No Cookies, No Problem – Using ETags for User Tracking (opens in new tab)

Yeah, I should learn not to post late in the night when I should be asleep (when I abbreviate, I often get into trouble). I didn't explain the other steps I take to stop tracking and there's quite few. Besides turning off JavaScript, these include plug-ins for ad-blockers, on-the-fly cookie-deleters and for the random changing of User Agent info among other things.

In addition, I use multiple browsers on both my PCs (usually 4) and smartphones (3) which—with the exception of one instance mentioned below—all are set by default to the following parameters:

- Location access — off

- Block 3rd party cookies — on

- Remove identifying headers — on

- WebRTC – off

- Clear cookies on exit — on

- Clear cache on exit — on

- Clear web storage on exit — on

Often before closing a browser—and depending on the sites I'm visiting—I'll manually clear the last three items above. (If I deem a site to be risky then I'll clear these items every few minutes or as soon as I'm finished with it).

Naturally, such action can break some sites, so to avoid this and or to save time I'll copy the relevant URL to another totally 'clean' browser specifically set aside for the purpose. For instance, I normally use Palemoon to browse HN but it's so loaded with protection that cannot be turned off quickly that it poses problems when posting comments (this level of protection means that sometimes I'm blocked from posting or that I have to refresh or renew the login info every time I want to do an edit, etc.). To overcome this I'll copy the URL into say a clean copy of Waterfox which still has protection (but it's minimal). This certainly overcomes any cache tracking (in fact you'll note this process effectively doubles protection against the cache tracking issue mentioned in the article).

Next, when internet activity has stopped for 10 minutes my machines are set to reboot the router/modem which gives me a new IP address when I next connect to the net. Moreover, my PCs upon start (and during router restarts) are set to only connect to the internet manually (i.e. the internet is essentially never connected to my PC unless I'm present at the machine).

I've been doing this with ongoing refinements ever since the early days of XP (then using Internet Explorer and Firefox as my original browsers).

At the time, it was a somewhat slow process to clear IE's cache on-the-fly so I put a link to its cache directory on the taskbar which gave me instant access to it. As subdirectories in IE were locked by the system, deleting them was performed by that wonderful utility unlocker, it'd kill the lot in a second or two and IE would have to rebuild a new clean set when it was next used.

Often, out of convenience, I'll simultaneously use multiple devices to browse the internet. Here, I'll use a smartphone's browser in conjunction with one of those in my PC. To save time typing a link on the second machine, the URL is 'copied' manually from one device to another with the aid of search engines (Duckduckgo or Startpage). As the smartphone and the router/modem each use different ISPs, there's no common IP address, hence tracking is made all that much harder.

Furthermore, my smartphones are rooted and I've deleted all their GApps, Gmail, etc. (BTW, I never use social media nor trust any of my files to the cloud). Also, I always use a firewall to block access to the internet for all apps except those that I've especially permitted (those permitted are mostly safe apps from F-Droid). The firewall is also set to automatically block all 'unknown' connections to the internet that act through various UIDs, 1000, 10015, etc. All unnecessary internet access is blocked not only by denying permissions but also by nuking 'receivers' and or modifying apps' manifests. Moreover, the only Android system app that I allow through the firewall is Downloads. Also, a utility manages the hosts file as additional bootstrapping protection (same goes for my PCs). The rule is simple—block any and everything from internet access, the only apps with access are ones I'm specifically using.

That's the brief explanation (there's more I've not had time to mention). I accept that my attempts at maintaining my privacy and blocking ads etc. won't be perfect for reasons too lengthy to explain here (except to say that those with whom I've contact on the net are likely to 'put me in' to Google (as they've usually Google accounts, etc.) and the same goes for Google's monitoring of my neighbors' routers to gather my SSIDs, etc [this nasty scam gives my location away and ought to be highly illegal]. BTW, I'm too lazy to bother suppressing the 'leaks' any further than this [i.e.: by killing visible SSIDs]; at this level of suppression I reckon it's not really that important that I grind the privacy granularity any finer.

The net effect is that going on for nearly two decades I've never had any hint that Google, et al, are tracking me with sufficient success for them to bother with me in any noticeable way (any info they gather will be essentially digital noise). Moreover, I never see ads on my either my PCs or smartphones! Again, I'd add that by far the most important procedure in taming the likes of Google, Facebook, Amazon, etc. is to kill JavaScript and NEVER, EVER use any of their apps.

Killing JavaScript also has other great advantages, the most of important of which is speed—the internet sans JavaScript is lightening fast. (If you want to know what else I reckon is wrong with JS then see some of my earlier posts on the subject.)

Of course, none of this should be necessary. That's why we need internet Mark-II — an internet that puts power and privacy back into the hands of ordinary users — one that puts these big tech companies in their rightful place and at our disposal—not vice versa as it is right now.