Russ Harvey Consulting - Computer and Internet Services

Safer Browsing

Browser Choice | Settings | Use HTTPS
Browser Tracking

A stylized cloud containing icons for various programs has dotted lines pointing towards various computers, tablets and smart phones.

Your Choice of Browser Matters

It may be more convenient to choose your operating system's default browser, but that choice can affect your privacy, productivity and more.

Your choice of browser matters because it is used for so many tasks on today's computers.

First and foremost, the browser is one tool everyone uses. No matter your platform, you depend on a web browser.


I would go so far as to say 90% of the work and entertainment you undertake on any computing device connected to the Internet is via a web browser.


That means those ubiquitous applications have to pull a tremendous load.

Although modern browsers are very similar, the features and customizations they offer may matter to you.

Most people browse the web using Google Chrome without really thinking about their options. Gmail or YouTube or some other site once suggested using Chrome, and perhaps they never questioned it.


The truth is you do have options when it comes to your web browser, and you may find one that serves your needs better.


Browsers offer varying levels of privacy and security, as well as unique, helpful features beyond merely displaying websites.

Your choice of browser also affects how much information you share in the process.

Not all browsers take either your safety or your privacy seriously.

The Internet only stays healthy if we trust it as a safe place — to explore, transact, connect, and create. Our privacy and security online is under constant threat.


But there's something you can do about it: get informed, protect yourself, and make your voice heard. A healthy Internet depends on you.
— Mozilla

Browsers Continually Evolving

Each browser has strengths and weaknesses which can change over time.

At one time the only browser that counted to most site designers was Internet Explorer (now obsolete and unsafe to use). Today, Google Chrome is the dominant browser, with severe repercussions for the open Web.

Whichever browser you choose, the most recent version will usually have improved security features and known security issues will be patched.

Consider Security and Privacy

When making your choice, consider how well the browser handles privacy and security.

Browser Security

To be “secure,” a modern browser must meet certain requirements.

The lengthy list of requirements mentioned by the German Federal Office for Information Security is a good place to start.

Consider how your default browser does in meeting these requirements or choose one that better protects your security.

Browser Privacy

Because of the massive impact of the surveillance economy on privacy, it is important that you choose a browser that preserves as much privacy as possible.

Google Chrome is a poor privacy choice because Google's business model depends upon the collection of private information.

Mozilla has long been at the forefront of trying to improve privacy on the web.


The company even came up with the Do Not Track option for browsers….


Firefox was the first browser with a private browsing mode that could hide browsing not only from people with access to your device, but also from other sites.

Privacy and Search Engine Settings

Check your browser's settings rather than accepting its defaults including its default search engine.

A search engine can leave behind a history that can last for years.

I recommend either StartPage or DuckDuckGo to preserve your privacy.

Adding third party extensions and addons can either improve your privacy or expose you to malicious information gathering.

Clear Private Data

Regularly clear your privacy data (cookies, saved form information, cache and authenticated sessions).

Perform this clearing before and after visiting sites like online banking and other sites where you logon, especially when site contents are sensitive or confidential.

Private Windows or Incognito Mode Not Secure

Modern browsers have a privacy mode that doesn't retain site history.

  • Firefox and Microsoft Edge call this a private window.
  • Google Chrome calls it incognito mode.

Incognito mode does NOT protect your privacy online:

It is a myth that you can't be tracked while using so-called "Incognito mode." In fact, Incognito mode mainly just deletes information on your computer and does nothing to stop Google from saving your searches, nor does it stop companies, Internet service providers, or governments from being able to track you across the Internet.

Firefox's Private Browsing Mode shields the information from websites as well as other users on your computer.

Delete Browsing History

Many browsers default to saving your browsing history, even after the browser is closed. Firefox provides options for address bar search requests:

Search options for the address bar in your browser.

Retaining browsing history can lead to privacy issues because it can be valuable to others for marketing and profiling purposes.

