Slashdot Mirror
Tracking Users Via the Browser's Cache
Mukund writes to point us to an article he has written about a method of tracking using the browser cache instead of cookies. A demonstration shows that tracking can remain continuous if you clear only cookies or only the cache, but not both. (Firefox's Clear Private Data tool can be set to clear both when closing the browser.)
For those of you who aren't going to RTFA, basically you send a JS file with a unique ID and tell the browser to cache it... then any page that includes that JS script gets your unique ID... even if you disallow all cookies.
My server
But seriously most people leave cookies on and those who know to turn them off are probably the sort of people who regularly clear their cache. The percentage of users you could target with this would be very small for the effort required. If tracking user usage is that important to you then just refuse to serve the page with cookies disabled.
So it still doesn't work on some of us.
Regarding Sourceforge/Google. Did he consider that Google's automated email may have gone to sourceforge alias which was then forwarded to his email address?
Saved by NoScript again. If you're not using it, you really should; it can block exploits before anyone knows they exist! (Since they may require JavaScript, and this would block them. My statement is strictly true.)
Javascript can compromise anonymity! ... Wow. ... What else is new? I mean, even if this particular story hasn't been referenced, I think this could qualify as a dupe ;-)
How often does an average Slash reader close his Firefox window?
(I ask because I leave my Deer Park and Safari windows opened for months.)
If you don't know what AltaVista is (was), get off my lawn.
You can have total anonymity or marginal functionality. Since HTML alone offers almost nothing in the way of functionality (beyond rendering) you need something more (JavaScript, Java, Flash, ActiveX (arguably in ascending order of dangerousness)) to provide even rudimentary functionality. If I'm really so tinfoil-hat that I'm worried about my browser cache betraying what I'm up to, I probably need some medication and/or an air-gap between me and the Internet(s).
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
Move on folks, there's nothing to see here.
This was done last year, by these guys: Browser Recon @ Indiana University
Defenses against this, and other attacks have been created and deployed through two firefox extensions
put out by Stanford University: Safe History and Safe Cache
This stuff ain't new.
"This is how various forums/websites block dissident political posters (sites such as slashdot, metafilter, DU, FR, Fark, etc., all block dissident political posters, otherwise they would not get as much mention in the corporate media, causing those sites to be less valuable)."
uh? err, I think you forgot to take one of your pills.
It is an advert bot, I can't understand how it wasn't modded -1 off topic yet
Copyright infringement is "piracy" in the same way DRM is "consumer rape"
That's all well and good if you your goal is for the user to track himself, but how is the server going to get an image out of the cache?
How would the server known that the image was cached as opposed to not having been downloaded? The javascript file contains the unique ID and then the browser reports this back to the server a GIF can't do that (without javascript).
not because I am a bot, "advert" or otherwise.....
Homo Sapiens Americanus--A documentary in p
Yes it can, when you download a file from the server then the server stores it in the logs, if you visit the page again then the server can check if the file was already downloaded (304 headers) so it should be possible, but it would definately be difficult.
I saw this article on Digg a while back, using an ingenous JavaScript that would look at the *rendering* of a link to determine if you'd been there or not (and possibly upload this information to the remote server). That's kinda scary...
Yes but the URL in the HTML would now point to a different unique ID because it would have refreshed from the server. If the HTML is cached then nothing is requested from the server and so it wouldn't know. Unless of course you use something like the the CSS based method christo linked to.
Thought I'd mention that the parallel IE option seems to be under the "Tools | Internet Options..." dialog, "Advanced" tab, "Security" tree: "Empty Temporary Internet Files folder when browser is closed" (unchecked by default)
The IE "Security" and "Privacy" tab also contains some options that let you handle cookies and Javascripts different ways for different sites; this is why IE exploits that get around the dividers between different classes of sites are noteworthy.
take a look at Firefox' or Mozilla's or Seamonkey's Bookmarks in a plain text editor, it keeps dates about visiting web sites that could be used to track users (that is) if website's servers can access it to look at it. seens like such an unnecessary feature, if i can find a way to shut off the record keeping within bookmarks i would re-write my bookmarks to keep only the name and URL...
