Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evercookie: A cookie that undeletes itself from 8 different storages

samy.pl

Post reply on HN
Print view View original

81–90 of 114 posts

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#81

Post by eli »

ithkuil wrote: post #72
BenSchaechter wrote: post #51

Earlier quoted context omitted.

Now, playing devil's advocate and judging by the number of upvotes this comment got -- couldn't the idea behind evercookie be used for good and not evil in some instances? I'm curious more than anything else. For example, using this persistent cookie as an alternative to having users login?

the essential reason of this kind of persistence is that it has to survive the explicit deletion of the cookie by the user. Browser offer the user the possibility to remove cookies (manually or delete all), and this is because users want privacy. This clever library manages to exploit browser features to go around this and store some identification information persistently against the will of the user If the user doe…

The deletion isn't always explicit. Several consumer "web security" applications delete cookies automatically and the user may not be aware.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#83

Post by Pistos2 »

Just tried this in Opera. Having never visited the site before, I opened it in a "New Private Tab". Set Opera to reject all [normal] cookies from that domain. Saw an ID number on the page; recorded it. Opened another private tab. Saw a different ID number. Refreshed page; got yet another (different) ID number. Revisited page within same [private] tab (pressed Enter in address bar): got yet another (different) ID number. Did the same in Chrome (regular tabs): saw same behaviour.

Using two different private tabs in Opera, I get two different IDs to start with, but when using the "click to rediscover" buttons, both allegedly private tabs [eventually] end up with the same ID.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#84

Post by kungfooey »

I think it's appropriate to mention that the New York Times just ran an article covering some lawsuits related to tracking users:

http://www.nytimes.com/2010/09/21/technology/21cookie.html?p...

I think the take-away here is that if you're going to use a trick like this, it might be in your best interest to be transparent with your users and offer a way for them to remove all of this information. Of course, if you're using this particular hack then you probably don't want your users to remove the cookie to begin with.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#86

Post by Retric »

mike-cardwell wrote: post #65
mike-cardwell wrote: post #64

Firefox's BetterPrivacy addon defeats all of these techniques. I just tested and confirmed this myself.

I also have Firefox clearing all cookies and all history on exit so that probably helped during my testing. BetterPrivacy dealt with the lso stuff though. I don't know why people allow cookies to persist between browser sessions. I've been clearing them on exit for years now and it really doesn't make it more difficult to use the Web.

I only restart Firefox 1 or 2 times a month. Keeping all those tabs open really is far more useful than having the same sites bookmarked.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#89

Post by gloob »

ithkuil wrote: post #72
BenSchaechter wrote: post #51

Earlier quoted context omitted.

Now, playing devil's advocate and judging by the number of upvotes this comment got -- couldn't the idea behind evercookie be used for good and not evil in some instances? I'm curious more than anything else. For example, using this persistent cookie as an alternative to having users login?

the essential reason of this kind of persistence is that it has to survive the explicit deletion of the cookie by the user. Browser offer the user the possibility to remove cookies (manually or delete all), and this is because users want privacy. This clever library manages to exploit browser features to go around this and store some identification information persistently against the will of the user If the user doe…

Your exploiting a security hole in my browser and overriding my explicit wishes to benefit your company is no more ethical than my exploiting a security hole in your website and "fixing" your database.

Re: Evercookie: A cookie that undeletes itself from 8 different storages

#90

Post by abyssknight »

I'm reading a ton of posts saying how terrible this is, why anyone would do it, and so on. If you don't know, Samy also created the MySpace worm. OWASP built a project called Anti-Samy to combat the work he did on the MySpace worm. He was sentenced to three years probation, 90 days community service and an undisclosed amount of restitution. I'm pretty sure he knows how terrible it is, and that's the point. He spoke at Black Hat 2010 USA as well...

"How I Met Your Girlfriend: The discovery and execution of entirely new classes of attacks executed from the Web in order to meet your girlfriend. This includes newly discovered attacks including HTML5 client-side XSS (without XSS hitting the server!), PHP session hijacking and weak random numbers (accurately guessing PHP session cookies), browser protocol confusion (turning a browser into an SMTP server), firewall and NAT penetration via Javascript (turning your router against you), remote iPhone Google Maps hijacking (iPhone penetration combined with HTTP man-in-the-middle), extracting extremely accurate geolocation information from a Web browser (not using IP geolocation), and more."

Post reply on HN