Freemor's Old Weblog

Phorm, NebuAd, and Privacy

Well it seems NebuAd is coming to Canada soon, and is already in place in several US ISP’s.

So Considering all this I spent much of the day mulling ways that users can protect their privacy. I have so far come up with the following suggestions:

Flush Cookies on each browser close:

Although it won’t stop them watching what you click it will help to prevent them from getting a good picture as they will not have month or years of you browsing tied to a single UUID.

Use as much SSL as possible:

They can’t use their DPI (deep packet inspection) on encrypted connections, so find ways to be as encrypted as possible. If you use web mail make sure the entire session is encrypted (not just the log on). Better yet, use an email client that supports secure connections and a email provider that supports them Google, Yahoo Canada, fastmail, etc. Using an e-mail client with TLS/SSL not only encrypts the connection it takes cookies out of the picture.

Use things like Scroogle’s SSL page, for searching to keep them from sniffing your searches.

Use an Encrypting Proxy:

Set up and use a VPN or SSL encrypted proxy. This will make your entire session unreadable. There it the problem of trust. Encrypting systems like TOR, and I2P may just expose you to even more tracking from evil exit nodes. JAP may be backdoored (but according to Wikipedia this is not/no longer the case). Similarly “Open” proxies on the net may not be trustworth.

The best solution I can think of for this problem is to have a trusted friend in another counrty set up a VPN, private SSL proxy or Psiphon node for you, and you could do the same for them. Even if his ISP was sniffed by NebuAd and your’s by Phorm it would muddy the waters. Which bring us to

Obfuscation:

Find ways to hide your traffic. You could run a TOR or I2P exit node (lots of HTTP traffic for them to sniff none of it yours).

Find alternate ways to get webpages you don’t want sniffed like web2mail.

So those are some of my thoughts on the matter. I’ll post more as I come up with them. If any readers know of good HTTPS services on the web like secure Wikipedia or Secure WikiBooks, etc Please post them in the comments

Thoughts and comments always welcome