What techniques do advertisement companies use to get my browsing information, and how can I stop them?
There are several ways I can think of:
Browser-fingerprinting. To stop browser-fingerprinting, use Random Agent Spoofer correctly.
Your IP address. To stop this, use a VPN such as Private Internet Access, and connect to a random IP every time.
Your free accounts. When you connect to free accounts such as Gmail, YouTube, etc., they sell your information to third parties. Associating your fingerprint and known IP addresses helps people track you down. To stop this, quit logging into your free services on your current IP, including VPNs.
Third-party Cookies. Don't allow third-party cookies, like ever. And on some sites, simply don't allow them to use cookies at all.
Canvas-fingerprinting.
Javascript that tracks you. You can disable Javascript, or find an add-on that prevents tracking scripts from loading. Usually, uBlock will do this.
Flash LSO objects. Use an addon such as Better Privacy.
There's a lot of different ways to track you...
Apparently, there are a lot of things I haven't considered. Check Steffen Ullrich's suggested reading.
Also, you should be using uBlock origin.
- uBlock for Chrome
- uBlock for Firefox
Wear an advertisement-based Tinfoil Hat
I would suggest a mix of the above, but probably take it a step further: set up a virtual machine (such as VirtualBox) that connects to a different host, and use your "free" services on the virtual machine's web browser.
If it's online, and it's free, then the majority of the time, you're the product. How do you think these companies survive by providing free products while having a LOT of staff members? It isn't because of their good nature.
Don't forget to clear all of your cookies.
Intro
There are so many ways they are tracking you, you will almost need a specialization in Infosec to thwart only most of them. The big thing to remember is that security, privacy, and anonymity are a process, not a toggle switch. Here is a brief overview of the subject, with links for you to get more info and get started.
Disclaimer if it wasn't obvious: This is not comprehensive, merely the tip of the iceberg. I'm not affiliated with anything below, and I haven't tested all of the software I mention, nor am I related to or liable for anything you do.
Image from Concurring Opinions, which has a good article on the topic too.
You need to add layers to your onion-cake in an effort to thwart adversaries. Depending on your adversaries and the consequences for failure, you may need substantially more layers than other people might. For example, nation states and LEOs may bust down your door, while advertisers may simply sell information to said nation states and LEOs so they know which door to bust down or target with a drone missile. Extreme example to prove a point.
You are not alone in trying to keep your personal stuff personal, nor are you crazy or inherently bad, and there is good reason to do so.
Step 0, because in computer-land we start counting with 0
Before the technology, you need to change what tracks you leave on the web. You'll have to understand how you are really paying for those free services, and which free services that you will give up. For example, even if you disable ads on Facebook, they can still track you by any links you click on while on their site. Or by the Like button embedded into web pages. This guy has articles, a web page, and a few videos going pretty in depth into the topic. Don't put personal information into any random website. Have separate silo's for different access/browsing (i.e. multiple email addresses). Unsubscribe from those retail email mailing lists. Stop posting pictures of your kids. No seriously, it probably has a GPS tag embedded in it.
You will need to forcefully manage many of the underlying technologies that you use, most of which you may not even be aware of unless you have technical proficiency in computers, networking, and software development. The assaults on our privacy, security, and anonymity are so thorough and widespread, you may give up after realizing the enormity of it all. Never fear, for there are plenty of people who are working on this problem.
You will also need to manage lots of technology by installing and configuring lots of different software within your browser and on your machine to plug the pervasive holes that you bleed information and metadata out of.
Browser
- JavaScript - You will need to manage the JavaScript that runs in your browser. In today's world, there is so much JavaScript that you can't just point blank period turn it off. NoScript is an example of an extension to do this.
- Cookies - You need to be the anti-cookie monster. Disable 3rd party cookies. Self destructing cookies is an example of how you can manage other cookies automatically. You may also need to manage flash cookies.
- HTTPS - Some sites support HTTPS but don't have it turned on by default. HTTPS Everywhere will catch those and force the connection to upgrade to HTTPS.
- Remove ads - All the time, every time. Ads are delivered by tracking networks and are a vector for malware. I understand that people want and deserve to get paid, but they need to fix their stuff. UBlock, Adblock Plus, etc. I think ABP's idea to white list some ads is a good idea, but you may not. Also, ABP on Android will break MMS (picture messages).
