My OperaYou need to be logged in to post in the forums. If you do not have an account, please sign up first.
Can Opera block "Beacons"?
Today I leaned of a new privacy tracker file called a beacon. As an Internet-tracking technology, beacons are similar to cookies and flash cookies.What does Opera do to allow me to identify, control, and block these pieces of software that gather data as we use websites?
There's a new interesting website about Who’s Spying on You Through Your Browser with a cool interactive infographic containing all the ways top websites track your data.
Read more <a href="http://gizmodo.com/5826044/whos-spying-on-you-through-your-browser">here.</a>
Can anyone at Opera tell me more about this (Searching <a href="http://my.opera.com/community/forums/search.dml?term=beacons&id=26">Opera</a> finds nothing)?
Where did you find this word?
Are you talking about web bugs?
http://en.wikipedia.org/wiki/Web_bug
31. July 2011, 03:56:31 (edited)
Originally posted by sgunhouse:
it refers to a 1x1 transparent GIF embedded in a page ...
When I looked at the Gizmodo article In-OperaBle mentions I saw it reloading every 10 seconds causing brief dropouts in my mouse pointer. This is the repeating pattern:
GET /ping?h=gizmodo.com&p=%2F5826044%2Fwhos-spying-on-you-through-your-browser....... Referer: http://gizmodo.com/5826044/whos-spying-on-you-through-your-browser.......... Host: ping.chartbeat.net HTTP/1.1 200 OK Server: nginx/0.7.67 Content-Type: image/gif Content-Length: 43 Connection: close GIF89a.............!.......,...........L..;
Could the gif89a from the last line be a beacon? Would be sort of ironic. Having set my cookies to 'block third party' I do indeed not see any other traffic going on, but the constant reloading I see in more and more sites can be distracting at times -browsers like Chrome, IE and QTWeb generate similar traffic but don't display any reloading.
Originally posted by XP1:
I don't see the word "beacon" anywhere in the article.
Hi, the screen-shot above is of the Wall Street Journal's interactive (flash) article titled "What They Know" (linked in the Gizmodo article), which you can find <a href="http://blogs.wsj.com/wtk/">here</a>.
Originally posted by sgunhouse:
Web beacon is a legitimate term too, but rather specific - it refers to a 1x1 transparent GIF embedded in a page that allows the host to access cookies. As such if you've blocked cookies it's just an invisible pixel ...
Interesting.
Originally posted by bartgzn:
Could the gif89a from the last line be a beacon? Would be sort of ironic. Having set my cookies to 'block third party' I do indeed not see any other traffic going on, but the constant reloading I see in more and more sites can be distracting at times -browsers like Chrome, IE and QTWeb generate similar traffic but don't display any reloading.
Interesting find. Im not sure, but I believe our collective research is valuable, so thank you. Also, yes the periodic reloading of Opera's background tabs (reloading circle tab indicator), is bothersome. Im not sure, but a "Beacon" could be the cause.
You may view where to click the original link on Gizmodo by seeing the red arrow & yellow square Ive created <a href="http://files.myopera.com/In-OperaBle/files/giz%20link%20-%20Copy.jpg">HERE</a>.
You may view where to click to start the interactive (flash) Wall Street Journal article by seeing the red arrow & yellow square Ive created <a href="http://files.myopera.com/In-OperaBle/files/wsj%20interactive%20-%20Copy.jpg">HERE</a>.
The original Wall Street Journal titled "What They Know" is <a href="http://blogs.wsj.com/wtk/">HERE</a>.
Sorry I wasn't more clear.
The whole privacy problem is getting on my nerves more and more
*ng private data miners crawling all over the place It's like being forced to spend your time and energy to build barricades and guard your house from burglars and if a burglar manages to enter then the burglary is legal THIS is the source of all of the private data related collecting issues! That it's accepted as an obviousness! And legal.Oh but it's the major source of income for many companies you use services of.
