Privacy Settings for Firefox–History

By default, Firefox remembers your browsing history to make it easier to return to a visited site.

Select Options and then Privacy in the left hand navigation panel. Under History, open the drop-down menu labeled “Firefox will:”and tell the browser to never remember your history or use custom settings.

Selecting “Always use private browsing mode,” is for hardcore privacy, but you need to understand the implications of private browsing mode. See the Mozilla’s support pages for more information on this.

Here are the History settings that I suggest.

Uncheck the box for remembering your browsing and download history, un-check remembering search and form history, and leave the box checked for “Accept cookies from sites.” Then under “Accept third-party cookies” set it as Never, but change “Keep until:” I close Firefox. Finally check the box that says “Clear history when Firefox closes.”

This combination of settings allows Firefox to behave normally, but erases most of your activity upon closing the browser. These settings provide some measure of privacy without sacrificing functionality.

Privacy Settings for Firefox–Tracking

Firefox is the best browser for protecting your data. However, Firefox does require several setting adjustments to avoid intrusive tactics like ad tracking.

Select Options and then Privacy in the left hand navigation panel.

By default, Firefox does not enable the do-not-track feature. Turn it on by selecting “Request that sites not track you.” Also select “Use Tracking Protection in Private Windows”, which enables tracking protection that blocks ads and other online trackers when you’re in private browsing mode. However, few sites honor this request.

To enforce your do-not-track intentions, you need to use an add-on such as Ghostery, Disconnect, or the Electronic Frontier Foundation’s Privacy Badger. We have found that some sites do not to allow access to content with add-ons like these enabled.

Little Snitch

Just to be different, I started using a Mac to do some IIR. One of my quick fixes for security was  Little Snitch, a firewall for OSX. It monitors outgoing network traffic and alerts you if a program you’re running is trying to contact a strange server. This could be a shell or a program that snaps photos using your webcam or one that takes screenshots and sends them to an outside server.

Web Proxies & User Agents

A web proxy provides an easy way to change your IP address while surfing the Internet. They don’t require software or modification to your networking settings.  You just enter a website address and the sites you visit through the proxy see an IP address belonging to the proxy rather than your IP address.

I am very cautious about using web proxies as you never know who actually operates it and what data they might collect as you use it. You also don’t know  to whom they might give that data. On the other hand, I have found one that has a useful feature.

nroxy offers all the usual web proxy features plus something interesting–it offers the ability to change the user agent.  For example, some web sites cannot be viewed properly using Firefox. Sometimes it is an old site that requires MS Internet Explorer (IE) or it may be a site designed for mobile devices. This proxy offers user agents typical of 5 mobile devices and a long list of browsers.

To get the information I need I am finding it necessary to switch user agents more often. Usually, I use the User Agent Switcher extension that adds a menu and a toolbar button to switch the user agent of a browser. It allows you to chose from three versions of IE or an iPhone. Selecting the iPhone user agent often reveals additional  functionality on the site. The extension is available for Firefox and will run on any platform that this browser supports including Windows, OS X and Linux.

Now I have another option when I need to change the user agent and I get the additional proxy features as well.

The Darknet & Freenet

Freenet is like BitTorrent with web sites. Freenet is an anonymous peer-to-peer data-sharing network where uploaded data is assigned a unique key then broken-up into small, encrypted chunks which are then scattered across multiple computers on the network.

When someone wants a document, photograph or some other data, they “fetch” it from the network using the unique key assigned to that data. The fetch requests get routed through intermediary computers that don’t house the requested data, This ensures that no single computer on the network knows the contents of any individual data file.

With the Freenet client running on your PC, you can use most Web browsers to browse files and websites (AKA freesites) on the Freenet. The client allows you to access the Freenet welcome page (http://127.0.0.1:8888/) using your normal browser. From this welcome page, you can move on to browse Freenet, chat on Freenet forums, and communicate with other Freenet users.

Freenet has a darknet mode (AKA friends-only mode) for maximum privacy. In darknet mode, you connect to Freenet through trusted associates with whom you exchange encryption keys, which makes it difficult for anyone to track your movements on Freenet or even that you’re using Freenet. Of course, funneling your Freenet access through a handful of trusted associates may create a traffic bottleneck that slows response times. To avoid this, get five or ten friends to join up with you so you can fetch Freenet websites and files at greater speed.