- Certificates - You will want to remove extraneous certificates installed by 3rd or 4th parties to prevent things like Superfish. Oh, BTW, Superfish was an ad company. Same concept applies to the system level or the browser level, as those certificate stores may be the same, or may be different. Carnegie Mellon has made a decentralized certificate verification system, but I am not sure if I can trust them, given the attack on Tor (link).
- DNS - You can leak a lot of information just by DNS lookups. Don't use Google's DNS servers, even if they are easy to remember. Don't use your ISP's either. Your commercial VPN provider should offer DNS, or you can go so far as to purchase DNS from OpenDNS (they have a free option too) to manage ads and get DNSec (Maybe they stopped offering that product, but this company still offers it). You can always DIY with a SOHO router, pfSense and/or Privoxy (or other tools).
- Reputable software author turning malicious or greedy - Google is an ad company. They want to track you. Don't use Chrome. Microsoft is following Google's lead with tracking (Windows 10, link, link), so don't use IE or Edge. Etc. Vett your software companies.
- Security patches - Stay up to date. But watch out for Microsoft style malware and backdoors coming down that pipe. Realize that auto updates may slip past your VPN if the VPN is software, either because of misconfiguration or it making a connection while it starts up or crashes. There are plenty of logs that adversaries would like.
- Passwords and authentications - Use a secure password manager like KeePass or Lastpass. Each password for every account needs to be unique and difficult to remember. Unless you are in DoD-level secure areas, you should not need to rotate through passwords.
- Misc addons - Privacy Badger, Ghostery, and other extensions will help enhance your privacy, security, and anonymity in the browser. WebRTC is a great idea from a technology perspective. And will leak your real address under certain circumstances even if you are using a VPN. You can use an extension to plug that hole.
- Search - Use an alternative search provider like DuckDuckGo, Disconnect, or similar.
On your NIC/network:
- Network (VPN, Tor, IP Sec, etc.) - Tor and a commercial VPN are different technologies with different use cases. Learn about them and use them. You should almost always be running a VPN, preferably a pfSense box putting all of your network traffic through the VPN. Legislation and technology can be enemies, even if technology can technically thwart legislation. There are a number of sites and pages to assist you in choosing a VPN provider. Pay anonymously (Crypto currency, gift card, cash) and vett the provider. Make sure they put their money where their mouth is. Examples include by donating to the EFF, running a blog that doesn't pull punches, or has a proven track record (i.e. not HideMyAss).
- DNS - You can leak a lot of information just by DNS lookups. Don't use Google's DNS servers, even if they are easy to remember. Don't use your ISP's either. Your commercial VPN provider should offer DNS, or you can go so far as to purchase DNS from OpenDNS (they have a free option too) to manage ads and get DNSec (Maybe they stopped offering that product, but this company still offers it). You can always DIY with a SOHO router, pfSense and/or Privoxy (or other tools).
- IP blocking - You can roll this into a proxy or firewall if you like, but the basic idea is to never connect to known bad actors. It's 1 layer in your defense, and probably a small one, but still worthwhile. Torrenters use this technology to prevent themselves from being caught. You might use this technology to prevent yourself from going to a malicious website before it gets taken down.
- Security patches - Stay up to date. But watch out for Microsoft style malware and backdoors coming down that pipe. Realize that auto updates may slip past your VPN if the VPN is software, either because of misconfiguration or it making a connection while it starts up or crashes. There are plenty of logs that adversaries would like.
- IPv6 surprisingly still breaks a lot of stuff (It was specified in 1998!). Like OpenVPN DNS leaks, or just not working at all. Unless you have a need or expertise in the matter, you're probably better off turning off IPv6 on all your machines.
On your machine
- Encrypted storage - Something like Trucrypt, Veracrypt, etc. Don't use hardware based drive encryption unless it is vetted. I thought I had read that manufacturers have been able to decrypt it, which defeats the point, but I can't seem to find a link. you can reference the Clipper Chip for the same concept/
- Physical security - Without this you have no security. Keep your devices close and don't share them. Your computer is like your underwear. You don't share that, do you (#88)?
