Visible Information:
Data Involuntarily Divulged
When You Use The Internet

When you visit a website, there is some information that is automatically divulged which you have little-to-no control over.  I'll try to explain here the most personal aspects of that information.

Your User Agent String

Your web browser automatically identifies itself and its operating system to websites by sending a user agent string^[1].  This information isn't particularly personal, but it can be used to serve content more appropriate for your system, or to annoy you with messages like, “We see that you're using a mobile device; download our mono-tab web browser that only shows our website!”

Your current browser's user agent string is “claudebot.”  My simple detection algorithm thinks you're browsing with Unknown vt, and your operating system is laudebot.  You are not using a mobile device.

You can change the user agent string that your browser sends to servers, and there are legitimate reasons to, like when my sister-in-law's husband had to make his web browser pretend to be running on a Linux machine because of the way he was connecting his Windows PC to the internet through his smartphone.  Be aware however that doing so can break websites which put too much weight on your user agent string.

Asynchronous JavaScript Communication

A JavaScript-enabled webpage can constantly communicate asynchronously with a server and share data without the page ever reloading^[2].  Thankfully, proper up-to-date browsers have good enough security that the amount of data available to this action is limited (as long as you don't install any malicious or exploitable plug-ins^[3]).

Here is some of the information that this page can gather right now via javascript:

There's a bit more than that, but those are the most “exciting” parts.  (If you want to see what else this simple javascript query reveals, pull up your browser's command console, typically by pressing Ctrl+Shift+I, then enter “console.log(navigator);”.)  Each piece by itself is quite innocuous, but taken as a whole, and combined with performance measurements, namely via the HTML5 canvas element, it can actually be used to compile an identifiable profile for tracking^[4].

Anything you type into a webpage could be captured and sent to the server without your consent, but without the right kind of plug-in, a web page can't capture keystrokes entered outside of the browser page or snoop through your computer^[5].

Your IP Address

One of the most important pieces of information automatically shared by your computer is your public IP address^[6].  This is the internet address to your modem^[7] (the device that connects your computer or LAN^[8] to the internet).  Depending on your ISP^[9], it may or may not be your static IP address^[10], hence some of the debate about whether IP addresses are personally identifiable.  Static IP addresses don't change so long as the ISP doesn't change and the user doesn't move to a different location.  In any case, ISPs usually keep a record of which IP address was assigned to which customer at which time, for billing purposes if nothing else, and may even log every request you make.  (So-called “private browsing” is no defense against this because your browser still has to tell websites where to send data.)

Your current public IP address is 18.221.146.223.  Using a third-party service, I can automatically figure out the physical location of your ISP, which in most cases is the same city as your current location, usually near where you live, which explains why so many websites display those annoying adverts to “meet single people in [your city's name].”  (If you engage in any legally-punishable activity on-line, law enforcement can use a website's access logs to trace your IP address to your ISP, then demand from your ISP your home address.)

Here's what I learned about you from just your public IP address:  Your ISP is Amazon.com, Inc., which is located in Dublin, Ohio, United States 43017, in Time Zone America/New_York.  Here's a map using the latitude and longitude I got from looking up your IP address:

The above might not be 100% accurate; this method placed my ISP location in an alfalfa field the last time I checked, but it wasn't too far off.

There are ways to obscure your IP address.  One is to fake it, but that won't serve any legitimate purpose because an IP address is like a return address on an envelope in the mail; if the address is wrong, the requested information will never get back to you.

Another way to avoid identification is to use a VPN^[11].  In a VPN, you connect to a chain of one or more computers that relay your requests to a website so that it sees only the IP address of the last computer in the chain instead of yours.  Data sent through a VPN are also expected to be well encrypted.

VPNs aren't quite what they should be, however.  You can pay a lot of money for a service but not receive the level of security and privacy you expect^[12].  If you don't want to put your trust in the corporations, you could use a free, open-source VPN like TOR, but, nevermind that you're putting your trust in a bunch of strangers, it has been shown to be vulnerable to goverment hacking^[13].  Not only that, but in violation of The Fourth Amendment, anybody that uses a VPN is considered a criminal by the FBI and subject to being “remotely investigated^[14],” because “only criminals have anything to hide” (just like anybody who closes his drapes or locks his door at night absolutely must be engaging in criminal activity^[15]).

You can put one more step of obfuscation between yourself and any websites you access by using a public Wi-Fi connection, but that's still not guarenteed to hide your identity; the elusive founder of the “Silk Road,” an on-line black market, was arrested while using a public library's Wi-Fi^[16].

“But I don't engage in any illegal activity on-line; I just want my privacy and security when I read e-mail or look at my bank account, so I should be alright with a good VPN, right?”  Well, you probably won't go to prison for that, but as mentioned above, the very act of hiding your digital activity with encryption is considered a criminal act by law enforcement agencies who will feel justified to violate your rights to privacy should you do anything else to get their attention^[17].

No matter how good your personal digital barriers against prying eyes may be, any website administrator can be bullied into providing a government agency with user records or even building in a backdoor^[18][19], regardless of legality or ethical implication^[20], because the alternative is a wrongful arrest for failure to comply^[21] and/or a lengthy, uphill legal battle which can easily result in the loss of one's livelihood.

Ultimately, whether or not using a VPN is worthwhile depends on the balance between risk and value.  There are legitimate uses for VPNs, such as getting around region obstruction so that you can watch a show that Netflix won't stream to your country due to distribution licensing^[22][23], or reporting on corruption in the face of a totalitarian regime.

Your GPS-Enabled Device

If you're using a GPS-enabled^[24] device, a website can get the global coordinates of your current location, but this action requires your explicit permission (nevermind what your operating system does^[25]).  However, if you upload a photo that you just took, and your device is configured to embed GPS coordinates into the photo, there's nothing to stop the website from extracting that information from the photo^[26].

Data About You Stored Here

The House of Waffles only records the following data about you:

That's some extremely rudimentary data and not very useful on a commercial level.  No third-party tracking software like Google Analytics is used here.