Questions About Internet Privacy 8/27/00  revised 9/7/01
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ 
(*** is Karl's 2 Cents, Please Use Your Common Sense, Also ***) 
Q. Hey! I installed Zone Alarm, but my browser is still accepting cookies? What kind of crappy software is this?
A. Zone Alarm is not a cookie blocker. Your browser has this capability if you'll just configure it. Read on for all the gory details. 
Q. OK, my computer is locked down like Ft. Knox, I can surf the net all fat, dumb, and happy again, right?
A. Well that depends on your level of comfort. 
Q. Uh, oh. What do you mean?
A. Consider this. You're walking though the mall, when you notice some scrawny little short guy dressed in all black following you around with a notepad. He's writing down every ad that you look at and whether you appear to like it or not. He's noting every store you visit, the kinds of clothes you try on, and what you buy. After a little while, you notice him pull out a walkie-talkie and start talking to someone on it. Later on, you see these guys changing the ads as you approach, in an attempt to show you ads related to the things you've been trying on. Freaked by all this, you go home. Later that night, the phone rings and someone is trying to sell you stuff similar to what you were looking at in the stores. "How did you get my number?" you demand. "I got it from the little black troll--DoubleClick's his name. He followed you around to see what you like and he got your number from your credit card company--you know, the card you used at Victoria's Secret, where you bought that red underwear?" 
Q. Whoa, that's freaky. I'd call the cops if that ever happened to me.
A. It's happening right now! 
Q. How'd you know what color my undies are? You pervert!
A. No, not that. You see, you're being followed all over the web by that little DoubleClick guy and others like him. They're keeping track of everything you do--every site you visit, every ad you see (especially the ones you click on), and everything you buy. And as soon as you buy something--boom! They've linked your name, address, and telephone number with their big bad profile of everything you like. Shouldn't be long before that creepy guy starts calling you. 
Q. Egads! How do I stop them?
A. One way is to destroy their ability to track you across the net. They do this with cookies. 
Q. Hah! I don't eat cookies while surfing the net, so they can't be following the crumbs!
A. No, not that kind of cookies. These are little files that they put on your computer, and these files rat out your identity every time you visit a site that checks for them. 
Q. The little bastards! Why would I want cookies at all?
A. Some cookies are good. You can customize your pages to suit your needs at some sites. When you return, the cookie identifies you and your customized page is served up. Some sites use a more benign form of preference tracking too. Like Amazon.com <http://www.amazon.com/> tracks the things you look at and buy, and uses that to make recommendations of things you might like. 
Q. That's kinda cool, I think.
A. Yeah, until your wife logs on and sees that Amazon is suggesting she buy the new Playboy home video. Busted! 
Q. How did you know about that?
A. It's happened to everybody. 
Q. Well how can I kill off the bad cookies but retain the useful ones?
A. This is what I've done. I'll explain how to do it in Internet Explorer 5.01, since that's the browser I use. First you have to identify the bad guys. 
Q. How do I do that?
A. Go into IE and select Tools | Internet Options... Under Temporary Internet Files, click Settings... In the box that pops up, look at Current location, and write this down. Click Cancel. Click Delete Files... Click OK. Click OK again. Now open up Windows Explorer and navigate yourself on over to that directory with all them Temporary Internet Files in it. 
Q. How do I do that?
A. Look this isn't a Windows tutorial. Some stuff you'll have to learn on your own. After you get there, you should pretty much have just cookies in it because you deleted everything else, remember? 
Q. How can I tell what's a cookie?
A. It'll have the little text document icon next to it and will start with the word "Cookie." Easy enough? Now you're going to go through these one by one and do one of three things with each one. 
Q. What's that?
A. If it's a site you trust, that you use often, and that you want to be able to identify you and personalize content for you, leave the cookie alone. Write down the name of the domain, though, on a piece of paper labeled "Trusted Sites." (The domain is just a general area owned by the site. For example, if you have a cookie from "www.amazon.com," just write down "*.amazon.com"--the "*" is a wildcard character and means literally anything ending in amazon.com.) 
Q. What's the next category?
A. The next category is what I call nuisance cookies. You don't really recognize the site, or use it often, but somehow it's put a cookie on your machine anyway. If you can't link it to advertising or web statistics or something evil, it's just a nuisance cookie. Just delete these. Right-click on the cookie and choose Delete. Confirm that you want to delete the cookie. You don't need to write anything down. 
Q. OK, and the third category must be the bad stuff, right?
A. Correctamundo. Anything you can link to an ad company or something that tracks your movements across the web goes in this category. Write the domain name down on another piece of paper labeled "Restricted Sites" and delete these cookies like there's no tomorrow. These are the little guys that have been following you around the web. You've just cut them off. 
