Just another Reality-based bubble in the foam of the multiverse.

Friday, January 20, 2006

Making Life Difficult for the NSA

Just because.

How does a search engine tie a search to a user?

If you have never logged in to search engine's site, or a partner service like Google's Gmail offering, the company probably doesn't know your name. But it connects your searches through a cookie, which has a unique identifying number. Using its cookies, Google will remember all searches from your browser. It might also link searches by a user's IP address.

How long do cookies last?

It varies. Yahoo sets a cookie that expires in June 2006. A new cookie from Google expires in 2036.

What if you sign in to a service?

If you sign in on Google's personalized homepage or Yahoo's homepage, the companies can then correlate your search history with any other information, such as your name, that you give them.

Why should anyone worry about the government requesting search logs or bother to disguise their search history?

Some people simply don't like the idea of their search history being tied to their personal lives. Others don't know what the information could be used for, but worry that the search companies could find surprising uses for that data that may invade privacy in the future.

For example, if you use Google's Gmail and web optimizing software, the company could correlate everyone you've e-mailed, all the websites you've visited after a search and even all the words you misspell in queries.

What's the first thing people should do who worry about their search history?

Cookie management helps. Those who want to avoid a permanent record should delete their cookies at least once a week. Other options might be to obliterate certain cookies when a browser is closed and avoid logging in to other services, such as web mail, offered by a search engine.

How do you do that with your browser?

In Firefox, you can go into the privacy preference dialog and open Cookies. From there you can remove your search engine cookies and click the box that says: "Don't allow sites that set removed cookies to set future cookies."

In Safari, try the free and versatile PithHelmet plug-in. You can let some cookies in temporarily, decide that some can last longer or prohibit some sites, including third-party advertisers, from setting cookies at all.

While Internet Explorer's tools are not quite as flexible, you can manage your cookies through the Tools menu by following these instructions.

What if I want more anonymity than simply deleting my cookie when I'm searching?

If you are doing any search you wouldn't print on a T-shirt, consider using Tor, The Onion Router. An EFF-sponsored service, Tor helps anonymize your web traffic by bouncing it between volunteer servers. It masks the origins and makes it easier to evade filters, such as those installed by schools or repressive regimes.

The service has its drawbacks. While it can be very useful for a journalist in China, data services can be slower or have greater latency due to the extra stops the data makes, and a general dearth of servers.

Is Tor perfectly anonymous?

No. Computers leak data. Tor, combined with the Privoxy proxy server (which comes bundled with Tor), reduces some of that leakage, but still isn't foolproof. But when used with Firefox, Tor and Privoxy can provide a mostly-anonymous web browsing experience.


If you use a service like Blogger (that's this site, baby) with a log in function, the host server keeps track of your I.P. address. Yup, they know who I am. Among others.

But, clearing cookies everytime you visit a verboten site keeps the Google server- or the Microsoft server- or the Yahoo server- or the DARPA server if you frequent .mil sites- from keeping track of where you've been.

Remember, they aren't omnipotent, no matter what they claim to be.

They aren't even smart enough to avoid a land war in Asia.

No comments: