Mastering Online Privacy: คู่มือปฏิบัติสำหรับ Beginners

โดย Iulian Gulea

เราอยู่ใน Remarkable Times สร้างรูป Places/People ชอบด้วยการกดปุ่มบนโทรศัพท์ Shop จากบ้าน Anything จาก Needles ถึง Cars Reach Hundreds of Thousands ผ่าน Social/Blogging Platforms Consume Information Any Topic Any Volume Any Time

คน 30 ปีก่อนอาจฟัง Futuristic สำหรับเรา Just How Things Are Common Sense

แตทั้งหมดมาทีมี Price และ Price นั้นคือ Privacy ของเรา

Why Stay Private?

I am Law-abiding Citizen, I Have Nothing to Hide

Or This One:

Why Hide ใน Globally Connected World?

People เยอะคิดแบบนี้ Understandable และ Normal เรา Expect บาง Companies รู้ Info เยอะเกี่ยวเรา (เพราะเรา Provide ให้เอง) แตอาจ Surprise ที่ Companies อื่น Collect Sensitive Information มากกว่าที่คิด ไม่ได้ Share กับใคร

To Make Matters Worse AI Advances Recent Years Enable Companies Find Interesting Patterns Create Fine-grained Physiological และ Psychological Profiles จาก Online Behavior Case 2012 Company รู้ Daughter Pregnant ก่อน Family รู้ Imagine AI + Lots of Data Today

Hopefully End of Article คุณ Review Thoughts เกี่ยว Online Privacy ก่อน Move On หยุดพัก Consider Feelings ถ้า Share Info นี้กับ 200 Strangers:

• Where Located (Geographically)
• When Surf Internet และ How Long
• List All Sites Visited Each Day
• Illnesses (If Any) Searched Online
• Products Types Bought Online
• Devices Used Connect Internet
• Content Types Prefer Read
• Food Types Prefer Eat
• Political Views

List Continues แต่ Stop Here คุณน่าจะไม่ Share ทั้งหมดกับเพื่อน ไม่ถึง Strangers

แต Reality: วันนี้ People มากมาย Unwillingly/Unconsciously Share Data นี้กับ "Strangers" ใน Companies ที่ Collect Data เพื่อ Benefit

Your "Personal Anonymous Profile"

แม้ Majority Companies Collect Data ไม่รู้ Real Name ไม่ Important สำหรับพวกเขา ไม่ใช่ Name ที่ Interest แต่ Behavior และ Preferences ไม่มี Name จะ Label ID ใน System

แต่บาง Companies Do Know Name และ Social Security Number แม้คุณไม่ Explicitly Share

Paradox: เรา "Share" Data ส่วนใหญ่ ใน Ignorance เกี่ยวกับ Information Type ที่ Easily Obtainable เมื่อ Navigate Internet

Privacy มีมาก Impossible Fully Protect จาก Amoral Corporations แต่ Minimize Risk ได้ ผมเชิญคุณ Find Out How

The Pyramid of Privacy

Visual Demonstrate อะไร Protect Privacy และ Effective แค่ไหน

In Order of Significance, Bottom to Top:

1. Operating System

Source: pixabay.com

Without Solid Foundation ไม่ Build Anything Useful ได้ Choice ของ OS ที่ใช้ Pose Risk เพื่อ Privacy

The Risk

Windows 10 User? Bad News เพราะ:

• Device Tagged Unique Advertising ID By Default
• Data Syncing Enabled By Default (Browsing History, App Settings, Wi-Fi Names/Passwords)
• Cortana Collect Any Data (Literally Any Data Operate บน Computer รวม Credit Card Info, Mic Input)
• Microsoft Collect Any Personal Data
• All Data Shared With Third-parties Without Consent

Solutions

Possible Solution: Switch OS เช่น Linux หรือ MacOS MacOS ต้องซื้อ Mac แต่ Linux Install ได้บน Computer ใดๆ

Scary Tales เกี่ยว Linux? Check Yourself Popular Distributions List ดู Form Download Install หรือ Start ไม่รู้ ให้ Go with Ubuntu