I care as much as I care about narco criminal loosing his only source of income after police grabbed his 'merchandise'. This is not a metaphor. I care... exactly... as... much... For me both can eat * and die
, if they decide a proper job is not for them. Sorry for the OT and rant but I've decided some time ago that I will engage in more organized pro-privacy
activities sooner or later as this is getting annoying, grotesque and dangerous for that matter. We have no obligation to keep it legal what those people who have chosen to do some whorelike profession in their lives.A big thanks for the topic author for the heads up!
I knew about the beacons but I didn't know about the Opera extension.
Can anyone post a link to source of the image in the OP. I remember I've seen some sort of a ranking of the worst popular (like photobucket, facebook etc.) sites engaged in data mining.
Firefox with the NoScript extension added stops virtually all kinds of JavaScript exploits and allows you to see exactly which websites are trying to access all your precious data. You can allow or disallow each 3rd-party-site access or not, permanently or temporarily.
I use this setup when I need to be signed into a website but don't want my bandwidth or cookie data sucked up by 3rd party leeches like doubleclick, googleanalytics, etc. Some websites like eBay will have over a dozen websites trying to vacuum up my info when I just startup the website; it gets worse when I land on a listing that has an external website like Auctiva hosting part of the listing.
I don't know of any such easy fine-tune control for security purposes in Opera. I tried using TOOLS > PREFERENCES > ADVANCED > CONTENT > MANAGE SITE PREFERENCES but some sites like eBay use other external websites to load media, analytics, etc to function properly.
I tried this setup in Opera, "Accept cookies only from the site i visit" with eBay and it did not function properly enough for me. And if you have the time and/or patience to "Manage Cookies...", well you're a bigger geek than me.
Originally posted by vincentrodriguez:
If you wish to defend yourself against third-party JavaScripts, there is an excellent Opera extension calledNoAddsFirefox with the NoScript extension added stops virtually all kinds of JavaScript exploits and allows you to see exactly which websites are trying to access all your precious data. You can allow or disallow each 3rd-party-site access or not, permanently or temporarily.
You can defend your privacy further if you check the "Delete new cookies when exiting Opera" checkbox in Settings > Preferences > Advanced > Cookies.
Everything is possible for Opera users unlike IE users
http://translate.google.com/translate?js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&sl=ru&tl=en&u=http%3A%2F%2Fjavascript.ru%2Funsorted%2Fid&act=url
A theory? Well, the technology is going into production. Here is a startup for you to contemplate:
http://www.bluecava.com/
So... Sorry, but you are just wasting time trying to protect yourselves.
And even if you DO manage to hide (which I believe isn't possible), you'll be standing out like a white crow amongst all the others who do not. Therefore it'll be a piece of cake to identify you.
But for those who are very concerned about this issue there is also a program called Advanced Onion Router
Originally posted by komokdj:
If you wish to defend yourself against third-party JavaScripts, there is an excellent Opera extension calledNoAdds
Just a correction. It's NotScripts.
If you need any help from me with regards to Opera, please make a comment on any of my blog posts.
Support Opera wishes
Originally posted by Swapnil99pro:
Never used this extension, because NoAds fits all my needs. It blocks almost all advertisements on webpages and JavaScripts as well. I know a little about trackers 'cause NoAds blocks their JavaScripts (the most common is google-analytics) on many webpages I visiting. But I spit on privacy protection as my dynamic IP doesn't allow to identify my personality. And in general, nobody is interested to identify you. Every person in statistics is just John SmitJust a correction. It's NotScripts.
Originally posted by komokdj:
Originally posted by Swapnil99pro:
Never used this extension, because NoAds fits all my needs. It blocks almost all advertisements on webpages and JavaScripts as well. I know a little about trackers 'cause NoAds blocks their JavaScripts (the most common is google-analytics) on many webpages I visiting. But I spit on privacy protection as my dynamic IP doesn't allow to identify my personality. And in general, nobody is interested to identify you. Every person in statistics is just John SmitJust a correction. It's NotScripts.
They gather whatever data they can. If they have opportunity to grab your name, surname and address for 0.02 c, they will. Because They've just earned 0.02 while it cost them nothing.
AFAIK google analytics can be blocked with just the urlfilter.ini.
