Gotta Block’em all
CC Attribution 3.0 Germany:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Huber, Markus
Today’s websites and mobile applications heavily rely on third party libraries: to display advertisement, to enable social networking, and to analyze their audience. The convenience of these third party libraries comes at the cost of privacy violations for their users.
 I'm with the University of the Blythe Sciences where I started this year. I'm trying to establish research into privacy there. The talk today is about trackers and how to get rid of them. I think our mission as privacy people, trackers, we should get rid of them. In this talk, I show you some research on how you can effectively block trackers and also another project I'm working on where we try to make this tracker blocking protection a little bit more usable. First off, and I don't know how many of you have seen the talk on privacy peture, anybody on the first day. Yeah, a few hands. I was obviously because I'm very obsessed by the topic. I went there and watched it. This is also why I'm only briefly speaking about the threats of online tracking to start off my talk. This picture is the classic. You saw it 10 years ago in presentations. It's this old cartoon from the New York Times. On the internet, nobody knows you're a dog. Obviously 20 years later, this is not true at all. What I'm going to do is in my future talks, this is going to be the new cartoon I will use for all my presentations on tracking, I think. Privacy on the internet by the Tech of Joy or the Joy of Tech. It's really cool. I think it summarizes the whole tracking problem pretty well. In the old days, you were reading your newspaper at home in front of your chimney, and you were happy and nobody was watching you. Nowadays, when you browse the web, it's like you're reading the news online. It's like its Facebook is tracking you, the articles you're reading, the NSA might track what you're reading. Google obviously tracks the whole ecosystem. They're leaking a lot of personal information nowadays when you surf the web. I think the literally sickest example for this online tracking is from Austria this year, so Austria, the country I'm coming from. This is a translation by the guy into English. Maybe it's not obvious to you. The story behind this is Daniel Knapp, a fellow Austrian, unfortunately got cancer, and he started googling his symptoms and his diagnosis, and he ended up getting advertisement for funerals by Facebook. This is, I think, as sick as he can get. He was targeted for funerals. See this here, Bestatung and Wien. I think this is the most epic fail with targeted advertisement. The other thing, except from companies like Facebook or advertising companies tracking your online behavior, it's also governmental organizations. What we learned recently through the Snowden disclosures is that the NSA luckily picks up tracking cookies. They are basically piggybacking on all the tracking advertising companies, too, because they have selectors, and it's very nice for them. They have these unique identities created by advertising companies and social networks which uniquely identify you. One thing they used it for was to reveal the identity of door users. This is a very special case. This is for people who use their browser, both for serving normally in the Internet and then use some kind of hack or a door proxy to access door. They can basically just link the advertising cookies and they know exactly who you are, no matter if you're using door or not. The other thing is they use it for target selection. They're listening to this huge stream of data, and they want to attack this admin at this company or somebody at BelgaCom. They want to target the very exact person they want to exploit. This is where tracking is very handy for them. They also piggyback on mobile tracking, so things leaking through mobile smartphone apps. I think this is the biggest threats with tracking nowadays. This is making profiles about what you serve online, about your medical history and so on and governmental organizations on the other hand. The second part of my talk focuses on some insights into this arms race between trackers and blockers. Of course, I'm going to talk about these extensions later on. I think what's the most effective defense at the moment are browser extensions. There are so many of them. This is the most popular ones. I don't know. I guess most of you use some of the blockers on this list, and I will go into detail about them in the next few slides. The most popular one is Adblock Plus. We see that a number of extensions are basically building on the filter rules of Adblock Plus. Then we have Ghostory, which is very popular. A new one, a new browser extension, which I quite like, is Ublock and then Privacy Petra. I will explain Privacy Petra in a few sentences as well. We see that Adblock Plus is used by 20 million people. This is a widespread use of such a protection measure. The thing with Adblock Plus is the rules are pretty good. The controversial thing they started in 2012 was this acceptable ads program. They have some agreements with certain companies, including Google and Amazon, to not block their tracking code or their advertisement. If you're using Adblock Plus and you're not aware of this, opt out of this feature. Wherever you install it, just remove the acceptable ads. Adblock is