Q. That's great, but won't they come right back, like some kind of electronic plague?
A. That's where the next step comes in. Open up Internet Explorer and go back to Tools | Internet Options... Click on the Security tab at the top. Click on the little "Do Not Enter" sign that says Restricted Sites. We're going to restrict these anti-social sites because they can't behave. Now click on the Sites... button. Start adding all those domains you copied down on your Restricted Sites list. 
Q. OK, all done, what now?
A. Click OK to close the restricted sites. Click on Trusted Sites and do the same procedure to add all your Trusted Sites in there. 
Q. Where is all this leading?
A. Well, we're classifying sites. What we're gonna do is set it so that IE won't accept any more cookies from the restricted sites. To do that, click on Restricted Sites again. Verify that the security level is set to *HIGH*. If it's not, click Default Level. Now it should *ALMOST* be. 
(*** NOW select *Custom Level*. Click the Settings button. Then go down the list of security items and make sure each one is set to Prompt **at a minimum**) 
(*** For nearly all of them *I recommend the Disable setting* because it's just too easy to absent-mindedly click a warning dialog. ***Be sure*** you get the big three *** DISABLE Java, DISABlE Active Scripting, and DISABLE scripting of signed ActiveX controls ***) 
 Then, go to Trusted Sites and verify that the security level there is set to medium. If not, click on Default Level again. Now move the slider from low to medium. That will allow your Trusted Sites to place cookies on your machine without asking you first. 
Q. What about all the other sites out there that aren't either Trusted or Restricted?
A. Well, that's next. We want to set those sites to be able to set temporary cookies without asking you but force them to ask before putting permanent cookies on your hard drive. We do that by setting the security level to medium in the same way that we set the level for Trusted Sites. Click on the little globe Internet icon. Now, click on Custom Level... Scroll down to the Cookies section and change "Allow cookies that are stored on your computer" from Enable to Prompt. Click OK twice to close all the dialogs. Now all other random internet sites will have to ask before placing cookies on your machine, and you'll have the choice of accepting them or declining them. 
Q. OK, I found a lot of bad cookies on my machine. How does my list compare to yours?
A. Here's my most up-to-date list of bad guys: 
*.adforce.com 	*.adknowledge.com 	
*.admaximize.com 	*.admonitor.net 	
*.adsmart.net 	*.adsoftware.com 	
*.advertising.com 	*.affina.com 	
*.ap-adcenter.net 	*.aureate-im.com 	
*.aureate.com 	*.avenuea.com 	
*.bankads.com 	*.beseen.com 	
*.bfast.com 	*.bnex.com 	
*.burstnet.com 	*.centrport.net 	
*.ads.cimedia.com 	*.click2net.com 	
*.clickagents.com 	*.commission-junction.com 	
*.datais.com 	*.doubleclick.com 	
*.doubleclick.net 	*.engage.com 	
*.engageaudience.net 	*.enliven.com 	
*.eu-adcenter.net 	*.flycast.com 	
*.focalink.com 	*.hitbox.com 	
*.ads.home.net 	*.hyperbanner.net 	
*.imgis.com 	*.link4ads.com 	
*.linkexchange.com 	*.linksynergy.com 	
*.livestat.com 	*.maximumpcads.com 	
*.maximumpcads.net 	*.mediaplex.com 	
*.mediasynergy.com 	*.adserver.monster.com 	
*.narrowcastmedia.com 	*.networkedbanners.com 	
*.ngadcenter.com 	*.preferences.com 	
*.radiate.com 	*.registration-server.com 	
*.sabela.com 	*.targetnet.com 	
*.track-star.com 	*.track4.com 	
*.utopiad.com 	*.valueclick.com 	
*.webconnect.net 	*.webtrends.com 	
*.webtrends.net 	*.webtrendslive.com 	
*.worldbannerexchange.com 	*.ads1.zdnet.com 	
*.ads2.zdnet.com 	*.ads3.zdnet.com 	
*.ads4.zdnet.com 		
Q. Wow! That's a LOT of sites. Do I have to type them all in?
A. Hey! I had to painstakingly scour two years worth of cookies to extract those domains for you. I had to go to their sleazy websites to confirm that they really were ad tracking slimeballs. Then, I had to type each one of them in manually. Not to mention re-typing them here for your reference! However, you could cut-and-paste them, rather than trying to type them all. 
Q. Isn't there an easier way?
A. Actually, because I like you, I'll try to help you out. All of the information regarding your internet zones is stored in the registry. Therefore, in an attempt to save you time, I have exported the applicable entries to a file which you may now import. 