ยังไม่ Switch Windows? Check W10Privacy — Tool Disable Tracking Settings ใน Windows

2. Networking Layer

Source: pixabay.com

ตอนนี้มี Chance Anonymous ไม่มี Unique ID Stuck บน Computer Connect Internet

Wondered How Internet Works? Navigation Complex แต่ Reflect Engineering Power ไม่ Dive Internals Focus Privacy Topics: IP และ VPN

The Risk

Real World ทุก Device Connected Digital WWW มี Address = IP Address Visible to Any Site You Visit ดังนั้นไม่ว่าจะ Hide Data/Preferences จะ Identified ผ่าน Address ที่ Computer Connected Internet

นี่คือเหตุผล Ads ใน Native Language จาก Country คุณอยู่ แม้ Navigate Foreign Website

Method ที่ Sites Restrict Access Visitors จาก Specific Countries ดู IP Address Points บน World Map ที่นี่

Solutions

1. Virtual Private Networks (VPNs)
2. WebRTC IP Leak Test

Discuss ทีละอย่าง

1. Virtual Private Networks

ไม่ได้ Just Hide IP Address จะ Navigate Internet ไม่ได้ แต่ Pretend Different IP Address จาก Real One Virtual Private Networks เข้ามา

VPN Extends Private Network Across Public Network Enable Users Send/Receive Data Across Shared/Public Networks As If Devices Directly Connected to Private Network

Source: Wikipedia

150+ VPN Providers Worldwide Choose Right One Tough แต่ละ Provider Features/Limitations ต่างกัน

Critical Things Consider When Choosing Surprisely Related to "Eyes"

Five Eyes, Nine Eyes, Fourteen Eyes

All Global Alliances Goal: Mass Surveillance Cooperatively Collect, Analyze, Share Data Citizens Worldwide Started Post-WWII Countries Spy Each Other's Citizens Share Intelligence Online Activity, Emails, Facebook Posts

Countries ใน Groups:

Five Eyes: Australia, Canada, New Zealand, UK, US

Nine Eyes (All Above Plus): Denmark, France, Netherlands, Norway

Fourteen Eyes (All Above Plus): Belgium, Germany, Italy, Spain, Sweden

Short: Choose VPN Provider Based ใน Countries นี้ Not Guarantee Privacy เพราะ Entities (NSA etc.) จาก Same/Different Countries Force VPN Providers Offer Data

Nice List 150+ VPN Providers Features/Limitations ที่ oneprivacysite.net Read Analyze VPN Fit You Best Recommend Use 1 Month ก่อน Buy Long-term Subscription

2. WebRTC IP Leak Test (Even with VPN May Be Visible)

Hold On! Even Behind VPN + Encrypted DNS May Still Leak IP Address Why Complicated?

Technology Improves New Things Developed Bugs หรือ Ways Exploit Features Get Results WebRTC — New Communication Protocol Relies on JavaScript Leak Actual IP จาก Behind VPN Check privacytools.io ถ้าเห็น IP Addresses Identified Check Section นั้น privacytools.io Follow Steps เห็นอีกครั้ง WebRTC Leak IP!

3. The Browser

Source: pixabay.com

Discuss Surfing Boards Navigate Digital Cosmos of Internet

Browser ไหน Better?

• Internet Explorer! (Said Nobody)
• Edge (Whispered Somebody)
• Opera! (Said Couple People)
• Safari! (Said Bunch People All Apple Products Newest Version Day 1)
• Tor! (Shouted Anonymous Group)
• Яндекс Браузер! (Russian Speaking Group)
• Chrome!!! (Cried Crowd Google Probably Has Digital Version of Them)
• Firefox!!! (Cried Another Crowd Privacy Posters)
• Brave! (Said Somebody Unclear Browser หรือ Just Be Brave?)

