NSA uses Google cookies to pinpoint targets for hacking

http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10/nsa-uses-google-cookies-to-pinpoint-targets-for-hacking/

by mikecane • 13 years ago

337 173 13 years ago

washingtonpost.com

sehugg• 13 years ago

Interesting choice of cookie:

http://blogs.wsj.com/digits/2012/02/28/the-google-cookie-tha...

https://bugzilla.mozilla.org/show_bug.cgi?id=368255

PavlovsCat2• 13 years ago

Gotta love the arrogance of "This is intend behavior of the feature. WONTFIX for me.", without the ability to explain why this cookie would be required for the feature to function.

simfoo• 13 years ago

Also "...I am not worried that google is misusing this data...". This clearly isn't acceptable in a post-Snowden world.

driverdan2• 13 years ago

On Firefox, the cookie shows up automatically as part of Safe Browsing, unless a user disables “third party” cookies.

Disable 3rd party cookies. It solves a lot of these types of tracking issues.

chroem2• 13 years ago

Hah, the joke is on them: I browse with cookies disabled.

Of course, I'm sure they have some other way to pwn me, but it's nice to know that I was doing something right.

misiti3780• 13 years ago

if you browse with cookies disabled, that means you cannot successful browse arounds sites logged in - correct ? you basically do a ctrl+shift+N in chrome every time you open a new window ?

chroem2• 13 years ago

I have a select few sites whitelisted, but they're disabled by default.

Also, I'm on Iceweasel/ Firefox instead of Chrome. It's probably nothing to worry about, but you can never be too careful these days.

gress2• 13 years ago

So all that paranoia about being tracked by Google... wasn't paranoid at all.

Yes, I know Google likely didn't cooperate in this, but they built a giant tracking engine, so it's not surprising to see it repurposed.

psbp2• 13 years ago

"I know Google likely didn't cooperate in this"

I'm sure they have plausible deniability.

eli3• 13 years ago

It is indeed quite plausible.

001sky• 13 years ago

There was a quote here from oppenhimer the other day, about when it comes to cool technical solutions, you shoot (solve) first and deal with the morality (ask questions) later. Pity that everyon seems to be "hacking" the hell out of pandora's box, though.

PavlovsCat2• 13 years ago

If you build it, they will come.

Smerity• 13 years ago

There are two primary issues here: the prevalence of Google Analytics and the unencrypted nature of the majority of websites.

Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far have GA on them[2].

That means that you're basically either on a site that has Google Analytics or you've likely just left one that did.

If the page you're on has Google Analytics and isn't encrypted, the Javascript request and response is in the clear. That JS request to GA also has your referrer in it, in the clear.

The aim of my research project is to end with understanding what proportion of links either start or end in a page with Google Analytics. If it starts with Google Analytics, your present "location" is known. If the link ends with Google Analytics, but doesn't start with it, then when you reach that end page, the referrer sent to GA in the clear will state where you came from. All of this is then tied to your identity.

If people are interested when I get the results of my research, ping me. I'll also write it up and submit it to HN as it would seem to be of interest.

[1] http://trends.builtwith.com/analytics/Google-Analytics

[2] http://www.youtube.com/watch?v=pkoIUmP5ma8 (GA specific results at 1:20)

quesera10• 13 years ago

Please do post your research when it's cooked. It sounds like useful stuff.

Firefox, ABE, NoScript, Request Policy, Ghostery, HTTPS-everywhere, hygiene.

The irony of my militant approach toward privacy is that I probably make myself more interesting to would-be eavesdroppers by my carefulness than I would if they could see it all -- I'm just not that interesting.

On the plus side, the LCD of legitimate-threat hostiles is greatly increased. I'm fairly boring even to neighbors and law enforcement and copyright holders and scam artists and advertisers. I imagine I'm pretty stultifying to nation-state actors. :)

Still, I'd like everyone else to join me so that I can get lost in the crowd. The untracked, encrypted, well-rested crowd.