very similar to Adblock Plus. It basically just filled the gap for Chrome because the Adblock Plus people were too slow to board the extension there. Ublock, as I said, is a new browser extension which builds on some of the rulesets of Adblock Plus, such as Easy List, Easy Privacy, and also a DNS list, which I quite like by Peter Lover. There are no acceptable ads, and the focus is on performance and privacy. It's all open source on GitHub. This is an extension I would highly recommend you. The other thing is extensions. The first ones were all focusing on advertising. Other blocking tools are dedicated to blocking trackers. Maybe the most popular one is Gorsery. How many people here have Gorsery installed? Yes, a lot of people. The thing is, Gorsery for us, it works pretty well. For the layperson, the problem is you have to opt into blocking. Some people just install the extension. It shows these nice little bubbles about trackers, but you're not actually blocking them. I guess everyone sitting in this stamp already did this. Just as a word of caution. The other thing is disconnect me, which is very similar to Gorsery. It's also included in Firefox right now. This is an optional feature in Firefox built in a tracker blocker which you can enable. Privacy, the really nice thing is, and I suggest you to also watch the talk from the first day about Privacy Petra is it doesn't depend on rule files, so it doesn't download, it doesn't have subscription to rules, but it uses some heuristics to block trackers. So it's while you surf, it detects, hmm, that's strange. I'm going through all these different websites and I'm always loading content from Google. This might be a tracking domain, so I block it. So Privacy Petra is a really, really nice idea. The thing we as researchers are interesting is on how effective are these tools really. So I mean, with Gorsery, you have these little bubbles or with AdWords Plus, you just see okay, the advertisement disappeared, so this seems to be working quite well. But we were interesting in how effective they really are. So this is some joint work I have done with Georg Metzdofnik. So Georg Metzdofnik is a very gifted programmer who implemented this. And so we crawled 200,000 websites and different sub pages of them, so roughly half a billion web requests. And we had automated browsers to analyze the traffic. And we collected the network traffic to see how effective they are and who is actually tracking people. So the next few slides, what you're going to see is, so to say, bleeding edge research, which means the graphs are maybe not easy to read and not as polished as we wanted to, but they give you a general idea of our findings. So the first thing you see here is who are the most prevalent trackers. So what are really the companies that track you the most? And if you look at this table on the right-hand side, upper corner, you see that Google is really the biggest player in the game. So it's Google Analytics, Google's Ad Provider, DoubleClick, and so on. Facebook is also very popular. And the graphs basically show you why for us it made sense to really analyze a big sample. So some researchers previously, they analyzed, I don't know, the top 100 websites. So really wanted to have a big sample. And as you can see here with a small spike by Do, obviously, is in Asia has a bigger market share. So you see that some of the Google services are declining while by Do for some popular websites is a bigger player. The other thing, and this is unfortunately a table, which is very hard to read, maybe with the huge project that is, the thing is, and this is really the top tracking domains and we wanted to see how effective the different tools are. And to our surprise, or not to our surprise, actually, Gostery is really, really leading the field. So you can see that, so the first column is like, how many, if you don't use any extension, who is tracking you. And then with Gostery, you can see that some of the domains go to 0%. So Gostery is effectively blocking the tracking domains. You might also notice that there are some domains which Gostery doesn't block. This is, for example, APIs. So font APIs from Google, so third party content, which you can't easily block, but which is also not really tracking you. So this was all kind of setting the stage for the last part. I want to talk about this. So I showed you all these extensions and what I really want to do, or what we want to do in this project is make tracker blocking a little bit more usable. And I'm going to talk about certain drawbacks and also advantages of this solution. And this project is called the usable privacy box or UBRE box in short. It's an open source project. And I was very lucky to get funding by the Internet Foundation in Austria. Yeah, the funding is called NetID. And so the idea is to use a commodity hardware, so basically a Raspberry Pi with a Wi-Fi dongle and make some kind of privacy enhanced Wi-Fi hotspot and make it as zero config as possible. Why the Raspberry Pi? I don't know. It's like, I think this Raspberry Pi hype always goes in cycles and there are so many gig friends who bought like, I don't know, five Raspberry Pies and now they're just lying at home unused or maybe you're using it to watch television or something with your media center setup. I really want you once the software is out, take your buy off the shelf and put our software