What is it and why it is dangerous to you?
You decide to check the weather on your computer, and for convenience, you click the new Windows 10 icon in the taskbar.
Your eye is caught by the Microsoft news and articles and before you know it, you’re looking at things that you had no intention of looking at. This could happen from pretty much any web page, as most pages have some adverting because, well, because they can!
Your interest in the weather is a distant memory and suddenly you realise that hours have passed by as you browse health, sex, cars, finance, holidays, or entertainment articles etc.
How did this happen? You never used to follow the adverts.
Websites have long had adverts and you have generally ignored them but now you can’t, because now they look interesting, not because you have changed, but because the content changed, and the articles got more interesting. Why?
Many assume this is a result of Amazon shopping, Google and Bing search history and that damn voice assistant that you know is listening to your every word. It probably isn’t. At least, not just those services.
Click just one of those pages and they start logging your activity and profiling your personality. Over time they build an increasingly accurate picture of your interests. Connected (partner) websites using get to know what you like, even if you have never visited their site, and if they purchase the advertisement placeholders in affiliate sites, they can target you with their product, articles, and propaganda.
Every time you click (or linger too long) on an affiliate site, your actions may be logged without you even knowing it is happening. You are being profiled!
First; A walkthrough of how the evil magic happens.
Harry Potter
I will use a fairly innocuous example: Harry Potter. Imagine you are browsing for something and an advert arises: “Harry Potter actors, then and now?”. Images of a fresh-faced Daniel Radcliffe with his trademark round glasses, wand and Hogwarts uniform appear next to a bestubbled, spiky-haired, 30-year-old man without glasses, and this draws your attention, and you can’t help but feel a pang of nostalgia from when you watched Harry, Ron, and Hermione getting one over on Draco, Snipe and he-who-must-not-be-named. You click the link!
The sites you visit from these types of links are always very short on content with a brief description and one or two relevant images at most per page. But there will be many pages, each accompanied by the inevitable moving buttons (hasting clicking will whisk you away to the target of popup advert that somehow always loads too slowly, despite your blindingly fast broadband connection, pushing the buttons down a few centimetres).
Eventually, you learn the patience of waiting just long enough for the adverts to load and the page to stop jumping around so that you can quickly navigate to page 34 using the NEXT button. It’s like a weird internet game (you want to know what’s on page 34 now don’t you?). Can you even remember the character you were wondering about how they have changed?
Maybe you’ll get bored after a few pages and click some other image.
As soon as you enter the site, you’re asked to accept cookies.
You have seen this prompt a million times thanks to EU cookie directives and now every site has an annoying opt-in to accept cookies and a disclaimer that nobody reads and few understand, so you just click Agree, Next or whatever gets you into the site and off you go; This is where the tracking starts!
The truth is, the tracking probably started months ago on another machine, pc, phone, tv etc. Your current device may just be additional.
For reference: here is the URL of a site that shows the then and now actors in the Harry Potter series.https://<<Removed>>.com/trending/40-harry-potter-stars-who-look-entirely-different-without-their-costumes-sdfsfsd-fdgd
And here is a screenshot from the page for Harry (er, I mean Daniel Radcliffe).
Near the usual PREV and NEXT buttons, we see some adverts for other things that you might like.
Hang on, is that Emma Stone wearing a see-though knitted sweater? We are going to have to investigate that!
Actually, Let’s not. We all know what will happen. This is classic click-bait.
Instead, let’s right-click the image and choose inspect from the context menu, and see where the link goes in the dev tools? (blurred so you don’t get the actual link from me, because I disapprove of this)
(Even the image name doesn’t hide what it is)
Search the internet for “Emma stone 03/06/2021”, and you may find the real image, which looks a bit different.
The thumbnail image comes from the fake news and porn site “cellebrity jihad”, is resized by taboola.com, and takes you to a trash site with more click-bait than you can shake a shiny stick at.
https://<<Removed>>.com/top-10-most-beautiful-women-in-the-worldAppended to this URL was a link tracking id for the referral site (they must get paid too).
Of course, you won’t find the see-through sweater image in the target site; That is only shown in the thumbnail image (that’s the definition of clickbait). The fake wonky boob version of Emma is quite unrealistic when it isn’t a thumbnail.
The target site presents thousands of similar articles, each with multiple pages in the familiar list format and each page containing more clickbait and adverts, to keep viewers totally hooked.
Basically, it’s just a horde of lists, from the sublime to the ridiculous.
- Top n most x in the world
- n ways to do x with y
- Photos taken in supermarket/airport/beach etc.
- n Cancer Symptoms You Are Most Likely to Ignore
- Top n Reasons Why Cats Follow Us to The Bathroom
- n HARD TRUTHS YOU HAVE TO ACCEPT TO BE SUCCESSFUL
- Take This Each Morning & Flush Away Belly Fat
The more you scroll on the page, the more articles you see. The site uses an infinite-scroll technique whereby an AJAX script detects when you are near the bottom of the page and fetches more content from the server which is appended seamlessly, providing an infinite page of adverts/articles.
The site eventually includes a disclaimer, stating its information “is not intended or implied to be a substitute for professional health, nutrition, or diet advice”. Really? Due to the infinite scroll, you’ll be hard-pressed to find this text though.
If you don’t scroll, parts of the page will auto-update anyway to change the currently displayed content (that you obviously aren’t interested in because you haven’t clicked anything yet), with new content that they hope you are interested in. Anything to get you to click!
- When you click, your interest is logged, and your profile is updated.
- When you don’t click, your lack of interest is logged, and your profile is updated.
Back-end server algorithms identify articles that do and don’t work for you by logging everything against your anonymous tracking id.