*googleanalytics*
Originally posted by Bucic:
Maybe you mean *google-analytics*google analytics can be blocked with just the urlfilter.ini.
*googleanalytics*
Manual editing of urlfilter.ini is a bad idea at all.
I advice to download a ready-to-use Fanboy's Main List+Tracking List urlfilter.ini instead. It counts thousands of filters and promises to "Block 3rd party Tracking, Statistic Collecting and other code which breach your privacy. It is Recommended to use this list if you do not want your personal information to be collected by websites and Ad Companies."
And still better will be to install Opera AdBlock extension which automatically updates Fanboy's lists.
P.S. By regret, all advertisements will be also blocked as a side effect.
11. August 2011, 03:35:53 (edited)
But I spit on privacy protection as my dynamic IP doesn't allow to identify my personality.
Your IP is used as one of the components of the digital signature. Then it goes to BlueCava database. This database will allow to track you globally. A couple of sites where you enter your name/surname -- voilà, there you go. Of course, you can always use false names, but do they really need your actual name? They're just Internet businesses. And if someone (like government) needs you, BlueCava will give your signature to the government. Never mind that governments often spy on you with ISPs' help anyway. And what will you do when IPv6 goes to the masses? There will be no need for ISPs to assign dynamic IPs.
I mean it, it's useless battle, until there's an international law prohibiting these kinds of things. It's like murders: people don't murder or fight much because the law prevents it.
11. August 2011, 04:50:57 (edited)
He doesn't have a fixed IP though, so he only has to worry about cookies.
I see you still don't understand. OK, I'll go into more details.
Imagine someone going from country A to country B. In country B that person looks for porn in Google. Porn is prohibited in country A.
Now, imagine that Google employs BlueCava. BlueCava looks at this person who has a dynamic IP:
"Aha! This guy has a dynamic IP! What city is he in? X city? Go-od. Now, what about Javascript? Oh, it's off? How much people in my database are there in the X city with Javascript off? Ok, a thousand people. What next? His screen resolution. Screen bit depth. Ok, still 900 people. What browser is he using? Opera? Wow, great, what version? 11.1? Nice, 50 people. Let's go into details..."
So BlueCava goes into further details. It identifies the specific device with redundant accuracy. Now the person visits his Yahoo Mail. Yahoo employs BlueCava, and BlueCava again identifies him, and because of redundancy he is always unique for the system. Therefore, it tracks him across all partner sites. IP is just a component in an extensive digital signature.
The man now wants to get more anonymity. He uses TOR. And yet, the same happens:
"Oh my, here we have a TOR user! Is his Javascript off? Yes, it is. Let's look at CSS criteria or maybe at TCP/IP packets size".
BlueCava again redundantly identifies our poor guy. Moreover, he uses the same device, so now his two entries in the database are linked.
Now, he logged into his mail from other devices in country A before the trip... They're also linked now! Our dude doesn't even have to bring his notebook with him in his journey, he is recognized anyway!
The guy returns to home country A. Home country wants to know what he was doing in country B. However, government of country B won't tell anything. As won't tell Google or Yahoo. But BlueCava will. Because it's not a public company and it most probably is registered in some offshore. It doesn't care about our dude, it only wants money and doesn't want problems with government of country A. BlueCava gives away the signature and all the sites that were visited etc.
So the hero of our little story is now officially screwed and put into jail for 100 years.
Originally posted by Kropotkin2:
So the hero of our little story is now officially screwed and put into jail for 100 years.
The topic is not about how to circumvent authorities, it's about tracking and what you can or even more important, willing to do about it.
- Disable cookies. Enable them only for trusted sites you need them to log in. At least you can use the option to delete new cookies when exiting Opera (in case you are exiting Opera daily).
- Clean Flash cookies.
- Disable JavaScript globally. Enable it only for sites where it is imperative.
- Disable local storage.
- Set disk cache to be emptied on exit (in case you are exiting Opera daily, otherwise you could disable disk cache if you have enough RAM).
Last but not least, if you are registered at FedBook or akin sites than privacy shouldn't be a matter of concern anyway.
