f
loati

All courses Free · No account · In your browser

The Watched Web

A free, hands-on course on how the web tracks people, and how to stop it. Read what a practice tracker learns, watch browser defences break it, build a blocker, and measure the privacy you win. All in your browser, against practice sites.

27 modules 156 lessons 156 auto-graded exercises Self-paced · ~48h of material Labs in a practice worldBeginner friendly
Start the course Verify a certificate
Your progress 0 / 156 exercises complete
Daily goal
Module 1

What a website knows the moment you arrive

Look at any web page and say what it learned about your device, network, location and the page you came from before you clicked anything.

✓ What your browser hands over exercise 12 min ✓ IP addresses exercise 10 min ✓ The referrer exercise 10 min ✓ Link decoration exercise 12 min ✓ WebRTC and IP leaks exercise 11 min ✓ Quiz and recap exercise 10 min
Module 3

Fingerprinting: tracking without cookies

Explain how a browser can be recognised with no stored ID, estimate how identifying a trait is, and choose defences that really help.

✓ Why clearing cookies is not enough exercise 9 min ✓ Your fingerprint, measured exercise 25 min ✓ Bits of identity exercise 11 min ✓ Defences exercise 11 min ✓ Do Not Track and Global Privacy Control exercise 10 min ✓ Quiz exercise 10 min
Module 6

HTTP from the inside

Read raw HTTP the way a browser does, and write your own parsers for requests, headers, cookies, a rule-following cookie jar, a link cleaner and a redirect-chain logger in plain Python.

✓ Parse a raw HTTP request exercise 20 min ✓ Headers exercise 20 min ✓ Parse Cookie and Set-Cookie exercise 20 min ✓ A cookie jar that follows the rules exercise 30 min ✓ URLs and link cleaning exercise 25 min ✓ Redirect chains exercise 25 min
Module 9

Measure privacy, honestly

Measure how identifiable people are in a dataset, show why removing names and hashing emails fail, apply real defences, and report a full tracker-and-blocker experiment as checkable numbers.

✓ Anonymity sets and entropy exercise 22 min ✓ k-anonymity exercise 22 min ✓ Hashing is not anonymising exercise 20 min ✓ The defence exercise 25 min ✓ Leg 2 project: the Tracker Lab report exercise 50 min
Module 10

Script injection (XSS)

Explain how untrusted text turns into running script, find it on practice pages, and fix it with correct escaping, HttpOnly session cookies and templates that escape by default.

✓ What XSS is exercise 20 min ✓ Find the injection exercise 25 min ✓ Escaping done right exercise 20 min ✓ Why blacklists fail exercise 20 min ✓ What an attacker gets exercise 20 min ✓ Templates that escape by default exercise 12 min
Module 11

Content Security Policy and framing

Read any Content Security Policy, write one that blocks injected scripts without breaking your page, roll it out safely with nonces, report-only and Trusted Types, stop clickjacking with frame-ancestors, and audit a policy with a repeatable score.

✓ What CSP is exercise 13 min ✓ Write a policy exercise 25 min ✓ Nonces, hashes and report-only exercise 13 min ✓ Trusted Types exercise 12 min ✓ Clickjacking exercise 11 min ✓ Audit lab exercise 35 min
Module 12

Third parties on your own site

List every outside service your site loads, decide which to self-host, load on click or keep, and lock down the rest with SRI, Permissions-Policy and Referrer-Policy.

✓ Every embed is a guest that watches exercise 11 min ✓ Audit a site's third parties exercise 22 min ✓ Self-host or embed exercise 11 min ✓ Subresource Integrity exercise 20 min ✓ Permissions-Policy exercise 10 min ✓ Referrer-Policy and link hygiene exercise 11 min
Module 13

Privacy by design

Design a site that collects less, counts visits without tracking people, protects what it keeps, deletes on schedule, and prove it by taking a practice shop from F to A.

✓ Collect less exercise 20 min ✓ Analytics without tracking people exercise 13 min ✓ Keep what you keep safely exercise 14 min ✓ Retention and honest policies exercise 20 min ✓ Leg 3 project: harden the practice shop exercise 50 min
Module 14

Encryption you can explain

Explain in plain words what symmetric and public key encryption, HTTPS, end-to-end encryption, signatures, passkeys, encrypted DNS and VPNs each protect, and verify a signed message in Python.

✓ Symmetric and public key exercise 14 min ✓ What HTTPS hides and what it does not exercise 13 min ✓ End-to-end encryption exercise 13 min ✓ Verify a signature exercise 22 min ✓ Passkeys and passwords exercise 12 min ✓ Encrypted DNS and VPNs exercise 14 min
Module 15

Private AI

Explain where AI prompts go, use on-device models, redact personal data in Python before text leaves the device, and choose private-by-default AI features for your own product.

