How Web Browsing Works . . . With that definition in mind, a web browser's “operation model” is simple and straightforward; it is just a series of individual queries and replies:

1. Query: The browser requests an “asset” from a remote server. 2. Reply: If the server has the requested asset, it is returned and provided to the browser.

The key concept is that individual page assets exist separately on remote servers, and each must be requested separately by the web browser.

Since each individual page asset must be separately requested from remote web servers, pages are literally built-up and assembled by requesting, receiving, and accumulating many separate assets onto a single page.

1. The main "body" of the page is first retrieved from a remote web server: 2. After receiving the page's text, the web browser searches for all references to additional assets contained on the page and sends out a second wave of requests for each of the page's additional assets: 3. The remote web server (or servers) locate and return all of the requested page assets to the requesting browser, thereby completing the page and allowing it to be displayed in finished form:

As depicted in the diagram below, a single web page can request and receive web page assets from more than one server. Since individual web page assets are identified by URL addresses, just like web pages, they can originate from anywhere on the Internet.

4. As shown in the diagram above, the “first-party server” is addressed by the page's main URL. It provides the web page's main page & body, and usually provides most of the page's other assets. “Third-party servers” are any other servers, located at different web addresses, which pitch-in to provide some of the page's content. Web advertisements are provided by “third-party ad servers” which inject their advertisements into hosting web pages in exactly this fashion.

• The web page upon which an advertisement will appear reserves a blank space in the page's layout with a URL containing a third-party advertising server address.
• Whenever that page is displayed, the user's web browser will read the page, discover the URL address of the advertising server, and request a web page asset from it. This could be an image, flash animation, video, or other resource from the third-party server.
• When the advertising asset is received by the browser, it will be inserted into the page to appear in the reserved location and become part of the delivered page.

Another way to express what we summarized above, would be to say that when a web page is displayed it can contain, and usually does, URL references to page assets existing on web servers other than the site we're visiting. To retrieve all of the page's content, our web browser will then — without notifying or asking us in any way — send queries to all mentioned “third-party” web servers requesting the required page assets.

As we will now see, what's disturbing about this is the amount of potentially private information that's automatically sent to unknown & untrusted “third-party” organizations located anywhere on the Internet . . . The following table shows the complete contents of a single query for a single web page asset.

Please don't worry about understanding the details of the material below. (There will not be a test on this.) We just wanted to give you one complete sample of a query so that you could see how much “stuff” a web browser supplies during every query: Web browser queries are composed of a series of lines of information, with each line containing a “name” and a “value”. Not all queries contain all of the same items. Some may contain additional “name:value pairs”, some fewer. The example above is typical and you can probably infer much of the intent from the names and values themselves.

Once your eyes have uncrossed from encountering all of the gory details of one complete query, we will focus upon just the few details that are important for our exploration:








The architects of the original world wide web designed the powerful and flexible system we still use today. Unfortunately, the trusting, academic world they designed the system for is different from the world we live in today.

While on the surface this seems like a reasonable thing to do, a web browser's page asset queries contain so much information — which is being provided to arbitrary third-party servers the user has not chosen to trust — that