pandaflux’s list o’ recommended browser plugins

Firefox

  • googlesharing: encrypts your google traffic and routes it through a proxy where it is combined with many other people.
  • https-everywhere: Automatically enables a secure connection for websites that supports it.
  • better privacy: Among other things, Better Privacy will delete “flash cookies” that are difficult to manage otherwise.

Chrome

  • disconnect: Stop third parties and search engines from tracking the webpages you go to and searches you do.
  • click & clean: Deletes your browsing history, typed URLs, Flash cookies, all traces of your online activity to protect your privacy.
  • KB SSL Enforcer: Automatic security, browse encrypted.
  • NOREF: Suppress Referrer (referer) for Hyperlinks

GoogleSharing: a firefox addon

While reading the latest issue of Information Security Magazine I came across an article of a tool Moxie Marlinspike released at Blackhat this past summer, Googlesharing

Marlinspike has introduced several tools
that help people concerned about privacy avoid giving up personal information.
GoogleSharing, a Firefox add-on, acts as an anonymizing proxy service and is
designed to evade Google analytics and prevent Google from tracking searches. 

GoogleSharing firefox plugin
GoogleSharing firefox plugin

DNS Performance & Security…

I’ve gotten tired of Road Runner’s DNS redirection/hijacking service which I opt out of yet it keeps coming back.  I decided to do some DNS benchmarking, comparing my assigned ISP name servers against publicly provided DNS such as Google.   The results were very surprising.  It turns out I have less latency and hops reaching some of the publicly available DNS servers instead of those provided by my ISP (the servers actually resolve lookups faster).

Here’s what I did:

  1. Download and run DNS Benchmark (Windows or Wine): http://www.grc.com/dns/benchmark.htm
  2. Add your ISP assigned DNS servers into the DNS benchmark tool for comparison (Windows: ipconfig /all  Linux: cat /etc/resolv.conf)
  3. Load any additional public DNS servers into the tool: publicly provided DNS
  4. If public DNS is faster, configure your machine for hardcoded DNS (not to pickup from DHCP).

Coincidentally, Symantec has just released their own version of a public DNS that provides malware filtering.  You can read The H article here.  Symantec’s “secure” DNS servers are 198.153.192.1 and 198.153.194.1

Google beta’s SSL for web searches

According to this H article, Google is beginning to beta a new feature of providing SSL for their standard web search service. As one commenter noted, Google is still collecting the same information from your searches but this will limit 3rd parties from eavesdropping on your search queries. Remember SSL doesn’t guarantee absolute privacy as there’s Moxie Marlinspike’s work, chance of CA intermediaries, and your employer loading their own trusted CA’s into your corporate devices.

Google & Privacy

Bruce Schneier recently posted an article about the erosion of privacy.  Specifically how the social networking sites are accelerating this “privacy decay.”  Along with attacked social networking sites he through in Google.  I just came across an interesting Forbes article where a Google engineer rebukes Schneier. You can find that article here: http://www.forbes.com/2010/04/12/privacy-facebook-gmail-technology-security-google.html

Two interesting tidbits in the article are Google’s privacy control pages which you may not be aware of:

  1. Google Dashboard – Control your Google privacy settings for all of google’s applications
  2. Ads Preferences Manager – Control whether ads are tailored to your viewing habits or not.  You can opt out here.  *Warning this site sneakily redirects through doubleclick.net — bastards!

Try something new…. AskEraser….

I’ve been looking around for a new search engine besides Google.  I’m worried about giving them all the business and their privacy policy scares me.  They’re collecting more and more of our information and no one seems to notice.  (Take a look at Google’s new Dashboard if you want to see what they’re collecting on you)  I’ll admit, I haven’t started running my own MTA again but I’m getting close. Do you want my public key?  I hope you have one.  There’s guys in Utah and St. Louis looking through your email contents as I write this….

Anyways…back on track….

It’s not the easiest task comparing privacy policies even if you limit your search to the big players (google, yahoo, bing, baidu, ask, altavista).  Besides Scroogle which is a Google proxy — returning scrubbed results cookie free, most of the large search engines are very similar with their policies.  They all store some type of tracking cookie and say they can use this to target specific advertisements towards you and or share with third parties.  HOWEVER, all is not lost, I did come across the Ask.com AskEraser.  Navigate over to Ask.com and in the top right corner you’ll see “AskEraser On | Off”  turn this guy and check your cookies for yourself….it does make a difference…

When enabled, AskEraser will completely delete your search queries and data from Ask.com servers, including: your IP address, User ID and Session ID cookies, as well as the complete text of your search query–all within a matter of hours,

We’ll have to take Ask’s word that they’re actually removing our search data from their servers unless someone has a better idea?  Raid one of their NOCs on a Friday night hoping to bribe the night security guard with a pizza and a hooker? (maybe the pizza and a mountain dew would be enough)