all 45 comments

sorted by: hot top controversial new old
[+] 18 points 11 months ago (5 children)
  • [+] [S] 10 points 11 months ago (3 children)
  • [–] 2 points 11 months ago (1 child)

    A vpn is just another isp, which could also sell your data

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 11 months ago* (last edited 11 months ago)

    I would trust something like Mullvad more than ATT or Verizon to not sell my data, wouldn't you?

    **this comment was posted like 6 times because all of the Lemmy instances I've been using have been super weird lately not letting me post comments and stuff so I kept trying and kept trying and then all of them pushed through at once.

  • source
  • parent
  • load more comments (1 reply)
  • [–] 2 points 11 months ago* (last edited 11 months ago) (1 child)

    Wasn't Mullvad famously raided and found to keep no logs?

    I'd sure trust that more than any ISP in UK or USA and I think you would be crazy not to as well.

    One has a proven track record, the others undoubtedly do it and have been known to do it and tell you they do it.

    It frustrates me to no end that people can't understand that truth.

    Even with TOR and shit they say don't do that and I think that's wrong. Sure sure, fingerprinting or whatever. I believe there is a much more tangible risk of your ISP knowing that you are connecting to TOR in the first place especially in countries like UK and USA.

    Sure if you lived in Belize or something where it doesn't matter it wouldn't be a big deal but living in those two countries and even like Canada and Germany automatically makes you a target for using it.

    Out of those options or a VPN I pay anonymously with Monero or mail cash to I would consider that much, much safer than any ISP.

    I encourage you to look up what Snowden said about ATT helping the NSA during Prism which is absolutely still ongoing.

    In fact, here you go heres a small part of it https://www.pbs.org/wgbh/frontline/article/how-att-helped-the-nsa-spy-on-millions/

    But sure keep preaching about how VPNs don't do anything and instead trust the companies that have direct interests to the governments they serve to stay in favor and that have your credit card and address on file. That is much more secure!

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (1 reply)
  • load more comments (-1 replies)
    [–] 9 points 11 months ago

    How old is that game? Are there other people in your demographic who also play the game, and then searched for the same thing?

  • source
  • [–] 8 points 11 months ago* (3 children)

    I would guess the likely culprits are

    Firefox extensions

    Search engines

    Wikipedia

    Other search results you may have opened or pre-loaded (not a default Firefox behaviour)

  • source
  • hideshow 3 child comments
  • [+] [S] 6 points 11 months ago (3 children)
  • [–] 1 point 11 months ago*

    You’ll need to provide all the sites you visited immediately after each of the ones you searched. Your origin header will give that info away freely. So if it’s in the query parameters of the URL, then you go to Facebook, it’s as easy as {k: v for k, v in (pair.split("=", 1) for pair in response.headers["origin"].split("?", 1)[-1].split("&"))}

  • source
  • parent
  • load more comments (-1 replies)
    [–] 5 points 11 months ago*

    It's duckduckgo. Search duckduckgo.com with the term "restaurants near me." You'll often get responses that are close to your IP location.

    That couldn't happen unless DDG passes your IP address on to Bing. It's possible they censor part of the IP and only pass part of it to Bing, but probably not.

    (Go ahead! Try it!)

    Since Bing sells to data brokers, data brokers know your IP is linked to a search for rambutan, even without fingerprinting your browser.

    I'm not calling duckduckgo.com a honeypot... I'm also not calling it not a honeypot. But it knows too much for something supposedly private.

    Any closed source firefox extension that has access to the browser display could be parsing the texts and selling it and your IP and other identifiers to data brokers. It's part of how these extensions are profitable.

    Cloudflare also does highly advanced fingerprinting and has a script called cloudflare insights, so it seems likely that any cloudflare activity is generating marketing data.

  • source
  • [–] 4 points 11 months ago*

    You say you were not using a vpn. Then the site has your ip and probably has meta/google ads or other shit running on it and links the product with your ip.

    This data is added to some data broker/ ad network and you see an ad when you visit a site using this network as you have "signalled" interest in the product by viewing the product page the first time.

  • source
  • [–] 3 points 11 months ago (2 children)

    If the EFF de anonymization tool can de anonymize your browser, then the ad network can too.

    Try searching for something with tor browser - no javascript

  • source
  • hideshow 2 child comments
  • [+] [S] 2 points 11 months ago (2 children)
  • [–] 2 points 11 months ago (1 child)
  • load more comments (-1 replies)
  • load more comments (-1 replies)
    [+] 2 points 11 months ago* (last edited 11 months ago) (19 children)
  • [–] 10 points 11 months ago (11 children)

    That's not true, your ISP might see your DNS and unencrypted web traffic sure but web searches use HTTPS so ISPs aren't reading the query or results

  • source
  • parent
  • hideshow 11 child comments
  • [+] 1 point 11 months ago* (10 children)
  • [–] 16 points 11 months ago (9 children)

    No, unless you browse http website. They'll only see the domain name in the request SNI or during the DNS request.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 1 point 11 months ago (3 children)

    But see ip you connect to. Reverse dns using own dns could show set of url possible on ip.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 11 months ago (2 children)

    Reverse DNS would only show domain name, not URL. And even then a lot of websites are sharing IPs. No point in doing that when you've got SNI.