on. So we'll be very happy if people gave it a try. The first prototypes on the left side, this is on my desk back in St. Burton. On the right hand side, this was at Leivandville in Matalep. This is where I stayed at the camp. It's a very awesome village. If you have time, go by there and check it out. And yeah, basically just use some cable binders to deploy my hotspot there. You could also try it out if you wanted to. We actually want to go. Next is want to create a nice case and actually work on the software, which brings me to the next point. What is it actually doing? So it's first of all, it's blocking trackers. So I'm using some kind of DNS blacklist which redirects certain domains. So for example, Google Analytics is resolved by the UBRE box and redirected to a different host and it resets the cookies from this tracking domain. So basically you connect to the Wi-Fi once and you also get rid of some old cookies. It also uses a transparent proxy called Prevoxy. I guess most of you know the project. If not, Google it. It's quite nice. It's maintained by some German developers. This also injects CSS into the website. So advertising is not displayed. And what I ultimately want to do is block advertising and tracking in on websites and also in applications on your mobile phone. So if you connect your mobile phone, I want these little tracking ads to be gone. Network blocking though is tricky. So I mean the network blocking, the nice thing is you connect to the Wi-Fi and most of the trackers are gone. So it works with most of the devices which have Wi-Fi. So if you're old feature phone with Wi-Fi, it works the same way as with your Android or iPhone. However, it's not very easy or it's quite tricky to do network blocking. For one, you can't reliably detect third parties. So if you have a browser extension, this is something that you can easily do like Privacy Petra does. This is very tricky to do on the network. The other thing is, and this might be a privacy paradox on or at least for my project is the growing number of websites which are using DLS or HTTPS by default, which is very good because you don't leak any information. But obviously the box can't intercept it. It's a very, it would be a very, very bad idea for a privacy project to open up the HTTP traffic. So this is something I'm definitely not doing. So certain trackers are harder to block. So for example, this Facebook like button because it's all encrypted and it's on the same domain, the tracking is on the same domain as the main Facebook website, you can't just block the domain. I would love to, but then people would get annoyed if they want to serve their Facebook account. The other thing is onion routing with Door. We decided to deactivate this feature. It works quite nice. So it filters advertisement and you route your whole traffic over Door. The thing though is there's no magic, there's no magic door boxes. You're always going to screw up if you're using one of these privacy boxes we've drawn them because it's just a very, very bad idea. So what we do is we point the people to download the door browser bundle. What I personally think is the most effective way to block trackers and to increase your privacy. You'll never, ever do if you're doing something critical, never, ever use your normal browser and just route it over the Door network. The last thing the urebox is going to offer is a VPN. So it comes with open VPN certificate based. We spent quite some time on trying to get IPsec running. There might be some network guys among you here. I just literally hated it working with it. But open VPN is very nice and so you can use it, use the box even when you're abroad. So I guess the CCC can would be a good option to use a VPN because of, yeah, you know, all your colleagues and their friendly neighbor hacker. The issues here are the challenges is zero config is tricky to set up. So you have to somehow do the port forwarding with you, PMP or not PMP. And of course you have to handle changing or dynamic at peace by your provider somehow. Yeah. The plan for the project is that we release it on GitHub using a configuration management tool called uncivil. So you can really reproduce the image and we want to release it in the end of this year. And yeah, there are many, many gifted students and people helping me. So I'm not doing this by myself. There's Alex and Anton who are doing mostly the networking stuff and the hardening. Julian and Tobias, I do bachelor students at FHASA, which were really good. We program us and really obsessed with security as well. So we always have interesting discussions and also have some usability people and some people helping me with the case. So basically, I'm very happy to work with a small team of people to get this done. Yeah. This brings me basically to my final slide, the takeaways from this presentation. So yeah, just in a nutshell, I think we are now entering basically an arms race between trackers and blockers. So Adblock Plus, for example, had a legal case in Germany now because by blocking advertisement, of course, it's also you're creating problems for publishers because they lose revenue. And so they were suing some German news companies were suing Adblock Plus, for example. A former Google employee wants to create a new company now, which works in the opposite direction of browser extensions where he wants to come up with