Why would anyone want to create this monster?!? (I have to admit it's very well done, though...)
Evercookie: A cookie that undeletes itself from 8 different storages
71–80 of 114 posts
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#72What's truly disturbing is that this absolutely meets a need for a paid gig I'm working on now, where the client wants persistent identity tracking for the purposes of marketing and analytics. (I'm part of the problem, aren't I?)
Now, playing devil's advocate and judging by the number of upvotes this comment got -- couldn't the idea behind evercookie be used for good and not evil in some instances? I'm curious more than anything else. For example, using this persistent cookie as an alternative to having users login?
the essential reason of this kind of persistence is that it has to survive the explicit deletion of the cookie by the user.
Browser offer the user the possibility to remove cookies (manually or delete all), and this is because users want privacy.
This clever library manages to exploit browser features to go around this and store some identification information persistently against the will of the user
If the user doesn't want to delete or disable cookies, then you can use normal cookies for the purpose of legitimate "remember me" functionalities.
However I can understand that not all users know what cookies are, and there are many people who might have cookies disabled by default (sysadmin choice in a company) or somebody told them to do that.
So, you could reason this way:
"There is no point disabling the cookies anymore, since anybody could employ this trick to circumvent it. There are people which disable cookies because an obsolete 'security policies' which is not anymore secure. I want to make a webapp that works for everybody. It requires cookies. People are paranoid but employ obsolete security policies which don't protect them anymore. I can exploit the same trick to circumvent their default security policy for morally good reasons"
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#73Earlier quoted context omitted.
I wrote up a technique for storing values in the cache a little while back, no PNG or canvas necessary. http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracki...
True, but it's more difficult to analyze and attempt to filter a PNG based on content.
You can analyze and filter script that extracts information from PNG, and such unusual script would draw attention.
Cookie stored as a simple variable in a cached JS file is IMHO better solution if you're trying to be sneaky — there's nothing unusual in variable assignment or cacheable JS file.
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#74Yet another moment in human history where someone brilliant decided to do something because they could without asking if they should. Perhaps one day Samy will look back and reflect that he isn't evil man, though he has done evil things. (The thing is I'm not even sure how serious I am. On the one hand, damn, clever. But on the other hand, I can see some truly miserable privacy issues at play here.)
It's not evil. It just shows that "Clear cookies" button is no longer an effective privacy tool.
Browser vendors are aware of this already and working to make evercookie no worse than regular cookie, e.g. Mozilla blocked reading of visited link history, Chrome privacy window has link to Flash LSO controls. All vendors are working towards making it better integrated and more effective against all "evercookies".
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#75In firefox set about:config -> dom.storage.enabled -> false Use flashblock and also block cookies by default. The above causes evercookie to fail for me. No need to block javascript.
Personally, I prefer to allow websites to use those things, but to then clear them between browser sessions. Just use the Firefox BetterPrivacy addon.
I don't know how you work but I keep the browser open 12 hours a day which is a very long session. During that time they can track you across their network of sites if you allow those types of storage by default in the first place.
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#76Earlier quoted context omitted.
Personally, I prefer to allow websites to use those things, but to then clear them between browser sessions. Just use the Firefox BetterPrivacy addon.
I don't know how you work but I keep the browser open 12 hours a day which is a very long session. During that time they can track you across their network of sites if you allow those types of storage by default in the first place.
This is true. I do however use AdBlock, Ghostery, Flashblock and NoScript as well, which should stop the vast majority of that sort of tracking.
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#77Once again I am forced to golf clap for a horrifying idea brilliantly executed.
Of course though it's fairly unnecessary.
If all you want to do is track users, it's far easier to use UserAgent/screensize/plugins/etc to uniquely identify users.
You can then store anything heavier server side.
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#78How will the PNG caching work if you have asked your browser to delete all local files?
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#79Yet another moment in human history where someone brilliant decided to do something because they could without asking if they should. Perhaps one day Samy will look back and reflect that he isn't evil man, though he has done evil things. (The thing is I'm not even sure how serious I am. On the one hand, damn, clever. But on the other hand, I can see some truly miserable privacy issues at play here.)
It's not evil. It just shows that "Clear cookies" button is no longer an effective privacy tool. Browser vendors are aware of this already and working to make evercookie no worse than regular cookie, e.g. Mozilla blocked reading of visited link history, Chrome privacy window has link to Flash LSO controls. All vendors are working towards making it better integrated and more effective against all "evercookies".
> It just shows that "Clear cookies" button is no longer an effective privacy tool.
It has never been. the vast majority (90%+) of browsers are uniquely identifiable simply from useragent, plugins, capabilities etc.
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#80Sure hope everyone got that css history hack fix.
Not sure what you mean by ‘got the fix’ — wouldn’t the fix be completely disabling browser history?
There was a hack to see what pages someone visited. I see that they actually link to a page about that. The problem with that approach would seem to be that it is a cross-domain vulnerability so other domains could detect the history thus ever-cookie data.
Not sure if they have some other mechanism for preventing this problem. I actually thought this problem had been resolved in some manner in many browsers but that doesn't appear to be the case.