this post was submitted on 02 Dec 2025
44 points (100.0% liked)

Privacy

46095 readers
526 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 6 years ago
MODERATORS
 

So a bit ago I got an add for "canned rambutan". I had looked up Rambutan a few days prior after hearing it mentioned 10 hours into the video game Baby Steps. I wasn't using a VPN at the time and I didn't have fingerprinting protections active but I only mentioned it to a few sources (according to my browser history) all of which generally are implied to be private.

Which of these do you think is the reason the ad networks know?

  • Wikipedia
  • Startpage Search
  • Duckduckgo Search
  • My ISP
  • Firefox
  • My Firefox Extensions
  • Kubuntu
  • CachyOS
  • The omnipotent algorithm connecting my mentions of Baby Steps with my progress through the game.
  • Does this only make sense if my browser history is incomplete?
  • Maybe I was using DNS over HTTPS via Cloudflare at the time of my search.

Any guesses as to where the weak link is?

top 50 comments
sorted by: hot top controversial new old
[–] mspencer712@programming.dev 9 points 2 months ago (1 children)

How old is that game? Are there other people in your demographic who also play the game, and then searched for the same thing?

[–] Tenderizer78@lemmy.ml 4 points 2 months ago

September 2025

[–] ryannathans@aussie.zone 7 points 2 months ago* (last edited 2 months ago) (1 children)

I would guess the likely culprits are

Firefox extensions

Search engines

Wikipedia

Other search results you may have opened or pre-loaded (not a default Firefox behaviour)

[–] Tenderizer78@lemmy.ml 6 points 2 months ago (3 children)

I don't think Wikipedia is a likely culprit. I haven't heard anything about them selling data.

[–] partofthevoice@lemmy.zip 1 points 2 months ago* (last edited 2 months ago) (1 children)

You’ll need to provide all the sites you visited immediately after each of the ones you searched. Your origin header will give that info away freely. So if it’s in the query parameters of the URL, then you go to Facebook, it’s as easy as {k: v for k, v in (pair.split("=", 1) for pair in response.headers["origin"].split("?", 1)[-1].split("&"))}

[–] Tenderizer78@lemmy.ml 1 points 2 months ago

Firefox only stores the time of my most recent visit so I don't have that information anymore, so let's just assume I went to YouTube immediately afterwards.

load more comments (2 replies)
[–] JoeKrogan@lemmy.world 5 points 2 months ago* (last edited 2 months ago) (1 children)

You say you were not using a vpn. Then the site has your ip and probably has meta/google ads or other shit running on it and links the product with your ip.

This data is added to some data broker/ ad network and you see an ad when you visit a site using this network as you have "signalled" interest in the product by viewing the product page the first time.

[–] Tenderizer78@lemmy.ml 2 points 2 months ago

Except the only sites I visited where I mentioned rambutan were Duckduckgo, Startpage, and Wikipedia.

[–] lefthandeddude@lemmy.dbzer0.com 5 points 2 months ago* (last edited 2 months ago)

It's duckduckgo. Search duckduckgo.com with the term "restaurants near me." You'll often get responses that are close to your IP location.

That couldn't happen unless DDG passes your IP address on to Bing. It's possible they censor part of the IP and only pass part of it to Bing, but probably not.

(Go ahead! Try it!)

Since Bing sells to data brokers, data brokers know your IP is linked to a search for rambutan, even without fingerprinting your browser.

I'm not calling duckduckgo.com a honeypot... I'm also not calling it not a honeypot. But it knows too much for something supposedly private.

Any closed source firefox extension that has access to the browser display could be parsing the texts and selling it and your IP and other identifiers to data brokers. It's part of how these extensions are profitable.

Cloudflare also does highly advanced fingerprinting and has a script called cloudflare insights, so it seems likely that any cloudflare activity is generating marketing data.

[–] florencia@lemmy.blahaj.zone 4 points 2 months ago (1 children)

If the EFF de anonymization tool can de anonymize your browser, then the ad network can too.

Try searching for something with tor browser - no javascript

[–] Tenderizer78@lemmy.ml 3 points 2 months ago (2 children)

This isn't a matter for fingerprinting. I haven't directly visited any sites about rambutan other than Startpage, Duckduckgo, and Wikipedia.

