Blocking Google and Facebook using Ad Block Plus and Ghostery

http://www.leaseweblabs.com/2014/02/blocking-google-facebook-using-ad-block-plus-ghostery/

by maus80 • 12 years ago

55 49 12 years ago

dfc4• 12 years ago

In my experience Adblock Plus, NoScript and RequestPolicy allow much more control than Adblock Plus and Ghostery. Adblock is even easier to use if you install the Element Hider Helper.

xenophonf• 12 years ago

RequestPolicy is pretty awesome. I've switched to Adblock Edge, which hopefully protects me better than Adblock Plus. Unfortunately, the more I delve into web privacy, the more I think that non-technical users are screwed. How on earth are mere mortals supposed to protect themselves when someone skilled in the art has a difficult time getting web sites to work in a privacy-maximal fashion?

djent• 12 years ago

I had to install Adblock on my mother's laptop after she visited a webpage with a malicious advertisement. I went ahead and installed HTTPS Everywhere and Ghostery while I was at it. Non-technical users are completely up the creek without a paddle.

newman314• 12 years ago

The combination of RequestPolicy, Ghostery, HTTPS Everywhere and Adblock Plus breaks formatting The Verge for me. I have yet to find a solution.

Looking at the RequestPolicy log does not present an immediately obvious solution.

mutemule• 12 years ago

I honestly don't understand why RequestPolicy doesn't get more love from the pro-privacy crowd. It does exactly what they want: prevents sites from issuing HTTP requests to other sites.

I once used a rather ambitious collection of addons, and I've since reduced it to just NoScript and RequestPolicy. And NoScript actually allows Javascript everywhere; it just has the XSS filter enabled. As a result, the vast majority of websites (with a categorical exception, below) work without any fiddling, and I don't see any third-party content at all: advertisements, share/like/+1 buttons, etc.

My only complaint about RequestPolicy is its lack of wildcard domain matching. I'd love to allow access from all sites to 'x.cloudfront.net', but that's not possible in the current version. (Rumour is that this is being fixed, and while I can confirm that wildcards are supported in the alpha version, it's definitely not ready for real-world usage yet.) Unfortunately, this means that some sites just don't work right; eg. 'x.blogspot.ca' always renders oddly, because they all pull from 'blogblog.com' and 'blogger.com'.

paulgb3• 12 years ago

It surprises me that more people don't just block third-party cookies. No need to maintain blacklists that way. Sure, you still see ads, but it keeps tracking at bay.

radley3• 12 years ago

Because I need cookies for all my logins and subscriptions. Ads I don't need and take up a lot of screen space.

Encosia• 12 years ago

third-party cookies are rarely necessary for logins (typically just when logging in with oAuth providers like Facebook and Twitter).

Terretta• 12 years ago

I block third party cookies, Ghostery, and block Flash. I've even opted out on the various ad tracking opt out aggregators.

I still get shown ads correlating to other sites I've visited, searches I've done, or emails I've received on Gmail.

I searched for Niles and Russound multi-room audio one Friday last summer, and HTD.com (Home Theater Direct) has been showing me whole house amps everywhere I go ever since.

The third party cookie block doesn't seem to help much any more.

Pacabel• 12 years ago

That's a pretty bold claim to make.

If third-party scripts or images are still being requested, then what prevents a site- and/or page-specific identifier from being included in the URLs of those assets? And what then prevents those site IDs, page IDs, the IP address you used to make the requests, your user agent's User-Agent string, the Referer header values, and other identifying information from being collected and stored? What prevents them from them from then tying this information together in a way that tracks you and your browsing behavior?

Keep in mind that cookies of any type are not at all necessary for such tracking to occur. The only way to truly avoid that kind of tracking is to not make any such requests in the first place.

lmkg• 12 years ago

I work in web analytics. Recently, one of our clients decided that they wanted to track visitors across multiple domains. After much hemming and hawing, and research proposals, and industry comparisons, the ultimate solution that was decided upon was... third-party cookies.

The change is extremely simple, and the data loss from people who block third-party cookies is like 5%.

So what prevents sites from deploying these technologies? Economics. To your point, there are no insolvable technical barriers. But right now the marginal return return on these technologies in no way stacks up to the marginal effort required to deploy them. Considering the fraction of the population that even knows what a cookie even is, I do not anticipate this changing in the near future. If everyone starts blocking third-party cookies, then yes we'll see an uptick in use, but I don't see that happening this decade.

username2233• 12 years ago

Not so much. AFAICT anything including an IFRAME to Google (e.g. a map) will set their tracking cookie, and anything fetched from any of their servers will probably try to identify you via browser fingerprinting. To do anything that really matters, you need to block the HTTP requests.

paulgb3• 12 years ago

I just tested this and it's simply not true. Cookie headers to an iframe from a third-party domain are suppressed when third-party cookie blocking is on, and sent when cookie blocking is off.

