4 Ways Your Browser Leaks Personal Information

the browser can easily become be a leaky faucet when it comes to identifying personal details that could then be exploited by attackers for financial gain. Here’s how your browser might be compromising your privacy and what you can do about it.

1. Avoid sites that don’t use the HTTPS protocol

Heading to a website that doesn’t have the “https” prefix means anything you do there is unencrypted. This includes what you click as well as what you type — it’s all visible to any eavesdropper. While that shouldn't be a concern for public content sites where you are simply reading information, it should be a big concern on any site where you are entering personal information such as login credentials, social security numbers or any other information you would not want snoopers to see.

Some websites may include the https prefix on their home page, then default to the unencrypted “http” on other pages. Things get especially dicey when you’re at a site where you need to log in with a password or input payment details.

Chrome, Edge, Safari and Firefox all flag sites as Secure with a locked box if they are fully encrypted or Not Secure if they’re unencrypted. The alert appears on the left of the URL box.

What to do

Check that page URLs are prefixed with “https” before entering any log-in or payment information.

Download the HTTPS Everywhere extension for Firefox, Chrome, and Edge (Edge now runs Chrome extensions) which automatically encrypts your browser’s communications with major websites if it finds faulty HTTPS links.

2. Minimize the use of plug-ins and extensions

The web is rife with downloadable software designed to give your browser additional powers. These include extensions that show you whether reviews are fake and golden oldies Adobe Flash and Java, which allow your browser to play animated content.

Unfortunately, these plug-ins can be riddled with vulnerabilities that hackers may exploit for a land grab at your personal info. And when developers fail to update their plug-ins and extensions, people who use them can become targets.

Simply having plug-ins and extensions installed makes your browser vulnerable to attacks, even if a site doesn’t require the plug-in or extension to be used.

What to do

Head into your browser settings to see what plug-ins and extensions you have downloaded, and disable those you infrequently or never use.

You might consider disabling Adobe Flash and Java, since many sites no longer use these plug-ins. If you receive too many messages that you need to run these plug-ins, invest in a script-blocker extension such as NoScript (Firefox) or ScriptSafe (Chrome and Edge). These stop all Flash and Java by default, with options to build a whitelist of trusted sites that need these plug-ins.

3. Dodge browser fingerprinting

Websites often query your browser for data such as location, screen size or browser version, so they’re able to load the web pages correctly. However, plug-ins like Adobe Flash and Java also happen to relay a lot more information, including the hardware you’ve installed, the plug-ins installed and, most tellingly, the exact lineup of fonts you have on your computer. This list combines to make a “fingerprint” that’s overwhelmingly unique to your browser, making it highly trackable even if you’ve disabled trackers.

See how unique your browser is at Panopticlick, a browser tester set up by the Electronic Frontier Foundation. The site will tell you how unique your fingerprint is and provide all of the geeky details, if you’re interested.

What to do

There’s not a lot you can do about browser fingerprinting. In theory, protection from fingerprinting involves a device with the same settings and programs as the most other people. For example, an iPhone would offer better protection than an Android because it has less ability to be customized and made unique; a Chrome user would be less unique than, say, a Linux user.

Chrome and Firefox users could try extensions that randomize what data is reported by the browser, because presenting a different fingerprint every time makes tracking impossible. Chameleon (Firefox) and Random User Agent (Chrome and Edge) have decent reviews at their respective app stores.

4. Prevent phishing attacks on browser autofill

Your browser’s autofill function exists to make it easier and faster to fill in forms that ask for the same tedious information—your name, address and date of birth. The convenience of saving such information often outweighs any concerns over the security chops of a browser.

However, in the past, browsers have been tricked into revealing saved personal information without the user realizing it. This phishing attack would occur via hidden text boxes coded into a malicious site, alongside a couple of visible requests for innocuous information like your name and email address — say, a pretense at getting a discount offer. When you type in the info, the autofill feature ends up adding other information saved to the browser autofill, which could include enough details to enable credit card fraud.

What to do

Avoid typing in any personal information on websites you’re not sure about. Delete credit card information from your browser, or turn off the autofill feature entirely. Here’s how.

Chrome: Settings > Payment methods to remove credit card information and Settings > Addresses and more to remove your address.

Edge: Settings > Profiles > Payment info to remove credit card information and Settings > Profiles > Addresses and more to remove you address.

Safari: Preferences > AutoFill. Manage what information is autofilled and delete or edit what’s saved.

Firefox: Options > Privacy & Security > Forms and Autofill. Click in the box to remove the check mark.

Source: Techlicious.com