checking and advertisement methods, which are harder to block. So I think that's really a lot of things are happening there. Basically I think the browser extensions to some extent to my surprise are quite effective. As said, I would go with Ublock. Disconnect is also very nice and Privacy Badger. These three applications come all with an open source license, which is really nice. And then finally, I talked about this usable Privacy Box project I'm working on, but the goal is really to make the whole thing zero config. So you don't have to install the browser extension on every browser you use. You don't have to configure it and make sure. I don't know, you enable blocking in Ghostry and disable the feature where you send statistics called Ghostrank back to Ghostry, where you don't have to fiddle with Adblock Plus to disable acceptable ads and so on. So basically something I could also give to my parents at home and to connect their devices and they are happy. And as I said, if you have a spare Raspberry Pi, I really hope you could turn it into a U-Rubbox and give it a try. And yeah, the last one is an obvious thing for everyone who ever programmed. Prototyping is very easy. Productive setup is hard. This is not the use of a Privacy Box. There are so many tutorials. So if you check out other fruit, they have an onion pie, there's an other fruit, Wi-Fi, advertising, blocker and so on. If you want to go from this small how-to to something really, I don't know, more stable and useful, that's tricky. But also that's not a surprise, but just to let you know we are working hard on the box. Yeah, if you want to stay tuned for the public release, this is the Twitter account at use of a Privacy. If you don't have the chance to speak with me today, you can always contact me for questions. Actually there's a typo here, so it should be.org. Yeah, thank you for listening and hopefully you learn something new and you have some interesting questions. Thank you very much, Markus Huber for your talk. As we are running short on time, please only one or two short questions. If you have more questions, please meet each other outside of the tent. I think it's okay for you to meet. Yeah, sure, sure. Okay, one or two questions only please. Just one question. Do you have tried some combination like NoScript on one of these tools? There's NoScript and Request policy. I think it's what most people here at the camp use, but I think it's just not accessible to the average person. So the whole thing for me is also a usability idea. I know most people here are fond of NoScript. It's effective, but anybody not from the camp would have a hard time using it. So this is why we didn't include it. Did this answer your question? I wondered if you had any advice for publishers who are relying on advertising to fund their sites. Obviously the revenue from targeted ads is much higher than revenue from ads that are just generally broadcast on the internet. I wondered if you could, if you had any advice for them. So I didn't really get the question. The question was about revenue and advertisement. So advice for publishers, so people who are trying to keep their site running on advertising revenue. So it's obviously in their interest to have targeted ads on their website because they get more revenue than they will. Yeah, yeah, that's true. I see a real problem here, especially, I mean, some open source or grass root campaigns also relying on advertisement to basically fund their projects. I think one really nice idea is like things like micro payment systems like Flutter or something where you can directly donate to a website and you just Flutter websites. But I think it's a very bad idea if you run your website that you enable tracking of people. For bigger media houses, I'm afraid that once people effectively block advertisement, it's going to be like movies nowadays, it's going to be news with product placement. So you're basically reading a news article which is funded by a company and looks like normal news to you. So this is with movies and TV, we got rid of all the advertisement. Now you're watching a movie cluttered with products. So I think that's for one thing. But for smaller websites, I would go for crowdfunding, Flutter or get Bitcoin donations, PayPal donations, something like this, but not rely on advertisement. So for more questions, please meet Makos outside of the tent because we're running out of time. Thank you again very, very much Makos Huber.
 I'm with the University of the Blythe Sciences where I started this year.  I'm trying to establish research into privacy there.  The talk today is about trackers and how to get rid of them.  I think our mission as privacy people, trackers, we should get rid of them.  In this talk, I show you some research on how you can effectively block trackers and  also another project I'm working on where we try to make this tracker blocking protection  a little bit more usable.  First off, and I don't know how many of you have seen the talk on privacy peture, anybody  on the first day.  Yeah, a few hands.  I was obviously because I'm very obsessed by the topic.  I went there and watched it.  This is also why I'm only briefly speaking about the threats of online tracking to start  off my talk.  This picture is the classic.  You saw it 10 years ago in presentations.  It's this old cartoon from the New York Times.  