Read this article in 日本語.
Websites may want to do several things that have significant privacy implications. They may want to use your camera and microphone in order to offer a chat application or know your location in order to show your position on a map. By default, Vivaldi will not allow this and will ask you for permission when a website tries to access them.
In order to prevent a website from repeatedly pestering you in the hope that you will eventually give in, Vivaldi will remember when you deny permission and will block the website from pestering you again. You can reset that choice at any time.
Make sure that you really trust a website before allowing access to this information. If a website knows your location, it can learn where you spend most of your time, whether you appear to be at home or work, whether your house is empty, or if you are somewhere away from home. Even if you are happy to grant permission right now, will you be happy for that website to know your location if you open it again in a few minutes, hours or days?
If a website can access your camera, it can continue to access it if you open it later in your bedroom. Do you still trust the website enough to let it access your camera when you have it open in a tab later? And what if you accidentally reopen that website?
If you no longer want the website to know where you are, or to be able to record from your camera or microphone, make sure that you revoke the permission once you are done.
Quickly change privacy settings
Vivaldi gives quick and easy access to several website privacy settings so that you can quickly disable any permissions you have given to a website. Click the badge next to the website address in the address field, and change any settings you want back to their safe defaults. Click the Site settings link, followed by Reset site settings to quickly reset all settings for that website at once.
You can also set global default preferences for requests based on sound, geolocation, camera, microphone, motion sensors, Bluetooth devices, and Pop-ups. They can be controlled from Settings > Web Pages > Default Permissions.
Blocking ads
Blocking ads is not just about trying to get rid of intrusive ads that get in your way, or speeding up a slow connection. Many advert providers set tracking cookies so that they can see which other websites you use if they also provide ads on those other sites. A simple way to avoid this is to block ads. Several extensions are available that can block ads for you in Tools menu – Extensions – Get more extensions.
Note, of course, that many websites rely on ads for their income, and by blocking them you risk making the website become unprofitable and close down. In an effort to find a middle ground, many of the ad blocking extensions allow you to choose to only block ads that are particularly privacy invasive when it comes to tracking or ads that try to force you to allow yourself to be tracked. Check the settings for your chosen extension.
Use of third-party services
Vivaldi uses third-party services for some features, such as phishing and malware protection, and search suggestions.
Search suggestions can have very significant privacy implications because it sends everything you type into the address or search fields to your selected search engine. This means they get to see what you are typing even before you press Enter (even if you were actually starting to type a full URL rather than a search string). This can be quite revealing.
This is the reason Vivaldi does not enable search suggestions by default. If you choose to enable this function yourself, you should make sure you understand the implications first. Tools menu – Settings – Search / Privacy – Allow Search Suggestions In Address Field / Search Field. You can also choose to enable it only if you type a search engine nickname (like “d”), which is a clear indication that this is intended to be a search, not a URL. You can check if your selected search engine offers search suggestions using Tools menu – Settings – Search – select the search engine which is bold (the default search engine), and check if the “Suggest URL” field is filled in.
For phishing and malware protection, the browser has to check if the website that you are visiting has been detected as being fraudulent, or serving malware. It needs to get the most up to date information, since a website could have been hacked or cleaned, within the last few minutes or hours before you visit. It somehow needs to check this with a service provider, but if possible, preserve your privacy. The list of malicious websites changes very frequently as websites are added or removed, so it would waste a huge amount of bandwidth to constantly download updates for sites that you might never visit.
In order to avoid sending a full list of your visited websites to the service provider (which would be very bad for privacy), the service provider gives the browser a “filter” (there are a few different types that may be used here, such as Bloom filters, matrix filters, and Golomb Compressed Sets, but they all serve the same basic purpose). This is a small file which describes every URL that is known to be malicious, using an approximation method. Because of the way the approximation works, it always matches a known malicious website, but it also accidentally matches a few that are not known to be malicious. In most cases, the filter does not match, and the browser loads the website without contacting the service provider. Whenever the filter matches the current website, Vivaldi checks with the service provider, asking if the website is known to be malicious.
Rather than send the actual website URL, it sends a one-way hash of a portion of the URL (such as the protocol+domain), so that the service provider will not know the original full URL, and the service provider responds with a more detailed filter. If the more detailed filter still matches the current website, the browser tries another hash, from more parts of the URL (such as protocol+domain+path). If that still matches, it repeats it with more parts until it is certain that this is the URL where the service provider detected phishing or malware, at which point it tests a hash of the full URL. In this way, the browser tries to avoid giving the service provider a complete URL, but it is possible for the service provider to use the protocol+domain hash to work out the website, and the final hash (the one that actually matches the full URL) to work out which full URL you have visited, if the service provider has visited it themselves. So your privacy is maintained as much as possible until the browser is almost completely certain that this is a malicious URL.
Of course, by downloading the filter files, it does mean that the service provider gets to see that someone with your IP address is actively browsing the web, using Vivaldi (though for technical reasons it currently looks like Chromium rather than Vivaldi). Cookies are not sent during these checks. Because of the benefits of the phishing and malware protection, we recommend that you keep it enabled, but if you would like to disable it, you can do so using Tools menu – Settings – Privacy – Google Phishing and Malware Protection.
Browser advances
Traditionally, websites were all insecure, unless they dealt with the most significantly sensitive information. Banking sites might be secure, but regular searching and browsing would be done over insecure connections.
However, search terms can easily contain sensitive information, and your browsing habits may reveal private information anyway. So actively developed websites are moving towards using secure connections for everything. This is encouraged by some search engines giving a better ranking to secure websites, but also by the browsers themselves starting to warn when a website uses an insecure connection.
For example, if you use an insecure (HTTP) connection to a website and try to log in, Vivaldi will warn you that the login form is not secure, using a badge in the address field. This is a little ineffective since an attacker who replaces the content on an insecure connection can just replace the password input with a fake input that looks like a password input, and not get a warning, while still carrying out this attack. Therefore the purpose is not to prevent a real attack (something which is actually not possible), but instead to encourage the website owners to update their site to provide a secure connection. Although it does not offer any actual protection right now, hopefully, it will make your future browsing more secure; a net benefit.
Browsers like Vivaldi will continue to seek out new ways to make the web a safer place, leaving you to browse with confidence. But where it matters most, where it is important for you to be in control, the browser will continue to give you the choice, and the freedom to protect yourself as much as you want. After all, what is private to you, is what is important.
Stay tuned for more tips in our series on privacy and security.
* * *
Read more blog posts from the series:
- The basics of web browser security: an introduction
- Shared networks, tracking and fingerprinting
- Your browser, antivirus and other network intercepting software
Main photo by John Schnobrich on Unsplash.
