So a bit ago I got an add for “canned rambutan”. I had looked up Rambutan a few days prior after hearing it mentioned 10 hours into the video game Baby Steps. I wasn’t using a VPN at the time and I didn’t have fingerprinting protections active but I only mentioned it to a few sources (according to my browser history) all of which generally are implied to be private.
Which of these do you think is the reason the ad networks know?
- Wikipedia
- Startpage Search
- Duckduckgo Search
- My ISP
- Firefox
- My Firefox Extensions
- Kubuntu
- CachyOS
- The omnipotent algorithm connecting my mentions of Baby Steps with my progress through the game.
- Does this only make sense if my browser history is incomplete?
- Maybe I was using DNS over HTTPS via Cloudflare at the time of my search.
Any guesses as to where the weak link is?
Well, without a VPN your ISP sees every site you enter. I wasn’t aware they might be selling that data for targeted ads, but it makes sense, why wouldn’t them?
That’s not true, your ISP might see your DNS and unencrypted web traffic sure but web searches use HTTPS so ISPs aren’t reading the query or results
Aren’t they seeing all the urls you access?
No, unless you browse http website. They’ll only see the domain name in the request SNI or during the DNS request. C
But see ip you connect to. Reverse dns using own dns could show set of url possible on ip.
Reverse DNS would only show domain name, not URL. And even then a lot of websites are sharing IPs. No point in doing that when you’ve got SNI.
True only domain. TIL about sni. But vpn still protect against sni analysis no?
With a VPN it’s the VPN that has access to the list of domain you visit instead of your ISP. Whether you should put your trust in your ISP or a VPN is another question.
…and if you use DoH, they won’t even see DNS.
I would argue that you don’t need a VPN. It’s just another entity that can see your traffic, and there’s no reason to trust them over your ISP. They’re all for-profit companies.
https://www.pcmag.com/news/mullvad-vpn-hit-with-search-warrant-in-attempted-police-raid
Yeah you’re right man the VPN that got raided and proven to keep no logs is the exact same as ATT that helped the NSA spy on everyone in the USA and has your credit card and address on file.
https://www.pbs.org/wgbh/frontline/article/how-att-helped-the-nsa-spy-on-millions/
Sure something like NordVPN wouldn’t be trustworthy but come on, saying all VPNs are just as trustworthy as ISPs is absolutely insane
But they’ll still see the SNI.
Not for long. That’s about to get fixed with encrypted client hello.
Yes but ECH/ESNI have been around for some time now, even if the official spec is recent, but adoption is stil l very low.
Looking it up my ISP isn’t exactly trustworthy, but there have been no clear allegations. I’d say it’s the most likely cause if not my Firefox extensions.
EDIT: I just got another theory, Cloudflare, I’ll add it to the list.
If you’re really crazy about your privacy I’d recommend getting rid of any extensions you don’t 100% need (keep ublock origin though) as not only can they stalk you themselves but it can also help websites fingerprint you. Keeping your extensions to a minimum will help you blend in with the crowd, especially if you use a hardened browser like LibreWolf and/or Mullvad Browser
I use AdGuard rather than uBlock Origin for adblocking, because it allows me to opt-in and only block ads when they are aggressive enough to be annoying. But I’ve not been trying to minimize fingerprinting. The issue is just that everything I used in this instance came with either a tacit or explicit promise not to track me and I don’t know which is lying.
Other extensions I use are:
I’ve never used AdGuard but you can customize uBlock Origin to fit your needs and block specific things for specific websites. uBlock Origin is commonly used as a default in hardened browsers which would help you fit in with the crowd even more (although I realize you said you weren’t going for anti-fingerprinting, just something to consider)
I’m not really interested in maximum privacy, at least right now. I’m slowly moving there though.
Microsoft serves ads through duckduckgo that could connect the search to your IP perhaps if you clicked one
I’m pretty sure I never clicked on one. And I’ve turned off Firefox link previews too IIRC.
It doesn’t matter if you click on it. The ad space auction is already done.
Apparently Startpage and Duckduckgo use contextual advertising (rather than targeted advertising) so the advertisers on an unrelated website shouldn’t know I was looking up rambutan.
If you do searches on DDG, which is powered by Bing, you get responses that are relevant to your IP-based location, which means something about your IP is being passed to Bing aka Microsoft. That’s how.
The ISP shouldn’t even see the search term given basically everything on the internet uses https.
The ISP will see the domain names of the pages you visit if you use their DNS or some other unencrypted DNS but those are unlikely to contain the search term.
Even if you use encrypted DNS they’ll still be able to see the domain in the SNI. Websites using ECH are very rare.