On the internet, nobody knows you're a dog.  Obviously 20 years later, this is not true at all.  What I'm going to do is in my future talks, this is going to be the new cartoon I will  use for all my presentations on tracking, I think.  Privacy on the internet by the Tech of Joy or the Joy of Tech.  It's really cool.  I think it summarizes the whole tracking problem pretty well.  In the old days, you were reading your newspaper at home in front of your chimney, and you  were happy and nobody was watching you.  Nowadays, when you browse the web, it's like you're reading the news online.  It's like its Facebook is tracking you, the articles you're reading, the NSA might track  what you're reading.  Google obviously tracks the whole ecosystem.  They're leaking a lot of personal information nowadays when you surf the web.  I think the literally sickest example for this online tracking is from Austria this  year, so Austria, the country I'm coming from.  This is a translation by the guy into English.  Maybe it's not obvious to you.  The story behind this is Daniel Knapp, a fellow Austrian, unfortunately got cancer, and he  started googling his symptoms and his diagnosis, and he ended up getting advertisement for  funerals by Facebook.  This is, I think, as sick as he can get.  He was targeted for funerals.  See this here, Bestatung and Wien.  I think this is the most epic fail with targeted advertisement.  The other thing, except from companies like Facebook or advertising companies tracking  your online behavior, it's also governmental organizations.  What we learned recently through the Snowden disclosures is that the NSA luckily picks  up tracking cookies.  They are basically piggybacking on all the tracking advertising companies, too, because  they have selectors, and it's very nice for them.  They have these unique identities created by advertising companies and social networks  which uniquely identify you.  One thing they used it for was to reveal the identity of door users.  This is a very special case.  This is for people who use their browser, both for serving normally in the Internet  and then use some kind of hack or a door proxy to access door.  They can basically just link the advertising cookies and they know exactly who you are,  no matter if you're using door or not.  The other thing is they use it for target selection.  They're listening to this huge stream of data, and they want to attack this admin at this  company or somebody at BelgaCom.  They want to target the very exact person they want to exploit.  This is where tracking is very handy for them.  They also piggyback on mobile tracking, so things leaking through mobile smartphone apps.  I think this is the biggest threats with tracking nowadays.  This is making profiles about what you serve online, about your medical history and so  on and governmental organizations on the other hand.  The second part of my talk focuses on some insights into this arms race between trackers  and blockers.  Of course, I'm going to talk about these extensions later on.  I think what's the most effective defense at the moment are browser extensions.  There are so many of them.  This is the most popular ones.  I don't know.  I guess most of you use some of the blockers on this list, and I will go into detail about  them in the next few slides.  The most popular one is Adblock Plus.  We see that a number of extensions are basically building on the filter rules of Adblock Plus.  Then we have Ghostory, which is very popular.  A new one, a new browser extension, which I quite like, is Ublock and then Privacy Petra.  I will explain Privacy Petra in a few sentences as well.  We see that Adblock Plus is used by 20 million people.  This is a widespread use of such a protection measure.  The thing with Adblock Plus is the rules are pretty good.  The controversial thing they started in 2012 was this acceptable ads program.  They have some agreements with certain companies, including Google and Amazon, to not block  their tracking code or their advertisement.  If you're using Adblock Plus and you're not aware of this, opt out of this feature.  Wherever you install it, just remove the acceptable ads.  Adblock is very similar to Adblock Plus.  It basically just filled the gap for Chrome because the Adblock Plus people were too slow  to board the extension there.  Ublock, as I said, is a new browser extension which builds on some of the rulesets of Adblock  Plus, such as Easy List, Easy Privacy, and also a DNS list, which I quite like by Peter  Lover.  There are no acceptable ads, and the focus is on performance and privacy.  It's all open source on GitHub.  This is an extension I would highly recommend you.  The other thing is extensions.  The first ones were all focusing on advertising.  Other blocking tools are dedicated to blocking trackers.  Maybe the most popular one is Gorsery.  How many people here have Gorsery installed?  Yes, a lot of people.  The thing is, Gorsery for us, it works pretty well.  For the layperson, the problem is you have to opt into blocking.  Some people just install the extension.  It shows these nice little bubbles about trackers, but you're not actually blocking them.  I guess everyone sitting in this stamp already did this.  Just as a word of caution.  The other thing is disconnect me, which is very similar to Gorsery.  It's also included in Firefox right now.  