Come on in, the water's fine.

dunham• 13 years ago

I use Ghostery/Adblock, but I have found that it breaks some web sites (whose javascript expects the tracking code to be loaded).

BTW, if you're using Chrome, you might also want to look into the "Users" section of preferences. You can create multiple user profiles with separate history, cookies, cache, etc. You can have a different user profile per window at the same time. (After you create a second user, there will be an icon in the top right corner of the window to open a window as another user.)

I like to use this to protect against CSRF. (I do financial stuff as another profile and facebook as another profile.) It's also useful for QA if you need to be logged in as multiple people at the same time.

rosser• 13 years ago

My approach is similar to yours. I also take the step of using services I'm persistently logged into in different browsers than the one I do my general browsing in.

I also share your concern that my (lack of a) footprint makes me an outlier, and thus inherently more interesting to an adversary with the power and reach of No Such Agency. There's precisely zero I can do about that, without compromising my local objective of not being followed by every damned website, though, so I just carry on.

bigiain• 13 years ago

Idea: A service to allow people to anonymously "share" Google tracking cookies. Perhaps a local transparent proxy that MITMs all your cleartext Google requests, and re-writes the tracking codes on the fly, submitting the ones you've been given and retrieving other "real" ones from a service (probably a TOR hidden service?)

sdoering2• 13 years ago

Greetings. I nearly have the same policy, regarding surfing and my addons.

I would only advise against Ghostery, as they whitelist some trackers, if being paid. With every update I had to reselect these trackers.

And Evidon (Ghostery's mothership) selling usageinformation really bugs me: http://venturebeat.com/2012/07/31/ghostery-a-web-tracking-bl...

I would recommend the FF-addon Diconnect: https://addons.mozilla.org/en-US/firefox/addon/disconnect/

Does anybody have an idea, how I could make my own sites secure in a relatively cheap way? Just a personal site with not that much traffic, so spending much money seems a bit off to me.

Ideas?

r0h1n• 13 years ago

I would replace Ghostery in your list with Disconnect. I would also add the 'Self-destructing Cookies' browser plugin. In its settings, whitelist a very limited set of sites you want to allow persistent (or session) cookies.

goooderybucket• 13 years ago

I also recommend installing them and running the extra mile by changing your default search engine to DuckDuckGo (HTML SSL) without javascript (use NoScript). They temporarily track you and HTML one gives you direct links as opposed to redirects.

You can even modify you Firefox by changing values in about:config

geo.enabled ---> false

keyword.URL ---> Your Search engine query url

browser.urlbar.trimURLs ---> false

noscript.ABE.wanipCheckURL ---> 0

network.http.sendReferheader ---> 0 network.http.sendSecureXSiteReferrer ---> false ^these ones break some site functionality that rely on it. It's rare at least.

salient2• 13 years ago

It doesn't really matter if you're "interesting" or not. They're using keyword filters anyway, so if you don't encrypt your stuff, and say something that they consider suspicious, you'll probably show up in their alert system anyway. Welcome to the surveillance state and self-censorship. I'd say it's worse to not have your data encrypted.

reginaldjcooper4• 13 years ago

Still, I'd like everyone else to join me so that I can get lost in the crowd. The untracked, encrypted, well-rested crowd.

There's this add-on called Blender that is supposed to make your browser send headers like the average browser, you might be interested in that.

tunap• 13 years ago

ABE, NoScript, HTTPS Everywhere, Blender. Run em all in Sandboxie for pr0n and spelunking.

Like to point out what may be obvious to some but not others, when using NoScript you may want to remove Goog, Yahoo, etc from the default whitelist.

Before Blender I used various iterations of FF for testing & different surfing types(Waterfox/PaleMoon/ESR), but it appears I'll only be doing that for testing purposes anymore. https://addons.mozilla.org/en-US/firefox/addon/blender-1/?sr...

reginaldjcooper4• 13 years ago

What is this hygiene add-on?

malandrew• 13 years ago

Can't we simply block all requests to Google Analytics so that the GA javascript is never loaded?

joshfraser• 13 years ago

Sure, just black hole www.google-analytics.com and ssl.google-analytics.com in your hosts file.