WARNING! - Downloading and merging the following file will make changes to your registry. If this makes you uncomfortable, you may want to reconsider using this method, and type them in manually. Because of the plethora of different OS/browser combinations, neither I nor GRC will be held responsible for any damage that merging this into your registry causes, or any damage you cause yourself by trying to un-do what it does.
This registry file was created by me. I am running Windows 2000 and Internet Explorer 5.01. I have personally tested this registry file on my machine. It's no surprise that it works, since that's where it came from. According to Microsoft Knowledge Base Article Q182569 <http://support.microsoft.com/support/kb/articles/Q182/5/69.ASP>, Internet Explorer 4 and 5 share an identical registry structure for security zone settings. Therefore, I fully expect that this works on machines running Internet Explorer 4.0 or higher. I have now received positive reports from users running all flavors of Windows 9x, NT 4.0, and 2000.
The same Knowledge Base article seems to indicate that IE 3 uses a different registry branch to define its security settings. This means that there is little chance that this technique will do anything useful for those of you running Internet Explorer 3 or earlier (gasp). (You really should update your browser <http://www.microsoft.com/windows/ie/>,  I recommnd IE 5.5  [9/7/01]  BTW!) 
Of course this is useless for Netscape or for operating systems other than Windows (duh) so don't e-mail me to tell me that. 
Finally, let me reiterate: you do this at you own risk. I can see no reason why adding these registry keys would cause you any harm, even if it doesn't work for your combination of Windows and Internet Explorer, but we won't take any heat if it does. 
With that out of the way, you may now download the ***Original Nasties***.
[ *** Found ON Karl’s Tip Page***  Below this Article ]
 Make sure to choose "Save this file to disk" in the dialog that pops up. (Note: You may have to right-click this link and choose "Save Target As..." depending on your settings.)  
Q. What exactly does nasties.reg do?
A. This Registry Settings file will simply add all of the above sites to your Restricted Sites zone in Internet Explorer. It will not change your security settings in any way. Although I could configure those via the nasties.reg file, I have instead left that for you to accomplish manually, for security reasons. This file is simply a time-saver so that you don't have to type in all of the above sites. 
Q. OK, I got it. Now what do I do with it?
A. If you have to ask me that, you might not be ready to utilize this method. However, I know that if I don't tell you, it will just generate a flood of "How do I merge nasties.reg into my registry?" posts, thereby requiring me to include the answer in this FAQ. (You can see the catch 22 coming a mile away, can't you?) First, if you have any sense at all, you're not going to just blindly trust some .reg file you download from somewhere, not even from GRC. So right-click on the file and select Edit. This will allow you to examine it in Notepad. I know you don't understand any of it, so just close Notepad now--at least if your drive gets erased you can tell people you looked at it first. Now right-click on it again and choose Merge. A confirmation may pop up. If it does, confirm that you really want to do this. 
Q. Do I need to reboot now?
A. Amazingly, no. (I know you've been cultured to expect a reboot, so I'll wait right here if you want to do it anyway.) 
Q. OK, now how do I know that it worked?
A. Well open up the Internet Properties Security tab and check the Sites... under Restricted Sites. If you now have all these domains listed, congratulations, it worked. If not, I'm sorry, but I can't support this, so you're going to be stuck typing them in. 
Q. Do you have any other sites in your Restricted Sites list?
A. Yeah, I have some non-ad sites--go.com and wired.com to name two. 
Q. Hey! Those are respectable mainstream domains! Surely they're not evil ad agencies!
A. No, unlike most of these companies their main business is not ad tracking. However, I've found both of them to be just a little too invasive for my personal preference, without providing any kind of beneficial customization. So in my restricted sites list they go. This is my list. If you don't want to restrict them, don't. 
Q. How did you decide to put them in there?
A. I have my Internet Zone configured to prompt for cookies. If I get more than two prompts for cookies from a site I don't want to give a cookie to, that pisses me off. Some sites load as many as 30. Whoever wrote those web pages should be drawn and quartered. 
Q. Is AOL on your Restricted Sites list?
A. You bet. 
Q. Hey! My company, AdBastards.net is listed in your list! I'm gonna sue!
A. Go ahead. 
Q. But we're not an evil ad company! We target consumers with the ads they want to see!
A. Fine. I'd like all mine to be blank. Can you do that? 
Q. Well no.
A. But those are the ads I want to see. 
Q. But...
A. Shut up. You've pissed me off. I'm on to your Orwellian tactics. I won't have it. You're on my list. And soon, you'll be on lots of lists, thanks to this FAQ. Be afraid. Be very afraid. 
