Hacking. Disinformation. Surveillance. CYBER is Motherboard's podcast and reporting on the dark underbelly of the internet.

The Pentagon is carrying out warrantless surveillance of Americans, according to a new letter written by Senator Ron Wyden and obtained by Motherboard.

Senator Wyden's office asked the Department of Defense (DoD), which includes various military and intelligence agencies such as the National Security Agency (NSA) and the Defense Intelligence Agency (DIA), for detailed information about its data purchasing practices after Motherboard revealed special forces were buying location data. The responses also touched on military or intelligence use of internet browsing and other types of data, and prompted Wyden to demand more answers specifically about warrantless spying on American citizens.

Advertisement

Some of the answers the DoD provided were given in a form that means Wyden's office cannot legally publish specifics on the surveillance; one answer in particular was classified. In the letter Wyden is pushing the DoD to release the information to the public. A Wyden aide told Motherboard that the Senator is unable to make the information public at this time, but believes it would meaningfully inform the debate around how the DoD is interpreting the law and its purchases of data.

"I write to urge you to release to the public information about the Department of Defense's (DoD) warrantless surveillance of Americans," the letter, addressed to Secretary of Defense Lloyd J. Austin III, reads.

Do you work for any of the agencies named in this piece? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.

Wyden and his staff with appropriate security clearances are able to review classified responses, a Wyden aide told Motherboard. Wyden's office declined to provide Motherboard with specifics about the classified answer. But a Wyden aide said that the question related to the DoD buying internet metadata.

"Are any DoD components buying and using without a court order internet metadata, including 'netflow' and Domain Name System (DNS) records," the question read, and asked whether those records were about "domestic internet communications (where the sender and recipient are both U.S. IP addresses)" and "internet communications where one side of the communication is a U.S. IP address and the other side is located abroad."

Advertisement

Netflow data creates a picture of traffic flow and volume across a network. DNS records relate to when a user looks up a particular domain, and a system then converts that text into the specific IP address for a computer to understand; essentially a form of internet browsing history.

Wyden's new letter to Austin urging the DoD to release that answer and others says "Information should only be classified if its unauthorized disclosure would cause damage to national security. The information provided by DoD in response to my questions does not meet that bar."

The questions were specifically sent to the Under Secretary of Defense for Intelligence and Security in February 2021, Wyden's letter adds. Beyond the NSA and DIA, the Under Secretary of Defense for Intelligence and Security provides oversight to a range of agencies including the National Geospatial-Intelligence Agency (NGA) and the National Reconnaissance Office (NRO). A Wyden aide said it is not clear if the answers go beyond the agencies that act under the Under Secretary of Defense for Intelligence and Security.

The DoD did not respond to a request for comment.

Wyden's questions came in response to Motherboard's reporting on special forces purchasing location data, a Wyden aide said. Specifically, Motherboard previously revealed that U.S. Special Operations Command (SOCOM) bought access to a tool called Locate X that uses location data harvested from ordinary phone apps installed on peoples' phones. Motherboard also found that a National Guard unit tasked with carrying out drone strikes bought the same tool.

Advertisement

A Wyden aide said the office sent its original query to SOCOM's legislative affairs section. That department then said that the Under Secretary of Defense for Intelligence and Security would respond, the aide added.

As part of Wyden's office's own parallel investigation into the location data selling space, the DIA said in a memo its analysts have searched commercial databases of smartphone location data without a warrant in five investigations over the past two and a half years, The New York Times reported in January.

"Other than DIA, are any DoD components buying and using without a court order location data collected from phones located in the United States?" one of Wyden's questions reads. The answer to that is one that Wyden is urging the DoD to release.

The DIA memo said the agency believes it does not require a warrant to obtain such information. Following this, Wyden also asked the DoD which other DoD components have adopted a similar interpretation of the law. One response said that each component is itself responsible to make sure they follow the law.

Wyden is currently proposing a new piece of legislation called The Fourth Amendment Is Not For Sale Act which would force some agencies to obtain a warrant for location and other data. Current sponsors include Sen. Rand Paul, R-Ky., Majority Leader Chuck Schumer, D-N.Y. Sen. Mike Lee, R-Utah, Sen. Steve Daines, R-Mont., Sen. Edward Markey, D-Mass., Sen. Tammy Baldwin, D-Wisc., Sen. Elizabeth Warren, D-Mass., Sen. Sherrod Brown, D-Ohio, Sen. Brian Schatz, D-Hawaii, Sen. Cory Booker, D-N.J., Sen. Bernie Sanders, D-Vt., Sen. Jeff Merkley, D-Ore., Sen. Jon Tester, D-Mont., Sen. Martin Heinrich, D-N.M., Sen. Mazie Hirono, D-Hawaii, Sen. Patty Murray, D-Wash., Sen. Maria Cantwell, D-Wash., Sen. Patrick Leahy, D-VT., and Sen. Richard Blumenthal, D-Conn, Wyden's office previously told Motherboard.

Subscribe to our cybersecurity podcast CYBER, here.

Crédits : Starlink

Comme vous le savez peut-être, l'Arcep a dit oui quant à l'arrivée de Starlink sur le sol français en février 2021. Il n'était donc plus qu'une question de temps avant de voir le réseau internet par satellite d'Elon Musk débarquer dans l'Hexagone, au grand dam d'ailleurs des députés Insoumis. C'est désormais chose faite depuis ce lundi 10 mai 2021.

En effet et comme on peut le lire sur le site officiel du service, les inscriptions à Starlink sont ouvertes en France “à un nombre limité d'utilisateurs par zone de couverture”. SpaceX, maison-mère de Starlink, affirme que “les commandes seront traitées par ordre d'arrivée, selon le principe du premier arrivé, premier servi”. 

À lire également : Starlink – l'Internet par satellite est loin d'être au point, ce test de performance le prouve

Il faudra payer le prix fort pour s'essayer à Starlink

Si vous êtes intéressé par l'offre de SpaceX, il faudra d'abord se procurer le kit Starlink comprenant le routeur Wi-Fi, l'alimentation, les câbles, la parabole et le trépied de montage. Un kit proposé à 499 € il faut le rappeler. À cette coquette somme, vous devrez rajouter 59 € de frais d'expédition et de dossier, puis souscrire à l'abonnement mensuel de 99 € par mois. Soit une enveloppe généreuse de 657 € pour votre premier mois chez Starlink.

À titre comparatif, l'offre de Neosat (une filiale d'Orange Nordnet) propose un abonnement de 60 € par mois, et un kit similaire affiché à 349 € qui comprend d'ailleurs l'intervention d'un technicien pour l'installation. Pour ce prix-là et durant la phase de bêta, Starlink promet aux utilisateurs des vitesses de transfert entre 50 et 150 Mbit/s et une latence de 20 à 40 ms “dans la plupart des lieux au cours des prochains mois à mesure que nous améliorons le système Starlink”. 

Mais, et comme il y a toujours un mais, l'entreprise prévient ses clients que de “brèves périodes sans aucune connectivité” pourront arriver. Au gré de l'activation de nouveaux satellites, de stations terrestres et d'améliorations du logiciel de mise en réseau, Starlink espère offrir une vitesse de connexion proche de la fibre optique, soit 1 Gbit/s.

Source : Starlink

It’s hard to believe now, but in the early days of the public internet, the greatest worry of some of its most high-powered advocates was that it would be empty. As the Clinton administration prepared to transition the internet from its academic and military origins to the heart of the promised “national information infrastructure” (NII), the government’s advisors fretted that the United States entertainment and information industries would have no commercial reason to switch from TV, radio, and recorded music. And without Hollywood and the record labels on board, the new digital environment would end up as a ghost mall, devoid of businesses or users.

 “All the computers, telephones, fax machines, scanners, cameras, keyboards, televisions, monitors, printers, switches, routers, wires, cables, networks and satellites in the world will not create a successful NII, if there is not content”, former Patent Office head Bruce Lehman’s notorious 1994 government green paper on intellectual property on the Net warned. The fear was that without the presence of the pre-packaged material of America’s entertainment industry, the nation would simply refuse to go online. As law professor Jessica Litman describes it, these experts’ vision of the Internet was “a collection of empty pipes, waiting to be filled with content.” 

Even as the politicians were drafting new, more punitive copyright laws intended to reassure Hollywood and the record labels (and tempt them into new, uncharted waters), the Internet’s first users were moving in and building anyway. Even with its tiny audience of technologists, first-adopters, and university students, the early net quickly filled with compelling “content,” a  free-wheeling, participatory online media that drew ever larger crowds as it evolved.

Even in the absence of music and movies, the first net users built towers of information about them anyway. In rec.arts.movies, the Usenet discussion forum devoted to all things Hollywood, posters had been compiling and sharing lists of their favourite motion picture actors, directors, and trivia since the 1980s. By the time of the Lehman report, the collective knowledge of the newsgroup had outgrown its textual FAQs, and expanded first to a collectively-managed database on Colorado University’s file site, and then onward to one of the very first database-driven websites, hosted on a spare server at Wales’ Cardiff University.

Built in the same barn-raising spirit of the early net, the public interest internet exploits the low cost of organizing online to provide stable, free repositories of user-contributed information. They have escaped an exploited fate as proprietary services owned by a handful of tech giants.

These days, you’ll know that Cardiff Movie Database by another name – the IMDb. The database that had grown out of the rec.arts.movies contributions was turned into a commercial company in 1996 and sold to Amazon in 1998 for around $55 million dollars (equivalent to $88 million today). The Cardiff volunteers, led by one of its original moderators, Col Needham, continued to run the service as salaried employees of an Amazon subsidiary.

The IMDB shows how the original assumptions of Internet growth were turned on their head. Instead of movie production companies leading the way, their own audience had successfully built and monetised the elusive “content” of the information superhighway by themselves—for themselves.  The data of the rec.arts.movie databases was used by Amazon as the seed to build an exclusive subscriptions service, IMDbpro, for movie business professionals, and to augment their Amazon Prime video streaming service with quick-access film facts. Rather than needing the movie moguls’ permission to fill the Internet, the Internet ended up supplying information that those moguls themselves happily paid a new, digital mogul for.

But what about those volunteers who gave their time and labor to the collective effort of building this database for everyone? Apart from the few who became employees and shareholders of the commercial IMDb, they didn’t get a cut of the service’s profits. They also lost access to the full fruits of that comprehensive movie database. While you can still download the updated core of the Cardiff Database for free, it only covers the most basic fields of the IMDb. It is licensed under a strictly non-commercial license, fenced off with limitations and restrictions. No matter how much you might contribute to the IMDb, you can’t profit from your labor. The deeper info that was originally built by the user-contributions  and supplemented by Amazon has been enclosed: shut away, in a proprietary paywalled property, gated off from the super-highway it rode in on.

It’s a story as old as the net is, and echoes historic stories of the enclosure of the commons. A pessimist would say that this has been the fate of much of the early net and its aspirations. Digital natives built, as volunteers, free resources for everyone. Then, struggling to keep them online in the face of the burdens of unexpected growth, they ended up selling up to commercial interests. Big Tech grew to its monopoly position by harvesting this public commons, and then locking it away.

But it’s not the only story from the early net. Everyone knows, too, the large public projects that somehow managed to steer away from this path. Wikipedia is the archetype, still updated by casual contributors and defiantly unpaid editors across the world, with the maintenance costs of its website comfortably funded by regular appeals from its attached non-profit. Less known, but just as unique, is Open Street Map (OSM), a user-built, freely-licensed alternative to Google Maps, which has compiled from public domain sources and the hard work of its volunteer cartographers one of the most comprehensive maps of the entire earth. 

These are flagships of what we at EFF call the public interest internet. They produce and constantly replenish priceless public goods, available for everyone, while remaining separate from government, those traditional maintainers of public goods. Neither are they commercial enterprises, creating private wealth and (one hopes) public benefit through the incentive of profit. Built in the same barn-raising spirit of the early net, the public interest internet exploits the low cost of organizing online to provide stable, free repositories of user-contributed information. Through careful stewardship, or unique advantages, they have somehow escaped an enclosed and exploited fate as a proprietary service owned by a handful of tech giants.

That said, while Wikipedia and OSM are easy, go-to examples of the public interest internet, they are not necessarily representative of it. Wikipedia and OSM, in their own way, are tech giants too. They run at the same global scale. They struggle with some of the same issues of accountability and market dominance. It’s hard to imagine a true competitor to Wikipedia or OSM emerging now, for instance—even though many have tried and failed. Their very uniqueness means that their influence is outsized. The remote, in-house politics at these institutions has real effects on the rest of society. Both Wikipedia and OSM have complex, often carefully negotiated, large-scale interactions with the tech giants. Google integrates Wikipedia into its searches, cementing the encyclopedia’s position. OSM is used by, and receives contributions from, Facebook and Apple. It can be hard to know how individual contributors or users can affect the governance of these mega-projects or change the course of them. And there’s a recurring fear that the tech giants have more influence than the builders of these projects.

Besides, if there’s really only a handful of popular examples of public good production by the public interest internet, is that really a healthy alternative to the rest of the net? Are these just crocodiles and alligators, a few visible survivors from a previous age of out-evolved dinosaurs, doomed to be ultimately outpaced by sprightlier commercial rivals?

At EFF, we don’t think so. We think there’s a thriving economy of smaller public interest internet projects, which have worked out their own ways to survive on the modern internet. We think they deserve a role and representation in the discussions governments are having about the future of the net. Going further, we’d say that the real dinosaurs are our current tech giants. The small, sprightly, and public-minded public interest internet has always been where the benefits of the internet have been concentrated. They’re the internet’s mammalian survivors, hiding out in the nooks of the net, waiting to take back control when the tech giants are history.

In our next installment, we take a look at one of the most notorious examples of early digital enclosure, its (somewhat) happier ending, and what it says about the survival skills of the public interest internet when a free database of compact discs outlasts the compact disc boom itself.

Governor DeSantis is expected to sign it into law, as he called for laws like this. He cited social media de-platforming Donald Trump as  examples of the political bias of what he called “oligarchs in Silicon Valley.” The law is not just about candidates, it also bans “shadow-banning” and cancels cancel culture by prohibiting censoring “journalistic enterprises,” with “censorship” including things like posting “an addendum” to the content, i.e. fact checks.

This law, like similar previous efforts, is mostly performative, as it almost certainly will be found unconstitutional. Indeed, the parallels with a nearly 50 years old compelled speech precedent are uncanny. In 1974, in Miami Herald Publishing Co. v. Tornillo, the Supreme Court struck down another Florida statute that attempted to compel the publication of candidate speech. 

50 Years Ago, Florida's Similar "Right of Reply" Law Was Found Unconstitutional

At the time, Florida had a dusty "right of reply" law on the books, which had not really been used, giving candidates the right to demand that any newspaper who criticized them print a reply to the newspaper's charges, at no cost. The Miami Herald had criticized Florida House candidate Pat Tornillo, and refused to carry Tornillo’s reply. Tornillo sued.

Tornillo lost at the trial court, but found some solace on appeal to the Florida Supreme Court.  The Florida high court held that the law was constitutional, writing that the “statute enhances rather than abridges freedom of speech and press protected by the First Amendment,” much like the proponents of today’s new law argue. 

So off the case went to the US Supreme Court. Proponents of the right of reply raised the same arguments used today—that government action was needed to ensure fairness and accuracy, because “the 'marketplace of ideas' is today a monopoly controlled by the owners of the market.”  

Like today, the proponents argued new technology changed everything. As the Court acknowledged in 1974, “[i]n the past half century a communications revolution has seen the introduction of radio and television into our lives, the promise of a global community through the use of communications satellites, and the specter of a ‘wired’ nation by means of an expanding cable television network with two-way capabilities.”  Today, you might say that a wired nation with two-way communications had arrived in the global community, but you can’t say the Court didn’t consider this concern.

You might wonder why the Florida Legislature would pass a law doomed to failure. Politics, of course.

The Court also accepted that the consolidation of major media meant “the dominant features of a press that has become noncompetitive and enormously powerful and influential in its capacity to manipulate popular opinion and change the course of events,” and acknowledged the development of what the court called “advocacy journalism,” eerily similar to the arguments raised today. 

Paraphrasing the arguments made in favor of the law, the Court wrote “The abuses of bias and manipulative reportage are, likewise, said to be the result of the vast accumulations of unreviewable power in the modern media empires. In effect, it is claimed, the public has lost any ability to respond or to contribute in a meaningful way to the debate on issues,” just like today’s proponents of the Transparency in Technology Act.

The Court was not swayed, not because this was dismissed as an issue, but because government coercion could not be the answer. “However much validity may be found in these arguments, at each point the implementation of a remedy such as an enforceable right of access necessarily calls for some mechanism, either governmental or consensual. If it is governmental coercion, this at once brings about a confrontation with the express provisions of the First Amendment.” There is much to dislike about content moderation practices, but giving the government more control is not the answer.

Even if one should decry the lack of responsibility of the media, the Court recognized “press responsibility is not mandated by the Constitution and like many other virtues it cannot be legislated.”  Accordingly, Miami Herald v. Tornillo reversed the Florida Supreme Court, and held the Florida statute compelling publication of candidates' replies unconstitutional.

Since Tornillo, courts have consistently applied it as binding precedent, including applying Tornillo to social media and internet search engines, the very targets of the Transparency in Technology Act (unless they own a theme park). Indeed, the compelled speech doctrine has even been used to strike down other attempts to counter perceived censorship of conservative speakers. 

With the strong parallels with Tornillo, you might wonder why the Florida Legislature would pass a law doomed to failure, costing the state the time and expense of defending it in court. Politics, of course. The legislators who passed this bill probably knew it was unconstitutional, but may have seen political value in passing the base-pleasing statute, and blaming the courts when it gets struck down. 

Politics is also the reason for the much-ridiculed exception for theme park owners. It’s actually a problem for the law itself. As the Supreme Court explained in Florida Star v BJF, carve-outs like this make the bill even more susceptible to a First Amendment challenge as under-inclusive.  Theme parks are big business in Florida, and the law’s definition of social media platform would otherwise fit Comcast (which owns Universal Studios' theme parks), Disney, and even Legoland.  Performative legislation is less politically useful if it attacks a key employer and economic driver of your state. The theme park exception has also raised all sorts of amusing possibilities for the big internet companies to address this law by simply purchasing a theme park, which could easily be less expensive than compliance, even with the minimum 25 acres and 1 million visitors/year. Much as Section 230 Land would be high on my own must-visit list, striking the law down is the better solution.

The Control that Large Internet Companies Have on our Public Conversations Is An Important Policy Issue

The law is bad, and the legislature should feel bad for passing it, but this does not mean that the control that the large internet companies have on our public conversations isn’t an important policy issue. As we have explained to courts considering the broader issue, if a candidate for office is suspended or banned from social media during an election, the public needs to know why, and and the candidate needs a process to appeal the decision. And this is not just for politicians - more often it is marginalized communities that bear the brunt of bad content moderation decisions. It is critical that the social platform companies provide transparency, accountability and meaningful due process to all impacted speakers, in the US and around the globe, and ensure that the enforcement of their content guidelines is fair, unbiased, proportional, and respectful of all users’ rights. 

This is why EFF and a wide range of non-profit organizations in the internet space worked together to develop the Santa Clara Principles, which call upon social media to (1) publish the numbers of posts removed and accounts permanently or temporarily suspended due to violations of their content guidelines; (2) provide notice to each user whose content is taken down or account is suspended about the reason for the removal or suspension; and (3) provide a meaningful opportunity for timely appeal of any content removal or account suspension. 

Introduit il y a quelques mois par Brave au sein de son logiciel, le protocole IPFS permet d'héberger ses propres pages web sur un réseau décentralisé, ou chaque élément est stocké dans plusieurs nœuds.

Avec IPFS nous retrouvons plusieurs avantages. D'une part ce dispositif permet de répartir la charge réseau et donc d'optimiser la bande passante. Par ailleurs, le contenu se charge plus rapidement, surtout si le nombre de nœuds pour ce dernier est conséquent. Il ne s'agit alors plus d'accéder à un serveur central classique mais de récupérer le contenu sur les nodes les plus proches. Enfin, et c'est une bonne nouvelle, puisque l'on passe outre le protocole HTTP cela permet d'accéder à des contenus censurés.

Au-delà des simples page Web, ce protocole permet également de partager des fichiers très simplement en peer-to-peer à plusieurs de ses proches en passant directement par le navigateur. En d'autres termes, c'est une peu comme si nous retrouvions une sorte de WeTransfer directement intégré au navigateur.

De la même manière qu'un client BitTorrent , plus il y a de contacts partageant le même fichier, plus la vitesse de téléchargement sera importante.

Comment créer un serveur de fichiers avec Brave ?
1. Ouvrez une fenêtre du navigateur Brave et tapez l'adresse brave://ipfs-internals/ dans la barre d'adresses.

2. Cliquer sur Démarrer.

3. Cliquer sur « Mon nœud »

4. Vous arrivez sur l'interface de gestion. Pour envoyer un fichier, cliquez maintenant sur « Fichiers », dans le menu situé à gauche de l'interface.

5. Pour importer un fichier, cliquez sur le bouton "+Import", puis sur « Fichier ». Vous pouvez également envoyer un dossier entier en cliquant sur « Folder ».

6. Choisissez sur votre ordinateur le fichier à importer.

7. Pour partager votre fichier avec un ou plusieurs contacts, cliquez sur le menu d'options, symbolisé par les trois petits points à droite du fichier importé puis sur « Partager ».

8. Cliquer sur « Copy » pour copier le lien de partage.

Il ne reste plus qu'à l'envoyer à vos contacts pour qu'ils puissent commencer le téléchargement.

Ainsi, selon Gizmodo, l’avocat Ramon Rozas, du Maryland, a décidé de s’appuyer sur la note de blog de Moxie Marlinspike pour demander un nouveau procès pour son client.
« Un nouveau procès devrait être ordonné afin que la défense puisse examiner le rapport produit par le dispositif Cellebrite à la lumière de ces nouvelles preuves, et examiner le dispositif Cellebrite lui-même », explique-t-il dans sa demande.
On verra si les juges seront réceptifs à ce type d’argument. Si oui, les enquêteurs et les procureurs vont avoir problème, car ils s’appuient de plus en plus sur cet outil technologique.

A découvrir aussi en vidéo :

Cette méfiance n’apparaît pas qu’aux États-Unis. En Israël, un militant des droits de l’homme a demandé aux autorités d’arrêter toute utilisation de Cellebrite au sein des forces de l’ordre, tant que la fiabilité de l’appareil n’est pas analysée.
Cellebrite, de son côté, tente d’éteindre le feu. Selon Vice, le fournisseur aurait déjà diffusé un patch pour minimiser la surface d’attaque des failles en question, sans pour autant publier de communiqué officiel à ce sujet.

Sources : Gizmodo, Vice

A découvrir aussi en vidéo :

Le malware adapte son comportement en fonction du type de compte compromis (root ou non). Il est capable d’analyser le terminal infecté, d’exfiltrer des données sensibles et d’exécuter des plugins. Ces derniers n’ont toutefois pas pu être décortiqués par les chercheurs. Par ailleurs, on ne sait pas encore quel est le mode de diffusion de ce code malveillant. Enfin, les chercheurs ont remarqué que le code avait des similitudes avec Torii, un botnet d’objets connectés assez sophistiqué détecté en 2018 par Avast. Beaucoup de questions restent donc encore ouvertes sur ce curieux malware.

Source: Qihoo 360

This is why it’s so important to only use browsers you know will protect and improve your internet privacy. In this article, we explain how browsers capture so much information and which web browsers in 2019 are best at keeping your browsing history safe from data-hungry tech companies and advertisers

Further reading: Easy steps to improve your internet privacy

How you are tracked online

Before examining the impact your browser can have on your privacy, you need to understand how your online activity is monitored.

While having a company directly record your browsing history is a risk (see Google Chrome), the more common threats to your privacy come from online advertisers and third-party trackers. Similar to Google, advertisers and trackers want to record as much of your online browsing as possible. The more data they have, the better they can show you ads specifically tailored to you. The two tools they use to follow you around the Internet are device fingerprinting and cookies.

Device fingerprinting is when a site looks at all the characteristics of your device (the make and model of your device, what browser you are using, what plugins you have installed, what timezone you are in, etc.) until it has enough information to identify and follow it. Your device share this information to optimize the websites you visit. For example, websites want to know if you’re using a laptop or a smartphone so that it can select the correct font size and screen resolution. This can be surprisingly accurate. To see if your device has an easily identifiable fingerprint, check out the Electronic Frontier Foundation’s Panopticlick.
Cookies, or HTTP cookies, are tiny data packets that websites or services plant on your browser while you’re on a website. These cookies differentiate your browsers from others, like a nametag. 
The privacy risks of Chrome

Any discussion of privacy and Web browsers must begin with Google Chrome. It is, by far, the most popular Web browser. Chrome handles over 60 percent of web traffic. This is unfortunate because Google uses Chrome as a window to peer into every action you take online. Unless you modify your Google privacy settings, Chrome records every site you visit so Google can serve you targeted ads.

Even worse, Chrome does very little to block other advertisers and trackers from monitoring you with cookies or device fingerprinting. A Washington Post article reported Chrome gathers roughly 11,000 trackers in an average week. Do you want 11,000 pairs of eyes on you every time you do an Internet search?

[embedded content]

However, you do not need to give away your personal data to access the Internet.

There are Internet browsers that do not record your every action and protect you from trackers. Switching from Chrome to one of the following browsers can drastically reduce the amount of data you are inadvertently sharing as you browse the Internet.

Further reading: Gmail’s privacy problem and why it matters

Best secure and privacy-first web browsers: 
1. (tie) Brave

The Brave browser was designed to make privacy simple enough for everyone. It is an open source browser built on top of Chromium (an open source version of the Chrome browser), which means it’s easy for Chrome users to make the switch.

However, unlike Chrome, Brave does not collect any data about your online activity. Your data remains private and on your device.

Brave also makes blocking trackers easy. Instead of forcing users to decide which plugins and browser extensions they should download, Brave comes fully equipped. It automatically blocks all third-party and advertising cookies, and because HTTPS Everywhere is built-in, it ensures all your connections are securely HTTPS encrypted. Brave also features Fingerprinting Protection in the browser.

The company also has a social mission: to encourage websites not to rely on advertising based on tracking you around the Internet. Brave has introduced a system that allows you to reward creators and sites you visit directly.

Called Brave Rewards, it uses a utility token called a Basic Attention Token and enables you to anonymously reward the websites you visit most. Brave also has opt-in, privacy-preserving Brave Ads, and users who choose to view them earn 70% of the ad revenue, which they can then use to reward their favorite online creators.

Brave is available for desktop, Android, and iOS. 

1. (tie) Firefox 

The open source Firefox is the third-most-popular browser on the Internet, behind Google’s Chrome and Apple’s Safari. Developed by Mozilla, the Firefox team has improved the browser’s privacy protections in recent years.

They have introduced advanced anti-fingerprinting and Enhanced Tracking Protection features this year, both of which make it much more difficult for third-party trackers to follow you around the Internet.

Unlike Brave, the standard Firefox does not automatically block advertisements. However, there are numerous browser extensions that you can download that will prevent advertisers from getting your information or showing you ads.

Or, if you primarily browse the Internet on your mobile device, Firefox Focus incorporates automatic ad blocking. (Focus was developed as an ad blocker for Safari, but was then transformed into a minimalistic privacy browser for Android users.) 

Firefox is available for desktop, Android, and iOS. 

3. Tor browser

As we have discussed elsewhere, Tor is the best option if privacy is your utmost concern. The Tor browser is based on Firefox, but it has been stripped down and specially calibrated to run on the Tor network.

When you use Tor, your traffic is encrypted three times and bounced between three Tor servers before it reaches your desired website. The encryption is handled in such a way that each server only has access to one set of instructions, so no server has access to both your IP address and the website you are visiting.

This setup makes it impossible for Tor to keep any records about your online activity, and every time you close your session, the browser deletes your cookie cache and browsing history. The browser itself is formatted to prevent fingerprinting, and it blocks all kinds of trackers.

Unfortunately, it also blocks a lot of plugins that websites rely on. For example, with its privacy settings fully activated, the Tor browser will block JavaScript. JavaScript can expose user information, but blocking it can make websites unusable. Using Tor can also mean performing endless CAPTCHA verifications when you try to access larger sites. Finally, the Tor browser is slower than other browsers because of the extra encryption.