Don’t expect this to provide total anonymity if you are doing something that is illegal or a risk to national security. Freenet has been infiltrated by police agencies that have created their own Freenet nodes to deanonymize users. You can be certain that national intelligence agencies have done the same.

Finding a Secure Workspace

Recently, when working at a client sites, I’ve taken to occasionally using Windows to Go. This is Microsoft’s little-used secure workspace feature for Windows. It allows you to boot into a secure workspace located entirely on a USB key. This enables you to use Windows without relying on the operating system, applications, or storage on the host device. It creates a secure workspace on any machine that can boot from a USB drive without trusting the host machine. I have even devised a way to use a Virtual Machine (VM) in this workspace. Because the workspace doesn’t rely on the host operating system, the workspace on the USB drive isn’t at risk of compromise from a host machine and the VM protects the USB workspace. This saves me from constant use of my ‘Safe Mode on steroids’ or reinstalling Windows from a drive image on a client’s machine. However, it is too slow and requires too much effort to maintain. A similar live Linux USB seems to offer faster performance and it is easier to maintain the VM.

Defence Against the Dark Arts

I wander through the nether regions of the Internet and Dark Net looking for data to support my clients’ causes. This exposes me to severe risks from the nasty creativity of Beelzebub’s demonic gangsters and hackers.

It seems that a Windows system only lasts about 1/2 hour before getting infected without some form of anti-virus (AV). I regularly boot a clean live Linux USB, and then scan for viruses. This is like Safe Mode on steroids. In most instances, I find something malicious missed by the typical AV programs. However, this is only a temporary measure.

I am migrating to Linux for Investigative Internet Research because very little Linux malware exists in the wild. I only need AV on the Linux file server (or an email server if I had one). I do this because an infected Windows computer may upload infected files or an uninfected one might access infected files on the Linux machine, which then allows it to infect other Windows systems. AV on the file server isn’t protecting the Linux system–it’s protecting the Windows computers from themselves. I recommend the paid version of ESET Antivirus and Security Software as it doesn’t try to upsell you on other services.

Ashley Madison Hack

The Ashley Madison hack has a lot of people running around like a bunch of headless chickens. The simple fact is, you cannot trust this data. Let me explain why this data must be treated with extreme caution.

Registration was free but you needed to buy credits to contact other members. Stolen credit card numbers appear in the data. Nobody has verified the number of real and active accounts. The website would allow new accounts to be set up without confirming the email, therefore, anyone could open an account using someone else’s name and email address as a prank or out of malice, and of course, the hackers could add names to the list before publishing it. This type of malicious prank is truly viscious in the 79 countries where homosexuality is illegal. For example, in Afghanistan, Iran, Mauritania, Nigeria, Qatar, Saudi Arabia and the United Arab Emirates, the punishment for homosexuality is death.

Here are my favorite headless chicken searches:

 

Google-Free Wednesday–Disconnect Search

Disconnect Search is a specialized VPN that lets you search privately using Google, Bing, and Yahoo search engines. They say they don’t log searches, IP addresses, or any other personal info.

Using Disconnect search, your ISP shouldn’t see your search terms as they don’t have access to your searches. Normally, when you click a result link, the site you go to may see your search terms, but Disconnect should prevent this. Search engines save your searches, which can be connected to your real name or IP address. Disconnect should anonymize your searches.

Google-Free Wednesday–Escaping Google

The Great Google Escape

Google’s products are fast, intuitive and reliable–but they are not free. You pay Google with your identity, behaviour, habit, and preference information. Google then collates and analyses this data and sells it to advertisers and gives it to government and intelligence services. The longer Google does this, the more valuable the data becomes. This raises some very real privacy and security concerns for people who use Google.

There are solutions to this privacy and security issue. The first obvious solution is to avoid putting all your digital eggs in one basket. Use a different email and calendar provider. Use Firefox not Chrome as a browser. Use providers in Europe to take advantage of European Union privacy laws.

Sign in to your Google account and Use Google Takeout to export your data to a downloadable ZIP file from all the Google products. Getting out of Gmail is easy–getting out of Calendar and Contacts not so much. Google sets file standards for their calendar and address-book to make migration awkward. However, migrating to mailbox.org in Germany seems to go ahead without any real difficulty. It even allows you to encrypt your emails and other files before storing them on the server. Best of all they do not scan your data and try to monetize it. However, it costs €1 per month.