I recommend that you change your browser settings to clear search history and other tracking data when the browser closes or use a third-party utility like CCleaner for that purpose.

Use Bookmarks To Remember Important Sites

If you clear the search history, you need another method of remembering sites you want to come back to.

While not as complete as the search history, bookmarks (or favorites) can mark important sites, even temporary ones.

Keep Them Organized

Your bookmarks can quickly become disorganized if you simply drop them into a single location.

While you can use a search function, it is probably better to use a series of folders and subfolders to organize similar content.

  • Use a “Current” folder to manage new bookmarks, moving them to a permanent sorted location when you realize that you want to keep them.
  • Use general titles for the main folders, adding more specific subfolders to group similar bookmarks.
  • Backup your bookmarks frequently. In Firefox, go to Manage Bookmarks then Import/Export when the Library window appears.

Reviewing your bookmarks from time-to-time can help to eliminate bookmarks you no longer need or those that no longer point to the resource you bookmarked.

Much of the Web has moved to HTTPS so you may need to revisit existing bookmarked sites to correct the link address. HTTPS:// Everywhere can help with that process.

Tracking in Web Links

When bookmarking or forwarding links, be sure to remove special tracking codes included at the end of the web address (URL). These are often found in email or social media links:

  • Links with ?utm_source= usually include the site referring the link.
  • The ?ftag= includes tags that track an email campaign or similar criteria.
  • The ?sh= is a form used by to track links (e.g., /?sh=1b6b5fc8e0c7).

Be sure to check that the link works without the tracking code before bookmarking or forwarding the link.

In this example from Twitter, the link contains extensive tracking mechanisms:

  • ?ftag=COS-05-10aaa0g
  • &taid=60e6043dfdc7d30001f57c13
  • &utm_campaign=trueAnthem%3A+Trending+Content
  • &utm_medium=trueAnthem
  • &utm_source=twitter

This link is normally displayed in one long string:

You'd only want to include the base link text:

DuckDuckGo Privacy Essentials helps stop companies from gathering your browsing history and other information via personal identifiers embedded in the links you click on.

Browser Settings

Don't simply install your browser. Customize the settings to ensure that you've locked it down as tightly as you can.

See privacy settings specific to Firefox, Chrome, Edge and Safari.

Do Not Track

Do Not Track (DNT) is a browser setting where the user can indicate that they don't want to be tracked.

Most sites ignore the setting with a statement similar to the following:

At this time, there is no general agreement on how companies interpret Do Not Track signals. This site does not currently respond to DNT signals, whether the signal is received on a computer or on a mobile device.

Failure of DNT has more to do with Google's business model and their multiple monopolies than any lack of agreement on how to interpret these signals.

…Google swiftly rendered [DNT] useless by discouraging its use in market-leading Chrome; that only makes sense for the company that bases much of its business on tracking users.

Even when Do Not Track is enabled, some facilities track store visitors via their cell phone using Mobile Location Analytics.

Legislation to enforce privacy control is required since both corporations and governments are complicit in the wholesale collection of metadata.

If if wasn't so profitable to track users and gobble up their metadata, I'm sure that privacy would be protected just like copyright and patents.

Still Worth Setting

It is still worth setting the DNT.

[D]espite the fact that only a small number of companies respect it — a significant number of companies like Twitter, Medium and others do respect it.
Jules Polonetsky

Privacy Badger Work-around

Privacy Badger blocks tracking and enforces DNT even in the absence of voluntary industry compliance.

Global Privacy Control

While DNT has failed to make it easy for users to opt out, Global Privacy Control has the advantage of legislative backing.

You may have noticed “Do Not Sell” and “Object To Processing” links around the web from companies complying with privacy regulations. To opt out of websites selling or sharing your personal information, you need to click these links for every site you visit.


Now you can exercise your legal privacy rights in one step via Global Privacy Control (GPC), required under the California Consumer Protection Act (CCPA) and Europe's Global Data Protection Regulation (GDPR).

