Tag: privacy

Adbleed: A Proof of Concept for Adblocker Fingerprinting

Posted on by Martin Brinkmann

Internet users have plenty of options to make their connections more private. Popular choices include content blocking, using VPNs, or disabling services or features that may reveal information about them.

However, in rare circumstances, it is the very tools designed to protect users that may reveal information about them.

Enter Adbleed

Adbleed is a proof-of-concept designed to highlight a specific privacy risk associated with the use of regional adblocking rules.

The tool functions by detecting which country-specific filter lists—such as EasyList Germany or Liste FR—are currently active within a user’s browser. By probing for the blocking of domains unique to these specific lists, Adbleed creates a “filter fingerprint” that can reveal a user’s likely country of origin or language preference.

This technique demonstrates that users can be partially de-anonymized based solely on their adblocking configuration, even when employing VPNs or proxies to mask their physical location.

The detection process follows three simple steps:

  • Domains: The tool uses a curated list of domains that are blocked exclusively by certain filter lists, such as EasyList Germany.
  • Probing: Adbleed attempts to load resources from these specific domains. It then looks at what is returned. Blocked requests, which happen near instantly, are what the tool is after. It measures the time it takes to get a response to distinguish blocked requests from other errors, e.g., network failures.
  • Fingerprinting: When a specific number of domains are blocked from a regional listing, Adbleed concludes that the list is active.

What does it mean? It means that a site can detect if certain regional content blocking lists are likely enabled. This adds another factor to fingerprinting attempts.

Mitigation & Protection

Here are a few suggestions to mitigate Adbleed or limit its use for fingerprinting:

  • Stick to the defaults. If you do not enable any regional lists, Adbleed won’t detect any, which in turn makes your configuration less unique.
  • Enable anti-fingerprinting: If the browser supports anti-fingerprinting techniques, make sure they are enabled.
  • Disable JavaScript or enable hard-mode blocking: This may not be practicable, especially the JavaScript part, but this should protect against this particular type of attack.
  • Use different browsers: If you use different browsers, you torpedo tracking attempts, as the trackers can’t link your activities between different apps or browsers (unless there is a common factor that is unique).

Adbleed demonstrates that the tools designed to protect users on the Internet can sometimes be used against them. It reveals how regional content blocking preferences may allow sites to fingerprint and track users. It is not an argument against content blocking, but rather a wake-up call that things are never as straightforward as they look like on first glance.

hard drive

How to resume Disk Erase operations on Windows

Posted on by Martin Brinkmann

I ran into a bit of trouble recently when I tried to fully erase old hard drives that I no longer needed. Since I wanted to sell or give away the drives, I had to make sure that the new owner would not be able to restore any data from the drives.

My usual routine, formatting the drives fully and using full disk encryption, works well, but it is taking a long time and does not allow interruptions. The drives, for instance 8 TB external Western Digital hard drives, would take 12 or more hours to format alone.

Most regular format and erase tools, including Windows’ built-in format options and the recently reviewed HardWipe, do not support resume. Stopping the format and then restarting it at a later point always begins the entire process anew.

This means, that you need to keep the format operation going until it completes to make sure everything is erased. Since I could not to run the computer for that long, some formats would take more than a day to complete, I decided to look for a format tool with resume functionality.

There were not many out there, to my surprise, that support resume. In fact, I found a single program to do that: Active@ KillDisk.

It is available as a free version and commercial versions. The main difference between the versions, apart from free being allowed for personal use only, is that you can only run one-pass erases on disks. Since I did not want to run multiple passes anyway, as this would have extended the time even further, I decided to give this program a go to see how it fares.

Erasing hard drives with resume functionality

Erase Disk with Resume functionality

KillDisk erases content on disks by overwriting all sectors with the character 0. The professional versions support 24 international erase standards and some other features, such as providing access to boot disks or consoles.

To get started, download the latest version of the program from the developer website. The free version is provided as a setup and portable version; both offer the same functionality. An account is not required so that you may start using the program immediately.

Launch the program after the download and optional installation. You see the list of all connected drives, volumes and partitions.

Select the entire drive and then the erase disk option. The next screen defines the process. You can enable verification, but this extends the length of the process. There is also an option to write a fingerprint to the first sector of the disk and customize the Erase Certificate. This certificate is created after the process to confirm that the disk was erased. An option to disable this is also available.

Activate the Start button to run the erase operation on the disk. You can stop the process at any time with a click on the stop button.

To resume it, select “resume” after selecting the drive. The program will also display the resume reminder on the next start by default.

Note that resume will “go back” a bit and not restart the operation at the exact position it was stopped. Still, with resume supported, you may run the erase job at different times until the entire disk has been erased.

Closing Words

Active@ KillDisk is a well-designed program. While its main application is use in organizations, it is great for jobs at home as well. The erase and resume option sets it apart from the rest of the tools. While it is possible that other programs support resume functionality as well, I’m not aware of them at this point.