Hellenion• 13 years ago

if you have iptables you can try amici: http://github.com/upwhere/amici

g8oz• 13 years ago

Does blocking third party cookies stop Google Analytics from being used by the NSA in the way the article described?

dangrossman2• 13 years ago

Google Analytics uses first-party cookies. They're set and read on each website's own domain by JavaScript. Blocking third-party cookies wouldn't have any effect.

droopybuns• 13 years ago

+1'ing more encouragement.

I've been in the internet industry for a while now.

For what it's worth, I think your thesis has significant value.

DannyBee• 13 years ago

"My own partial results from a research project I'm doing using Common Crawl estimates approximately 39.7% of the 535 million pages processed so far have GA on them"

This is interesting. I would have actually expected more. The last time I remember someone analyzing this, I believe the result was "<script ... ga.js>" was the most popular tag on the web by far. This was, however, a few years ago.

mike-cardwell4• 13 years ago

Why do we still have referrers? They don't allow us to do anything that we wouldn't be able to do without them. If Mozilla and Google made a statement today saying, "We'll be removing referrers from cross site requests in 6 months time for Chrome and Firefox.", the tiny tiny proportion of sites that are using them for real functionality will have plenty of time to update.

Of course, as a web developer, it's useful to be able to see where people came from. But we don't have any right to that information. As an end-user, why the hell is my browser giving you this information for no reason when it doesn't have to?

I've been using RefControl for Firefox for years now. It fakes the referrer, setting it to the root of the domain being requested. This hasn't ever caused me any problems, so there can't be that many sites that rely on it.

I don't give a shit about your analytics or how much money you think you'll lose from referrers disappearing. Privacy is more important.

leephillips• 13 years ago

You ask, "Why do we still have referrers?", but then you answer your question: "as a web developer, it's useful to be able to see where people came from."

You are of course correct that we don't have a "right" to this information. But I've discovered, many times, through the referrers in my logs, links to my pages from some very interesting places that I might not have discovered otherwise (because the link information that Google discloses is woefully incomplete).

Any user who wants to hide referrer information can easily to do in a variety of ways. For example, I wrote a bookmarklet that does this for you: http://lee-phillips.org/norefBookmarklet/

JohnTHaller7• 13 years ago

For lots of us using basic CDN services, we enable referrer checks to ensure that folks aren't hotlinking images or direct linking downloads from other sites. These CDNs allow basic blocking based on referrers. You usually set it to only permit when there is a referrer from your own domain as well as blank referrers (if the CDN supports it) since most privacy conscious folks will disable referrer rather than fake it. We don't actually care that you don't provide a referrer, we just don't want other sites using our images in their own pages (leeching our bandwidth we pay for) or direct linking to binary downloads (bypassing our site with our advertising or revenue possibilities or branding but using our bandwidth).

j_s• 13 years ago

Google is already killing referrer on search results (by redirecting), to force people to pay for Analytics

reginaldjcooper4• 13 years ago

I use a RefControl and just don't send the header, although I feel that's close to being the least of my worries.

I just thought I'm already using NoScript, AdBlock, RequestPolicy, BetterPrivacy, Cookie Monster, Blender, and HTTPS-Everywhere; might as well go all-in.

cataflam• 13 years ago

That JS request to GA also has your referrer in it, in the clear. (...) If the link ends with Google Analytics, but doesn't start with it, then when you reach that end page, the referrer sent to GA in the clear will state where you came from.

I'm curious. In that case, the GA JS is requested from what you call the "end page", so the referrer it has should be the "end page", not the one before it.

bdt101• 13 years ago

Google Analytics uses only a first party cookie to identify visitors. That means your id is different on each site you visit. You therefore cannot track a unique visitor across the web using GA cookies.

