Privacy and anonymity on the Internet

Cookies

Cookies are textual data that is stored on the computer by the websites. Websites use cookies to manage sessions, to track users and to personalize the sites based on the user preferences. Cookies can be seen as the memory of the websites. For example, with the help of a session cookie, an online store can memorize the items that were added to the shopping cart.

Cookies can be described as key-value pairs, where the key helps the website to determine which kind of information is stored and the value contains the corresponding data that is saved to the user's computer. In addition, cookies can contain several attributes like the domain, path, the expiry date and whether the cookie is transmitted securely. This is illustrated on the following screenshot.

So how can the website access the data in cookies that is saved to the user's computer? This is achieved with the help of the web browsers. Each time the user visits a website all cookies that were previously set by the same website (more precisely set by the domain) are sent along with the query. To be more precise, only the key-value pair is sent back to the webpage. With this approach the website can find out if the user has an open session (is logged in to the website) but it also allows to track users. For example, if a website sets a cookie that expires in 2 years, then the website will be able to track the user each time the user visits the website for the next 2 years (assuming that the user never deletes cookies and that the same computer and browser is used to visit the website).

The usage of cookies is regulated in the EU by the "cookie law". There have been several examples of companies breaching the EU "cookie law" and one of them is Facebook according to the following Guardian article.

Classification of cookies

Session cookie

Session cookies are used by the websites to manage web sessions. Session cookie(s) allows the website to determine if a query is made by a new user or by a user who has already logged in. The lifetime of a session cookie is usually determined by the lifetime of the session, i.e., when the user logs out of the website, then the cookie becomes invalid. Session cookies are usually deleted when the web browser is closed. It is important that the session cookies would be transmitted over a secure channel. Demo: What could an attacker do when he is able to copy a session cookie?

Session cookies are used by websites that allow the user to log in. Not all websites who allow to log in to the website use encrypted communication. Thus, in case the cookie is transmitted over an insecure channel (HTTP), an attacker could access the session cookie and take over the session. In order to protect against such attacks it is important to encrypt the cookie when it is transmitted between the web browser and the web server (the encryption is provided by HTTPS). Online banking sites transmit session cookies over a secure encrypted channel and therefore an attacker can not access their session cookies.

Persistent cookie

Persistent cookies are used to save information for a longer period. The lifetime of a persistent cookie is determined either by the expiry date or by the maximum lifetime of the cookie. Persistent cookies are used to personalize websites and also to track users.

Third-party cookie

Third party cookies are cookies that are set by domains other than the website which is being visited. Websites link advertisements, photos, videos, social media buttons and other content from foreign domains and these domains are also able to set cookies. So why are the third parties interested in setting cookies? Well, by doing that it is possible to track users across websites. For example, online advertising companies usually collect information about the browsing habits of website users in order to serve personalized ads across different websites as this will increase their advertising revenue. This is possible if the online advertising company hosts advertisements in many different websites. Therefore by using third party cookies, it is possible to create a profile of a user's interests and browsing habits. Some users consider this to be a threat to the privacy and therefore configure their web browser to block some third party cookies.

Super cookie

Super cookies are cookies that are set by a top-level domain (e.g., .com, .eu, .ee), or by a domain that is used by many people and websites (e.g., co.uk, edu.ee). Web browsers automatically block such cookies as they are a risk to the privacy and security. If browsers would not block super cookies then a domain who sets the cookie could affect other sites on the same top-level domain.

Zombie cookie

Cookies that are resistant to deletion are called zombie cookies. They might be set in a way that makes them difficult to remove and when deleted they might have means to restore themselves. Zombie cookies are used to identify and track users. So how could a website create cookies that can not be simply detected and removed? Actually, there are several options for doing this, e.g., HTML5 storage, Flash local storage, specially modified PNG files. The PNG trick is demonstrated by the following website http://lucb1e.com/rp/cookielesscookies/. More information about the different storage methods can be found in the Wikipedia article about Zombie cookie.

Flash Player's privacy settings

Flash is able to save some data to the computer while a website is visited. Therefore, Flash could be used by the websites instead of cookies. So it is important to configure the Flash Player to make sure which websites are allowed to save data. In addition, it might be useful to delete the data saved by the Flash Player. The settings of the Flash Player can be modified globally from the following link: Global Privacy Settings panel. The settings panel allows to disable the usage of Flash cookies, disallow access to the microphone and to delete data about visited websites.

How to manage cookies

Try it yourself: Using Google Chrome try to find out which cookies are set by an online news portal or by a social media website.

