About half of your internet bandwidth is devoted to tracking you and serving up ads.
Besides slowing down your Netflix streams, all that Internet activity helps companies paint an intricate portrait of you and your habits: Where you go, what you read, what you like and what you dislike. We've mostly resigned ourselves to being tracked online constantly, but what if you didn't have to be?
Winston Privacy, a cybersecurity startup based out of Chicago’s mHUB innovation center, doesn't think you should. The company has built a new plug-and-play device that lets everyday internet users opt out of this tracking. And the startup just launched a Kickstarter to bring that device to market.
Designed to be set up by anyone who can work a power outlet, Winston plugs in between the user’s modem and router. The device then encrypts the traffic coming from all devices on the network and mixes it with traffic from other Winston users and routes it through other random Winston devices before sending it to its final destination.
If the government asks us for user information, all we can give them is a list of who’s a subscriber.”
On the receiver’s end, that means your data arrives from ever-changing IP addresses, making it difficult to connect your data back to your location. Equally importantly, Winston never sees any of your information, which serves as a safeguard against breaches and warrants.
“If the government asks us for user information, all we can give them is a list of who’s a subscriber,” said founder and CEO Richard Stokes. “Beyond that, we have no visibility.”
Those who’ve dabbled in internet privacy may recognize this privacy approach from Tor: a browser and accompanying routing network popular among reporters and activists — particularly in the years following Edward Snowden’s revelation about mass online surveillance.
But unlike Tor, Winston protects data that doesn’t originate from your browser. And it’s designed with user-friendliness front of mind.
“We designed Winston to be kind of like Tor for normal people,” Stokes said. “It’s meant to be easy to use, convenient and fast.”
Winston alters cookies used by websites to track visitors, and can automatically block traffic to or from specific sites. The device blocks 90,000 sites by default to fend off malware and tracking, and Stokes said users can add new ones to that list if they want to. The device also employs machine learning to adjust its settings based on usage patterns and perceived risk.
Ground control to Facebook
In testing Winston on his home network, with 20 to 25 connected devices — which is a fairly typical number for a tech-savvy family — Stokes said the dashboard detected around 200 applications making calls through the network, 100 of which were pinging Facebook’s servers. When one domain is tracking you across multiple devices, the Winston system views it as a major red flag, Stokes said.
Speaking of Facebook: Winston comes with a “boycott Facebook” option that keeps all of the company’s apps, services and tracking from reaching you on any device connected to your network.
There’s also a module designed specifically to let users play the popular battle royale shooter Fortnite, which would ordinarily get blocked due to its extensive tracking of users. In fact, Stokes said the company decided to enable the Fortnite module by default, because the game is so popular.
You can continue to use the internet, but you’re really not sharing much.”
Striking the right balance between security and convenience was one of Winston’s biggest priorities, Stokes said. In the world of cybersecurity, most experts tend to focus on worst-case scenarios: Could a nefarious actor with unlimited resources break into your device? That may be important if you’re a political dissident or a reporter, but most people aren’t singled out by powerful governments. And protecting yourself in such situations would require a change in online habits that most people aren’t willing to make.
For most people, Stokes said, making yourself inconvenient to track is enough to make companies lose interest. And Winston is designed to do that without making users give up their digital lives. In fact, by cutting off trackers and ads, Stokes said, the device actually makes your internet service faster.
“It doesn’t have to be perfect privacy, because most people really do not have anything to hide,” Stokes said. “We’re taking the current model, where you opt in to tracking by default, and changing it to one where you opt out by default. You can continue to use the internet, but you’re really not sharing much. And you can click a button in Winston to share everything if you want to.”
Do people want to be tracked?
Before getting into the cybersecurity game, Stokes founded an adtech company, which was acquired in 2012. Stokes stayed on as an executive with that company for the following five years, watching the advertising industry grow increasingly sophisticated in its efforts to gather data about consumers.
“In 2017, I realized that the advertising industry had hit a tipping point, and that this genie was not going back into the bottle,” he said.
More than half of all consumers do not want this kind of tracking — but they have no recourse.”
That made Stokes wonder whether people really wanted targeted advertising, as some in the industry claim, or whether they saw it as a minor tradeoff for the convenience and features they got in return. When he started to research that question, the answer was neither of the above.
“More than half of all consumers do not want this kind of tracking — but they have no recourse,” he said. “What we found was a state of resignation, and an inability to do anything about it.”
At least until now, that is. Winston launched on Kickstarter on Tuesday morning, with early backers having the option to buy the device for $179, with a free yearly subscription included. Devices are slated to ship in August, but a July delivery option is also available for $229.