✓ Where your prompts go exercise 10 min ✓ On-device models exercise 11 min ✓ Redact before it leaves exercise 25 min ✓ Embeddings leak too exercise 12 min ✓ Private-by-default AI features exercise 10 min
Module 16

Threat modelling

Write a one-page threat model for a person or a product, check a product's data flows in Python, respond calmly to a data leak, and build a rubric-checked threat model of a product you use.

✓ A one-page threat model exercise 11 min ✓ Personal threat models exercise 12 min ✓ Product threat models exercise 25 min ✓ Incident basics exercise 11 min ✓ Leg 4 project: a threat model exercise 50 min
Module 17

Packets, DNS and IP addresses

Explain what each network layer, DNS lookup and IP address reveals and to whom, measure how stable an IP-based ID really is, and model exactly what a VPN, a two-hop relay and Tor each hide.

✓ Packets, ports and layers exercise 13 min ✓ DNS as a diary exercise 12 min ✓ Encrypted DNS exercise 12 min ✓ IP-based tracking exercise 22 min ✓ IPv6 exercise 13 min ✓ Relays and VPNs, honestly exercise 22 min
Module 18

Network fingerprints

Read a TLS ClientHello and an HTTP/2 opening, compute JA3 and JA4-style fingerprints from simulated handshakes, and measure how far IP addresses and network fingerprints can link a person once cookies are blocked.

✓ The TLS handshake, slowly exercise 14 min ✓ TLS fingerprints (JA3 and JA4) exercise 25 min ✓ HTTP/2 and header fingerprints exercise 22 min ✓ Who uses this, and why exercise 11 min ✓ Link a user without cookies exercise 25 min
Module 20

How a browser decides

Work out which site any URL belongs to, and explain how browser engines partition storage, close side channels, grant storage access, stop bounce tracking and decide what counts as a tracker.

✓ Sites, origins and "same site" exercise 25 min ✓ Partitioning, implemented exercise 13 min ✓ Leaks through the edges exercise 13 min ✓ The Storage Access API exercise 12 min ✓ Bounce tracking and its defences exercise 13 min ✓ Classifying trackers exercise 14 min
Module 22

Tracking the person, not the device

Measure how typing, writing style, shared devices and broker records identify a person, and choose the defences that break those links.

✓ Behavioural biometrics exercise 12 min ✓ Tell typists apart exercise 25 min ✓ Writing-style fingerprints exercise 25 min ✓ Cross-device matching exercise 25 min ✓ Identity graphs exercise 25 min ✓ Defences that work exercise 12 min
Module 23

Privacy tech beyond blocking

Explain and build small teaching versions of differential privacy, Private Set Intersection and secure aggregation, explain Privacy Pass and Oblivious HTTP, and choose the right technique for a product problem.

✓ The maths you need exercise 15 min ✓ Differential privacy properly exercise 25 min ✓ Private Set Intersection exercise 25 min ✓ Secure aggregation exercise 20 min ✓ Privacy Pass exercise 12 min ✓ Oblivious HTTP exercise 12 min ✓ Choose the right tool exercise 15 min
Module 24

Anonymity networks and traffic analysis

Explain what each relay in an onion-routing circuit knows, show with simulated flows how timing and page shapes leak through encryption, measure what padding and constant-rate sending cost, and give honest advice on when Tor helps.

✓ Onion routing exercise 25 min ✓ Guards, exits and the first hop exercise 10 min ✓ Traffic analysis exercise 25 min ✓ Website fingerprinting exercise 25 min ✓ Mixnets and the limits exercise 12 min
Module 25

Measure the web like a researcher

Crawl a simulated web of 1,000 sites, build a tracker-prevalence table, find cloaked, bouncing and fingerprinting trackers, train and fairly score a tracker classifier, and write up a measured privacy fix with honest limits.

✓ How privacy studies work exercise 12 min ✓ Crawl the simulated web exercise 25 min ✓ Find hidden trackers exercise 25 min ✓ Train a tracker classifier exercise 25 min ✓ Honest statistics exercise 12 min ✓ Leg 7 project: a study with a fix exercise 50 min
Module 26

Capstone: choose one project

Choose one capstone project that fits what you want to show, scope it so it finishes, aim it at what the hidden world checks, and write up its results honestly.

✓ Choosing and scoping a project exercise 10 min ✓ How the hidden world grades you exercise 12 min ✓ Writing up results honestly exercise 10 min
Module 27

Review and certificate

Review the legs you completed, prove what you learned in a 20-question scenario check, and claim a certificate you can share safely.

✓ Spaced review exercise 15 min ✓ Final check exercise 30 min ✓ Certificate exercise 8 min