Open a news portal or a social network in Google Chrome
Make a right click on the website and choose "Inspect" from the context menu.
Click on the "Application" button that is shown in the new "Inspect" view
In the left menu expand the item "Cookies" and then click on a domain whose cookies you would like to see.
How many cookies are set by the website? How many different domains set cookies? Can you detect any third party cookies that are set by advertisement providers?

How to view cookies

Google Chrome - Navigate to "Settings -> Show advanced settings -> (Privacy) Content Settings" and click on the "All cookies and site data" button.
Firefox - Navigate to "Preferences -> Privacy -> Remove individual cookies".
Internet Explorer 11 - Navigate to "Tools -> Internet Options -> General -> (Browsing History) Settings -> View Files"

How to restrict the usage of cookies

Google Chrome - Navigate to "Settings -> Show advanced settings -> (Privacy) Content Settings" and the choose suitable settings for storing cookies.
Firefox - Navigate to "Preferences -> Privacy", choose from History topic that "Firefox will: use custom settings for history" and the choose suitable settings for storing cookies..
Internet Explorer 11 - Navigate to "Tools -> Internet Options -> Privacy -> Advanced"

How to delete cookies

Google Chrome - Navigate to "Settings -> Show advanced settings -> (Privacy) Clear browsing data" and choose "Delete cookies and other site and plug-in data".
Firefox - Navigate to "Preferences -> Privacy -> Remove individual cookies" and choose "Remove all cookies".
Internet Explorer 11 - Navigate to "Tools -> Internet Options -> General -> (Browsing History) Delete... -> Cookies and website data"

Browser extensions

Disconnect

Disconnect is a browser extension that lets the user view how web pages are tracking the users. The extension allows to view the graph of all possible domains that set cookies when a website is visited. It is also possible to block some domains from setting cookies. Browser extension "Disconnect" is available for Google Chrome and Firefox. In addition, they provide an application for iOS devices. An application for Android devices was removed from the Play store by Google, this is described by an article in TechTimes.

Task: Try to find out which domains track the user on a popular news site or on a social media site. First open Google Chrome browser and install the extension “Disconnect”, which displays the domains that set cookies. To install the extension go to the browser settings, then on the left menu click on the extensions menu and then click on the "get more extensions" link. "Disconnect" is also available for Firefox but there is also an alternative that is called “DoNotTrackMe”.

Privacy Badger

The extension Privacy Badger allows to limit the number of tracking cookies. Similarly to Disconnect, it displays the domains that track users but it also contains a smart feature that automatically blocks tracking cookies. Privacy Badger tries to learn which cookies are used for tracking and once such cookie is found it is blocked. Therefore, when the extension is used right after installation it won't block third party cookies, in order to get it working visit a few websites and you will notice that it starts to block third-party cookies. Sometimes a legitimate cookie might be blocked and this could make it difficult to view a webpage, in such case the extension can be disabled for the webpage or the cookies could be unblocked.

Privacy Badger is developed by Electronic Frontier Foundation, which is an organization that tries to protect the digital rights of users. Privacy Badger can be installed for free from the Google Chrome store. Privacy Badger is also available for Firefox.

Apple's Intelligent Tracking Prevention

Starting from macOS High Sierra and iOS 11, Apple has built Intelligent Tracking Prevention into its Safari web browser. This technology uses heuristic methods to limit and eventually purge third-party cookies originating from domains that the user does not explicitly visit (as first party) in a given period of time. Such third-party cookies are partitioned, i.e. a third-party gets different sets of cookies per each first-party domain that the user visits and that includes resources from the given third-party domain.

There's a good overview of how Apple's Intelligent Tracking Prevention works in the Security Now podcast episode #629 (starting at 1:45:10).

Private browsing

Almost all modern browsers can be used in a private browsing mode. Private browsing mode is designed to protect the privacy of the user by preventing a third party from finding out which websites were visited. Therefore, the effects of the private browsing mode can be divided into two: the protection that prevents the information to be read from the local computer and the protection that prevents the websites from identifying and tracking the users.

Private browsing modes usually provide protection against a local attacker who has access to the computer. Private browsing modes do not save browsing history, cookies, temporary files, etc. Therefore, private browsing should be used in public computers. However, it provides protection against the local attacker only when the computer user is careful, e.g., it is not wise to download files or create bookmarks during the private browsing session. It seems that there is a misconception about the functionalities provided by private browsing mode. This is illustrated by the following:

In theory, private browsing modes should also provide protection against external threats to the privacy. Thus, a website should not be able to identify and track the user when private browsing mode is used, but in real life this does not work. Usually the only protection provided by the private browsing modes is the deletion of cookies. Some private browsing modes also disable browser extensions during the private browsing session in order to increase both the privacy and the security. But it is still possible to track users based on the IP address, zombie cookies, browser configuration, behavioral biometric data or even by intercepting the network traffic.