Er, tracking id what?
This is how their artificial intelligence (AI) profiles you. Your name is “46281832-ea6c-448e-86b4-2e40ea101fbc” (or similar). This is a GUID (globally unique identifier) that uniquely defines you as a visitor. When you ignored all of the cookie warnings (of course you did), a cookie was created in your browser cache containing this id. That is probably all it contains, nothing suspect, just something that the website can identify you by the next time you visit their page or an affiliate (of which there may be thousands). The browser doesn’t need to store anything about you because you agreed to the cookie policy. All it needs to do is link your hardware and browser to the data it stores in the server.
Now, every time you visit any page affiliated with this system, they will read the cookie, identify you, and continue to profile you and your interests. Do you keep clicking the beautiful women, the fast cars, the fitness tips, or the health and ailments etc? They know.
The hope is that once you are on the site, you will just click and click until it is time to go to bed. Then do it again tomorrow, next week etc.
Every page you click will show adverts and every advert displayed will earn them money. Very little per advert (actually, very little per thousand of page impressions) but if thousands of people click multiple times per day… you do the math.
They also hope that you will click on some of the many adverts too, as that’s also a money-spinner!
Who cares?
So they have some id that proves a random somebody clicked a few (dirty) images right? Why would you care?
Did you read that cookie policy? I thought not.
You were warned
You were given a choice (sort of) and you chose to accept the cookies didn’t you?
If it was a simple YES or NO without consequence then everybody would say no, but then the site wouldn’t work properly, but you weren’t given a YES / NO, you were given a YES or something vague. And who are these partners? Do you feel that your privacy is valued, or don’t you care?
These options are designed to make you just accept everything because you know… TLDR;?
You have to accept the cookies before you even know what the site is about and whether or not you can trust it.
What did you sign up for?
Instead of YES. CONTINUE, let’s try HELL NO! (aka: More Options)
First up we see tracking geolocation. You don’t want people knowing where you live, so keep this off.
Hang on; Why is that scroll bar slider so short? (A short scroll control means a large scroll area)
That’s the small print! This is the bit where that EU cookie directive states that a site must display all parties (partners) that have access to the data, and what the data can be used for etc. Companies design these to be small and hard to use, and they appear on first-entry only, in a small scrollable window with loads of text displaying just a few lines at a time. how do you change your settings if you aren’t happy with your choice?
For this website, there were 259 affiliated partners that can access the data stored about you.
Let’s have a quick look at some other bits you probably missed.
“Technically deliver ads or content: Your device can receive and send information that allows you to see and interact with ads and content.”
“Match and combine offline data sources: Data from offline data sources can be combined with your online activity in support of one or more purposes”
“Link different devices: Different devices can be determined as belonging to you or your household in support of one or more of purposes.”
“Receive and use automatically-sent device characteristics for identification: Your device might be distinguished from other devices based on information it automatically sends, such as IP address or browser type.”
“Vendors can: Create an identifier using data collected automatically from a device for specific characteristics, e.g. IP address, user-agent string. Use such an identifier to attempt to re-identify a device.”
This last point is particularly interesting in that it highlights that even if you delete the cookies, your IP address (web address of your broadband router) or browser id may still be logged and used to identify you.
Still don’t know why you would care?
Do you ever think that someone has hacked your phone, listened through the microphones, tracked your activity? Did you blame Amazon, Google and Facebook when you’re thinking about something and then see ads for it, even though you haven’t specifically looked for it on your hardware? This is machine learning (part of AI).
In this example, with a single click on entering an unknown site, you have granted permission to 259 potentially suspicious companies to identify you and your interests as a collective. Remember that you have not signed into this companies website. Every time you return they will identify you based on cookie and/or IP address. This is not an isolated instance. Loads of websites do this.
Will any of these companies that you have never heard of, and never contacted you before, start spamming you or pushing their products onto your Facebook, Amazon, Google, general browsing sites?
If a website knows anything additional information about you, name, gender, location, job, friend list, email address, income, or possibly sensitive, do you want them to also gain access to this tracking profile and how it categorised you?
If the categorisation is based on a shared pc, IP address etc., does this reflect you in the way you would like?
How have you been categorised? Is it a correct assessment of your personality, traits and beliefs? You haven’t logged in; whatever they have decided about you cannot be altered.
When you search for something on the internet and cannot find the results you want but just keep getting the same shit as last time you looked, but your mate gets different, possibly better results, do you know what that is? Profiling.
The targeted advertising and articles issue raised by the Facebook Cambridge Analytica scandal is a direct result of this problem of shared tracking. People were manipulated by marketeers, governments and large corporations.
- What will they do with the data?
- Will they sell your information?
- Will any of them identify you and join the dots. Will they sell that too?
- Who will they sell it to?
That’s none of your business, apparently.
Protection
Apart from not visiting these sites and never succumbing to click-bait, the best protection to regularly clean the cache and relevant cookies, however, there are some sites we want to retain cookies on so clearing everything and faffing with cookie deletion site-by-site is a pain.
I suggest a good firewall, anti-virus and cleaner is a good start. At least this way, some malicious tracking cookies will be prevented. I use McAfee Small Business – PC Security suite, but it isn’t the best and there are plenty to choose from.
McAfee blocked some suspicious activity from the site mentioned in this article. This site appears to be linked on many other sites. I got to it from Windows 10 system tray!
Please note: The websites mentioned in this article are just a few of many such websites, and as such, this article is not intended as a slur on them or any specific individual or organisation, but purely to provide an informational article to educate in the safe use of the internet and assist with the understanding of how tracking cookies work and the dangers of not managing your own privacy.
Data Engineering by David Bridge 