Download the Tor browser app for desktop and Android, as well as a Tor-approved open source Onion browser for iOS.  

4. DuckDuckGo (honorable mention)

Unlike the other browsers mentioned above, DuckDuckGo does not have a standalone desktop browser, which means it is only a solution if you are browsing the Internet on your smartphone or tablet. With the DuckDuckGo browser, your browsing history never leaves your device. Deleting your entire browsing history is as easy as tapping a single button.

It automatically blocks ads, stops third-party trackers, and ensures HTTPS encryption on all sites where that’s possible. One feature that does set it apart is the Privacy Grade it gives each site. This makes it easy for you to evaluate how much data each website collects from you, with and without DuckDuckGo’s protections, at a single glance.

The DuckDuckGo browser is available for Android and iOS.
You can also use the extension for Chrome and Firefox.

The Web browser you choose can have a dramatic impact on your overall online privacy. By switching to one of the privacy-focused browsers in this article, you can protect your browsing history from the companies and trackers that want to monitor your every digital move.

What’s your favorite web browser? Let us know in the comments below on Twitter or Reddit.

Best Regards,
The ProtonMail Team

You can get a free secure email account from ProtonMail here.

We also provide a free VPN service to protect your privacy.

ProtonMail and ProtonVPN are funded by community contributions. If you would like to support our development efforts, you can upgrade to a paid plan or donate. Thank you for your support.

Cela vous intéressera aussi

[EN VIDÉO] Qu'est-ce qu'une cyberattaque ?  Avec le développement d'Internet et du cloud, les cyberattaques sont de plus en plus fréquentes et perfectionnées. Qui est derrière ces attaques et dans quel but ? Quelles sont les méthodes des hackers et quelles sont les cyberattaques les plus massives ? 

Pour espionner et contre-espionner, les agences du renseignement de n'importe quel pays utilisent les mêmes outils que les pirates : des malwares. Tout est secret défense, mais Kaspersky pense avoir mis la main sur les logiciels utilisés par la CIA. Bien évidemment, en prenant le soin de ne pas la nommer.

Dans son rapport trimestriel, le seul célèbre éditeur d'antivirus explique ainsi qu'il a étudié des échantillons de malwares envoyés en février 2019 aux experts de sécurité. C'est ce qui se fait habituellement, et les plus grands antivirus sont chargés de les analyser pour renforcer la protection de leurs solutions, mais aussi de faire le point sur les menaces actuelles.

Une variante d'un cheval de Troie utilisé depuis 2014

Certains des échantillons ne peuvent être associés à aucune activité connue. Kaspersky explique qu'il a alors isolé les malwares les plus sophistiqués, et les experts ont découvert des similitudes dans le codage, le style et les techniques utilisés dans la famille des logiciels malveillants dits Lambert. Il y a quatre ans, sous le nom de Vault7, WikiLeaks avait révélé au grand public les outils de la CIA et, chez Kaspersky, on avait décidé de les classer sous le nom de Lambert, avec un code couleur pour chaque variante.

Aujourd'hui, il s'agit donc de Purple Lambert, et ce cheval de Troie permet de surveiller l'activité du réseau sur l'ordinateur infecté. C'est un malware passif, qui agit en arrière-plan, et selon Kaspersky, son code date de 2014. C'est une découverte extrêmement rare et, bien sûr, l'éditeur ne nomme pas la CIA... Mais comme il range sa découverte dans la « famille Lambert », forcément, il s'agit des toolkits de piratage utilisés par le renseignement américain dans le passé contre l'« État islamique », ou encore le secteur de l'aviation civile chinoise.

Intéressé par ce que vous venez de lire ?

Lien externe

Définitions associées

All solutions support integration into directory services. External users can join Threema Work without having to complete a tedious registration process and even without providing a phone number or email address. On top of that, Threema Work can also be restricted to a closed user group.

Not to offer an option to archive user chats on a central server (e.g., for compliance purposes) is a deliberate decision of Threema Work because this would, in theory, allow the service provider to access message contents, which, in turn, would render the security benefits of end-to-end encryption completely useless.