Dozens ของพวกเขา List บน Wikipedia แต่ไม่ Answer Question…

The Risk

Browsers ทั้งหมด Complex Software Provide Internet Access Surfing WWW Browser Interacts Other Computers Expose Information About Itself to Any Site Visited ที่นี่ Complicated เพราะ Combination Browser Settings สร้าง Unique Device Fingerprint

Source: commons.wikimedia.org

Wait, What? Fingerprint?

Device Fingerprint = Information Collected About Remote Computing Device For Identification Fingerprints Used Fully/Partially Identify Users/Devices Even Cookies Turned Off

Source: Wikipedia

Bad News: Surfing Internet คุณ Literally Leave Digital Fingerprints ทุก Site

Good News? Device Fingerprint Can Be Not Unique หาก Change Settings Expose As Little Data As Necessary Navigate

Possible เพราะ Fingerprint ไม่ Single Piece แต่ Set ของ Settings (Screen Size, Browser Type/Version, Installed Fonts/Addons ฯลฯ) Together Uniquely Identify Browser

Lady in Red from The Matrix? Stand Out เพราะ Distinctive Appearance Compared to Others Browser เหมือนกัน — Distinctive Features มาก = Easy Spot in Crowd

แต Dress Her Black Jacket White Shirt Like People Around เธอ Won't Stand Out Much

Dozen+ Pieces of Information Browser Exposes About Settings Job: Make Them As "Common" As Possible

Want See Device Fingerprint? Check:

1. panopticlick.eff.org
2. amiunique.org

Choose Panopticlick See Something Like:

Column "Browser Characteristic" หา Information Type Collected Based on This Browser Identified Another Column "One in X Browsers Have This Value" = Entropy ของ Characteristic Smaller Number = Better (Many Browsers Same Setting)

Above Table See How Unique You Are Image Above = Test Run จาก Chrome ไม่ Configured for Privacy

After Tweak Settings Install Add-ons Achieve (Firefox Daily Use):

Only 1-in-75,604 Browsers Panopticlick Dataset Same Fingerprint As Mine Much Better (Not Ideal)

Solution

First: Select Browser Privacy Perspective Widely Recommended:

1. Tor Browser
Pre-installed Privacy Add-ons, Encryption, Advanced Proxy Use As-is Out of Box

2. Firefox
Tweak Default Config Install Privacy Add-ons Good to Go

3. Brave
Auto Block Ads/Trackers Faster Safer Navigation

Configure Browser for Increased Privacy
2 Options:

1. Easy Path: Follow Instructions Here (Only Firefox, Search Similar Settings Chrome Under about:flags)
2. Flexibility + Importable/Exportable Privacy Settings: Check ghacks-user.js Project on Github (Firefox Only) Comprehensive Requires Setup Worth It

Setup Additional Add-ons for Increased Privacy
Read Below Part 6

4. Cookies

Cookies บน Web Something Not Good (Otherwise Why Sites Inform Usage When Navigate?)

Reality: Cookies = Tool Only Some Uses Questionable from Privacy Standpoint

Cookies = Small Text Strings Site Store in Browser Cannot Install Anything (Just Text) Visible Only to Site That Stored (No Site Sees All Cookies 20 Other Sites)

Moreover Cookies Sent with Each Request = Potential Privacy Threat

Simple Example: Visit Site Light/Dark Themes Default Light You Select Dark Anytime Enter Site Even No Login/Register Displays Dark Theme

Case นี้ Site Saved Cookie theme=dark Browser Load Site Cookie Sent Server Serve Corresponding .css Dark Theme

Constantly Logged In Sites After Reboot Also Possible Due to Cookies Storing Session Data

The Risk

Innocent Example Not Clear How Benefit From Cookies Another Example Infringe Privacy:

Specific Example:

1. User Visit siteA.com
2. SiteA.com Show Ads from siteB.com Place Code Within Own Pages
3. SiteA.com Receive Request User Send HTML Page Requested Contains Ad Code
4. Browser Receives HTML Renders Page Makes Subsequent Requests Get Everything Load Page Browser Request Ad from siteB.com Sending Cookies Related to siteB.com No Cookies Yet siteB.com Instruct Browser Store Cookie __uId=abc1 Same Time siteB.com Create Profile Database ID abc1 Collect Data About User With Referer Header Contains URL Initiated Request Referer Header = www.siteA.com
5. After Time User Navigate siteC.com
6. SiteC.com Unrelated to siteA.com Show Ads from Same Ad Company (siteB.com)
7. Browser Receives HTML siteC.com Request Ad from siteB.com This Time Auto Send Cookie __uId=abc1 to siteB.com = User Unique Identifier With Referer Header = www.siteC.com Tells siteB.com User Already in Database Update Profile Latest Visited Site = siteC.com

Thus Bit by Bit Ad Companies Collect Tons of Data About Online Activities

Solution

3 Options:

• Completely Disable Cookies (Breaks Some Sites) Browser Settings
• Limit Cookies to "First Party" Only Current Site Write Cookies No Third-party Cookies from Ad Companies (May Break Few Sites) Browser Settings
• (Recommended) Install Add-on Handle Cookies Custom Rules Per Site (Requires Setup Most Flexible)

Add-on Recommendations End of Article

5. Scripts

Source: pixabay.com

Sadly "With Great Power Comes Great Responsibility" Not Popular Among Corporations…

JavaScript = Quintessential Building Block Websites Offers Possibilities Games, Engaging Interactions, Animations, Myriad Cool Stuff

JavaScript Get Screen Size, Battery Charge (Laptops), Installed Add-ons List, Other Info Uniquely Identify You

The Risk

Many Sites: Site Owners Put Ad Company Scripts On Sites Load Page Browser Loads Third-party Scripts Those Scripts Extract Potentially Identifying Info Send to Ad Companies With Your Actions on Page

Many Types Info JavaScript Gets Browser Canvas Fingerprint By Far Most Powerful Most Entropy Several Factors Vary Greatly: GPU, Graphic Drivers, OS, Browser Contribute Creation

Thus Bit by Bit Companies Collect Info Actions, Sites Visited, Clicks Create Digital Profile Tailored Ads Served Adjusted by Continuous Actions

Solution

Disable JavaScript Not Solution (Can't Use Half Sites) But Block Scripts from Specific Vendors Won't Load with Page Block Requests to Ad Companies with Identifying Info Add-ons Described Part 6

6. Miscellaneous and Add-ons

Above Steps Fundamental for Online Privacy But Unfortunately Not Sufficient — Still Enough Bits Sites Collect Construct Digital Profile

Section นี้: Basic Add-ons for Firefox Quantum (Version ≥ 57) Browse Safely Other Browser Search Alternatives in Add-on Lists

Not Exhaustive List Add Suggestions in Comments Some Features Present in Multiple Add-ons Most Cases No Conflicts But Aware Sometimes Things Not Work Recommend Install One by One Load Several Pages Test Works Expected

Here We Go:

1. Cookies

Plenty Add-ons Category Personally Use Cookie AutoDelete Activate Delete Cookies On Browser Close หรือ Once Predefined Period Elapsed

Thus Sites/Ad Providers Won't Track Easily with Cookies You Like New Visitor Each Visit Other Side "Privacy Blade" Log-in Each Time Open Browser Session Cookies Also Deleted

Bit Annoying But Hey Nobody Told You Daisies

2. Script Blockers

Popular Add-ons Block Unnecessary Tracking Scripts (No Order): uMatrix, NoScript, uBlock Origin, AdBlock, Others

First Two More Flexibility Require Learning/Setup By Default "Break" Lots of Sites Simply Block All Scripts Define Rules Allow/Block Personally Used Both NoScript and uMatrix Prefer uMatrix (Currently Using)

uBlock and AdBlock Best If Don't Want Learn How Work Just Start Navigate Securely Work Out of Box But Sometimes Less Privacy Than uMatrix/NoScript

3. User Agent

Plenty Add-ons User Agent Header Switcher (OS/Browser Info)