This is an optional feature in Firefox built in a tracker blocker which you can enable.  Privacy, the really nice thing is, and I suggest you to also watch the talk from the first  day about Privacy Petra is it doesn't depend on rule files, so it doesn't download, it  doesn't have subscription to rules, but it uses some heuristics to block trackers.  So it's while you surf, it detects, hmm, that's strange.  I'm going through all these different websites and I'm always loading content from Google.  This might be a tracking domain, so I block it.  So Privacy Petra is a really, really nice idea.  The thing we as researchers are interesting is on how effective are these tools really.  So I mean, with Gorsery, you have these little bubbles or with AdWords Plus, you just see  okay, the advertisement disappeared, so this seems to be working quite well.  But we were interesting in how effective they really are.  So this is some joint work I have done with Georg Metzdofnik.  So Georg Metzdofnik is a very gifted programmer who implemented this.  And so we crawled 200,000 websites and different sub pages of them, so roughly half a billion  web requests.  And we had automated browsers to analyze the traffic.  And we collected the network traffic to see how effective they are and who is actually  tracking people.  So the next few slides, what you're going to see is, so to say, bleeding edge research,  which means the graphs are maybe not easy to read and not as polished as we wanted to,  but they give you a general idea of our findings.  So the first thing you see here is who are the most prevalent trackers.  So what are really the companies that track you the most?  And if you look at this table on the right-hand side, upper corner, you see that Google is  really the biggest player in the game.  So it's Google Analytics, Google's Ad Provider, DoubleClick, and so on.  Facebook is also very popular.  And the graphs basically show you why for us it made sense to really analyze a big sample.  So some researchers previously, they analyzed, I don't know, the top 100 websites.  So really wanted to have a big sample.  And as you can see here with a small spike by Do, obviously, is in Asia has a bigger  market share.  So you see that some of the Google services are declining while by Do for some popular  websites is a bigger player.  The other thing, and this is unfortunately a table, which is very hard to read, maybe  with the huge project that is, the thing is, and this is really the top tracking domains  and we wanted to see how effective the different tools are.  And to our surprise, or not to our surprise, actually, Gostery is really, really leading  the field.  So you can see that, so the first column is like, how many, if you don't use any extension,  who is tracking you.  And then with Gostery, you can see that some of the domains go to 0%.  So Gostery is effectively blocking the tracking domains.  You might also notice that there are some domains which Gostery doesn't block.  This is, for example, APIs.  So font APIs from Google, so third party content, which you can't easily block, but which is  also not really tracking you.  So this was all kind of setting the stage for the last part.  I want to talk about this.  So I showed you all these extensions and what I really want to do, or what we want to do  in this project is make tracker blocking a little bit more usable.  And I'm going to talk about certain drawbacks and also advantages of this solution.  And this project is called the usable privacy box or UBRE box in short.  It's an open source project.  And I was very lucky to get funding by the Internet Foundation in Austria.  Yeah, the funding is called NetID.  And so the idea is to use a commodity hardware, so basically a Raspberry Pi with a Wi-Fi dongle  and make some kind of privacy enhanced Wi-Fi hotspot and make it as zero config as possible.  Why the Raspberry Pi?  I don't know.  It's like, I think this Raspberry Pi hype always goes in cycles and there are so many  gig friends who bought like, I don't know, five Raspberry Pies and now they're just lying  at home unused or maybe you're using it to watch television or something with your media  center setup.  I really want you once the software is out, take your buy off the shelf and put our software  on.  So we'll be very happy if people gave it a try.  The first prototypes on the left side, this is on my desk back in St. Burton.  On the right hand side, this was at Leivandville in Matalep.  This is where I stayed at the camp.  It's a very awesome village.  If you have time, go by there and check it out.  And yeah, basically just use some cable binders to deploy my hotspot there.  You could also try it out if you wanted to.  We actually want to go.  Next is want to create a nice case and actually work on the software, which brings me to the  next point.  What is it actually doing?  So it's first of all, it's blocking trackers.  So I'm using some kind of DNS blacklist which redirects certain domains.  So for example, Google Analytics is resolved by the UBRE box and redirected to a different  host and it resets the cookies from this tracking domain.  So basically you connect to the Wi-Fi once and you also get rid of some old cookies.  It also uses a transparent proxy called Prevoxy.  I guess most of you know the project.  If not, Google it.  It's quite nice.  It's maintained by some German developers.  