NSA tracks Google ads to find Tor users

Suppose Alfred hosts a Tor onion describing relativistic physics.

Suppose Bob cautiously uses Tor to consult such information on a regular basis.

Then depending on priviliged access or leverage on the internet backbone multiple approaches can be used:

A) suppose some regions randomly suffer internet or power black-outs. Obviously a Tor onion interacting with the Tor network is not in that region. While a Tor onion disconnected for the duration of such an event is possibly/probably in one of such regions. Similar for tor Browsers.

B) instead of waiting for spontaneous events they can be elicited (costly in case of internet blackouts, very costly in case of energy blackouts).

C) instead of disabling participation, one can randomly stall it: if ISP's at both ends co-operate or are compromised, network packets can be intentionally given known pseudorandom delays on top of the spontaneous delays. By calculating the correlation of the delays one can identify which Tor user IP address is frequenting which Tor onion host IP address. This works even if the added delays are smaller than the spontaneous delays, because the spontaneous delays are uncorrelated with the injected delays so the "correlation" of the spontaneous delays with the injected delays will average towards 0, whereas the correlation factor of injected delays will correlate with the injected delays. The number of packets necessary to have true positives raise above the noise floor depends on the relative sizes of the spontaneous variation in delays and the injected delays. If the injection delays are smaller it will take many more packets before true positives rise above the noise floor.

This article is from the time of the Snowden leaks, more than 10 years ago.

The moment they have correlated the traffic on your ISP's end, with the traffic on the specific Tor onion's ISP's end, they can just ask your ISP for your true name.

In this case the experts were convinced cookies were used, which is conceivably correct for a fraction of the users. The cookies and ads were probably multifunctionally abused: tracking random browsing, spam email for lucky hits, propagation delay injection of the advertisement packets, ...

they target politicians, whistleblowers and journalists.

if you ever volunteered to organizations helping those you quickly Learn that group is not very tech literate, have cheap limited devices, skips instructions.

You don’t have to login to be given a cookie that’s then stored and tracked across each new IP that Tor cycles through.

Google has programs where they can identify budding extremists and correlate behavior to medical diagnoses without HIPAA exposure.

If your secret weird shit that you’re doing with Tor is of interest, they’ll eventually get a profile. Using Tor is like setting off the bat signal.

about:preferences -> Privacy & Security -> Cookies and Site Data -> [x] Delete cookies and site data when Firefox is closed -> Manage Exceptions

Just don't forget to back up your `~/.mozilla/firefox/*.default-release/cookies.sqlite*` beforehand.

Ads can, in theory, serve a useful purpose, informing individuals of products and services which would legitimately make their lives better (e.g., I bought a low-end immersion blender a year or two ago, didn't know they existed too far beforehand, and am quite happy with the ease/safety improvements over any other blending strategy I used to have, especially for bulk and/or hot liquids, especially compared to what I paid and how much space it takes, but without _some_ kind of ad I might never have known about the product (not a perfect example, since I learned about them from a friend, but hypothetically)).

The push-based ad ecosystem has a tacit assumption that people don't want the products and services being sold. That's a mostly true assumption, but instead of the solution being filtering to better products, well-vetted products, avoiding added-cost-without-added-benefit lookalike products, not advertising outright frauds, ..., the industry has opted for more invasive ways of forcing us to watch things we won't ever care about and siphoning invasive tax/healthcare/... information to slightly reduce the miss-rate in ad serving.

That's probably inevitable without regulation (it's cheaper to bully people into watching ads than to improve your ad inventory, with the side benefit that as an ad network you profit when suckers fall for the frauds too, plus it's easier to charge the company making money instead of the end consumer, so a profit-focused company will naturally swim that direction). As an alternative business model though, imagine great search tools on top of a pool of better ad inventory, where you could choose the demographic info and interests you wanted to be considered for a particular search session instead of having that inferred from your browsing history and the raw copies of your paystubs your employer is likely selling.

If it ends the "brainwashing" it would be because people would not be on the Internet at all. And maybe that's a net good for the world. But here are you and me, on a web site that is itself basically an advertisement for a VC firm.

Artists must get paid, or they will either starve or stop making art.

This is the fundamental threat we have structured our entire civilization around. Art must be labor. Labor must have monetary value. Without income, people must starve and die.

To support this system, we have the most untenable law of the digital age: copyright. The most trivial act, to copy data, shall be monopolized.

But copyright didn't stop there. It grew. We use it to censor. We use it to moderate. We use it to end fraud. We use it to prevent libel. We use it to guarantee collaboration of work. Copyright has become the swiss army knife of law.

When a dull knife slips, it cuts deep.