Every morning a lion wakes up. It knows it must outrun the slowest gazelle or it will starve to death.
It doesn't matter whether you are a lion or a gazelle: when the sun comes up, you'd better be running.
The topic is not about how to circumvent authorities, it's about tracking and what you can or even more important, willing to do about it.
Well, if you read all my post and not just the last line of it (that was simply put there to show one possible outcome), you'll know that you can't defend from tracking.
Forget about "cookies". Modern tracking is done using fingerprinting:
http://en.wikipedia.org/wiki/Fingerprint_(computing)
And if you disable all those things you mention, you just make yourself more easily trackable, because all the other Internet surfers around you use default settings. It's like going out in the streets with a robber mask on your head.
Originally posted by Kropotkin2:
And if you disable all those things you mention, you just make yourself more easily trackable, because all the other Internet surfers around you use default settings. It's like going out in the streets with a robber mask on your head.
Firstly, it's naive to suppose that all other Internet surfers will use the default settings. It would mostly defeat the sense of fingerprinting
Neither will all Internet surfers use even the same browser (browser version for ever) nor will all use the same settings all the time.Secondly, if you are visiting a site scores of times you might be the same person according to your fingerprint or you may not. Nobody can tell for sure. Not really helpful for marketeers
Every morning a lion wakes up. It knows it must outrun the slowest gazelle or it will starve to death.
It doesn't matter whether you are a lion or a gazelle: when the sun comes up, you'd better be running.
Firstly, it's naive to suppose that all other Internet surfers will use the default settings. It would mostly defeat the sense of fingerprinting
No, it wouldn't. There's the hardware level. Look at BlueCava site, they say they're identifying devices and not users or browsers.
Besides, I meant default settings as in cookies, Javascript, Flash. These are often needed. A lot of users don't even know how to make an old-school toolbar appear instead of an Opera button, much less they care about unknown security options (hence Opera's simplified address bar). If you start disabling those options like crazy, you're worse off than before.
Neither will all Internet surfers use even the same browser (browser version for ever) nor will all use the same settings all the time.
True. Opera, for example, has not got a big market share. That means using it allows to track you much more efficiently than, say, IE6 user. IE6 doesn't even have things like persistent storage, so no need to disable them. By your logic, privacy-conscious ones should use the oldest software available that still has a big market share.
Secondly, if you are visiting a site scores of times you might be the same person according to your fingerprint or you may not. Nobody can tell for sure.
That's what heuristics are there for. It's possible to check if the computer is public. Or if it's a part of DDOS network, or if someone is mass-checking hacked accounts. Take a look at BlueCava again -- they say they fight with fraud. Of course, they fight for the corporations who pay them, not for users.
Near both locations one can spot these gray cable distribution boxes on the pavement, so if things turn out of hand....
Originally posted by Kropotkin2:
There's the hardware level. Look at BlueCava site, they say they're identifying devices and not users or browsers.
Did you look at their site?
In order to identify a device they need your client/browser accessing their code.
Our technology is embedded in some applications, like a multiplayer video game or a mobile application. Second, we can get the unique identity of a device when that device visits a site that contains a small amount of BlueCava code.
So it pretty much looks like your browser/client has to allow active content or at least scripting (BlueCava-code).
Furthermore:
We do this by collecting information from the browser on the device, such as the browser version, operating system, IP address, and time zone. These pieces of information are used to uniquely identify a device.
Originally posted by Kropotkin2:
By your logic, privacy-conscious ones should use the oldest software available that still has a big market share.
No, wonder where you got this. Read my advises again.
Every morning a lion wakes up. It knows it must outrun the slowest gazelle or it will starve to death.
It doesn't matter whether you are a lion or a gazelle: when the sun comes up, you'd better be running.
Originally posted by bartgzn:
If you were right, I'm now in Kremlin!In the past few months it has been locating me very consistently, always the same 500 meter offset, no matter my IP changing.
Can't believe in this...
Originally posted by komokdj:
If I'm wrong that would put you in Lubyankaif you were right, I'm now in Kremlin!
But seriously even if this doesn't work in every country or every ISP there are plenty of other tricks left -see above.