This also injects CSS into the website.  So advertising is not displayed.  And what I ultimately want to do is block advertising and tracking in on websites and  also in applications on your mobile phone.  So if you connect your mobile phone, I want these little tracking ads to be gone.  Network blocking though is tricky.  So I mean the network blocking, the nice thing is you connect to the Wi-Fi and most  of the trackers are gone.  So it works with most of the devices which have Wi-Fi.  So if you're old feature phone with Wi-Fi, it works the same way as with your Android  or iPhone.  However, it's not very easy or it's quite tricky to do network blocking.  For one, you can't reliably detect third parties.  So if you have a browser extension, this is something that you can easily do like Privacy  Petra does.  This is very tricky to do on the network.  The other thing is, and this might be a privacy paradox on or at least for my project is the  growing number of websites which are using DLS or HTTPS by default, which is very good  because you don't leak any information.  But obviously the box can't intercept it.  It's a very, it would be a very, very bad idea for a privacy project to open up the  HTTP traffic.  So this is something I'm definitely not doing.  So certain trackers are harder to block.  So for example, this Facebook like button because it's all encrypted and it's on the  same domain, the tracking is on the same domain as the main Facebook website, you can't just  block the domain.  I would love to, but then people would get annoyed if they want to serve their Facebook  account.  The other thing is onion routing with Door.  We decided to deactivate this feature.  It works quite nice.  So it filters advertisement and you route your whole traffic over Door.  The thing though is there's no magic, there's no magic door boxes.  You're always going to screw up if you're using one of these privacy boxes we've drawn  them because it's just a very, very bad idea.  So what we do is we point the people to download the door browser bundle.  What I personally think is the most effective way to block trackers and to increase your  privacy.  You'll never, ever do if you're doing something critical, never, ever use your normal browser  and just route it over the Door network.  The last thing the urebox is going to offer is a VPN.  So it comes with open VPN certificate based.  We spent quite some time on trying to get IPsec running.  There might be some network guys among you here.  I just literally hated it working with it.  But open VPN is very nice and so you can use it, use the box even when you're abroad.  So I guess the CCC can would be a good option to use a VPN because of, yeah, you know, all  your colleagues and their friendly neighbor hacker.  The issues here are the challenges is zero config is tricky to set up.  So you have to somehow do the port forwarding with you, PMP or not PMP.  And of course you have to handle changing or dynamic at peace by your provider somehow.  Yeah.  The plan for the project is that we release it on GitHub using a configuration management  tool called uncivil.  So you can really reproduce the image and we want to release it in the end of this year.  And yeah, there are many, many gifted students and people helping me.  So I'm not doing this by myself.  There's Alex and Anton who are doing mostly the networking stuff and the hardening.  Julian and Tobias, I do bachelor students at FHASA, which were really good.  We program us and really obsessed with security as well.  So we always have interesting discussions and also have some usability people and some  people helping me with the case.  So basically, I'm very happy to work with a small team of people to get this done.  Yeah.  This brings me basically to my final slide, the takeaways from this presentation.  So yeah, just in a nutshell, I think we are now entering basically an arms race between  trackers and blockers.  So Adblock Plus, for example, had a legal case in Germany now because by blocking advertisement,  of course, it's also you're creating problems for publishers because they lose revenue.  And so they were suing some German news companies were suing Adblock Plus, for example.  A former Google employee wants to create a new company now, which works in the opposite  direction of browser extensions where he wants to come up with checking and advertisement  methods, which are harder to block.  So I think that's really a lot of things are happening there.  Basically I think the browser extensions to some extent to my surprise are quite effective.  As said, I would go with Ublock.  Disconnect is also very nice and Privacy Badger.  These three applications come all with an open source license, which is really nice.  And then finally, I talked about this usable Privacy Box project I'm working on, but the  goal is really to make the whole thing zero config.  So you don't have to install the browser extension on every browser you use.  You don't have to configure it and make sure.  I don't know, you enable blocking in Ghostry and disable the feature where you send statistics  called Ghostrank back to Ghostry, where you don't have to fiddle with Adblock Plus to  disable acceptable ads and so on.  So basically something I could also give to my parents at home and to connect their devices  and they are happy.  