Politics is Treachery, Religion is Brainwashing
You don't need to store that unique id in a javscript variable.
Send some image (webbug), say it should be cached, but "must-revalidate" and "hijack" the Etag/IF-*-Match headers.
Doesn't have to. Just have them cache the image using a unique timestamp for Last-Modified (so that you should get a unique If-Modified-Since header) or using a unique ETag. Both should theoretically work to uniquely identify the user, and both can easily be embedded using an image. Combined with Cache-Control: private, this should even work through firewalls.
You are in a maze of twisty little relative jumps, all alike.
The author just didn't use the right browser.
.. paranoid crackpot leftover from the days of Amiga.
This is my own site, but I've been done this for a while and this slashdot story is the ideal to post it. (I don't want to be suffering a slashdot effect on my server.) This is how you can get some sites the user has visited. Post with some details: http://www.alexandre-gomes.com/ Demo: http://www.alexandre-gomes.com/privacy2.html
Use separate browsers, accounts, and/or machines for different purposes. I wouldn't dream of using my regular browser for on-line banking, for example.
since i do html/actionscript/dHTML stuff, i have my browser cache size set to 0. this would technicaly prevent the id to be cached, no? ant
These two firefox extensions can help block some of those style attacks
p df **PDF WARNING!**
http://www.safecache.com/
and
http://www.safehistory.com/
They do this by segmenting your cache and history so that each page only has access to each individual history.
this page has more info about the method they use,
http://crypto.stanford.edu/sameorigin/
and this is a *PDF* on the subject
http://crypto.stanford.edu/sameorigin/sameorigin.
Most people that clear history and caches are doing so to prevent snooping done using the location bar and history toolbars (or analogues) of their browser. You don't want your boss/family to see exactly which non-work-related/porn site you were viewing. While tracking a user may be good for data mining purposes, it's not necessarily a horrible thing for day to day use. I don't like the thought that just about anybody knows my browsing habits, but I don't find it invasive unless those tracking me are going to confront me about it. Let data miners collect their statistics; most folks' machines will not clear their history or cookies or cache. My irregular or perverse browsing habits are but a drop in the statistical pond.
I'll be your candy shop of infinite deliciousity if you'll be my discotheque of endless rump-shaking.
Doesn't help if you wanna display any sort of dynamic content based on the tracking info though, as you only know which user/session has loaded a page after the page has been loaded, when the image can be loaded.
Using the javascript method, you could do something like modify links on the page to add a session=xxx string, or even reload sections of the page. I guess it comes down to what you want your tracking to accomplish.
The revolution will not be televised... but it will have a page on Wikipedia
But with a 'web bug' you could restore the cookie that the user so diligently deleted, and then do a meta-refresh or similar to re-load the page with them logged back in. I'm not sure what would be the most effective method but it doesn't require cookies, needn't require JS, images or CSS (the html page itself could have the cunning cache) and keeps you labelled when you return to the site.
This just shows how much more complicated the issue is than most people realise... and there's no simple fix unless you just turn off etag style caching entirely, and this would be a shame.
Homme petit d'homme petit, s'attend, n'avale
Firefox decides the appropriate time for that...which is usually at around 15 windows and 120 tabs for me
Couldn't this easily be prevented if the browser had an option to only allow Javascript from the original site? I think a similar option for cookies exists and having it for Javascript would be quite useful and prevent other unwanted things.
Stealther is a Firefox extension which temporarily blocks history, cookies as well as referrer header.
On a related note:
http://sourcefrog.net/projects/meantime/
668: Neighbour of the Beast
is it even possible to use the internet on a network and not be tracked, are there any tools or ways to not be seen by a network administrator ???
"... at the current rate of growth, it is estimated that by 2010, 'toss' will have as many as 16,000 meanings"
That's a pretty tossy guess, did you toss that?
How to turn an old laptop into something useful