Showing posts with label eff. Show all posts
Showing posts with label eff. Show all posts

Tuesday, September 06, 2022

pde

This past weekend, we lost one of the worlds most noble technologists, Peter Eckersley.  Peter and I regularly collaborated when I was working on HTTPS and privacy at Mozilla, and he worked enthusiastically and tirelessly to hold everyone to a higher standard than even himself.  He was instrumental in many of the EFF's projects like PrivacyBadger, Panopticlick, and HTTPS Everywhere, while he nudged the Mozilla contributors to keep working on privacy and HTTPS; but possibly his biggest contributions were his work on CertBot and LetsEncrypt.


He didn't do this alone.  He was a leader, a technical idealist who captured people who often disagreed with him and channeled their energy to make the web safer.

When you use a web browser, the odds are good that Peter's influence has helped secure the bits you're transferring from a server or to protect you from surveillance.  If you believe information should be free, your data is yours, and everyone should have secure messaging, please consider how you can help empower the everyday person to resist surveillance online.  He fought the good fight but met an adversary that took him away from his work far too early.  He was 43.  I will miss you, pde.

Thursday, July 01, 2010

privacy-preserving videos

It's hard to resist the YouTube hotness -- especially if you feel like blogging about the adorable kittens you just saw on YouTube because all your friends must absolutely see it. Sarcasm aside, there are plenty of reasons to embed videos on a blog or web site, but there's something to consider: the embedded video might be used to track your visitors!

Frankly, any content embedded on your site but hosted by another site can cause privacy concerns. When the content is requested, the user's cookies go along with it. The effect is that not only does YouTube know what site a user is on when viewing the kitten video, but they potentially also know who the viewer is! This means that unless you log out of YouTube regularly, they know all the videos you've viewed and on what sites you saw them.

This isn't breaking news. This stuff has been around for a while, it's just Not Obvious.

So you run a blog or web site and you don't want to aid in YouTube tracking your visitors. What do you do? You have three options in my view:

1. Use YouTube's privacy mode. You can embed videos that suppress sending cookies until the visitor has clicked to watch them. This works by changing URLs for any content automatically loaded by your site from the domain "youtube.com" to "youtube-nocookie.com". This way the cookies (for youtube.com) aren't sent until more content is loaded from youtube.com after the click.

2. Don't trust 'em? Use EFF's MyTube. This does something similar, but the static content is loaded from your own site, then when the visitor clicks on the video, it is loaded from youtube.com and the cookies are sent.

3. Open Video FTW! If possible, host the video yourself (on your own website) and use the <video> tag! More info here. Flash is not the only way to display video on the web! Use open standards!