And as I said, if you have a spare Raspberry Pi, I really hope you could turn it into a  U-Rubbox and give it a try.  And yeah, the last one is an obvious thing for everyone who ever programmed.  Prototyping is very easy.  Productive setup is hard.  This is not the use of a Privacy Box.  There are so many tutorials.  So if you check out other fruit, they have an onion pie, there's an other fruit, Wi-Fi,  advertising, blocker and so on.  If you want to go from this small how-to to something really, I don't know, more stable  and useful, that's tricky.  But also that's not a surprise, but just to let you know we are working hard on the box.  Yeah, if you want to stay tuned for the public release, this is the Twitter account at use  of a Privacy.  If you don't have the chance to speak with me today, you can always contact me for questions.  Actually there's a typo here, so it should be.org.  Yeah, thank you for listening and hopefully you learn something new and you have some  interesting questions.  Thank you very much, Markus Huber for your talk.  As we are running short on time, please only one or two short questions.  If you have more questions, please meet each other outside of the tent.  I think it's okay for you to meet.  Yeah, sure, sure.  Okay, one or two questions only please.  Just one question.  Do you have tried some combination like NoScript on one of these tools?  There's NoScript and Request policy.  I think it's what most people here at the camp use, but I think it's just not accessible  to the average person.  So the whole thing for me is also a usability idea.  I know most people here are fond of NoScript.  It's effective, but anybody not from the camp would have a hard time using it.  So this is why we didn't include it.  Did this answer your question?  I wondered if you had any advice for publishers who are relying on advertising to fund their  sites.  Obviously the revenue from targeted ads is much higher than revenue from ads that are  just generally broadcast on the internet.  I wondered if you could, if you had any advice for them.  So I didn't really get the question.  The question was about revenue and advertisement.  So advice for publishers, so people who are trying to keep their site running on advertising  revenue.  So it's obviously in their interest to have targeted ads on their website because they  get more revenue than they will.  Yeah, yeah, that's true.  I see a real problem here, especially, I mean, some open source or grass root campaigns  also relying on advertisement to basically fund their projects.  I think one really nice idea is like things like micro payment systems like Flutter or  something where you can directly donate to a website and you just Flutter websites.  But I think it's a very bad idea if you run your website that you enable tracking of people.  For bigger media houses, I'm afraid that once people effectively block advertisement, it's  going to be like movies nowadays, it's going to be news with product placement.  So you're basically reading a news article which is funded by a company and looks like  normal news to you.  So this is with movies and TV, we got rid of all the advertisement.  Now you're watching a movie cluttered with products.  So I think that's for one thing.  But for smaller websites, I would go for crowdfunding, Flutter or get Bitcoin donations, PayPal donations,  something like this, but not rely on advertisement.  So for more questions, please meet Makos outside of the tent because we're running out of time.  Thank you again very, very much Makos Huber.
Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_0_1835.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_1836_2687.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_2688_2783.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_2784_3779.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_3780_4055.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_4056_4103.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_4104_5459.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_5460_8147.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_8148_13355.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_13356_13403.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_13404_14519.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_14520_16523.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_16524_25187.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_25188_25607.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_25608_27311.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_27312_27767.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_27768_29819.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_29820_30119.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_30120_34751.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_34752_34907.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_34908_36131.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_36132_36239.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_36240_36527.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_36528_37655.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_37656_39911.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_39912_40343.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_40344_40679.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_40680_41867.png Markus_Huber__Gotta_Block_em_all_gtK3iCBHMdQ_41868_42525.png