Google Analytics requests are also only unencrypted if the site itself is unencrypted, so the fact that the GA request includes the referrer doesn't seem relevant (since the referrer would have already been transferred in the clear in the Referer header on the initial HTTP request.)

declan• 13 years ago

I wish you luck with your research, but I'm not sure your look at Google Analytics is relevant to this discussion or the Washington Post article that started this thread.

First, as <bdt101> pointed out, you "cannot track a unique visitor across the web using GA cookies" because of the way they're designed: https://news.ycombinator.com/reply?id=6889120&whence=item%3f...

Second, the NSA doc as excerpted in the WashPost article talks only about Google's PREF cookie, which is set only when you go to say Google.com, not when you go to a non-Google property. It's a first-party cookie used for things like saving language preferences when you're not logged in, not for advertising across other properites. (That's what the Doubleclick cookie is for.)

aethertap• 13 years ago

Regarding the prevalence of GA, I've been experimenting with self-hosting analytics on my own domains using piwik [1]. So far, I'm pretty pleased with it and I feel somewhat better knowing that my users' data doesn't go to any third parties.

It does everything I want it to do (so far), but I'm not an analytics power user by any means.

[1] http://piwik.org/

cromwellian• 13 years ago

Don't even need cookies if you have JS enabled (https://www.eff.org/deeplinks/2010/05/every-browser-unique-r...) Without JS and with HTTP headers alone, you might be able to reduce entropy by using Geo-IP.

bottled_poe• 13 years ago

In my opinion, browsers should block all third party website content by default. Yeah, I know, the interwebs will break if they actually did this. Well perhaps someone should come up with some kind of website quality rating which indicates that a site can be viewed withing worrying about the prying eyes of FaceBook, Google, Twitter, LinkedIn, etc.

pavanred• 13 years ago

Firefox + Third party cookies blocked + Ghostery + NoScript

Can be a little inconvenient at times but seems justified now.

greenyoda• 13 years ago

If you're using Firefox, you might like a little add-on called "Cookie Monster", which lets you easily control which sites can set cookies (permanently or temporarily) and indicates whether the site you're on has attempted to set them.

https://addons.mozilla.org/en-US/firefox/addon/cookie-monste...

Anonymous823• 13 years ago

I made a post the other day, but it got pushed off 'new' in a few seconds. Anyway, I thought someone should setup a simple one or two page site that summarizes the importance of not tracking visitors. Then, it has a few 'this site respects your privacy' images in a variety of sizes that you can copy and paste into your own site, if you agree to respect those rules.

It would need to be a recognizable image and symbol. The image would link to the site above, that informs users how you respect their privacy and do not track them. Personally, I'd add it to my sites, because with all the recent concern about privacy, I think my users would appreciate this change, and it would provide some advantage over competing sites. I'd like to visit a site, see that image in the footer, and feel more confident using their service.

I think it would be a good way to encourage change from developers. Very few are going to pull Google Analytics on their own. However, if they get pressure from their users to follow a certain privacy standard, and by doing so they can drop an image on their site to illustrate the change and potentially increase trust and improve their reputation, we might see some improvements.

vu3rdd• 13 years ago

I have more or less the same opinions as you. I wrote my browsing setup optimized for privacy here: http://rkrishnan.org/posts/2013-12-01-firefox-privacy.html

Comments and further improvements welcome.

dobbsbob• 13 years ago

German Privacy Foundation does this

eli3• 13 years ago

Quality rating? I don't see how that could possibly work in practice...

pktgen• 13 years ago

Here's my ideal security policy:

- Cross-site requests not allowed without whitelisting. This means some setup will be required at first (for example, for separate image domains used by Amazon, Google, Yahoo, etc.), but after a bit it shouldn't be a problem. This also serves as a "better adblock" in some ways, as it blocks ad networks without relying on a database that needs to be updated.

- All cookies blocked by default; whitelist as necessary

- JavaScript disabled by default; whitelist-enable as necessary

- No Flash or Java, period. If I need Flash for something, I'll launch a VM.

