Making Purchases Online Private

---

Buying things online to be delivered right to our door is an amazingly convenient feature we have in our modern age, but it comes at a massive cost to our privacy.

A single account created at your favorite store contains enough information to start a profile about you: billing info, your home address, username, password, email, and more are excellent data points to be exploited in varying degrees.

Providing your information to make shopping online easy isn’t necessarily a bad thing, but you want to reduce your exposure to risk as much as you possibly can. And we created a fairly simple way to help you do this.

First, here’s a rundown, at a glance, of how exposed you are while shopping online. If you already have an idea and simply want to see how we can help, then scroll to the bottom and get started.

Surveillance

The data you volunteer is stored in a database and every single transaction will leave a trail of information outlining your habits. If, for any reason, someone was interested in you, then each piece of data can now be linked to any transaction regarding that data.

Data Harvesting, Trading, and Advertising

The fine print can be the bane of existence for many. The detailed nature of the fine print makes it easy to ignore reading it, as many do. And if you aren’t reading it, then you definitely have been a victim of data harvesting, trading, advertising, or all the above.

The process begins once you put an item in your shopping cart. You have added the last piece to the puzzle and can be targeted for a more specific advertising that can be shared across different vendors. A website now knows what you’re looking for even if you don’t buy the item.

After a certain amount of time you can be reminded, at the email you provided, about your unfinished purchase. You’ll now receive more advertising like recommendations to go with the new pair of shoes you were looking at. It doesn’t stop there either. The company can also sell your valuable data to other companies and bidders.

Hack or Breach

Your data is sitting in a database and everyday it needs to be protected from external and internal parties. As seen on the news time and time again, a breach is always possible and happens everyday.

The size of the company and the amount of money invested in security doesn’t matter. Once breached, the information can be plastered all over the internet.

Here are some ways this could happen:

• Zero-Day attacks
• Incorrect configurations such as privileges for accounts.
• Internal Data Breach
• Careless handling of data
• Database stores password as plaintext or old hash function instead of an up-to date cryptographic hash
• Identity Theft
• Extortion
• Doxxing
• Armed Robbery
• Spam & Phishing

Email Address

Your email address is now known. You now can receive advertising, spam, or have multiple hacking attempts on your account. Many people use one email address and password for all of their accounts, which is a horrible idea.

If someone were to attempt to correctly guess or brute force your password, then they can gain access to other accounts. Simply credential stuffing, using the same password on those websites, or stating they forgot the password will give more access to them.

If you use your email address as part of two-factor authentication, then that is overtaken as well.

Payment Requirement

When shopping online there are almost no sites that would ever allow you to purchase an item without a credit card or payment service like Paypal. These companies can see every single order you have purchased and this information is now out in the wild.

Delivery Requirement

The item you order needs to be shipped to you or close to you. This, alone, should make you wary of the possibilities of knowing your personal address.

Additional Linked Information

Any additional piece of information linked to these accounts increases your attack surface and makes you much more vulnerable.