Google whitelists their own third-party cookies by default in Chrome and it's possible other browsers come with a preset whitelist as well, maybe that's what you encountered.

unlimited_power• 12 years ago

http://www.areweprivateyet.com/

dredmorbius• 12 years ago

Y'know, something more than a naked link is going to be just a smidge more useful and informative:

AreWePrivateYet recreates Stanford University's Tracking the Trackers: Self-Help Tools study on a continuous basis in a reproducible way. The above chart compares the level of protection provided by the different privacy extensions across various metrics.

aj2• 12 years ago

It is also worth mentioning that http://www.areweprivateyet.com/ is created and maintained by Evidon, the makers of Ghostery (and unfortunately, they have no placed any obvious disclaimer except the footer mention and the top right ghostery logo which is not entirely sufficient imo

radley3• 12 years ago

Check out Adblock Edge. They're a branch the last version of Adblock Plus before ABP whitelisted everything Google.

https://addons.mozilla.org/en-US/firefox/addon/adblock-edge/

dfc4• 12 years ago

Is not needing to uncheck the box that says "allow non-intrusive ads" the only thing adblock edge has to offer?

radley3• 12 years ago

Not by my experience. I also use Element Hiding Helper and found many Google-based elements (such as YouTube sponsored videos) would still be visible using ABP. When I switched to ABE, my filters worked as expected.

double051• 12 years ago

Ghostery is fantastic after you've set everything to get blocked automatically, but it's noisy out of the box (you have to really go through every setting to get it just right), and many websites simply break if you block some external scripts from loading.

sweedy• 12 years ago

Here comes the next story where the writer makes no difference between adbloc Plus (https://adblockplus.org) and Adblock (https://getadblock.com)

ladzoppelin• 12 years ago

Does anyone know how Bluhell Firewall (Firefox) does against trackers?

rmrfrmrf• 12 years ago

The last time I checked out Ghostery, it phoned home by design. Is this still the case?

username2233• 12 years ago

Probably. They're pretty open about their business model -- gather data about where ads get served, and sell that to the people buying those ads. As long as a minority of people use Ghostery, they can keep making money.

The only real way to control tracking is via an HTTP proxy that blocks connections to known bad actors (e.g. Google). Keeping an up-to-date list of miscreants is a pain, but doable. Ghostery does this for you, for a price.

Silhouette• 12 years ago

From https://www.ghostery.com/privacy:

"Ghostery does not collect any data by default. You may choose to send us data by enabling the Ghostrank™ feature."

r0h1n2• 12 years ago

Adding a couple of solutions to the bucket. The first is of course Disconnect [0], which does everything Ghostery does and more, minus their "compromised" business model -

The second is "Self-Destructing Cookies" [1], a browser add-on that deletes cookies as soon as a tab is closed. Those sites whose cookies you do not want deleted (like, say, HN), you can add to a whitelist.

And yes, use AdBlock Edge instead of AdBlock Plus.

[0] https://disconnect.me/ [1] https://addons.mozilla.org/en-US/firefox/addon/self-destruct...

dfc4• 12 years ago

Disconnect is an "of course"? I looked at their issues page and saw these two open requests that are basic requirements for me:

"Feature: option to manage Whitelist/Blacklist #272 -- The whitelist is being stored in JSON format in the FF prefs.js, this is really hard to manage manually. I'd like a basic dialog for Whitelist/Blacklist management of sites."

"Element hiding in Firefox #237 -- Implemented?"

Scanning the rest of the bugs it seems like they do a bad job of doing what HTTPS-Everywhere does extremely well and the graph of behavior-tracking websites looked like a crappy version of LightBeam.

r0h1n2• 12 years ago

I personally don't use whitelisting, but yes, the lack of an element hiding element is felt.

Just did a quick Google search and discovered it might be possible to use the "Element Hiding Helper" plugin with Adblock Edge: https://addons.mozilla.org/en-US/firefox/addon/adblock-edge/...

joveian2• 12 years ago

I like Ghostery so far, but the Self-Destructing Cookies add-on looks excellent, thanks :). I just wish that it (and Ghostery) would not make obnoxious and useless notifications by default. Easy enough to change, though...

parag_c_mehta• 12 years ago

I should also point out that if you are serious about tracking, you should probably look into disabling Sync and "Signed In" feature of chrome. Though there is no proof yet, but theoretically Chrome update can start tracking based on logged in user.

SixSigma• 12 years ago

my armoury

* Facebook disconnect. * Google disconnect. * Ghostery * Privoxy * Self Destructing Cookies * No-Script

I wouldn't be so concerned about the ads themselves if they didn't flash, jump about, get in the way of text, harvest my likes, cross harvest my interests, get hijacked and infect my machine, steal my battery life by being animated etc. etc.

thisiswrong• 12 years ago

"Allow for some non-intrusive advertising"

This is what scared me about Add Block by default on browsers. Essentially what's happening is the monopolies (Google & FB) get to keep their profitable business models while all small time content publishers get stripped of revenue. WTF !?

Where's the Anti trust regulation? You'd think they were conspiring to kill independent content creation. Or are they?