If you use the free Google Drive, consider using the Omnicloud from Germany’s Fraunhofer Institute, which allows you to encrypt all data locally before uploading it to the cloud.

Install a tracker blocker such as Ghostery and Self-Destructing Cookies (SDC) in Firefox to guard against browser cookies and use a search engine like Duck Duck Go which does not record your search history.

 

How to Hide Your Searches from Google

Are you uncomfortable with how much Google knows about you? Google makes a lot of money mining your search history. A Boston-based privacy company Abine has a solution to this problem.

The Blur Private Search service prevents Google from linking a search query to you. Search results appear normally, except your search, IP address, and the links that you click on can’t be identified or connected to you by the search engine. It is easy to set-up and use—you don’t have to sign-up using Gmail or other service. Create an account using a throw-away email address.

Nothing is perfect. Private Search only works with Firefox because Chrome tells Google about everything you do all by itself. It won’t protect you from other search engines like Bing or Yahoo.

Damnable Hyperlinks–Part II

In my last article on this topic, I asked the following questions:

  • Should you include a warning about following links in your reports?
  • Should you include a warning about visiting URLs in reports?
  • Should you remove the links?

My answer is yes to all these questions. The content at the linked sites may not only change–it might plant malicious code on any computers used to visit it. This is more common than most private investigators recognise or admit. My research computers are almost immune to this but most other people do not go to the extremes that I do to avoid malicious code.

I do not like sending Word documents to clients. I much prefer sending PDF files. Unfortunately, much of my work is part of larger projects and the Word file allows a client to incorporate my work into other documents.

Sending Word documents has many risks but doing so is unavoidable in many cases. This leaves the investigator in a tight spot if he does not warn the recipient about the risks associated with visiting the links in the report. In addition to written warnings at the start of all reports, I now remove all links using Ctrl+Shift+F9. After being duly warned, to go to his doom, the reader must do more than just click a link.

I now include the following warning under the heading of Security Warning.

Warning about visiting reported links and URLs

All Universal Resource Locators (URL) or hyperlinks (links) cited in this report only report where we found data. We do not attest to the safety or security of any internet site or URL. Nor do we evaluate the security implications of visiting any URL.

Do not visit any cited URL or link without understanding the security risk of doing so. We only report the content associated with links, URLs, and Internet sites. You may compromise the security of your computer system and network by visiting URLs or links in this report.

If I recognise a site as an attack site or one that includes dubious code, I do report it, however, I have never had a request from a client that we evaluate the security risks of the sites from which I collect data. If I received such a request, I would turn away the job, as I do not have the expert staff to perform such complicated work.

Self-Destructing Cookies

Maintaining privacy during online research is as important as avoiding malicious code. Privacy begins with properly configuring the browser and installing the best oddons (for Firefox) such as HTTPS Everywhere and Self-Destructing Cookies (SDC).

SDC establishes a new cookie policy within your browser. It automatically removes cookies when an open browser tab no longer uses them. With this installed, cookies only identify you while you actually use them and they cannot stalk you across the entire web. It detects tracking cookies by their behaviour and removes them immediately—it doesn’t use a blacklist. SDC complements blacklist-based solutions such as Adblock and Ghostery. It also allows you to whitelist cookies from sites that you trust. Just remember, SDC’s whitelist is stored in site preferences. If you want to keep the whitelist from session to session, you must adjust your settings if you selected Clear History when Firefox closes. SDC does not work at all in private browsing mode.

This is a moderately complicated addon that requires the user to understand browser settings and how the browser handles cookies. Reading the addon documentation is required.

Productivity in Perdition

As I make my way through the infernal regions of the Internet, I have had to start using new tools. The most disconcerting form of torment has been the change to Linux to avoid malicious code. This has forced me to start using alternatives to Microsoft Office for some work.

There is nothing more disconcerting than changing word processing software. Nothing is in the right place and productivity decreases dramatically.  I’m not sure which of the two flavours of the open source alternatives I like best–I lean towards LibreOffice at this point.

Some people who don’t really work for a living will say it’s stupid to try to attempt to use Microsoft Office on Linux, but they don’t have to quickly produce reports on a daily basis. I have tried running MS Office 2010 (32 bit) with some success using Wine. This makes report creation easier and faster. However, this isn’t as stable as using LibreOffice–but that’s perdition for you.