A good overview of the private browsing modes is provided by the MIT course 6.858 Computer Systems Security. The video lecture is made available through the MIT OpenCourseWare program.

Private browsing in Firefox

Firefox can be used in either the normal mode or in private browsing mode. Private browsing mode does not save:

browsing history
search history
download history
data entered into forms
cookies
temporary files

However, if a bookmark is set in the private browsing mode, then the bookmark is not removed after the private browsing session ends. In addition, files that were downloaded during the private browsing session remain on the drive. Thus, you can see that the private browsing mode is designed to make sure that traces about browsing would not be saved to the computer. The private browsing mode can be activated by entering the following keyboard shortcut: Ctrl+Shift+P. The same shortcut for mac users is Cmd+Shift+P.

Incognito browsing in Google Chrome

The private browsing mode in Google Chrome is called Incognito Browsing and it works similarly to the private browsing mode in Firefox. The main difference between privacy modes of Google Chrome and Firefox is the way how browser extensions are handled. Namely, Google Chrome disables browser extensions during the incognito browsing session as it is not known how if the extensions protect the privacy of the user. In addition, browser extensions may contain bugs that lower the security level and in some rare cases the browser extension might contain malicious code. The Incognito Browsing mode can be activated by entering the following keyboard shortcut: Ctrl+Shift+N. The same shortcut for mac users is Cmd+Shift+N.

InPrivate Browsing in Internet Explorer

The privacy mode in Internet Explorer works similarly to the Incognito Browsing in Google Chrome. In Internet Explorer the privacy mode is called InPrivate Browsing. In the InPrivate Browsing mode toolbars and browser extensions are disabled. The InPrivate Browsing mode can be activated by entering the following keyboard shortcut: Ctrl+Shift+P.

How to anonymize network traffic

Surely you have noticed that some websites and web services know where you are located even when you have not logged in to the website and have not given out such information. So how can the website know that you are currently located in Tartu? This is possible due to the way how IP addresses are distributed. Each device that is connected to the Internet has an unique IP address (unique either globally or in the local network) and when a query is sent out then the source IP address is added to the query. Thus, a website that you are visiting knows your IP address as otherwise you would not be able to view the website in your browser. The web server has to know the source IP address in order to send the contents of the webpage back to the browser that made the query.

Now we know that the websites have access to our IP addresses but we still don't know how they can find out our location based on the IP address. IP addresses are distributed to the Internet Service Providers (ISP) in blocks and based on the block it is possible to determine in which city the IP address is located. In addition, there are many GeoIP services that have collected mappings between IP addresses and locations. The additional information could have been collected so precisely that it is possible to map an IP address to the house number where the device is located. Google used to collect the location information by scanning wifi networks while taking photos for Google Maps, more information about the incident can be found from the Guardian article.

In addition, websites might ask for a permission to detect the location of the visitor. In these cases the browser shows a dialog asking if the user would like to share his/her location with the website. In case you do not prefer to share such information, then it is possible to block such queries by configuring your browser.

Google Chrome:
- Settings -> Advanced -> Content Settings -> Location
- Replace Ask before accessing with Blocked
Firefox:
- type to the address bar: about:config
- agree with the warning
- find dom.webnotifications.enabled and set it as false
- find geo.enabled and set it as false

Sometimes it might be useful or even necessary to anonymize web traffic in order to protect your real location. In order to do that a proxy could be used and the proxy would act as a middleman between the user and the server. Thus, the user would send the query to the proxy and the proxy would relay it to the server. Then the server would send the answer back to the proxy and by doing that the server would not find out who really made the query.

The concept of a proxy (source).

The simplest solution is to use a HTTP proxy, which simply relays the queries made by the user. HTTP proxy was first used to cache websites in order to lower the bandwidth usage. Nowadays, HTTP proxy could be used to access resources that are available only in a certain location.

However, HTTP proxy does not provide protection against an attacker who is listening to the network traffic, as HTTP proxy does not encrypt the packets. All network nodes that transmit HTTP packets can read the data that is inside the packets. If the data is sensitive or confidential then it should only be transmitted via HTTPS, which provides encryption between the endpoints, i.e., between the web browser and the web server.

