Evercookie: A cookie that undeletes itself from 8 different storages
1–10 of 114 posts
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#2Once again I am forced to golf clap for a horrifying idea brilliantly executed.
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#3Once again I am forced to golf clap for a horrifying idea brilliantly executed.
No kidding. I especially liked:
>Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out
and:
>Storing cookies in Web History (seriously. see FAQ)
Brilliant and EVIL. Wow.
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#4Sure hope everyone got that css history hack fix.
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#5Yet another moment in human history where someone brilliant decided to do something because they could without asking if they should.
Perhaps one day Samy will look back and reflect that he isn't evil man, though he has done evil things.
(The thing is I'm not even sure how serious I am. On the one hand, damn, clever. But on the other hand, I can see some truly miserable privacy issues at play here.)
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#6samy is a rockstar. also did the myspace worm thing.
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#7so now that I visited his page, how to I get rid of his supercookie?
could a grease monkey script automatically clean up the supercookies after they have been planted?
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#8Heh, after a quick look at some of the source code for storing the "cookie" in the browser history:
// sorry google.
var url = 'http://www.google.com/evercookie/cache/ + this.getHost() + '/' + name;
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#9Yet another moment in human history where someone brilliant decided to do something because they could without asking if they should. Perhaps one day Samy will look back and reflect that he isn't evil man, though he has done evil things. (The thing is I'm not even sure how serious I am. On the one hand, damn, clever. But on the other hand, I can see some truly miserable privacy issues at play here.)
All of the methods he uses have been known to the web-app security community for a while. He's simply raising awareness of what's already broken.
Keeping these things quiet helps nobody. We need more privacy and security issues to be publicly demonstrated so that they'll get fixed instead of ignored.
As an example, his work exploiting wireless routers to get location is genius. Who would have thought that having your router's wireless MAC available to your internal network allows a website to determine your location to within a few hundred feet? It uses well known and oft ignored attack methods to produce a sensational result with which everyone can immediately identify.
Re: Evercookie: A cookie that undeletes itself from 8 different storages
#10so now that I visited his page, how to I get rid of his supercookie? could a grease monkey script automatically clean up the supercookies after they have been planted?
[deleted]