Protecting your LiveJournal privacy with Firefox

[ciphergoth]

This journal entry describes ways in which people you know may be monitoring the way you use LJ. How often you read their journal, what friends groups you define, and so on.

It's done with what are called "web bugs" - tiny images served from special servers that record this information. You can block the servers that serve the web bugs, but they can always create more servers, so it's a game of "whack-a-mole".

Today I found out about a setting in Firefox that blocks *all* web-bug based tracking, from all websites to all websites, permanently. No longer will people be able to monitor you in this way.

Go to the URL bar and type "about:config". Select the setting "network.http.sendRefererHeader". If it has the value "2", change it to "1". That's it.

Technical details

I'll be setting this on all my browsers ASAP.

Comments

[dennyd.livejournal.com]

LJtoys knows nothing about my LJ cookies.

[nikolasco.livejournal.com]

LJ cookies are only sent to LJ, but a site can set it's own cookies to help pin down particular machines. This is an issue with NAT ("routers") and many ISPs (due to dynamic IP addresses). Setting "from originating site only" for cookies in Firefox preferences prevents the trick from working.

[dennyd.livejournal.com]

I still don't how they can connect their cookie and my LJ username?

Unless, hrm. Some cunning screen-scraping in Javascript might do it, if your 1 pixel gif was actually a script... I know there are some sort of limitations on scripting across domains, but I'm not sure what they are.

[nikolasco.livejournal.com]

My idea is to combine cookie/IP tracking with data from link-click Referer headers and meme data. For example:
1) You visit LJ with tracking image
2) Your browser fetches said image. The server logs the IP and cookie. If you don't have a cookie, it gives you one.
3) One of the following:
a) Some time later you click a link, sending a Referer header with it. A username can now be guessed based on the Referer (http://dennyd.livejournal.com/friends).
b) You go do a meme thingy. It asks for a username and you give it one.
Either way, your IP and cookie are given to the server again. The match is stored and can now be attached to all that old, previously sorta-anonymous data.
4) Profit?
I doubt anyone's bothering with this, but it's a thought.

Setting the cookie while viewing a journal can be stopped by only allowing cookies from the "originating site" in Firefox prefs; it makes it so if you're viewing livejournal.com, foobar.com can't set cookies as you fetch images or whatever. IP address tracking can be mitigated by using Tor (http://tor.eff.org/) or something like it.

Clearly all of this tracking can be rendered useless by a sufficiently informed/determined/whatever person.