Online Disguises From Prying Eyes
New software helps keep Internet activities private Dan Fost, Chronicle
Staff Writer
Thursday, September 23, 1999
1999 San Francisco Chronicle
URL:
http://www.sfgate.com/cgi-bin/article.cgi?Þle=/chronicle/archive/1999/09/23/BU10
123.DTL&type=tech_article
The Internet is watching your every move. Web sites pelt your browser with
``cookie'' Þles that store information about you. You've told total
strangers your name, address, age, income and marital status, all for free
e-mail accounts and contests. No less an authority than Scott McNealy,
chief executive of Sun Microsystems, said this year: ``You have zero
privacy anyway. Get over it.''
You don't have to get over it. You can get around it.
Several software products, some free, let people disguise their identities online so they can surf without giving up their personal data. These products help consumers delete privacy-invading cookies and serve up bogus identities to Web sites that are avid to know all about them.
``For the Þrst time, you can feel like you're online and don't have a
camera over your shoulder,'' said Dov Smith, spokesman for Zero-Knowledge
Systems, a Canadian software Þrm with privacy protection software being
prepared for release.
The new products work in different ways. Some let people surf by using servers at remote locations as intermediaries, scrambling the user's true identity. Others put encrypting software onto the users' computers.
The new tools are called ``privacy enhancers,'' said Jason Catlett, president of Junkbusters Corp., a New Jersey consulting Þrm that makes one of the free software products.
The products are necessary, advocates say, because of the way people freely shed their privacy online.
``The Internet has developed as an intimate medium, more than the U.S. mail
or the telephone,'' said Robert Ellis Smith, publisher of Privacy Journal
in Providence, R.I. ``They communicate with the screen and think it's an
opportunity to exchange sensitive information without repercussions. They
think the (information) will be protected. People are shocked to discover
it isn't.''
People may post a question or comment to an Internet newsgroup, unaware that this ``tentative, unedited thought . . . will be archived and can be retrieved,'' Smith said.
As Zero-Knowledge's Smith puts it: ``If you're 14 years old and you post to a newsgroup, `My parents just put me on Prozac because I'm depressed,' that comment is there, and any moderately Internet-savvy future employer or insurer or date can go to the site and get the statement. And that's just the tip of the iceberg.''
Smith of Privacy Journal said the Internet has even made window- shopping something that can be tracked. ``Never before has it been possible to keep a log of when you handle the merchandise,'' he said. ``All of that can be recorded and exploited later to reach you in your home.''
That's where privacy enhancing software comes in. The leading examples of this new breed are:
-Web Incognito from Privada (www.privada.net): For $5 a month, this software from San Jose's Privada compartmentalizes and encrypts various information so that no one can make a connection between a Web identity - the name, password and personal data you give to Web sites - and a real-world identity. Cookies - the Þles that Web sites store on your hard drive to track your movements and remember your passwords - are stored on Privada servers.
-Anonymizer (www.anonymizer.com): Anonymizer, a company based in La Mesa (San Diego County), offers a free eponymous product and a beefed-up version for $14.99 per three months. Anonymizer is entirely Web-based, meaning there's no software to download; users surf to sites through the Anonymizer site, which masks their identity and deþects any cookies.
-Freedom, from Zero-Knowledge Systems (www.zeroknowledge.com): Zero-Knowledge is a Canadian company whose þagship product is still in beta-testing mode, with a $49.95 version due out next month. Freedom is software that sits on the user's computer and sets up a pseudonym for Web surÞng, e-mail, newsgroup posting, Þle downloading and many other online activities. Zero- Knowledge also supplies encryption software for Freedom users to many small to midsize Internet service providers, for extra security.
-Junkbuster (www.junkbusters.com): Junkbuster software sits on a user's computer, and works between the browser and the Internet, throwing out cookies and other information that the user doesn't want revealed.
Many of these Þrms also maintain comprehensive Web sites referring users to other products, resource guides, more Web sites and books on privacy protection.
Lumeria, a Berkeley company, has a similar product in the works. Lumeria's Super ProÞle will be an ``infomediary,'' which lets users selectively sell information about themselves to marketers and guard their privacy at the same time.