On the other hand even if 95% of the people would be traceable all that information would be split between some 50 companies. The worst thing that can happen is them firing ads, most people see them, many block them and a tiny minority actually buys viagra pills.
Originally posted by Krake:
The topic is not about how to circumvent authorities, it's about tracking and what you can or even more important, willing to do about it.
"The topic is not about how to circumvent authorities"
How so? You don't think that every person that is not committing a crime and does not give "the authorities" probable cause for invigilation has the right NOT to be spied upon? Whether it's a specific invigilation or spying en mass on the whole population (like here).
You like Stasi and KGB? They were also authorities that cared about public safety and were looking for the "enemies of the people" among their population. You would never want to circumvent Stasi?
Of course it's not possible to escape the invigilation by spying agencies in USA and its satellite states (Britain, Poland, etc...). All the traffic from ISP's goes to NSA.
And now the real problem. Virtually all those "private commercial" companies are fronts for NSA/DoD, CIA, MI5. Commercial interest is just a side benefit. Their real goal is to circumvent the oversight by legislature. USA and Britain privatize their KGB, so they can claim it's not about a totalitarian state.
It's like with Google, a front company of DoD and NSA. A couple of stooges got the best search algorithms from NSA, plus they got some money from the military-industrial complex (and most probably some NSA hardware), so they became the best on the market.
NSA wanted to spy on all computers in the world, so they needed a cover (in USA, they already had their own creation AOL, and now they have all ISP's giving them all the traffic). A private search engine was the best one (this actually had a good side effect, it gave the consumer some needed service
; another good one: Google Earth, gotten from National Reconnaissance Office). Now Google doesn't even hide its evil nature. They openly roam the cities of the world and collect wireless data on everybody. Why would you need a slogan "Don't be evil" if you didn't have evil on your mind?
So this BlueCava may not be (most probably it is not) just a commercial enterprise. Making money on advertising may be just a sideshow.
So the point is, there is no escape from the evil bastards, because the commercial spies are linked to the spy agencies overlords. Unless there is an international law banning this corporate piracy, as Kropotkin mentioned. And of course, all the espionage beasts must be defeated. Like CIA, DIA, MI5/6 and all their corporate fronts.
12. August 2011, 03:13:35 (edited)
In order to identify a device they need your client/browser accessing their code.
I never said they do only hardware fingerprinting. They certainly do IP logging when you connect to the server. They probably do other similar things. They probably do CSS-probing (so you should advise users to turn off CSS; also to change things like TCP/IP packets characteristics or http headers). They also track if you do not execute their code. You really think a lot of companies would let some fraudster (from their point of view) use their services?
So it pretty much looks like your browser/client has to allow active content or at least scripting (BlueCava-code).
So what? It's just one startup out of many. You think there aren't others (with other tech)? BlueCava already sued with Microsoft, and won:
"In 2003 when Ric was living in California he noticed that Microsoft might be infringing on his patent so he did what any sensible Aussie would do. He sued them. Years later in 2009, a jury in Rhode Island awarded Uniloc USA (our parent company) $388 Million excluding damages or interest."
You think if Microsoft is doing it, Google isn't?
Bottom line: turning off cookies won't save you. Turning off Javascipt (read: refusing to execute their code) will turn you into an ill-wisher.
Originally posted by Kropotkin2:
They also track if you do not execute their code.
For sure they do, by magic.
Originally posted by Kropotkin2:
You really think a lot of companies would let some fraudster (from their point of view) use their services?
I couldn't care less. I'm fine without those companies and such kind of 'services'.
Originally posted by Kropotkin2:
So what? It's just one startup out of many. You think there aren't others (with other tech)?
There might be. However there is no voodoo black magic in computing.
Originally posted by Kropotkin2:
Bottom line: turning off cookies won't save you. Turning off Javascipt (read: refusing to execute their code) will turn you into an ill-wisher.
Yeah, bottom line is that turning off JavaScript will prevent successful tracking.
BTW, JavaScript is the most misused scripting language of the Net. Not only for tracking...
