Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evercookie: A cookie that undeletes itself from 8 different storages

samy.pl

Post reply on HN
Print view View original

11–20 of 114 posts

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#11

Post by danilocampos »

kogir wrote: post #9
danilocampos wrote: post #5

Yet another moment in human history where someone brilliant decided to do something because they could without asking if they should. Perhaps one day Samy will look back and reflect that he isn't evil man, though he has done evil things. (The thing is I'm not even sure how serious I am. On the one hand, damn, clever. But on the other hand, I can see some truly miserable privacy issues at play here.)

All of the methods he uses have been known to the web-app security community for a while. He's simply raising awareness of what's already broken. Keeping these things quiet helps nobody. We need more privacy and security issues to be publicly demonstrated so that they'll get fixed instead of ignored. As an example, his work exploiting wireless routers to get location is genius. Who would have thought that having your…

Important point. Better to let everyone see the truth of evercookie than let the bad guys enjoy it in the dark.

Still, with it all packed up so tidily, a few rascals will do something interesting with it.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#14

Post by kuahyeow »

swankpot wrote: post #7

so now that I visited his page, how to I get rid of his supercookie? could a grease monkey script automatically clean up the supercookies after they have been planted?

Good Q. In Chrome, you can add a block action under the 'Exceptions' list. You can add blocks for Cookies(includes HTML5 storage), Javascript, and Images (shudder).

Before you do that though, have a look at what info is stored under samy.pl. Nice to see Chrome list HTML5 storage and cookies etc in one place.

* I'm not sure whether the above is really effective. * Repeating this for N sites that uses this is going to be fun. There's always the whitelisting approach, which is available in Chrome too.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#15

Post by barrybe »

danilocampos wrote: post #11
kogir wrote: post #9

Earlier quoted context omitted.

All of the methods he uses have been known to the web-app security community for a while. He's simply raising awareness of what's already broken. Keeping these things quiet helps nobody. We need more privacy and security issues to be publicly demonstrated so that they'll get fixed instead of ignored. As an example, his work exploiting wireless routers to get location is genius. Who would have thought that having your…

Important point. Better to let everyone see the truth of evercookie than let the bad guys enjoy it in the dark. Still, with it all packed up so tidily, a few rascals will do something interesting with it.

Also now that it's packed up so tidily, we'll probably get some better tools for blocking/removing all of those tricks. Think of it like an Acid3 test for browser security.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#17

Post by danilocampos »

barrybe wrote: post #15
danilocampos wrote: post #11

Earlier quoted context omitted.

Important point. Better to let everyone see the truth of evercookie than let the bad guys enjoy it in the dark. Still, with it all packed up so tidily, a few rascals will do something interesting with it.

Also now that it's packed up so tidily, we'll probably get some better tools for blocking/removing all of those tricks. Think of it like an Acid3 test for browser security.

That's a good perspective. It's my fervent hope someone names their tool everenema.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#18

Post by nl »

Groxx wrote: post #3
shib71 wrote: post #2

Once again I am forced to golf clap for a horrifying idea brilliantly executed.

No kidding. I especially liked: > Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out and: > Storing cookies in Web History (seriously. see FAQ) Brilliant and EVIL . Wow.

Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out

That's pretty "nice". It might be possible to "improve" it by storing metadata inside the PNG, and then reading it by parsing it out of the raw data after the call to getDataURL().

I haven't tried this though, and it's possible browsers drop the metadata when they recreate the image. The spec says A future version of this specification will probably define other parameters to be passed to toDataURL() to allow authors to more carefully control compression settings, image metadata, etc.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#20

Post by toolate »

Groxx wrote: post #3
shib71 wrote: post #2

Once again I am forced to golf clap for a horrifying idea brilliantly executed.

No kidding. I especially liked: > Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out and: > Storing cookies in Web History (seriously. see FAQ) Brilliant and EVIL . Wow.

I wrote up a technique for storing values in the cache a little while back, no PNG or canvas necessary.

http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracki...

Post reply on HN