Q. But if everyone puts me on their list, we won't be able to target our ads and people will have to start subscribing to see good internet sites which are currently ad-supported.
A. If you hadn't pissed off so many people by invading their privacy, you wouldn't be on our lists. If all you did was show ads and you didn't share our private information with others or track our web surfing, we wouldn't be so mad. 
Q. But we'll change!
A. OK, sure, whatever. You're still on my list. 
Q. What do I have to do to get off your list?
A. You're not getting off my list. You put a stinkin' cookie on my machine and used it to clandestinely track my surfing habits. I'm finished with you. Screw off. 
Q. Wow, you sure are pissed at those guys aren't you?
A. Do you have any idea how long it takes to wade through two years worth of cookies and pluck out the cancerous ones? And then write a FAQ about it? You're damn right I'm pissed. 
Q. OK, well what if we've missed a site?
A. Look through your cookies about once a month. It shouldn't be such a big deal now, because we've cut off the big offenders and forced everyone else to ask us. If you happen to find a cookie that you don't like, delete it and add the domain to your restricted sites list. That simple.   BTW, Microsoft offers something that will make this task easier. Download their Power Tweaks Web Accessories, and you'll find options to quickly add sites to either Restricted or Trusted Sites right in your Tools menu. Kudos to MS for this one: 

Q. Do I have to set up my security zones just like you did?
A. Nope. They're your zones. Set 'em up how you want. 
 
(*** All the Above pertained to ME,   BELOW may Help You? ***) 
 
Q. This is all very cool, but I use Netscape.
A. Don't be embarrassed--I used to use Netscape too, but then Microsoft fixed Internet Explorer so that it didn't suck anymore. At least you're not using a Macintosh. 
Q. What I mean is how do I do this in Netscape?
A. It is my understanding that there is no concept of security zones in Netscape as there is in Internet Explorer, which is one reason (out of many) that I prefer IE. However, to block all cookies using Netscape or Opera, try this suggestion submitted by Chris Heaven: 
Considering many websites deny access if their cookies are not accepted, and that rejecting all cookies is not an acceptable choice for most people, I have a method which allows me to accept no cookies, but indicates to websites that I have. If you rename the cookies.txt file in Netscape to anything but it's original name, this will allow you to create a new directory (folder) in the same location which can be named cookies.txt. In Opera, you would rename the cookies.dat file and then create the new directory with the original name. You can then set the new folder properties to be designated as read-only. 
When a site sends you a cookie, your computer will temporarily accept it, deceiving the website into believing the cookie is serving its purpose. In reality, when your computer discovers it can't write the text of a cookie directly to the folder, the cookie just "floats" off into cyberspace. This practice allows me to access sites without them placing any cookies on my system, and also relieves me of having to manage cookies whatsoever. The inconvenience of having to remember and type my user name and password at the few sites I have to is far outweighed by disposing of the cookie issue. [Speak for yourself on this one, Chris!] 
Please note, I have heard of people cleaning out all of their cookies, then going directly to websites that required them to sign in, accepting the cookies, and then designating the cookies.txt file as read-only, basically eliminating future cookies much the same as the method I previously described, but still providing the convenience of easy sign-in at selected sites. I have tried this several times, but after I reboot, the file properties revert back to their original state and normal cookie acceptance is enabled once again. 
Stan Broski has provided a couple of batch files to automate this process. I suggest you only implement this if you honestly believe you can pull it off without screwing it up, but here it is: 
Inspired by pchelp, I even wrote and tested two micro batch files that allow users to easily change the attributes of the cookies.txt file while in the browser window. 
These batch files should be stored in the Windows folder. I suppose one file with a switch could be written, but it was easier for me to write two files. They can be executed in mid browser session by using the run menu as follows: 
•	Open the run dialog box (Start | Run or hit Windows-R on a 104-key keyboard) 
•	Enter the name of the batch file (the extension ".bat" is not needed) 
This file called cookoff.bat makes the cookie.txt file read only: 
     REM This batch file adds the read only attribute to the
     REM cookies file. Cookies will not be saved.
     @echo off
     cls
     attrib +r "c:\Program Files\Netscape\S-jb\cookies.txt"
     echo Cookies will not be saved
     echo Close DOS Window
This file called cookon.bat makes the cookie.txt file writeable: 
     REM This batch file removes the read only attribute from the
     REM cookies file. Cookies will be saved.
     @echo off
     cls
     attrib -r "c:\Program Files\Netscape\S-jb\cookies.txt"
     echo Cookies will be saved
     echo Close DOS Window
These scripts indicate my particular path entry for the cookies.txt file. Users, of course, will have to substitute their own path and should remember to use quotes if their pathname includes non DOS-friendly pathnames like spaces between words. The final entry in each file is merely a prompt to the user to click on the upper right corner "X" to close the window. 