Cthulhu_• 12 years ago

I... think it's kinda weird, yelling for 'anti trust regulation' when you're blocking ads / denying people their income.

null_ptr• 12 years ago

What if I choose browse the web with Lynx (text-only browser, no JavaScript). Am I still denying people their income? What if I watch TV and go to the bathroom during commercial breaks, am I denying those people's income too?

joveian2• 12 years ago

I use ABP + Ghostery and most Google ads do not qualify as unobtrusive (I don't use FB). I can't recall having seen a Google ad since installing ABP probably not too long after the new policy (I installed Ghostery a few months later IIRC). E.g. the ads at the top of searches are gone, which is great for me since I use redshift and can never tell where the ads stop and the results begin when it is shifting (it is also nice to not need to scroll down to see actual results, although the re-search as text is entered into the search box thing annoyed me enough that I switched to DDG). For people who installed ABP after the option was added it is well documented.

I think ABP came up with a good list that actually indicates when ads have minimal negative impact. Does following those rules actually harm independent content creation? Before installing ad blocking it was not at all infequent for me to not look at websites at all because the ads were too obnoxious. OTOH, when I find an article valuable I usually look around more at what the site has to offer and would at least see the less obtrusive ads at that point even if I missed them earlier.

TuxLyn• 12 years ago

Unfortunatly, none of this will protect you from EverCookies (https://en.wikipedia.org/wiki/Evercookie). The only way possible right now is to disable firefox history/cookies/javascript and use private mode, and even then its not 100%. But at that point you wont be able to use most of the sites. This means even if you use TOR or VPN, you can still be tracked. There is one plugin in beta stage called NeverCookies beta (https://github.com/sensepost/neverevercookie) you can also find xpi on softpedia site. NeverCookie does not have any options in beta version. But there is another plugin no one mantioned called "Random Agent Spoofer" (https://addons.mozilla.org/en-US/firefox/addon/random-agent-...) It protects your ETag, X-Forward-For and more.

Aoyagi• 12 years ago

I don't know, I've used Ghostery and ABP for a while and despite claims of lack of trust, I've had no issues with them. They both allow blocking everything, the options aren't exactly hidden in a locked closet guarded by a leopard. But I don't get my hopes too high, I know that there are still other ways to track users and I feel it's a hopeless fight (without going to extremes like ABP+Ghostery+noscript+TOR+no cookies+never using the same device twice). But hey, if it annoys them enough to pay for being whitelisted by default on some platforms, it's worth the fight for me.

boards2x• 12 years ago

Ghostery is problematic, I've stopped using their serivce (now using disconnect.me.

Some sources say that Evidon, the company owning Ghostery, plays a dual role in the online advertising industry. Ghostery blocks sites from gathering personal information. But it does have an opt-in feature named GhostRank that can be checked to "support" them. GhostRank takes note of ads encountered and blocked, and sends that information, though anonymously, back to advertisers so they can better formulate their ads to avoid being blocked.[4]

mp3geek• 12 years ago

Use Fanboy-Social List, Ghostery isn't needed.

/Disclaimer; Author.

JetSpiegel• 12 years ago

Isn't it called the AntiSocial list?

Whatever the name, it's a great feature. Thanks!

notastartup• 12 years ago

    it’s is made by an advertising company called Evidon … 
    it is a Web tracking blocker that actually helps the ad 
    industry

doesn't that defeat the whole product of Ghostery? I was eager to install it but after reading that I'm not so sure. What are they exactly doing?

someguy2• 12 years ago

don't forget about flash cookies, a.k.a LSO's or SuperCookies. BetterPrivacy works well mitigating that.

i'd also recommend 'Secret Agent' - "Continuously Randomizes your Firefox/SeaMonkey HTTP User Agent, to Suppress Device Fingerprinting, and Resist Web Tracking. Also Prevents eTag Tracking.": https://www.dephormation.org.uk/index.php?page=81

hosts file is another option: http://winhelp2002.mvps.org/hosts.txt

616c• 12 years ago

To expound upon someguy2's recommendation below, I have since moved on my Arch Linux laptop after reading a dev's blog post[0] to using hostsblock to block a lot of known domains to redirect to localhost. That, in conjunction with dnsmasq and kwakd (a ~400 LOC web server in C that only returns <html></html>)[2] for all requests makes me worry a lot less.

I also use disconnect.me (after discovering the motivation behind Ghostery is just to sell info back to marketers). My only real issue is that kwakd is clearly choking on certain sites (namely Google, which I just back to permanent NoScript blockage) with some of the weirder stuff it does with asynchronous JS calls. Blocking Google completely as a result makes my web experience much, much faster and cleaner.

[0] http://jasonwryan.com/blog/2013/12/28/hostsblock/

[1] http://gaenserich.github.io/hostsblock/

[2] https://code.google.com/p/kwakd

metastart• 12 years ago

Try the Epic Privacy Browser -- a chromium based browser that rips out all google calls/services and protects your privacy -- it blocks ads and trackers and philosophically doesn't send your browsing through its servers nor collects any data unlike many of the other privacy addons mentioned.

nighthawk24• 12 years ago

http://prism-break.org/en/ Opt out of global data surveillance programs like PRISM, XKeyscore and Tempora.

Blocking Google and Facebook using Ad Block Plus and Ghostery

Related Stories