It is perfect for erasing data on large hard drives, especially if you can not leave the computer on for the time it takes to erase a disk entirely in one session.

Hardwipe

Hardwipe review: erase hard drive data permanently

Posted on by Martin Brinkmann

Hardwipe is a privacy software for Microsoft Windows operating systems. Its main purpose is to erase hard drive data permanently so that it can’t be recovered anymore with recovery software.

You may remember my guide on making files unrecoverable on hard drives. I used the encryption software VeraCrypt for that, as it runs a full format on the drive by default.

While that is still recommended, full formatting a drive may take a long time to complete. Depending on the drive in question, it may take days to complete.

Hardwipe offers an alternative. Instead of using full format to make data unrecoverable, you’d use the program instead to overwrite all data with random characters. It offers a much faster process.

Note: Hardwipe appears to have been abandoned in 2017. The last version of the program is available on software download sites such as Major Geeks. It is compatible with all recent versions of Windows, including Windows 11.

Hardwipe installation and use

Hardwipe

Installation of Hardwipe is straightforward. Just double-click on the downloaded setup file and follow the setup screens. The only choices that you have to make is whether to place the application’s icon on the desktop and whether you want to add its installation folder to the path variable. The latter is only advised if you plan to run it from the command line.

Once you run it, you are greeted with a simple interface. The left side displays the list of supported sources. You may use the application to wipe an entire hard drive, a volume, free space or specific data.

Select “devices” from the list and check the hard drive or hard drives that you want to erase all data from. Once back in the main menu, activate the “random data” menu to select one of the available options. This defines the characters used to overwrite the data on the selected drive(s).

Hardwipe supports several algorithms next to random. These include Gutman, Schneier, DOD (Department of Defense) and several others. Some overwrite multiple times, which extends the process considerably. You may set the default algorithm in the options.

Select the Start button to begin the process. You will notice that it takes less time than a full drive format. The length of the operation still depends on certain characteristics, such as the speed of the drive or the load of the system.

Apart from wiping entire hard drives, you may use the program to wipe individual files or folders, or the entire free disk space.

Closing Words

Hardwipe is an excellent program if you want to protect data on hard drives against recovery. It is much quicker than full formatting hard drives, which makes it a viable option when it comes to that.

One downside is that the tool is abandoned. Still, it is an excellent program that works reliable and quite fast.

Is Google turning Chrome into its agent?

Posted on by Martin Brinkmann

What would you do, if you were in control of the world’s most used search engine and web browser, and also the world’s largest advertising company? Would you keep things strictly separate, even if it would mean leaving billions of Dollar on the table?

Google’s control of advertising, to a large degree at least, and the Chrome web browser is a problem. The company has made several attempts in the past to push technologies that favor it through Google Chrome.

The oddly named Privacy Sandbox is just one attempt. Google uses the name to portrait an image of improvement for users of the Chrome browser. While not totally wrong, as it is a better system in some regards than the currently used third-party cookie tracking system, it is not the Holy Grail of privacy efforts Google portraits it as.

See, privacy sandbox is still about tracking. What sets it apart from cookie-based tracking are two things: first, that users are associated with interest groups instead of individual interests. Chrome looks at the browsing history and assigns groups to the user. Browse lots of car, sports or knitting sites? Chrome picks these as your interests and advertisers may use the information to display advertisement that falls into the groups.

Second, because it puts Google at the center of control of the feature. Google controls Chromium by and large, and also Chrome. If the system is baked into the browser, Google is in control. It can make adjustments and other changes, and everyone has to play ball to avoid being shut out entirely from the system.

Manifest V3

Privacy Sandbox is not the only attempt that mixes Google’s core interests, advertising, with the development of Internet browsers.

Manifest V3 is a new ruleset for extensions. Google had to postpone the release multiple times as protests sounded loud and clear throughout the Internet.

Apart from some technical issues, missing APIs and the like, Manifest V3 is clearly aimed at making content blockers and other privacy tools less useful. It would go too far to dive deep into technicalities, only this much.

Content blockers, such as uBlock Origin, reign freely under Manifest V2 rules. When they are active, they tell the browser what to do with certain requests. The browser then acts accordingly, for instance by blocking advertisement or allowing a video to play.

Under Manifest V3, that power moves to the browser. The browser controls the blocking and extensions may only make “declarations”. The extension would tell the browser to block or allow a certain element, and the browser would act accordingly.

Google’s explanation for this is improved privacy. Extensions are no longer able to access “potentially sensitive user data”, which in turn makes extensions safer to use.

The argument is flawed, as extensions still have access to the data. They may still use the old API, but only with read access. This means, that they can still access all the data, which in turn means that nothing is won or lost in regards to privacy.

Google announced this week that it will go forward with Manifest V3. Old extensions, those based on Manifest V2, will be disabled automatically for most Chrome users by mid-2024. Enterprise users may get a 1-year extension through a special policy.