- Passwords and authentications - Use a secure password manager like KeePass or Lastpass. Each password for every account needs to be unique and difficult to remember. Unless you are in DoD-level secure areas, you should not need to rotate through passwords.
- Reputable software author turning malicious or greedy - Google is an ad company. They want to track you. Don't use Chrome. Microsoft is following Google's lead with tracking (Windows 10, link, link), so don't use IE or Edge. Etc. Vett your software companies.
- Security patches - Stay up to date. But watch out for Microsoft style malware and backdoors coming down that pipe. Realize that auto updates may slip past your VPN if the VPN is software, either because of misconfiguration or it making a connection while it starts up or crashes. There are plenty of logs that adversaries would like.
- Certificates - You will want to remove extraneous certificates installed by 3rd or 4th parties to prevent things like Superfish. Oh, BTW, Superfish was an ad company. Same concept applies to the system level or the browser level, as those certificate stores may be the same, or may be different. Carnegie Mellon has made a decentralized certificate verification system, but I am not sure if I can trust them, given the attack on Tor (link).
- Keeping the machine free from infection - Easier said than done. Commercial Antivirus/Antimalware might work for you. Having your ear to the ground and being in tune with your system is a requirement. Don't be afraid to reformat and reinstall, regardless of what device it is.
- Encrypted communications - Use programs and apps that have built in security, privacy, and anonymity features. Signal is cross platform voice, messaging, and video calling; Threema is mobile; PGP/GPG do email on all platforms; or you can go with sneakernet (wiki).
- Backup - Backup anything important. Cryptoransomware will hold it hostage if you get infected. I don't know of many softwares that would rate this kind of list, but Crashplan, Goodsync, and a self hosted Seafile server might fit the bill.
- Root, jailbreak, or otherwise own your device - You don't have to build everything from source, but find some open source stuff that you like to use and replace your OS. It's pretty easy nowadays, and you can enhance your security posture with the right apps, add-ons, and configurations that would not otherwise be possible with a poorly supported stock ROM.
In your apps, programs, and services
- Stop using malicious services that track you, profile you, or sell you and your data as a product. There is a lot of pressure both way regarding the 3rd party doctrine and the collection (PDF), dissemination, and sale of your data (link, link).
- If you determine that you need to use malicious services (Facebook, Google, etc), find out what options you can turn off, do so, and periodically double check them.
- Stay logged out unless you need to be logged in. YouTube's ability to suggest awesome videos comes at a price, after all.
- Investigate the app permissions on apps.
- Apple products give you security vs certain threats, but also prevent you from having your way with your own hardware and software. In the future, jailbreaking these devices will probably become unfeasible.
Sites/articles with lots of info or useful test tools
- EFF Panopticlick - Lets you test how easy to fingerprint your browser is
- EFF Surveillance Self Defense - Good starting point, even for nontechies
- Privacy Tools IO - Explanation, links to software, recommendations, etc.
- Reddit /r/Privacy FAQ - Good FAQ with nontechnical discussion.
Interesting people to read/listen to
- Bruce Schneier
- Steve Gibson of Security Now
- The Grucq
- Moxie Marlinspike
Interesting projects and miscellany
- P.O.R.T.A.L., the project that spawned Anonabox and its ilk.
- Seafile - A way to set up your own replacements for cloud services.
- SpiderOak - Secure cloud service to synchronize files across devices.
- Privoxy - A proxy that enhances your privacy by doing adblocking outside of the machine. You can add it to an OpenWRT router, or pfSense (though it's not supported) (or something similar), or build your own.
- Guerillamail - disposable email addresses from SHARKLASERS.com How cool is a shark laser??
Final Thoughts
Be prepared to DIY and pay for things that you previously haven't. Ass, grass, or cash; you have to pay somehow. In the digital world, it's more like "Ads, DIY, or cash".
I use an extension for my browser called Ghostery that sifts the webpages you visit for trackers, beacons and other products.
https://chrome.google.com/webstore/detail/ghostery/mlomiejdfkolichcflejclcbmpeaniij?hl=en
Ghostery makes money by selling data to the website owners about what trackers are running on their website because many times they don't know about it themselves.
Personally I run it so that all those tracking programs are not slowing down my browser.
Looking at what it has found, even on this site, shows 4 different Ad tracking programs and Google Analytics.