Bob Anderson contacted me separately with much the same method as Chris, and added the following: 
When you browse the Net, it is not only those sites you visit that drop cookies on your machine. All those ad banners you see and anyone else the site has sold out to can do the same. This is why Netscape has the option "Accept only cookies that get sent back to the originating server." This option limits cookies to those set by the site you're visiting (the "originating server"), and rejects cookies from the other servers which are supplying the ad banners. You want to enable this option. Go to Edit | Preferences | Advanced, and select "Accept only cookies that get sent back to the originating server." 
This is one of the few features of Netscape that I, as an Internet Explorer user, envy. Are you paying attention, Microsoft? 
Q. Wow! That's some good info. Do you know anything else about Netscape?
A. I didn't even know that, but Bob also mentions that some more cool Netscape mojo for advanced users is available at: 
•	Advanced Communicator Preferences
<http://www.inmind.com/people/phrank/commonly/userprefs.html> 
Q. What about the Macintosh?
A. If there's anything I know less about than Netscape, it's Macs. Can't stand 'em. At least I've actually used Netscape personally. I can't even figure out how to eject a floppy disk from a Macintosh! 
Q. You have to drag it into the trash can.
A. Oh, now that's intuitive. You know, where I come from, that would make more sense as a procedure for erasing a disk! Anyway, here's some Mac info from Ross for you poor saps who got suckered in by the translucent fruity beasts: 
I have noticed from time to time that a Mac user will ask for information from the group. On the off chance that one would be smart enough to read a FAQ :) and as I have tried to educate some Mac friends about security, I have compiled a couple of links to related sites. An entry level discussion is available at: 
<http://netsecurity.about.com/compute/netsecurity/msub23.htm> 
For something more technical and Cable/DSL specific, see: 
<http://www.securemac.com/Cmacscable.cfm> 
I usually add the following to the end of my rant after they have told me how secure their OS is and, "besides, hackers only attack Windoze machines": 
This link is to a Mac hacker site. It shows what type of intrusion tools are readily available. Have a look if you are feeling brave :-) 
<http://freaky.staticusers.net/index2.shtml> 
To my knowledge there are no free solutions. A security suite is NetBarrier: 
<http://www.intego.com/NetBarrier/> 
A firewall-only solution is DoorStop: 
<http://www2.opendoor.com/doorstop/DoorStop.html> 
Q. Okay, well I use an older version of Internet Explorer and I can't find the Internet Options.
A. It's in the View menu. 
Q. Hey thanks, but everything's different than you describe.
A. You really should update your browser <http://www.microsoft.com/windows/ie/>. It's free, you know. 
Q. I can't--I use AOL.
A. I'm sorry. I've already talked about AOL. Either you've taken my advice or you haven't. 
Q. What about ICQ? I've heard it's pretty un-safe.
A. Yeah. That's probably why AOL recently acquired them--fit their corporate image like a glove. Here's the answer I posted to that question recently: 
Well there used to be a great "list from the dark side" at http://www.fatalz.com/icq.html. It had links to a bunch of programs useful for hacking into ICQ. Unfortunately, it appears to have been yanked, which prompts the question, "Which one of you ratted them out?" However, that many of the vulnerabilities exploited by those tools have been remedied in ICQ v. 0.99b <http://www.icq.com/download/>. 
For info on ICQ vulnerabilities, as well as some funky music, see: 
•	ICQ Hazards & Safeguards
<http://diamond-back.com/icqhazards.html> 
Q. Wow, that's some intense stuff. Should I dump ICQ too?
A. That's your decision. I find it so useful that I still use it, but I've followed the advice I've read on the net in order to reduce the chances of bad things happening to me. The best and easiest thing to do is to always download and use the newest version. They usually fix the holes that hackers have exploited in previous versions. The hackers then proceed to find new holes. 
Q. I read this whole stinkin' Privacy section, and you didn't even mention Aureate/Radiate!
A. When I originally wrote this FAQ, the story hadn't broken yet. Besides, everything I know about Aureate can be found on Steve's Aureate page at <http://grc.com/optout.htm>. 
Q. Okay, well here's something that's not on Steve's page. I downloaded OptOut a while ago and I love it. However, now it appears to be expired. I click on the "Update" button and it takes me someplace strange. Do I need to set the clock back on my computer to use OptOut? 
A.	***  OptOut is expired  !  I recommend OUR suggested Ad-Aware !!! 

END of Article, AAAAaaae !