Outside of these areas, compliance may be spotty.

Privacy regulators in California, for example, have said companies need to honor GPC to comply with the state's privacy law. And the Interactive Advertising Bureau's privacy compliance framework — the Multi-State Privacy Agreement — includes support of GPC, while publishers including The New York Times and WordPress owner Automattic similarly support the opt-out request facilitator.

Return to top

HTTPS Encryption

Much of the Internet is broken, a result of greed and exploitation at the expense of those who simply want information and entertainment.

These recommendations make your browsing safer.

Use Encrypted HTTPS Sites Where Possible

HTTPS is a secure protocol used by websites that encrypts traffic between the site's server and your browser.

The content of your web request and the reply that comes back can't easily be monitored by other people on the network.


This makes it much harder (nearly, if not absolutely, impossible) for attackers to eavesdrop on secrets such as passwords, credit card numbers, documents, private photos and other personal files that show up in your network traffic.


HTTPS traffic isn't just encrypted, it's also subjected to an integrity test. This stops attackers sneakily altering or corrupting data in transit, such as replacing bank account numbers, changing payment amounts or modifying contract details.
Sophos Blog

Secure sites are indicated by https:// (notice the trailing “s”) in the website address and/or some sort of a padlock symbol. The display varies by browser:

How HTTPS is indicated in the address bar of Firefox, Microsoft Edge and Google Chrome

  • Firefox, Google Chrome, Safari, Microsoft Edge and Opera all use a padlock to the left of the address.
  • The shield beside the padlock in Firefox indicates enhanced tracking protection.
  • Firefox and Edge display the HTTPS prefix. Chrome, Safari and Opera don't.

Connect Only to HTTPS Sites

Only connect to sites that are encrypted with HTTPS (HTTP over TLS), especially if you're logging into a site or sharing personal information.

HTTPS across the Web is good for Internet Health because it makes a more secure environment for everyone. It provides integrity, so a site can't be modified, and authentication, so users know they're connecting to the legit site and not some attacker.


Lacking any one of these three properties can cause problems. More non-secure sites means more risk for the overall Web.
Mozilla Blog

This is particularly important when using online banking or when shopping online — anywhere that you are sharing banking or credit card details.

Avoid Unsecured Sites

Unsecured (non-HTTPS) sites are vulnerable to man-in-the-middle attacks.

Without HTTPS, there are many places along the way between your browser and the other end where not-so-innocent third parties could easily eavesdrop on (and falsify) your web browsing.


Those eavesdroppers could be nosy neighbours who have figured out your Wi-Fi password, other users in the coffee shop you're visiting, curious colleagues on your work LAN, your ISP, cybercriminals, or even your government.
Sophos Blog

Site owners should ensure their site is encrypted if they wish to retain the trust of visitors to their site.

Many sites scrape information and engage in cross-site tracking. Facebook and Google are the worst offenders.

The surveillance economy is a one sided bargain that only benefits advertisers and data brokers.

Watch for Insecure Content on HTTPS Sites

Watch for warnings on HTTPS sites that indicate that some content is not being handled securely.

This can results from insecure links to images and similar material or could indicate metadata collection or browser fingerprinting.

This degrades the security of the site. Most browsers mark these sites as insecure.

HTTPS:// Everywhere

HTTPS:// Everywhere is a browser extension that encrypts your communications with many major websites, making your browsing more secure.

Enable HTTPS on Your Websites

If you're a site owner, ensure that your site has HTTPS enabled by default. HTTPS sites are more secure and load faster.

Now, with the ever increasing percentage of HTTPS sites, it is the share of sites using the HTTP protocol that is getting smaller and smaller.

Chrome and Firefox Now Default to HTTPS Sites

Browsers are starting to default to HTTPS sites in order to help secure the Web.

This is annoying to site visitors and greatly reduces confidence in non-HTTPS sites, which is bound to affect your SEO.