Sadly, Safari doesn't support whitelisting for any of this. Chrome supports whitelisting of cookies and JS by default, but the Chrome UX is worse than Safari's IMO (for a few reasons, but that's another topic entirely).

RequestPolicy handles the first one quite well, but is unfortunately Firefox-only.

quesera10• 13 years ago

Safari is effectively ungovernable, and Chrome is part of the problem.

Firefox is the answer. No other option makes any sense, if you're serious about this stuff. I understand that some people like the UI or process model of other browsers better, and that's where the evaluation of priorities comes in.

The good news is that the days of Chrome's technical superiority are truly over.. Speed, memory consumption, rendering engine...Firefox is all there and sometimes better.

Firefox is also the only browser with an ability to sanely handle tabs on the side, which is the only sane place to put tabs on modern screens. If I had to choose between sane tabs and sane privacy policies, I might have some soul-searching to do. I understand that everyone has their own equivalent, but be sure not to dismiss Firefox based on historical issues.

gorhill11• 13 years ago

Doesn't that fulfill all your points: https://github.com/gorhill/httpswitchboard

Posted on HackerNews two days ago.

noinsight• 13 years ago

Since browsers have varying support for even creating plugins for this, maybe it would be possible to create a proxy server that could handle this stuff?

hnha• 13 years ago

this would just lead to sites using subdomains pointed to the ip addresses of those.

driverdan2• 13 years ago

Disabling 3rd party cookies works just fine. I've been doing it for years.

gorhill11• 13 years ago

What a coincidence... I was just a few seconds ago, before taking a break to read HackerNews, investigating an issue with a Chromium blocker (https://github.com/gorhill/httpswitchboard/issues/79#), and was puzzled finding that the `pref` cookie of `.google.ca` changed every single time the tab of the page lost focus. Even went to Google privacy page to understand what this cookie did, with nothing in their statement that could explain this. Now this?

gorhill11• 13 years ago

That part (value of `S`) changes everytime the tab loses focus: pref=[...]:S=J3ITrb9DNMWLQBzc

What kind of "preferences" changes in that way each time the user browse away the page and how does it help "user experience"?

samstave• 13 years ago

So, are you saying that through this - NSA can see exactly which tab you are viewing at which time?

grey-area• 13 years ago

Google analytics tracks your time on page, and is probably storing values to do with that when you lose focus on the page - this is used in analytics for showing site owners engagement etc. Re the pref cookie, it could well be to track your interaction with searches, as they do for site analytics, if it changes when you leave a page, that's the most likely explanation.

gress2• 13 years ago

Also, it's worth pointing out that the tracking isn't for search. It's for more profitable advertising.

suprgeek• 13 years ago

A perfect reason to NOT let Google own all layers of the stack between you and the internet (or indeed the real world).

Search - Check (goog.com)

Mail - Check (Gmail)

Browser - Check (chrome)

Devices - Check (Android/Chrome books)

Websites - Check (Double click/AdMob, Unknown number of other companies)

Google Analytics - Check

Your DNA - Check (23&Me)

Cars - Check (self-driving cars)

I am probably missing large chunks of tracking even with this list.

Where do you draw the line so that organizations like Google do not handover (willingly or inadvertently) our life to NSA, GCHQ, ASIO, CSIS & whatever New Zealand's Intelligence spooks go by, on a platter?

Heterogeneity - Make the buggers at least have to work a little bit to invade your privacy.

eli3• 13 years ago

Your larger point might be true, but has nothing to do with the current revelation.

If every site switched from Google Analytics to, say, Mixpanel... nothing would change. The NSA would just target the equivalent mixpanel cookie. So long as their are popular third-party cookies, this will be a problem.

jdubs• 13 years ago

It also seems like does the risk of being eased dropped upon outway the benefit of having data to drive business needs?

