Anonymity sought by users on the Internet is limited by the transmission of the IP address during communication. Various forms of user tracking also make anonymous use more difficult. In addition, careless behavior by users leaves traces on the Internet. The greatest possible anonymity vis-à-vis most operators of services on the Internet can only be achieved with special knowledge, considerable effort and special care. In addition to using the IP address, there are other ways to track surfers on the World Wide Web and thus also store data about them.
Eavesdropping
Internet service providers, proxy operators, corporate or university network operators, as well as Tor exit nodes can listen to the unencrypted data traffic. Under certain circumstances, this data can be used to infer the identity of the user. An Internet user can avoid this by choosing a trustworthy provider or by using encryption.
Tracking Cookies
Tracking cookies are a common means of “tagging” visitors to a website in order to be able to recognise them later. Normal cookies are used, for example, in practically all websites where the visitor has to log in with a username and password in order to be able to identify a user for a session. Shopping carts in online shops are also usually created with cookies. However, tracking cookies are also used to observe a user’s surfing behavior over a longer period of time, even without explicit login by the user and across several websites. With Lightbeam, this tracking can be graphically displayed. Controversial programs such as Ghostery display these trackers and block them if desired.
---
Technically, cookies are small blocks of text that the server sends to the browser and later gets back and can use. On the first visit, the user receives a cookie with a unique identification number, and on each subsequent page visit, the server can recognize the visitor by it. Cookies are stored either permanently or for a set period of time. On the server, they usually consist of the user’s IP address and a time specification, while the user’s server address is stored by the browser. The cookies cannot contain executable commands and therefore do not pose a security risk to begin with.
Operators of different websites can work together to track a visitor even across different pages. If a user logs in to website B and then visits website A in which a web address (URL) of website B is embedded, website B can access the cookies containing the login data and then transmit them to website A. Such an embedding of a web address could be, for example, an advertising banner or a counter graphic. However, whether page B can access the browser’s cookies when embedded from another website depends on the browser configuration.
Even with a targeted exception for the same-origin policy, a website A can query information from a website B.
Virtual Fingerprint
DNS profile
All visits to websites using a domain name result in a DNS query that determines the IP address of the requested server. By combining the IP address of the requesting client with the DNS requests, the DNS server can create profiles about the websites accessed. However, the profiles remain coarse because the DNS server does not receive the path of the web address, and due to DNS caching, not every new call to the same domain causes a DNS request.
However, the DNS server can also censor websites by not resolving certain domains into IP addresses; These will then not be accessible. Anonymous, uncensored DNS name resolution is an important prerequisite for effective anonymization and against censorship. Anonymous name resolution means using an anonymous, uncensored DNS server to reach the desired web address. Unless the client uses a pre-configured DNS server, it is usually automatically allocated via DHCP.
Browser profile
Numerous so-called HTTP headers provide information about the type of browser used, the operating system (user agent), the previously visited website (referrer) and the next website called up when leaving the page. The server only needs to evaluate the data contained in the call.
Extensive (secretly loaded) scripts program browsers to send identification data. As a rule, JavaScript code requested as much information as possible from the browser and sent it to servers even before the IndexedDB interface in 2009. Even before that, users could be found out and tracked, e.g. via the screen resolution used, color depth, installed plugins, etc.
Since 2010, the service does not require cookies, which may expire or be switched off, or IP addresses that can change. It evaluates the HTTP request headers, which consist of browser identifiers and accepted MIME types, as well as, via JavaScript, information about installed plug-ins, fonts, screen size and time zone. In addition, data on standard and “supercookies” (Flash cookies, web storage, IE-userData) are also included in the ranking. In many cases, this allows for the creation of a unique virtual fingerprint. The information content of this fingerprint can be reduced by various measures, but these measures are usually not ideal because they limit convenience, such as turning off JavaScript.
Deleting cookies immediately (or at least regularly) has been a recommendation since the last millennium. When standard and “supercookies” are combined, they are referred to as “evercookies”, which allow profiling and are difficult for the user to remove.
For example, Mozilla Firefox users are calling for both HTTP fingerprinting and JavaScript fingerprints to be reduced.
Compromise of the system
The user can be deanonymized if unauthorized persons can gain access to his system or third-party systems that possess his data. This can be done, for example, through infiltrated malware or by exploiting security gaps and backdoors in the system. These can then be used to record and transmit all user activity and data from all available sources. These sources may include, but are not limited to, all accessible disks, webcams, and microphones. Authorities have the ability to compromise suspects’ systems in order to monitor them as part of an online search. Measures against compromise are assigned to the area of information security.
