You know that rule that you are not paranoid if folks really are tracking you down?

Consider yourself no longer paranoid, despite the pandemic.  Count to three.  No, wait, count to 100.  This is going to be pretty annoying.

First, thank Sarah Bird, Ilana Segall, and Martin Lopatka.  These three folks who work for Mozilla, just presented their study:  “Replication:  Why We Still Can’t Browse in Peace:  On the Uniqueness and Reidenfiability of Web Browsing Histories” at the 16^th Symposium on Usable Privacy and Security.  It’s not their job to make us feel better- just to inform us of what’s going on in the world.

Here’s their findings in a nutshell:  Our browsing history is so unique (and so available) that advertisers don’t need to have an extensive file on us at all to know who/what we are.  Moreover, once they have the initial data, they can re-identify us and track us with ease.

So much for that anonymized browsing history protecting us.  Because it takes but 50- but less than 150- of our most accessed domains for us to have created that perfect tracking profile for our nemeses.

More importantly, the situation is unchanged from the findings published back in  2012 (Lukasz Olejnik, Claude Castelluccia, Artur Janc:  Why Johnny Can’t Browse in Peace: On the Uniqueness of Web Browsing History Patterns)  when this was first discovered- despite all those promises of privacy improvements that have been ‘made’.  That data analysis involved some 380,000 internet users (January 2009 through May 2011); 97% of those folks managed to have a browser history that was as unique as our fingerprints are.  (And, they were able to be reidentified upon subsequent analysis, too.)  But, back then, checking 50 domains only was 38% accurate; 500 domains almost doubled that accuracy to 70%.   (Please note this included a special test site- but it turns out- as you will find out in a few seconds- that is certainly not necessary.)

That’s why Bird, Segall, and Lopatka wanted to revisit the premise.  They did their research over a month- from 16 July 2019 to 13 August 2019- and just for Firefox users.  52000 folks said go ahead, check us out.  The analysis involved the same sort of data collected by the analytics companies that abound to hound us with advertising.

Like the previous study, two stages of analysis were involved.  In stage one, folks shared their browsing history (that was the first week in the 2020 publication); then the browsing history was provided for the second stage to see if user identification was possible. (35 million websites were visited, but only 660,000 unique domains.)

Surprise-  99% of the browsing profiles were unique to the user.  So, of course, the users were easily reidentified.  Worse- that 50 domain benchmark meant it identified 50%, not 38%, of us.  And, it took just 150 domains to identify 80% of the folks.

I know what you did yesterday!

Here’s some ways to counteract it…

How to shield yourself on Google? (Reduced data collection)

Maneuver over to Privacy Check up, turn off location history and stop Google from saving our searches., while making sure your are not ‘Minority Reported’- to prevent Google using our info to tailor advertising to us. You can extend this to YouTube (A division of Google, nowadays).

You can also check what devices upon which you inadvertently let Google track you.  That means you must maneuver to the Google Security Checkup.

If you are really paranoid, you can even tell Google to forget you forever.  (Account Preferences, Google Deletion Service.)

It’s time for some serious cloaking!