Turning off cookies will also prevent you to be tracked. Cookies are still the predominant method on the Net to track users.
Every morning a lion wakes up. It knows it must outrun the slowest gazelle or it will starve to death.
It doesn't matter whether you are a lion or a gazelle: when the sun comes up, you'd better be running.
12. August 2011, 06:34:17 (edited)
For sure they do, by magic.
You've misread. I've meant they track the code not being executed.
I couldn't care less. I'm fine without those companies and such kind of 'services'.
So you are fine with Opera which forces things like tab stacking on its users? Or EOLAS patent on European users? How do you even know Opera itself isn't spying on you? What's stopping them from dealing with BlueCava and building their small code into the engine like they build in TLS?
I suggest uninstalling Opera and using text browser if one is not going to take advantage of graphical browser features. Again, one won't have to disable "privacy-related" things like persistent storage. Or maybe utilize a packet sender with a primitive HTML parser.
There might be. However there is no voodoo black magic in computing.
No black magic. Hackers have been using fingerprinting for years. Check Nmap:
http://nmap.org/
What's stopping some startup from fingerprinting you back on connect, just like that? Nothing.
Yeah, bottom line is that turning off JavaScript will prevent successful tracking.
Correction: BlueCava tracking.
Cookies are still the predominant method on the Net to track users.
Statistics, please.
I know that the Ghostery extension for Opera claims to block beacons or web bugs, among other tracking web objects.
What I would like to know is how effective Ghostery for Opera will be (compared to its Firefox counterpart) on blocking web beacons/bugs, since Ghostery's blocking capability is dependent on Opera's content blocking functionality/API, which AFAIK, is not as efficient as Firefox' (no site-specific filters, among other filter limitations).
Many already know that Opera AdBlock is not as effective as Firefox' AdBlock Plus (one of the reasons are: no site-specific filters, which causes ad-blocking filter list authors like Fanboy, to not implement certain ad-blocking filters for their Opera ad-blocking lists since it could potentially affect non-ad content in other webpages). I think that the same issue might apply to Ghostery for Opera compared to its Firefox counterpart.
Opera feature or extension requests: Option to Disable Tab Stacking | Show webpage title in status bar | Improve browser bookmarks! | Feature/extension to configure proxy server settings on a per site basis
The Wall Street Journal's What They Know series - web trackers, web bugs, spying, privacy
Originally posted by intergalacticninja:
Beacons are also known as Web bugs, tracking bug, and tag or page tag. Common names for web bugs implemented through an embedded image include tracking pixel, pixel tag, 1×1 gif, and clear gif. Source: http://en.wikipedia.org/wiki/Web_bug
I know that the Ghostery extension for Opera claims to block beacons or web bugs, among other tracking web objects.
What I would like to know is how effective Ghostery for Opera will be (compared to its Firefox counterpart) on blocking web beacons/bugs, since Ghostery's blocking capability is dependent on Opera's content blocking functionality/API, which AFAIK, is not as efficient as Firefox' (no site-specific filters, among other filter limitations).
Many already know that Opera AdBlock is not as effective as Firefox' AdBlock Plus (one of the reasons are: no site-specific filters, which causes ad-blocking filter list authors like Fanboy, to not implement certain ad-blocking filters for their Opera ad-blocking lists since it could potentially affect non-ad content in other webpages). I think that the same issue might apply to Ghostery for Opera compared to its Firefox counterpart.
Ghostery for Firefox can also block cookies and delete flash cookies at exit.
It can : ( i guess the Opera API makes it harder for them to implement the same features.Basically Ghostery for Opera and Chrome are the same, a stripped down version of Ghostery for Firefox)
-Scan and block images served off the matched tracker domain
-Scan and block iframes served off the matched tracker domain
-Scan and block embed and object tags served off the matched tracker domain
-Look for and prevent redirection from known trackers
-Scan for dynamically inserted page elements
And a strange thing I noticed is that it block more web bugs than Ghostery for Opera 631 vs 622.
The Wall Street Journal's What They Know series - web trackers, web bugs, spying, privacy
URL in the previous post was missing! Sorry.