Web Browser Basics

by Todd · Published November 27, 2016 · Updated November 28, 2016

SURFING THE WEB EXPOSES A LOT OF INFORMATION ABOUT YOU. Even before you get a warning about a site wanting to access location information, or anything protected, your web browser is broadcasting a lot more information than you realize. Getting that under control is a step that anyone can do, regardless of how far down the path you want to go to anonymity, and will not take very much effort at all.

Here’s an exercise for you. Go to these websites and see what they say:

All of that information is without even allowing location services. And it doesn’t cover what information you’re sending to websites via cookies or tracking bugs. Once you start adding those in, your web browser is just a big, sophisticated way of surveilling you, that you voluntarily downloaded. Oh, and it happens to display cat pictures, too. We can make this a little better, and it’s not going to take very much effort on your part to do it.

The first thing that you should do is install the HTTPS Everywhere Plugin from the Electronic Frontier Foundation. This is a very simple plugin that assures that if a website supports a secure, encrypted connection, that your browser uses it. Once installed, you won’t even know the plugin is there: it works automatically and doesn’t interfere with your normal activity.

Why is HTTPS important? If you’re not familiar with it, HTTP is the HyperText Transfer Protocol. This is how your web browser communicates with websites. The last ‘S’ stands for ‘Secure’. An HTTPS connection, also called SSL or TLS (Secure Sockets Layer or Transport Layer Security – they’re different things, but close enough for our purposes), means that the connection between your browser and the website is encrypted. This means that anyone eavesdropping on the network traffic can’t see what you are doing. They might know that you’re connecting to the website, but they don’t know what the content is.

Now that we’re as secure as possible (without rejecting all non-secure connections), we need to do something about all the tracking bugs. Websites use all kinds of methods for tracking you, and they share that information with a lot of people. Before we fix this, let’s take a crash course in how it works.

When you load a website, like CNN, the first thing that happens is that the structure of the page loads. This structure has some number of commands in it for your browser to load other content. Some of this is other things you see on the page, like images and videos. Then there’s the advertising. There’s also things that load invisibly and send information to systems all over the place. We call these things bugs, beacons, analytics, or tracking. On CNN’s website it tells your browser to make connections to:

Advertising: Amazon, ChartBeat, Criteo, Google, Krux, NetRatings, Outbrain, Rubicon
Analytics: ClickTale, Omniture, Optimizely, mPulse
Comments Systems: LyveFyre
Interaction Systems: Usabilla

That’s 14 different trackers, and it might have loaded more if I let it load those at all. And they’re all setting their own cookies on your web browser. A cookie is a bit of information that sticks around on your browser and gets sent back to the website every time you visit. So all of these services know you just went to CNN. And they know all the places they’ve seen you from before on other websites. It is said that “If you’re not paying for it, you’re not the customer. You’re the product.” All of these sites sell your information to anyone who wants it. That’s why you get to use so many websites and services for free: they’re selling your information.

OK, let’s get rid of them. My favorite plugin for this is Ghostery. It’s free, it updates automatically, and it’s configurable so you can allow some things (some websites break a little bit if you block everything). Don’t install it just yet, because we need to talk.

Remember what I just said about “you’re the product”? Ghostery is free. Yep, they’re making money off you too, but they’re very open about this: when you install the plugin, you see a configuration screen, and the first page is about providing information back to them to help websites make their sites more secure. Here’s what you need to do on the config screens when you install it:

On the “Help Keep Ghostery Free” page, click “No thanks”
On the “Notification” page, it’s your choice. I don’t show the alert bubble anymore because the information is there if I want it
On the “Blocking” page, click “Select all”. There’s also a popup at the top that says “New trackers will also be blocked”. Click “Sounds good!”

One note here, courtesy of Alison – when you install Ghostery, there’s a feature that’s disabled by default, called GhostRank. If enabled, this sends anonymous information about your browsing to Ghostery so they can improve what they’re doing. Of course, we’re looking for privacy here, so you want to make sure that stays disabled.

Now go back to CNN. Looks a little different, doesn’t it? You can click on the ghost icon that’s up at the top of your web browser now and see all the good that Ghostery is doing for you. One thing to note is that you’re periodically going to have to use that ghost icon to allow some trackers or “whitelist” a website so it doesn’t have any trackers blocked. Do that with care. It might be nice to allow Facebook’s share icons, for example, but that means you’re letting Facebook track you.

Ghostery does a good job, but I like a little backup, so let’s also install AdBlock (NOTE: AdBlock is not the same as “AdBlock Plus” – ABP lets advertisers pay for play). The install here is simple, and it brings up a page where you can donate to them if you want to. The one thing you can consider changing is clicking on the “disable Acceptable Ads” link on that page. They’re trying to work with advertisers a little bit to allow some ads that are straightforward, because we would like these free services we use to remain free.

These are the only plugins I make sure are in all the browsers I use. So the next thing I want you to do is take a hard look at what extensions you have installed previously, and evaluate all of them while being paranoid. These instructions are for Mac, but they should be similar for Windows:

Chrome: From the menu up top, select “Window” and then “Extensions”
Safari: From the menu, select “Safari” and then “Preferences”. Click on the “Extensions” icon
Firefox: From the menu, select “Tools” and then “Add-ons”

Do you really need it? If the answer is no, remove the plugin. The fewer things installed, the fewer things we need to worry about tracking us.

Once you’re done going through your plugins, we’re now going to wipe the slate clean. We need to clear all of our browser history, dump all the cookies, and start fresh.

Chrome: From the menu up top, select “Chrome” and then “Preferences”. Click “Show advanced settings” at the bottom, and click “Clear browsing data”. Select everything and click the button to clear it.
Safari: From the menu, select “Safari” and then “Clear history”. Select “all history” in the drop-down, and click the button to clear the history.
Firefox: From the menu, select “Firefox” and then “Preferences”. Click “Privacy”, and click “clear your recent history”. Select “Everything” from the drop-down, click the little down arrow button and select all the checkboxes, then click the button to clear it.

That’s going to be a little annoying for you. You’re going to lose logged in sessions on websites, as well as some settings on those sites here and there. But the only other option is to manually go through every cookie on your browser and make a decision whether or not to delete it. Take the hit once and know that you’re restarting from a much better place with those plugins installed.

The one thing we didn’t cover here is what to do about the information that your IP address (that’s Internet Protocol address – it’s a number just like a street address that identifies your system when you connect) exposes. In a normal web browser there’s not much you can do about that. Coming up next in this series we’re going to talk about two ways where you can hide where you are coming from.

Up Next: Using the Tor Browser