Problem: Many OS/Browser Versions Header Alone Useful Info Source For Identification

Source: amiunique.org

Purple Color OS Chart = iOS Versions Most Common OS = Windows 7 Not "Common" Browsers Side Vendors Stamp New Versions Like Hotcakes:

Source: amiunique.org

Left: Firefox Version Distribution amiunique.org Dataset Right: Chrome Distribution

No Strong Favorite Currently Use User Agent Switcher Allows Custom User Agent Header Value + Random Mode Switch Between User Agents Over Time

4. Encrypted Browsing

Spotted URLs Start https:// vs https://? HTTP = HyperText Transfer Protocol Protocol Defines Computer Communication Over Internet

Add Secure = HTTPS When Access https:// Contents Encrypted Hard to Understand What Sending Even If Intercepted

Sadly Not All Sites Auto Redirect HTTP to HTTPS Making Navigation Visible to Interceptors

Luckily HTTPS Everywhere Solves Auto Redirect to Encrypted Version (If Exists)

5. Canvas Fingerprinting

Two Solutions Approach Canvas Fingerprinting:

1. Block Any Attempt This API
2. Alter Resulting Fingerprint Each Time Accessed

Long Run First Option Best (No Additional Info) But Few People Aware/Block Canvas API Lack of Canvas Fingerprint Is Itself Identifying Information

Other Option: Alter Canvas Fingerprint Occasionally Change Each Time Different Fingerprint As Though Different People Navigating

For This CanvasBlocker Works Good Has Both Options Up to You

6. Referer Header (Without Double 'r')

Header Sent Each Request Indicating Where Request Came From (Which Site Referred Page Requesting) Track Online Navigation See Which Sites Access From Which Sites

But Can Alter Hide Online Navigation Routes For Your Eyes Only

Use uMatrix (Above) Comes with Referer Header Spoofing Otherwise Search "referer spoof" Add-ons Choose One

7. Link Cleaner

Referer Header Advanced Way Know Where Person Came From But Common Approach Track Engagement = Query String Parameters Parts of URLs After ? Character Hold Various Data

Example Link: https://meyerweb.com/eric/thoughts/2017/03/07/welcome-to-the-grid/?utm_source=frontendfocus&utm_medium=email&page=2

Key=Value Pairs Right of ? = Query Parameters Click Link Values Sent to Server

Wondered utm_medium และ utm_* Parameters Mean? Related to Google Analytics

Not All Query Parameters Infringe Privacy Some Necessary Site Work Properly (e.g. page Parameter)

Use Link Cleaner Remove Most Query Parameters Used for Tracking

The Next Steps

Source: pixabay.com

Cover Main Aspects Online Privacy Solid Foundation Further Investigation Learning

But Privacy So Much Hard Cover Everything One Article Things Not Mentioned Add in Comments People Want Learn More Chance!

Also Mainly Focused Safe/Private Browsing Internet But Privacy Should Consider Each Online Services: Email, File Sharing, Daily Services

Remember: Consciously Share Info With Others vs Sensitive Info Collected Without Knowledge/Consent

Stay Private!

Useful Links

PrivacyTools — Comprehensive Resource Privacy Links/Recommendations Service Providers

BrowserLeaks — Analyze Browser Privacy Dimensions: IP Addresses, Canvas Fingerprinting, Flash More

Panopticlick — Check Browser Safety Against Tracking Report Things Reveal Most Info

AmIUnique — Alternative Panopticlick General Statistics Dataset

Firefox Hardware Report — Weekly Report Hardware Used Representative Sample Internet Population

Screen Resolution Tracking — Interesting Thread Browser/Screen Size Let You Down

Firefox Getting Smarter About Third-Party Cookies

If Article Useful Give Claps Others Learn About Privacy Online Thanks!

เรียนรู้เขียนโค้ดฟรี หลักสูตรโอเพนซอร์สของ freeCodeCamp ช่วยให้ผู้คนมากกว่า 40,000 คนได้งานเป็นนักพัฒนา เริ่มต้นได้เลย