  • source
  • parent
  • hideshow 2 child comments
  • [–] -1 points 11 months ago (4 children)

    ...and if you use DoH, they won't even see DNS.

    I would argue that you don't need a VPN. It's just another entity that can see your traffic, and there's no reason to trust them over your ISP. They're all for-profit companies.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 11 months ago

    https://www.pcmag.com/news/mullvad-vpn-hit-with-search-warrant-in-attempted-police-raid

    Yeah you're right man the VPN that got raided and proven to keep no logs is the exact same as ATT that helped the NSA spy on everyone in the USA and has your credit card and address on file.

    https://www.pbs.org/wgbh/frontline/article/how-att-helped-the-nsa-spy-on-millions/

    Sure something like NordVPN wouldn't be trustworthy but come on, saying all VPNs are just as trustworthy as ISPs is absolutely insane

  • source
  • parent
  • [–] 1 point 11 months ago (2 children)

    But they'll still see the SNI.

  • source
  • parent
  • hideshow 2 child comments
  • [+] [S] 4 points 11 months ago* (7 children)
  • [–] 3 points 11 months ago (3 children)

    If you're really crazy about your privacy I'd recommend getting rid of any extensions you don't 100% need (keep ublock origin though) as not only can they stalk you themselves but it can also help websites fingerprint you. Keeping your extensions to a minimum will help you blend in with the crowd, especially if you use a hardened browser like LibreWolf and/or Mullvad Browser

  • source
  • parent
  • hideshow 3 child comments
  • [+] [S] 3 points 11 months ago (3 children)
  • [–] 1 point 11 months ago* (last edited 11 months ago) (1 child)

    I've never used AdGuard but you can customize uBlock Origin to fit your needs and block specific things for specific websites. uBlock Origin is commonly used as a default in hardened browsers which would help you fit in with the crowd even more (although I realize you said you weren't going for anti-fingerprinting, just something to consider)

    1. I switched to using Grayjay Desktop rather than my browser for YouTube
    1. If you need a userscript manager, Violentmonkey is an open source alternative
    1. Proton Pass has an app, yes less convenient without the autofill but better for privacy not to have the extension
    1. Personally, I would just sail the seven seas
  • source
  • parent
  • hideshow 1 child comment
  • [+] [S] 2 points 11 months ago (1 child)
  • [–] 1 point 11 months ago
    1. If you want maximum privacy, Grayjay and Freetube don't link to accounts so Google doesn't know what you're doing (especially if you're on a VPN) but again, it's understandable if you don't feel that's worth it.
    1. Ah got it, didn't realize you were using passkeys.
    1. If you're willing to do a bit of setup, Stremio + RealDebrid ($40 a year) + Torrentio/AIOStreams is pretty much perfect to me (although if you watch a lot of super obscure shows maybe not the way to go as RealDebrid doesn't cache everything)
  • source
  • parent
  • load more comments (-1 replies)
  • [–] 1 point 11 months ago

    Do any extensions have permission to view your browsing data? You can check by opening the extension manager, clicking the extension and clicking the 'permissions and data' tab. I would suspect 5 and 6 the most, 1 might be suspect too. Those extensions by nature would need such permissions to some extent.

  • source
  • parent
  • load more comments (-1 replies)
  • [–] 2 points 11 months ago (2 children)

    Microsoft serves ads through duckduckgo that could connect the search to your IP perhaps if you clicked one

  • source
  • parent
  • hideshow 2 child comments
  • [+] [S] 1 point 11 months ago (2 children)
  • [–] 4 points 11 months ago* (1 child)

    It doesn't matter if you click on it. The ad space auction is already done.

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (-1 replies)
  • load more comments (-1 replies)
  • load more comments (-1 replies)
    [–] 1 point 11 months ago

    Out of what you say, probably cloudflare or incomplete history. Have a great day!

  • source
  • [–] 1 point 11 months ago

    I don't see ads but if I were to, and despite all my precautions some would be on topic based on my past behavior I would methodically dissect to find out the leak. Namely I would try to automate the process :

    • identify a place showing ads
    • take an action, e.g. search or browser, on a verifiable unique topic (in order to prevent from generic suggestions, e.g medication during flu season)
    • verify if the ads become relevant
    • enable/disable any of the tools used, repeat
  • source