IBM• 13 years ago

Search was easy to replace. Bing and DuckDuckGo are both good. Firefox was an easy switch now that Chrome seems to be much more of a resource hog (and the extensions are better). I don't have an Android phone. For e-mail I've switched to Fastmail but Outlook is also a good alternative if you want something free. I don't use anything else. I'd say e-mail was the hardest friction point of them all, but overall it was pretty easy to leave Google.

psbp2• 13 years ago

Switching to Microsoft from Google is not an ethical accomplishment.

lallysingh• 13 years ago

I think you're focusing on the wrong (or at least, non-primary) axis: destination. I'd suggest your on-wire image instead: packet header, protocol, encryption, etc.

This is all assuming you consider your adversary to be the NSA. If it's google, well, choose other vendors. If it's both, you'll have to consider both your destination and wire-protocol axes.

FWIW, if your traffic is split evenly between 3-4 main vendors (e.g., google, amazon, bing, etc), and all HTTPS, it's hard to tell what you're doing.

jodrellblank• 13 years ago

I am probably missing large chunks of tracking even with this list.

Enormous amounts of things have some connection into Google. Other connections into Google's equipment potentially include Voice, Talk, Hangouts, embedded Google Plus +1 buttons, embedded YouTube, Blogspot sites, embedded Picasa images.

Google runs ReCAPTCHA. ( http://www.google.com/recaptcha/ )

If you email someone with a GMail account your email address is in Google's servers with the email header containing your IP address.

Google's SafeBrowsing URL check built into FireFox which normally works by hashed URLs but could still track that you are using it, but has a simple version of the API so applications could send plain text URLs to it without you knowing ( https://developers.google.com/safe-browsing/ ).

Sites hosted on Google AppEngine ( https://developers.google.com/appengine/ ).

If you have IOS, Safari defaults to Google suggestions - i.e. sending everything you type in the address/search bar to Google.

Google Maps, built into other websites and services. Google Geolocation API built into other software ( https://developers.google.com/maps/documentation/business/ge... ).

Google DNS (last time I read the privacy policy, it said queries are not combined with other data Google collects).

Sites loading popular JavaScript from Google's hosted libraries ( https://developers.google.com/speed/libraries/devguide ).

Sites embedding Google Sparklines ( https://developers.google.com/chart/interactive/docs/gallery... )

Links going via Google's URL shortening service Goo.gl

Not counting things you choose to use (Chromecast, music, docs, drive, Now, voice search, News, Groups, Finance, Toolbar, Android sat nav, Chrome's open tab sync between your devices via Google Cloud, etc.).

That's not to say they are good or bad, or they are or are not tracked. Just that it's way to late to "avoid Google" just by switching away from GMail and blocking Google Analytics.

http://en.wikipedia.org/wiki/List_of_Google_products

judk• 13 years ago

Is there a way for mobile browsers to block analytics cookies JS , a la ghostery and adblock?

maxerickson• 13 years ago

Adblock Plus is available for Firefox on Android.

fixanoid12• 13 years ago

Ghostery is available as a stand alone app for iOS, and has extensions for mobile Firefox and Opera.

timbro2• 13 years ago

it lets NSA home in on someone already under suspicion

Like OWS protesters, for example.

drawkbox• 13 years ago

So not only are businesses like cloud services, video games and messaging/devices affected by anti-business NSA trust breaches. But now we have the advertising industry that is going to be affected by the anti-privacy and anti-business practices of over the top spying on individuals. If any private company was doing this there would be legal issues.

timbro2• 13 years ago

No website has to have Google track their users. If you do it, you choose to do it (you're disrespecting your users).

You can get your open-source and locally running web analytics here: https://prism-break.org/

jimworm• 13 years ago

Let's be charitable to the NSA for a minute, and imagine that they are following the plot of the God Emperor of Dune[1], where in seeing the danger posed to the Internet by the formation of cloud service giants, they became the fearsome yet benevolent tyrant, strategically planning an engineered leak, so that on their death the Internet would react by distributing its services among many providers in The Scattering, thus ensuring the safety and continued survival of the Internet.