Let's Encrypt

What's stopping you from securing your site with HTTPS?

HTTPS certification used to be expensive but Let's Encrypt, a non-profit option, now provides free site certificates.

Enabling HTTPS requires action on your part, including changes in your hosting service settings. Cost should no longer be a factor.


I strongly recommend Firefox for privacy and performance. See Firefox's privacy notice.

Not only is Firefox more secure, but Mozilla is a non-profit organization dedicated to protecting privacy. Mozilla has no ties to an operating system or search engine company and is one of the few remaining browsers NOT based on Chromium.

Firefox products have never — and never will never — buy or sell user data.
IRL Podcast

Built-in Privacy Features

Firefox has built-in privacy and security features that are designed to keep you safe, but are flexible enough that you get to choose your settings.

Firefox also has a good privacy story, with a private mode that not only discards a session's history and cookies but also hides your activities from third-party tracking sites during the private session.


Firefox recently implemented DNS over HTTPS, which hides your web address lookups from your ISP. Firefox also has built-in Content Blocking to fend off known trackers and cryptocurrency-mining ploys.

Privacy Settings

Firefox's privacy settings are located Privacy tab: SettingsPrivacy & Security. Be sure to review all the settings as you go.

When you come to History I recommend checking Clear history when Firefox closes. You can choose which items get removed by clicking the Settings button located to the right:

Clear Private Date dialogue box

Rather than retaining your browsing history, bookmark sites you may want to come back to later in a temporary folder (I use a “Current” folder). If you decide the bookmark is valuable, move it to a location where you can easily find it later.

Private Browsing Mode

Firefox's Private Browsing mode allows you to surf without saving information about the sites and pages you've visited. Neither cookies nor passwords are saved.

Mozilla VPN Recommended

If you want to go further to protect your privacy, Mozilla VPN is my recommendation because Mozilla is committed to protecting your privacy — unlike many of the other VPN services. That's not to say that no others are worthy, only that Mozilla's record speaks for itself.

Firefox HTTPS-only Mode

Firefox introduced HTTPS-only mode in version 83 (November 17, 2020).

HTTPS provides a secure, encrypted connection between Firefox and the websites you visit. Most websites support HTTPS, and if HTTPS-Only Mode is enabled, then Firefox will upgrade all connections to HTTPS.

If an HTTPS option cannot be located, Firefox warns you that a secure connection is not available, telling your that it is most likely that the site doesn't support HTTPS, including this caveat:

It's also possible that an attacker is involved. If you decide to visit the website, you should not enter any sensitive information like passwords, emails, or credit card details.


If you continue, HTTPS-Only Mode will be turned off temporarily for this site.

Firefox DNS Over HTTPS (DoH)

DNS (Domain Name Server) is the process by which the domain name that is easier for humans to remember (e.g., is converted into the numerical address (e.g., that computers on the Internet can understand.

Unfortunately, this process can be tracked or spoofed, so Mozilla added security:

We are introducing two new features to fix this — Trusted Recursive Resolver (TRR) and DNS over HTTPS (DoH). Because really, there are three threats here:
  1. You could end up using an untrustworthy resolver that tracks your requests, or tampers with responses from DNS servers.
  2. On-path routers can track or tamper in the same way.
  3. DNS servers can track your DNS requests.
  4. Mozilla

Google Chrome

If you're like most people, you're probably using Google Chrome as your default browser. It's hard to fault Google's record on security and patching but privacy is another matter for the online ad giant.

Google Chrome is now the dominant browser (of the major players, only Firefox and Safari are not based upon Chromium).

If I had to take a guess, I'd say Google is just lucky the average user either doesn't like change or doesn't even realize there are alternative browsers available.


If you happen to fall into that category, I highly suggest you install Firefox and see if you don't find yourself setting it as the default browser on all of your devices and platforms.

Chrome's Privacy Issues

Chrome collects your surfing data and there are significant privacy concerns.