Fred Davis, Lumeria's CEO, said Super ProÞle will let users decide which cookies to keep in a ``cookie jar,'' and it will give a fake IP address and fake information about surÞng habits to Web sites that try to place unwanted cookies. Davis called the tactic ``Cookie Doe,'' and he likened it to ``a bulimic agent that tosses its cookies.''
Privacy protection software is not yet big business. Junkbusters Corp. gives the software away, which helps promote the company's consulting business. Privada and Zero-Knowledge want to make money by selling their products, but the software is still in beta and not yet commercially available for downloading. (Privada is for sale on CD only, with the download coming soon.) Even so, Privada CEO Barbara Bellissimo reports 70,000 visitors to her site in the Þrst month.
Anonymizer CEO Lance Cottrell hopes that by giving away a limited version of his product, users will want to buy a more comprehensive version. He said 100,000 people use the free version of his product, while less than 10,000 people have bought the enhanced version.
``That's a tiny, tiny fraction of the potential market size,'' Cottrell
said. ``People are just becoming aware of these issues.''
Each time a security þaw is exposed in Microsoft software, he said, or Amazon.com reveals what employees at various companies are buying, people's awareness of the power of online data collection grows.
``People want to control their personal information on the Web,'' said
Privada's Bellissimo. ``There's a segment of people on the Internet who
don't know what can be obtained without their knowledge, but there's a huge
segment that aren't even on the Internet because of their fear of losing
their privacy.''
The Center for Democracy and Technology, a Washington, D.C., organization
that advocates for civil liberties in the digital age, maintains a Web site
that offers a glimpse of the kinds of information Web sites can gather on
surfers. Click on the word ``You'' at snoop.cdt.org, and you'll see your IP
address (which could give a potential hacker a head- start on Þnding out
who you are and what you're doing online), the type of browser and
operating system you're using, and other information such as your Internet
``host'' and your e-mail address.
Often, people simply give away information about themselves, unaware that it can be combined with this other technical data to form a powerful market research tool.
Of course, if you sign up for one of the privacy enhancement services, you have to trust that company.
Privada said it can't tell who's doing what using its service, but it does know who has signed up. If a law enforcement agency brings a subpoena, Privada can install a ``monitor'' so it could track a user's activity.
Zero-Knowledge's Smith said his company's name speaks to its commitment to users: ``We don't know anything about you, and we never want to.''
More than mere technology, protection of privacy will also require government's passing new laws, as well as self-regulation by Internet companies and users.
``No single technology can solve all the problems,'' said Ari Schwartz, a
policy analyst at the Center for Democracy and Technology. ``And on a
global medium like the Internet, no technological solution can work on its
own without some sort of policy.''
TURNING DOWN COOKIES, CREATING PHONY IDENTITIES
People concerned about online privacy can take matters into their own hands.
Fred Davis, CEO of Lumeria, offered some tips for protecting privacy online.
You can go into your browser's preferences Þle and turn off cookies, but you soon will discover just how many sites require that you accept a cookie. Plus, privacy advocates note, there are cookies that users want to accept, such as those that remember a password and save users the trouble of retyping it each time they visit a site.
Davis recommends that you never give your true identity when signing up for something online. If you're an old man in Northern California, perhaps you want to sign up as a young woman in Seattle. (But be careful: I gave a bogus ZIP code when I signed up for a free Internet fax service and wound up with a number in the wrong area code. When I tried to sign up again, the service wouldn't let me - it had placed a cookie on my browser and knew I was back for more.)
Another way to mask your identity is to set up free e-mail accounts, like those available at a portal site (such as Yahoo or Excite) or at Hotmail, and use them in identifying yourself around the Web.
``The public is concerned, and yet they still go around the Net and Þll out
the correct information on forms,'' Davis said, shaking his head in
disbelief. ``People are honest.''
PRIVACY RESOURCES
A number of Web sites offer extensive information about privacy online, including:
PROTECTING YOUR PRIVACY
New privacy protection services prevent data - such as a user's e-mail address - from being transmitted to Web sites. How they work:
Source: New York Times News Service
Todd Trumbull / The Chronicle
1999 San Francisco Chronicle Page B1