Nowadays people are becoming increasingly aware of the lack of privacy in modern day life, CCTV cameras, electronic commerce and the internet have obvious advantages but at a price. It might not matter to most people that thanks to a store loyalty card, there’s a computer file sitting somewhere which will tell someone exactly what my family’s favorite breakfast cereal is, what brand of beer I drink and indeed how much. Ok not exactly that important or critical but it kinda bugs me.
However the amount of privacy lost by normal offline functions is dwarfed by the intrusions that happen online, here you have virtually no privacy at all. The main problem is the language or protocol that we use to conduct the majority of our browsing, which goes by the name of HTTP (HyperText Transfer Protocol). It is the primary medium for transporting all our web requests and documents, however most people have no idea how it works and why anonymous secure surfing just doesn’t happen using HTTP.
An Overview of HTTP
HTTP is a request/response protocol, basically the client (thats our browser) sends a request to the server (the website) and the server sends back a response. There are no complicated handshakes like you get with many other protocols.
So what’s in this request then, a HTTP Request consists of a method, the target (the URL), an identifier for the version of the protocol and a set of headers. The method actually specifies what really happens – here’s some example methods that are commonly used.
- GET – used to retrieve documents, images and files stored on the web server.
- POST – used to perform form submissions, messages etc into HTML documents
- PUT – this is used to modify existing resources or creating new ones such as uploading a file
- DELETE – used to delete a resource or a file
- HEAD – similar to the GET method except that it returns only attributes of an item not the resource itself
Anonymous Secure Surfing Problem with HTTP
Information Divulged in HTTP Headers
- IP Addresses – the clients (that’s you and me) IP address is included in the headers, unless this is protected or filtered by a proxy server.
- Internal Hostnames – the host names of the client or proxy server is revealed in the header.
- Internal Network structure – there are various headers such as Via and Forwarded which can reveal network topologies.
- Operating Systems – what OS you are running and what version, especially useful information for hackers
- Software/Browser Versions
- Email Addresses
So a quick summary the HTTP headers are going to reveal your IP address, what OS you’re using, the type of browser pretty much at a minimum – and that’s just the headers! Then everything you’re actually requesting and sending is also in clear text – so the web site you’re visiting, the files, pictures or videos you request, information supplied on forms or any other communication. This is the default situation which is why anonymous secure surfing is such a pipe dream when only using HTTP to browse on the internet.