Chrome doesn't seem to have a privacy setting to clear data when the browser closes. You need to manually clear data — SettingsPrivacy & Security — or use a third-party utility like CCleaner.

Chrome also doesn't fully shut down when you close it.

Turn off background services by opening the System settings (SettingsSystem) and unchecking Continue running background apps when Chrome is closed:

Turn off ‘Continue running background apps when Google Chrome is closed.’

A Global Monopoly

Google's monopoly goes far beyond their browser's dominance.

Google is now the world's largest marketing company which now threatens the future of the open Web and the digital economy.

We created the monster that Google Chrome has become. Only we can destroy it.

Google now controls a significant majority of both Web searches and browser installations, giving Google a monopoly on access to content on the Web.

Google purchased existing companies with expertise in areas they traditionally didn't have, then combined the users' data from all their companies to create powerful search and advertising profiles.

Google Never Forgets

Google makes their money by exploiting the information you provide both intentionally and unintentionally. Google never forgets.

Don't Sign-in To Google

Signing into your Google account when using Chrome provides you with access to all your bookmarks and history from any number of computers, phones and tablets.

Clearing the data on your computer doesn't remove it from Google's servers where it resides forever.

You may miss some of the conveniences by not signing in, but you provide less information to Google.

Microsoft Edge

The Microsoft Edge Legacy was released with Windows 10 in 2015. It was built with a proprietary EdgeHTML engine but replaced in early 2020 with the New Edge.

Microsoft Edge is now Chromium-based but more tightly locked down than Google Chrome.

The most important difference between the new Edge and Google Chrome strikes right at the heart of Google's business model. By default, the new Edge turns on tracking protection and sets it to Balanced, which blocks many ads and almost all third-party tracking code.

Edge Privacy Settings

Edge's privacy settings are closer to Firefox's than Chrome's.

Edge has more privacy settings than Chrome, and it's much easier to track them down. For example, Edge can block trackers from sites you've visited and those you haven't. It can also reduce the odds of your personalized information being shared across sites.
Digital Trends

Open the privacy settings (SettingsPrivacy, search & services) then review each of the settings as you go to personalize your privacy preferences.

Edge, like Chrome, doesn't fully shut down when you close it.

Turn off background services (SettingsSystem & performanceContinue running background apps when Microsoft Edge is closed) to close Edge when you're not using it:

Turn off ‘Continue running background apps when Microsoft Edge is closed.’


Edge's Monopoly Tactics

For many years Microsoft used their operating system dominance to force people to use Internet Explorer (IE). They agreed to international browser standards then promptly broke them with IE, ensuring a poor experience with IE-based websites on other browsers.

Microsoft's latest tactic added links within Windows 11 that force the user to open certain resources with Edge rather than their choice of browser:

With the launch of Windows 11, Microsoft made it difficult to change the default browser, but soon users will be forced to use Edge for certain tasks.


Microsoft uses microsoft-edge:// links instead of https:// for specific features in Windows, like links to online news, weather, or Start Menu search results.

EdgeDeflector was designed to restore functionality to your chosen browser, but Microsoft has disabled that extension in the latest update.

These aren't the actions of an attentive company that cares about its product anymore. Microsoft isn't a good steward of the Windows operating system. They're prioritizing ads, bundleware, and service subscriptions over their users' productivity.
Daniel Aleksandersen

Apple Safari

Safari is Apple's default browser and they have made great efforts to improve the privacy protections.

The “Good Privacy” Browser

Some of those changes were aimed at fighting ad-tracking and digital fingerprinting of the Safari browser.

Safari Privacy Settings

Safari has some unique privacy measures (PreferencesPrivacy).

However, there is no automatic removal of browsing data except the ability to clear your history after a minimum of one day (PreferencesGeneral).


Browser Tracking

Many websites monitor your browser to track your progress as you surf the Web using cookies, supercookies and fingerprinting.

The surveillance economy has thrived on the creation and selling of personal profiles.

