Spaced review
Why it matters Much of what we read only once fades within weeks. The point of this course is that, months from now, you still spot a pre-ticked box on a cookie banner, a tracking ID stuck on the end of a link, or a page that sends your form data to a stranger. A few minutes of review, spread out over time, is what makes that stick.
You have come a long way. Leg 1 started with what a website knows the moment you arrive. By Leg 4 you were reasoning about encryption, private AI and threat models. This lesson pulls those threads together and sets you up to keep them.
Watering, not flooding
Think of memory like a plant. A full bucket of water once a month drowns it and then leaves it dry. A small glass every few days keeps it alive with far less water in total. Study works the same way: short reviews with gaps in between beat one long cram session.
Spaced review: coming back to the same ideas several times, with the gaps between visits growing longer each time you remember well.
Retrieval practice: pulling an answer out of your own memory before you look it up, like finding your way home without the map. The small effort of remembering is what strengthens the memory. Rereading feels productive, but it mostly checks that the page looks familiar.
How review works in this course
Every time you passed a quiz in this course, its questions were quietly added to your Daily Review. The Daily Review brings back questions that are due. If you remember one well, it comes back after a longer gap. If you miss it, it comes back soon.
The gaps start at about a day, then about a week, then grow from there. The whole review pool lives in your own browser, in local storage: a small store a site keeps inside your browser, the same kind you met in Leg 1 as one of the places a tracker can hide an ID. It is not sent anywhere unless you choose to back up your progress or save it across devices, and it never affects your grades or your certificate. If you clear your site data, the pool goes with it, so use the progress backup if you want to keep it.
| When | What to do | Time |
|---|---|---|
| Today | This lesson, then the final check | about 45 minutes |
| Tomorrow | Your first Daily Review | 5 minutes |
| Next week | Daily Review again, plus one prompt from the list below | 10 minutes |
| Each month | Daily Review, and redo one small part of your Leg 1 audit | 15 minutes |
The core in one page
Before the quiz, read these summaries. Cover each one with your hand first and try to say the main ideas out loud. Then check.
Leg 1: How you are watched. A site sees your IP address, headers and referrer the moment you arrive. Cookies are like cloakroom tickets: the site hands you one and you show it on every return visit. A third-party cookie belongs to a company embedded on many sites, so one ticket can follow you across all of them. Fingerprinting recognises your browser from its traits instead of a ticket. Pixels, beacons, hidden scripts and apps add more watchers. Consent banners often nudge you toward "Accept", and you learned what an honest banner looks like and how to switch on Global Privacy Control.
Leg 2: See it in code. You read raw HTTP, parsed Set-Cookie by hand and built a cookie jar. In the practice world you read AdCo's tracker log as it joined one fake user's visits across three shops, then watched it break when storage was partitioned (one cookie jar per top-level site). You built a blocker from a filter list, judged it with precision and recall, and learned that hashing an email is not anonymising it: a known list can be hashed and matched.
Leg 3: Build sites that do not leak. Script injection (XSS) happens when a page treats visitor text as code. The fix is escaping by default, then a Content Security Policy as a second wall. Every embed on your site is a guest that can watch your visitors, so you audit third parties, use Subresource Integrity, and switch off features with Permissions-Policy. Privacy by design means collecting less, counting without following people, and deleting on a schedule.
Leg 4: The privacy engineer's toolkit. HTTPS hides the page and its contents, not the fact that you talked to that server. End-to-end encryption means only the people at the ends hold the keys. Private AI means knowing where your prompts go and preferring on-device models or redaction. A threat model answers three questions: what am I protecting, from whom, and what could go wrong.
If you also took the deep half (Legs 5 to 7)
Leg 5: Below the page. Packets are envelopes inside envelopes, and each layer tells its carrier something. DNS questions are a diary of where you go. Encrypted DNS hides them from the network but shows them to your resolver. Browsers can be recognised by their TLS and HTTP/2 handshakes before a page even loads.
Leg 6: Inside the browser engine. "Same site" depends on the public suffix list and the scheme. Every storage area needs a partition key, and the ones an engine forgets become leaks. Defences such as bounce-tracking detection and farbling always cost some breakage, which you measured.
Leg 7: The person, and the tech that protects them. Typing rhythm, writing style and identity graphs can link a person across devices. Differential privacy, Private Set Intersection, secure aggregation, Privacy Pass and Oblivious HTTP each control who learns what. Onion routing splits knowledge across relays, but timing can still give flows away.
Your Daily Review already holds the questions from these legs' quizzes, so keep them in the same routine.
Explain it to a friend
The strongest review is explaining an idea to someone who has never heard of it. Pick one prompt a week:
- Why does clearing cookies not stop fingerprinting?
- Why did your Leg 2 tracker break when storage was partitioned?
- What does a Content Security Policy do that escaping does not?
- What can the network still see when you use HTTPS?
If you get stuck halfway through, that is useful: it shows you exactly which lesson to reopen.
A common misconception
"If I get a review question wrong, I have failed." Not at all. A miss simply brings the question back sooner, and a question you had to work for tends to stay with you longer than one that felt easy. The quiz below needs every answer right to pass, but you can retry as often as you like, and each answer comes with an explanation.
Recap
- Short, spaced reviews beat one long cram, and recalling beats rereading.
- Your Daily Review already holds every quiz you passed, kept in your browser unless you choose to back it up.
- Each leg has a one-paragraph core: say it out loud before you check it.
- Getting a question wrong is part of review, not a failure.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.