[–] chgxvjh@hexbear.net 3 points 2 months ago* (last edited 2 months ago) (1 children)

Did you click on any search results?

I found that the Firefox Browser history is often incomplete.

[–] Tenderizer78@lemmy.ml 2 points 2 months ago (1 children)

As far as I can remember, only the Wikipedia one.

[–] chgxvjh@hexbear.net 2 points 2 months ago (1 children)

Any extension could leak this information as well.

Is your default engine something other then the mentioned search engines? The search suggestion feature leaks information too.

[–] Tenderizer78@lemmy.ml 1 points 2 months ago

I had removed all but Duckduckgo and Startpage from my browser.

My browser extensions are a good angle. If they're selling my data to fund themselves that'd explain some things.

[–] PiraHxCx@lemmy.ml 2 points 2 months ago* (last edited 2 months ago) (3 children)

Well, without a VPN your ISP sees every site you enter. I wasn't aware they might be selling that data for targeted ads, but it makes sense, why wouldn't them?

[–] ryannathans@aussie.zone 11 points 2 months ago (11 children)

That's not true, your ISP might see your DNS and unencrypted web traffic sure but web searches use HTTPS so ISPs aren't reading the query or results

load more comments (11 replies)
[–] Tenderizer78@lemmy.ml 4 points 2 months ago* (last edited 2 months ago) (2 children)

Looking it up my ISP isn't exactly trustworthy, but there have been no clear allegations. I'd say it's the most likely cause if not my Firefox extensions.

EDIT: I just got another theory, Cloudflare, I'll add it to the list.

[–] nkk@programming.dev 3 points 2 months ago (1 children)

If you're really crazy about your privacy I'd recommend getting rid of any extensions you don't 100% need (keep ublock origin though) as not only can they stalk you themselves but it can also help websites fingerprint you. Keeping your extensions to a minimum will help you blend in with the crowd, especially if you use a hardened browser like LibreWolf and/or Mullvad Browser

[–] Tenderizer78@lemmy.ml 3 points 2 months ago (6 children)

I use AdGuard rather than uBlock Origin for adblocking, because it allows me to opt-in and only block ads when they are aggressive enough to be annoying. But I've not been trying to minimize fingerprinting. The issue is just that everything I used in this instance came with either a tacit or explicit promise not to track me and I don't know which is lying.

Other extensions I use are:

  1. Remove YouTube Suggestions
  2. 10ten Japanese Reader (just now disabled)
  3. Tampermonkey
  4. Proton Pass (because my government services require 2FA, but only offer an official government app that uses the play integrity API, or a Passkey which is only natively supported on Windows or Mac)
  5. Time Tracker - Web Habit Builder
  6. Improve Crunchyroll (which seems to have stopped Crunchyroll from forcefully dropping my resolution to 144p).
  7. SteamDB (just now disabled)
load more comments (6 replies)
[–] ryannathans@aussie.zone 2 points 2 months ago (4 children)

Microsoft serves ads through duckduckgo that could connect the search to your IP perhaps if you clicked one

load more comments (4 replies)
[–] chgxvjh@hexbear.net 3 points 2 months ago* (last edited 2 months ago) (1 children)

The ISP shouldn't even see the search term given basically everything on the internet uses https.

The ISP will see the domain names of the pages you visit if you use their DNS or some other unencrypted DNS but those are unlikely to contain the search term.

load more comments (1 replies)
[–] stupid_asshole69@hexbear.net 2 points 2 months ago (1 children)

Have you considered confirmation bias?

It’s rambutan season and you saw an ad for rambutans. You haven’t mentioned that seeing the ad was weird so I gotta assume you see other ads they’re just not related to something that you searched for recently or something you recognize as being related to something you searched for recently.

[–] Tenderizer78@lemmy.ml 2 points 2 months ago

I don't see many ads, and the ads I do see are never food items. I think this canned rambutan was the first food ad I've seen in years.

I can't even fathom this being a coincidence.

[–] Camille_Jamal@lemmy.ml 1 points 2 months ago

Out of what you say, probably cloudflare or incomplete history. Have a great day!

load more comments
view more: next ›