It's a shame that the actual attack mechanism doesn't seem to be detailed on the github repo, and the link to the article is dead.
Paper author here, here’s a valid link: https://www.cs.uic.edu/~polakis/papers/favicon.pdf
Supercookie: Browser Fingerprinting via Favicon (2021)
11–20 of 105 posts
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#12What is the live demo supposed to do? I just get stuck in an endless redirect loop with a counter going from 1 to 18 and then restarting. I’m using Safari on iOS.
This was fixed after we reported it a few years ago while working on the paper.
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#13Related discussion?
"Tales of Favicons and Caches: Persistent Tracking in Modern Browsers"
https://news.ycombinator.com/item?id=25868742
53 comments on 22-jan-2021
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#14Probably not a popular opinion here but i'm honestly impressed that someone made this work?
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#15What is the live demo supposed to do? I just get stuck in an endless redirect loop with a counter going from 1 to 18 and then restarting. I’m using Safari on iOS.
Android/Firefox it showed me my unique ID after the first 18. Then there was a button to try again ans that put me in the same loop you're having.
Safari on iOS. It goes to 18/18 and then starts over from 1/18 again for me too. I had not pressed any retry button, this happened the first time I visited the page. And I wasn’t even in private browsing mode. Just navigated to it normally.
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#16Needs a (2023) addition in the title
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#17I got different IDs in regular browsing vs incognito mode in Firefox.
Seems like Firefox made changes to address this kind of tracking in version 85.
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#18Reminds me I noticed macOS Safari pulling in the favicons somewhat frequently when I load the new tab page with favorites on it.
Definitely something I don't want. Maybe I should just remove the favorites or maybe I can save them as redirects or HTML or something.
Note I use private windows most often & shoutout Little Snitch for driving the discovery.
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#19I was sure this has been a thing for a while, either that or safari has a UI bug since forever. I regularly get the wrong favicon in specific sites, for example ars technica favicon in reddit
I thought I was the only one! Something in the UI cache is so horribly corrupted and it has been for years on my MacBook, I just gave up hope.
Re: Supercookie: Browser Fingerprinting via Favicon (2021)
#20Previous comments (2021)