account once you’ve gone - not sure about key loggers though...

http://www.howtogeek.com/howto/windows-vista/open-ies-private-browsing-mode-the-easy-way/

 

[Guddler]

Clicked on that link. Apparently my iPad 2's browser is unique. Best I get it on eBay right away. Retirement here i come

 

[Chester_Pete]

Clicked on that link. Apparently my iPad 2's browser is unique. Best I get it on eBay right away. Retirement here i come

Martin, Amusing as it is, the only people who'd get the in-joke - are those that know you, and anyone else who can google



I'm pleased for you that you're open and trusting, but I must admit I try to avoid posting personal info unless I really have to.

Especially about who I am, where I live, where I work, where I went to school, age, partner, who my friends are, how long I've lived at present address, pictures etc.



I'm quite sure someone could publish all that info about me right now - but I'd appreciate it if they didn't.



I was talking about this subject (not about you!) with the NLPS guys over our Xmas lunch recently.

You'd be suprised at the things that can be found out - including who your mortgage is with, and how the company you work for is doing, or what companies you've recently disolved......

In some cases, you have to pay for the info, in others, its free.



I'm not going to list what can be done as it should be obvious why not - a shopping list of crimes that can be done etc



Shoot the messenger if you want. I'm only looking for security and on-line tips for someon that posts on-line - thats all.

 

[Guddler]

No 'in-joke' intended at all. I simply found it quite amusing how that web page can make such a big deal about such stock bits that everyone can find out with a tiny amount of know how. I don't doubt that if I spent time - which I don't have as I'm busy writing web apps that use this information! - then I would start getting a bit paranoid about how much information is out there about me. But it's not coming from the info that page seems to love to highlight.



So let's take a look at the results of that page on my current browsing session. It says, in bold text none the less that my browser is giving out over 20.85 bit of identifying information. So, what are they?

• The user agent. Ok, so I accept this. Fine it potentially identifies the browser I'm using and my OS etc, potentially making it easier for people to exploit my system, but I can fake that if I wanted to.
  
• HTTP_ACCEPT headers - the type and kind of data i accept. Ok. Needed for the web to work.
  
• Browser plugin details - and? Maybe there might be some known exploits in one of those plugins i guess?
  
• Time Zone - whoopie!
  
• Screen Size and colour depth - mine's a big one
  
• System fonts - i like fixed width 'cause I'm a programmer
  
• Are cookies enabled - yes. Ok, first bit of useful, usable information
  
• Limited supercookie test - never heard of it, but looking at the results, yep, accepted, that's useful.
  

(and that is it - I've not left anything out)

So, I can see that some of this stuff is useful information but I don't really see why the need for the web page to scare monger it quite as much. In reality, the bulk of the score is made up from the fonts I have installed which really, really is of no practical use to anyone, and the Browser plugins. Which yes, I'll admit COULD be exploited.

Like you say, if you want to get round some of this then use an "In Private" or "In Cognito" or "Private" or whatever your browser of choice calls it session. But sadly you'll very quickly find out how much of the web breaks when things like cookies and aren't enabled.

I think the truth of the matter is, it just needs a bit of common sense. At the end of the day, what do I care if someone knows who my Mortgage is with? (Which they're not going to get from that browser information), or who I work for, or how well they're doing - that info is available to anyone provided the company is filing there reports with companies house as they should be.

So my point really is to take the whole thing in context. Use a firewall (hardware not software), virus software if you must use Windows, but not Norton or McAffee if you care about the performance of your machines. They're almost as bad as virii themselves!, more than just a grain of common sense, and stay safe.

Unless you want to go off grid. And I really wouldn't think that's even possible any more as whether you like it or not, just by having power in your home, you're online, like it or lump it.

Anyway, I've spent far too much time on this now. I need to crack on with that code