Some countries do not provide freedom of speech to its citizens and some countries censor Internet in order to keep citizens under control. In such countries it might be necessary for human rights activists and free speech activists to stay anonymous. Also ordinary citizens might be interested in information that is not censored. So, how would it be possible to stay anonymous when browsing the Internet? To the human rights activists it is important that even the state is not able to identify them as otherwise they might be arrested. Therefore, a good solution should provide both secrecy and anonymity. The most common services that hide the location while providing anonymity and secrecy are Tor and VPN.

Tor

Tor is a free software that provides a method for anonymous web browsing and communication. Tor works by relaying traffic through a network that consists of over 6000 relays that are hosted by volunteers. Therefore, Tor is not centralized and everyone can participate as a relay in the Tor network. When Tor is used then the network traffic is directed randomly through several nodes (volunteer computers who act as relays) in the Tor network. It is important to note that a separate encryption key is used for each relay node. Each relay only knows the IP address of the previous relay and the IP address of the next relay. A relay node does not have access to the contents of the traffic. In addition, a relay node does not know who is the source of the traffic and who is the exit node of the traffic. Therefore, even the first relay can not distinguish between a real source node and a relay as they are both equally likely. Only the exit nodes can see where the traffic is directed and which packets are sent back to the Tor network.

Tor directs the network traffic through the volunteer computers and therefore the latency of the connection depends on the latency between the relay nodes. Thus, one slow node in the randomly chosen relay chain can significantly slow down the traffic. However, the speed of the Tor network is not so important as it is created for the users who would like to protect their anonymity and not for the user who would like to watch online videos. More information about Tor can be found from the Wikipedia page or from the Tor project homepage.

The concept of Tor (source).

Tor uses Onion routing in order to direct the packets through the Tor network. Onion routing encrypts the message layer by layer and as the packets are relayed through the network the encryption is peeled off layer by layer. Only the last node, i.e., the exit node is able to read the contents of the message. Onion routing is described by the following picture:

Simplified view of Onion routing (source).

Using Tor provides anonymity only when the end user knows how Tor works and is careful when using it. Probably one of the most common mistakes while using Tor is to access accounts that contain identifiable information as the user might be leaking his / her identity. In addition, one should be careful when downloading files via Tor -https://www.torproject.org/download/download.html.en#warning.

Several theoretical attacks have been found against Tor but most of these attacks are not feasible in practice. Still, it is possible that some countries who have lots of resources are able to deanonymise some Tor users.

An attack against Tor was found in the summer of 2014, the aim of the attack was to deanonymize Tor users. An overview of this attack was written by BBC News and a more technical overview was given by the Tor project blog. In 2015 a new attack was found that allows to deanonymize hidden services, an overview of this attack is given in the Ars Technica article. In addition, Tor users have been identified by zombie cookies, this method is described in a document leaked from the NSA: 'Tor Stinks' presentation.

A good overview of Tor is provided by the MIT course 6.858 Computer Systems Security. The video lecture is made available through the MIT OpenCourseWare program. The lecture is given by Nick Mathewson who is one of the main developers of Tor. The video helps to clarify why a service like Tor is necessary and how Tor functions.

VPN

VPN (Virtual Private Network) is a virtual network that can connect offices over the Internet. The traffic that goes through the VPN is encrypted. Therefore VPN can create an encrypted channel that allows to securely exchange data over the Internet. Companies use VPN in order to allow the employees to connect to the intranet. It also creates an opportunity to virtually connect two or more branches of the company.

As an alternative, it is also possible to use VPN to anonymize the web traffic. The traffic can be partially anonymized when it is routed through the VPN server. Thus, a website can only see that the query comes from the VPN server but can not detect who really made the query. In this sense VPN can be seen as an encrypted proxy service. Even the ISP can not read VPN traffic as it is encrypted. ISP or any other party that is able to intercept the traffic only sees that the packets are directed to the VPN server or from the VPN server back to the client. However, it is important to realize that the anonymity provided by the VPN service depends heavily on the logging policy and on the legal system in which the VPN service operates. The VPN provider almost always knows who is using the VPN service as the user has to pay for the service and that leaves a monetary trace. In addition, the VPN service provider knows the IP of the user and probably his or her contact information. It is also possible that the VPN service logs the queries made by the user so that they could be used when there is a legal dispute. Therefore, it is preferable to choose a VPN service that does not log the user activities and that operates in a suitable legal system.

How VPN works (source).

Actually, it is also possible to create a similar encrypted tunnel by using SSH.

I2P

Invisible Internet Project (I²P) is a darknet like Tor that allows to communicate securely by using pseudonyms. I²P provides layered encryption where the identity of the endpoints is not revealed. In I²P network all parties (nodes) are identifiable only by their cryptographic pseudonyms. More information about I²P can be found on the I2P homepage.

Information Security 2018/19 fall