0

I want to be completely anonymous to the website that I am visiting.

I have read on various blogs that a browser can send my location, MAC address and various other identification of my computer while visiting a website, without my permission.

Is it possible for Google with its smart engineers to somehow pin point my computer from which I had previously done a transaction on Google Checkout. May be, through MAC address or some other magic of Google with its Google Chrome.

Is there any web browser available which sends minimal personal information to the website?

John Nash
  • 315
  • 2
  • 6

2 Answers2

2

If you don't trust Google, don't use Google Chrome. The latest version of Internet Explorer is ok for security, and they're fighting Google on privacy. Use that. (Firefox without extensions doesn't really match the sandboxing techniques used by the other two, and defaults to Google search because that's where their funding comes from).

MAC addresses aren't visible from the internet, unless you use IPv6 without the privacy extensions. You probably don't have IPv6. It looks like the privacy extensions have been enabled since Windows XP. Maybe something to check though.

You might be concerned about Google's war-driving programme. That's only supposed to have identified MAC addresses, so it's not much of a risk. And Google would be crucified for doing it themselves, i.e. the cost/benefit really wouldn't stack up at the moment - but a small enough third party could get away with scraping their database if they wanted to do it.

Websites need to know an IP address to communicate with. Your IP address will reveal your ISP, and (on non-mobile networks) your rough location. (In general mobile networks are not as well run and regulated. They often force you through their own proxies. In the past, they have been known to add HTTP headers which contain your telephone number!). There are studies that suggest ways of narrowing the location down further. The most broadly effective of these would be quite intrusive and visible, so you can be confident that Google isn't using them.

If you have to ask, then your IPv4 address is not static. Unless you're in university halls of residence. So it can't be used as a permanent identifier of your browser.

An IPv6 network prefix, however, is intended to be static. It would serve as an equivalent of a static IPv4 address. One mitigation is that, although it could be used to identify a household, the reason for IPv6 is the proliferation of IP devices. Nowadays, it's much less likely to identify a single device - or user - because there tends to be more than one per household.

(Mobile connections are more likely to use IPv6. Mobile devices are less well documented. If you can't find it out yourself, then it would be safest to assume that any smartphone has an IPv6 address that identifies the device, i.e. IPv6 without the privacy extensions. I would like to say mobile USB dongles should be fine, but then mobile networks apparently include so many layer-violating kludges that "standard" networking knowledge doesn't necessarily help).

In theory, if you had an open wireless network - many ISPs build them into the router and allow other customers to use it - a wardriver could hypothetically have harvested IP addresses as well. In Europe, I think any large company would be shot down for that. In the US, there might be strong public disapproval, but not necessarily any legal response. My best guess is that if Google had used this originally, it would have come out by now... but once they feel/felt they've got the last mess sorted, and once open networks with static, globally-unique IPv6 prefixes become more common... Let's say, I think you'd have to consider it as part of your threat model.

So I think, there are several valid concerns about the practical effect of the IPv6 transition on privacy, even with the privacy extensions. Even for EU residents and businesses, IPv6 addresses are going to be logged by default, and legislators are not really keeping up with the world. (The "EU cookie law" is widely regarded with scorn. Partly because the practical effect of even privacy regulator's own websites, is to annoy people into enabling cookies. Previously you could browse with cookies disabled or cleared at the end of each session. http://sourcejedi.blogspot.co.uk/2012/07/how-to-block-cookie-popups-without.html).

People can hide their IP address using Firefox with the TorButton extension. The second price is the Tor exit node can intercept all your traffic - so unless you stick to HTTPS (HTTPSEverywhere extension would help a little), you're increasing your security vulnerability. The third price is that it's not as fast, although it's supposed to have gotten much better. I would not recommend it for your case - i.e. as a privacy protection you could safely apply to all your communications, and without requiring too much technical knowledge.

sourcejedi
  • 3,051
  • 2
  • 24
  • 42
1

That is not a specific browser you need, but a proxy.

No browser can hide this information, because if they did the server would not know who to answer to.

A proxy, on the other hand serves as an intermediary, and so the only thing google, or anything sees is the proxy, and not the computer that is behind it.

Also, it should be combined with cookie disabling (or just private navigation). Any recent browser provides this service.

Clement Bellot
  • 841
  • 1
  • 7
  • 19
  • Might be worth clarifying you mean a remote proxy or VPN. Privoxy is a proxy designed for privacy, but it's usually installed locally, which is not sufficient for what you're talking about. Alsp, proxies aren't _inherently_ private. Non-anonymizing proxies tend to pass on IP addresses by default. – sourcejedi Aug 24 '12 at 20:22