Closing Words

There is a conflict of interest at work. Google depends on the advertising business and will go through great lengths to expand it and keep its dominance in the sector. To be fair, the vast majority of changes that are made to Chromium and Google Chrome have nothing to do with Google’s advertising business.

Still, some of the changes appear to favor the business over the interests of users of the browser.

It remains to be seen if the changes will lead to a mass exodus of Chrome users to other platforms. It is too early to tell, especially since the changes affect a sizeable but still relatively small part of the entire Chrome population.

Now You: do you use Google Chrome?

Cloud Content Search: disable it in Windows 11

Posted on by Martin Brinkmann

Microsoft’s Windows 11 operating system runs local and remote searches when users use the search functionality. A relative recent addition is the ability to find cloud files. Windows Search may return content from OneDrive, Outlook and other Microsoft services alongside local results.

Some Windows users may find cloud search functionality useful, especially if they use OneDrive or Outlook. Others may want to disable the feature, as they may have no need for it or are concerned about privacy.

The operating system’s search uses connected Microsoft, work or school accounts, automatically when users sign-in with those.

Windows 11 users may connect personal or school/work accounts independently of that in the Settings:

  1. Select Start and select Settings, or use the keyboard shortcut Windows-I to open Settings.
  2. Go to Accounts > Email & accounts.
  3. Locate “Accounts used by other apps”.
  4. Select “Add a Microsoft account” to add a personal account.
  5. Select “Add a work or school account” to add an organizational account.

You are asked to provide the username and password for the account to add it.

Here is what happens when Cloud Content Search is enabled

Users who use a personal Microsoft account will see items from OneDrive, Outlook and other Microsoft services in Windows Search. A search for a filename may, for example, return files found on OneDrive.

Additionally, results will be personalized when searching the web or getting web search suggestions in Windows Search. Bing searches in the Windows search box will earn users Microsoft Rewards points.

Work or school accounts connected to Windows 11 may see organizational content returned in Windows searches. This may include content from OneDrive for Business, Outlook, SharePoint and other Microsoft services.

Disabling cloud-based searches in Windows

Cloud Content Search settings in Windows 11

Windows 11 includes options to disable cloud content search functionality. The functionality is enabled by default and users need to become active to turn it off.

The following guide provides step by step instructions on disabling cloud content search in Windows.

  1. Open Start and select Settings, or use the shortcut Windows-I to open Settings.
  2. Select Privacy & Security from the sidebar on the left.
  3. Click on Search permissions.
  4. Two Cloud Content Search options are available:
    • Microsoft account — handles personal account content.
    • Work or School account — for users signed-in with these types of accounts.
  5. Toggle one or both of the options to the Off state.

Windows 11 won’t pull data from remote Microsoft services, such as OneDrive, Bing or Outlook anymore, when turned off.

Windows 10 also includes options to turn off the feature. Here is how that is done on Windows 10 devices:

  1. Select Start and then Settings to open the Settings application.
  2. Select Search from the available categories in the Settings app.
  3. Find Cloud content search.
  4. Toggle Microsoft account and/or Work or School account to Off to disable the feature.

Turning off cloud searches with the Group Policy Editor

Administrators may use the Group Policy Editor to turn off Cloud Content Search for all users of the operating system.

Note: The Group Policy Editor is only available in professional and enterprise / education editions of Windows 11. Windows 11 Home systems need to make the change in the Registry; this is explained further down below.

  1. Use the keyboard shortcut Windows-R to open the run box.
  2. Type gpedit.msc and press the Enter-key to start the Group Policy Editor.
  3. Navigate to Computer Configuration > Administrative Templates > Windows Components > Search.
  4. Locate Allow Cloud Search on the right-side and double-click on the policy.
  5. Change the state from “Not Configured” to “Enabled.
  6. Use the menu under Options to select “Disable Cloud Search” to turn it off.
  7. Select OK to apply the change.
  8. Close the Group Policy Editor.
  9. Restart the PC.

Disabling Cloud Search in the Registry

Home edition users need to make the change in the Registry directly. It applies the same policy.

  1. Open the Start Menu, type regedit.exe and press the Enter-key to launch the Registry Editor.
  2. Confirm the security prompt that Windows displays.
  3. Use the hierarchical structure on the left to go to HKEY_LOCAL_MACHINE > SOFTWARE > Policies > Microsoft > Windows > Windows Search
    • If one of the keys is not available, right-click on the previous key and select New > Key. Name it accordingly to create the path.
  4. Search for the Dword AllowCloudSearch on the right side.
    • If it is not there, right-click on Windows Search and select New > Dword (32-bit) Value.
    • Name it AllowCloudSearch.
  5. Double-click on AllowCloudSearch.
  6. Set its value to 0 to turn off Cloud Search for all users.