[1] https://en.wikipedia.org/wiki/God_Emperor_of_Dune

salient2• 13 years ago

Relevant:

http://betanews.com/2013/12/09/tech-giants-surveillance-refo...

As long as these companies build the best tracking engines the world has ever seen, that can identify anyone and everything they're doing, it's just a matter of time before governments get their hands on that data, legally or illegally. It's just too tempting to pass.

If I were Google I'd start thinking long and hard about how to solve this problem, and try to make money by actually being on the user's side when it comes to privacy, not against them. Google will ultimately fail if their goals aren't aligned with those of the users anymore.

bosch• 13 years ago

Can someone answer this question:

From a business perspective why is Google and Facebook getting involved in this and calling for the government to not track users. Won't that just bring more attention to their two business models of... wait for it... tracking users and selling their information?

arbitrage• 13 years ago

Because their customers are pissed off, and if they don't do something to mollify them, they'll lose money.

Previously, when the customers didn't care, they did nothing to involve themselves with this, and almost certainly aided the government.

It's purely business. Google and Facebook don't have morals, they have a bottom line. You can understand their actions by following the money.

rl3• 13 years ago

To speculate: For connections that utilize NAT devices, NSA probably has analysis tools designed to attempt segregation of network traffic on a per-user basis.

Browser string, viewed content, frequency and magnitude of access, user authentication cookies, and ad-tracking cookies all would be tremendously helpful for this purpose.

Also, I'm betting they can easily tell when specific computers on a network are powered on or not based on fixed-interval network traffic from anything that polls regularly, such as anti-virus, news readers, mail clients and background updater services.

All of the above could aid in painting a more complete per-user picture behind the NAT, without actually having to compromise the local network or individual computers in question.

kissickas• 13 years ago

I see a lot of you are using Ghostery, which I've never even downloaded because they get paid to whitelist and are run by ad executives. Is there a reason why I would want Ghostery in addition to Noscript, or is all of the (privacy-protecting) functionality redundant?

This news makes me happy to see there's a point to me having Google Analytics blocked the last two years. I've noticed a new thing, Google tag manager, lately. Any point in whitelisting this? Anyone know what it does?

fixanoid12• 13 years ago

Heh, Ghostery is not paid to whitelist anyone, I would know since I run the database for Ghostery.

As to your question: NoScript does a different thing -- it concentrates on limiting known security issues by disabling Javscript. Tracking is accomplished in a variety of ways, and only some of them are Javascript based. Ghostery looks for all of these and lets users know who is tracking them on any given web page.

koide• 13 years ago

Why would you know how or why Ghostery is paid just because you run their database?

Unless you are something more than Ghostery's DBA.

usrnam• 13 years ago

Last weak i create extension for Firefox:

Disable Google tracking, log off user FROM Google search engine: * keep login into Gmail * also remove ads * remove Cookie,Sess~/localstorage __ First run, need refresh Google page to log off ~~

-- Also remove Google anal-itics Cookie :)

https://addons.mozilla.org/pl/firefox/addon/googleantyspam/?...

chanux• 13 years ago

For anyone who would find this useful: Self destructing cookies add-on for Firefox https://addons.mozilla.org/en-US/firefox/addon/self-destruct...

reginaldjcooper4• 13 years ago

This is a polished and wonderful add-on.

goldvine• 13 years ago

This is beyond ridiculous at this point. Wondering what else is still to come...

dangayle2• 13 years ago

As someone who works closely with several web marketing folks, this hits close to home. Each time they open a Snowden file, things get weirder and weirder.

elwell• 13 years ago

The problem with this is that most of the general public will read it as "Google helped NSA intentionally ..."

tejaswiy• 13 years ago

I mean, disgust aside, technically NSA is doing some seriously cool shit. I wonder what you could do if you had access to a de-identified data dump from the NSA.

NSA uses Google cookies to pinpoint targets for hacking

Related Stories