Protect Your Online Footprint. HINTS & TIPS provided by MWR InfoSecurity and the Data Baby project

Transcription

1 HINTS & TIPS provided by MWR InfoSecurity and the Data Baby project

2 Logging on is now one of the first things we do every day. And every time we do, we leave a trace, often without giving a thought to the information left in our trail. In most cases, we are unaware that someone, somewhere is taking our information, processing it, and using it. For example, you browse online for a product. Two days later, you visit a completely different website, and an advert pops up for the product you were searching for two days ago. How is this possible? Websites have developed new ways to identify their users, and behavioural marketing firms are coming up with new ways to use that data. In order to track the online footprint of the typical online user, MWR InfoSecurity and the Data Baby project are looking at the digital activity of Rebecca Taylor, a 27 year old Londoner who likes travelling, photography, music, fashion and uses all popular social networks. However, Rebecca does not exist. In reality, she is a laptop controlled by a team of journalists and guided by the personality type they have mapped out. She is the Data Baby project - a virtual identity of which every trace can be tracked and forensically analysed. Periodically, the Rebecca laptop is sent to MWR InfoSecurity, who analyse the information it has sent and received. A picture is building up of where the Data Baby s information is going, who is processing it, and how that is affecting Rebecca s online experience. Any data posted or sent online can in theory be accessed forever, and when MWR InfoSecurity and the Data Baby team analysed Rebecca s online activities after just a few months of virtual life, they found out that it was possible to determine what she likes, where she is, who her friends are and who she s. mwrinfosecurity.com 2/5

3 After the Prism / NSA scandal put online privacy back in the headlines, MWR InfoSecurity and the Data Baby project has compiled a series of hints and tips to help you browse privately and protect your identity. Protect your location Dongles/Mobile Devices Social Networks Wireless Networks Photos Protect your preferences Protect your personal information in Social Media Protect your identity Protect your friends Protect your personal documents Disable Location Services Turn off the where I am functionality Disable the GeoTagging functionality Make browser history private Do not use third party apps Turn off facial recognition software Hide your list of friends Encrypt your data stored in the cloud Protect your location - A proxy server requests information from another server on behalf of the users; it basically acts as the middleman. For example, we would send the data to the proxy, the proxy would connect to Facebook and send us the information back. In this way, Facebook will think that our IP* address is the IP belonging to the proxy. There are different third party options that can be used to connect through a proxy server: Virtual Private Network: You can use a third party such as to anonymously encrypt your internet activity from snooping eyes. However, you would still need to trust the third party not to track your connections. Website based proxies: Sites such as can provide you with software or web-based functionalities that use proxies around the world to provide you with anonymous access to web sites. Stand alone proxy servers: Configure your browser to route traffic through a proxy in the Internet, using one of the following types: Anonymous proxy: It will hide your IP address Distorting Proxy: It hides your IP by placing an incorrect IP address in the HTTP headers. High Anonymity Proxy: It will hide your IP address and it will not identify itself as a proxy making even more difficult to track. If you use any of the options above you will have to trust that the third party providing the service will not collect any tracking information. * An IP address is the numerical label assigned to each device (e.g., computer, printer) that is connected to a computer network that uses the Internet Protocol for communication. mwrinfosecurity.com 3/5

4 A solution for this is to use networks such as Tor ( which will prevent websites from tracking your physical location or what websites you have visited. Tor uses several proxy servers and works in a way that every proxy in the path will know just the addresses of the previous and the next proxy, therefore protecting and hiding what you send to where. Dongles/Mobile Devices Disable Location Services Using a dongle or a mobile device could expose your exact location if you allow the device to share location information. For example, when accessing Facebook with GPS turned on, the device will know your whereabouts. Social Networks Turn off the where I am functionality Social networks often offer a where I am functionality that will show your location when posting something. The best way of avoiding this is to go to your profile settings and remove this feature if possible. The best option to avoid this kind of data to be included in your photos is to turn off the GeoTagging functionality or, alternatively, when using social media sites you can remove the metadata before uploading a photo. Sites such as Facebook, Instagram, Flickr and Twitter remove it automatically but, for example, Google+ does not. However, software such as BatchPurifier can be used for this. Protect your preferences Make browser history private You can turn on the private or incognito mode available in most browsers which will delete cookies sent by websites and all other tracking info when closing the browser. Even though pages will still be able to analyse your behaviour while browsing, the information from previous sessions will be removed from your browser. Protect your personal information in Social Media Do not use third party apps and set your profile to private Each application will ask for certain permissions when you install them such as accessing your profile, your friend list or your posts and pictures. Some apps can even access your information when you are not using them once you have installed them in your profile. Make sure to restrict access to your personal information, your profile and if possible, avoid using third party applications. Wireless Networks Wireless networks will not help in avoiding tracking. In fact, on some occasions the position of wireless access will be known, including street address. To avoid being tracked in a Wi-Fi network you can use Tor or any of the options proxy server options available. Photos Disable the GeoTagging functionality Some advanced cameras and smartphones, including the iphone, will include metadata in the digital photo file, which is information such as copyright, contact information or details of the camera used. The metadata in the pictures may include as well the GPS position where the photo was taken, which is a feature called GeoTagging. mwrinfosecurity.com 4/5

5 Protect your identity Turn off facial recognition software Facebook s facial recognition software automatically identifies the faces of friends in uploaded photos, which would mean that the company is able to identify what you look like. It has been banned under EU law, but Facebook said it hopes to reintroduce it in the future. To turn it off simply do the following: 1. Click at the top right of any Facebook page and choose Account Settings 2. Click Timeline and Tagging from the left-hand column 3. Under the How can I manage tags people add and tagging suggestions? section, click Who sees tag suggestions when photos that look like you are uploaded? 4. Select your preference from the dropdown menu You can also add to this by turning on the feature in which you have to accept a tag before it is posted in your timeline. Protect your friends Hide your list of friends In your Facebook profile anyone can have access to your list of friends and see who you are connected with. To hide this simply go to your timeline profile, look where your list of friends is, put the mouse over it and a pencil like icon will appear, click on it and select edit privacy. There you can select there who is allowed see your friend list. Protect your personal documents Encrypt your data stored in the cloud If you are going to save your documents somewhere out of your control, for example icloud or Dropbox, then you should consider protecting them with encryption. There are different ways to do this, with each offering a different level of protection. A simple way would be to use software such as Microsoft Office to add a password to your most sensitive documents or to zip your files and protect them with a password. There are other options available for more technically aware users, including software such as Pretty Good Privacy (PGP) or GNU Privacy Guard (GnuPG). This software can offer an extra level of privacy for your files but always consider that if you lose the password or the key to your files, you may not be able to get them back. mwrinfosecurity.com 5/5