28.05.2023 Views

The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

background, not call attention to yyourself.

If yyou use a word or phrase unrelated to yyour name, make it as

unrevealing as possible. If yyour e-mail address is snowboarder@xyyz.com,

we mayy not know yyour name, but we do know one of yyour hobbies. Better

to choose something generic, like silverfox@xyyz.com.

You’ll of course also want to have a personal e-mail address. You should

onlyy share this one with close friends and familyy. And the safest practices

often come with nice bonuses: yyou’ll find that not using yyour personal e-

mail address for online purchasing will prevent yyou from receiving a ton of

spam.

Cell phones are not immune from corporate tracking. In the summer of

2015, an eagle-eyyed researcher caught AT&T and Verizon appending

additional code to everyy Web page request made through a mobile browser.

This is not the IMSI—international mobile subscriber identityy—I talked

about in chapter 3 (see here); rather, it’s a unique identification code sent

with each Web page request. The code, known as a unique identifier header,

or UIDH, is a temporaryy serial number that advertisers can use to identifyy

yyou on the Web. The researcher discovered what was going on because he

configured his mobile phone to log all web traffic (which not manyy people

do). Then he noticed the additional data tacked on to Verizon customers

and, later, AT&T customers. 8

The problem with this additional code is that customers were not told

about it. For instance, those who had downloaded the Firefox mobile app

and used plug-ins to increase their privacyy were, if theyy used AT&T or

Verizon, nonetheless being tracked byy the UIDH codes.

Thanks to these UIDH codes, Verizon and AT&T could take the traffic

associated with yyour Web requests and either use it to build a profile of yyour

mobile online presence for future advertising or simplyy sell the raw data to

others.

AT&T has suspended the operation—for now. 9 Verizon has made it yyet

another option for the end user to configure. 10 Note: byy not opting out, yyou

give Verizon permission to continue.

Even if yyou turn off JavaScript, a website mayy still pass a text file with data

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!