Data brokers gather and resell personal profiles to advertisers or anyone that will pay.

Instead of static ads, sites provide what they know about you to groups of online advertisers so they can bid on a “personalized” ad. This is why they whine when you use an ad blocker to protect your privacy.

Firefox Recommended

Firefox is recommended because it provides cross-site tracking protection and third-party fingerprinting protection.


Cookies are a necessary part of today's normal web. When you log into a site, a cookie is generated or altered to track your login status.

Without that “same-site” cookie, the site would not know whether or not a user was properly authenticated during the login process.

Reporting Your Web Habits

Unfortunately, companies often use malicious third-party cookies to track you from site to site for advertising or profiling purposes.

We're all tired of that uneasy feeling we get when we see an ad online that seems to know too much about us.

While this may improve profitability, it does so at the expense of your privacy.

Managing Your Cookies

You can deal with cookies using some of the many utilities available on the Net or by using the tools provided by modern browsers.

Close your browser and clear out cookies and other tracking frequently, especially before logging onto sites where you maintain banking and household accounts.

Opt-Out Cookies

The Network Advertising Initiative offers to place an opt-out cookie on your computer for certain ad servers such as DoubleClick.

ANY opt-out solution is a unethical.

Requiring people to register and maintain another cookie doesn't protect privacy.


Supercookies are a class of cookies know as unique identifier headers (UIDHs).

They are much harder to delete or block than regular cookies.

They employ troublesome Flash storage, ETags and HSTS flags.

The X-UIDH header effectively reinvents the cookie, but does so in a way that is shockingly insecure and dangerous to your privacy. In fact, it functions even if you use a private browsing mode or clear your cookies.

Supercookies make it nearly impossible for users to protect their privacy as they browse the web.

Flash Cookies

Many sites used flash cookies (Local Shared Objects or LSOs) that are not deleted when you remove traditional cookies.

Support has ended for Flash so LSOs should no longer work.

Browser Fingerprinting

Because people have begun to use ad-blockers and other privacy extensions, websites have begun to use sneaky tactics to track your movements on the Web.

One is browser fingerprinting which looks for a number of trackable identifiers which are broadcast by your browser to the sites you are visiting.

A digital fingerprint is essentially a list of characteristics that are unique to a single user, their browser, and their specific hardware setup.


Tracking sites can stitch all the small pieces together to form a unique picture, or "fingerprint," of the user's device.

Fingerprinting is much more difficult for users to combat because, unlike cookies, it's use can't be detected.

Nor can the user easily change the characteristics being tracked (such as screen resolution).

Cover Your Tracks

Cover Your Tracks shows you how trackers view your browser and offers suggestions.

DuckDuckGo Privacy Essentials

DuckDuckGo Privacy Essentials seamlessly protects you from most third-party trackers. Take control of your personal information, no matter where the Internet takes you.

It also provides a visual clue as to the integrity of the website you are visiting using the letter system commonly used for academic grades.

Clear Your Browsing History

Your browsing history can be used by online ad companies to fingerprint individual browsers over time.

Clearing your browsing history limits the amount of information available to such fingerprinting efforts.

Google Tracking

Google delayed its deprecation of tracking cookies while developing alternatives, beginning with FLoC.

Tracking APIs (modified forms of fingerprinting) “hide” the user in a group of like users.

Google Topics and FLEDGE replaced FLoC but significant issues remain.

While Google is positioning this as more privacy respecting, the simple fact is tracking, targeting, and profiling, still is tracking, targeting, and profiling, no matter what you want to call it.
Spread Privacy

Google plans to automatically enable these ad trackers for Chrome users.

Privacy Steps

Start by not logging into your Google Account when using Chrome.

Start by not logging into your Google Account when using Chrome, then:

Despite the name, "Privacy Sandbox" lets Google and other companies track and sell user data.

Return to top

Related Resources

On this site:

Buy Me A Coffee


Return to top
Updated: April 6, 2023