Introducing the Invulnerable Evercookie

An anonymous reader writes "Using eight different techniques and locations, a 'security' guy has developed a cookie that is very, very hard to delete. If just one copy of the cookie remains, the other locations are rebuilt. My favorite storage location is in 'RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out' — awesome."

Comments

Not hard to beat at first glance.

[grub]

evercookie is written in JavaScript and additionally uses a SWF (Flash) object for the Local Shared Objects and PHP for the server-side generation of cached PNGs.
[...]
If a user gets cookied on one browser and switches to another browser as long as they still have the Local Shared Object cookie, the cookie will reproduce in both browsers.

Well, the site's EXAMPLE failed on my box. That's NoScript at work. If you use BetterPrivacy (another FF extension), it removes the LSO at browser shutdown.

YMMV

Re:Not hard to beat at first glance.

[Shrike82]

That's NoScript at work. If you use BetterPrivacy (another FF extension), it removes the LSO at browser shutdown. YMMV

I take your point, but most people use neither of these things and will be at the mercy of persistent tracking. Of course anyone who doesn't know what a cookie is probably won't be affected by this in any way (i.e. they're already being tracked through regular cookies). Especially since "Private Browsing" modes have been shown to retain information.

Re:Not hard to beat at first glance.

[Inda]

Failed for me too.

The text displayed, an error was generated, then "The page cannot be displayed"

Internet Explorer cannot open the Internet site http://samy.pl/evercookie/. Operation aborted

Re:Not hard to beat at first glance.

[rwa2]

... soon to be followed by the evercookiemonster by same "security" guy, right?

http://farm1.static.flickr.com/119/299000164_4d7398dbf6.jpg?v=0

Re:Not hard to beat at first glance.

[grub]

but most people use neither of these things

True enough. My brother uses FF and AdBlock+ but won't install NoScript. Flat out refuses to, saying he hates having to whitelist everything. I've tried explaining that over (reasonable) time the sites you visit are all categorized and you rarely need to add exceptions. Even newly visited sites are fine much of the time.

"Give Me Convenience or Give Me Death" as the Dead Kennedys album says...

Re:Not hard to beat at first glance.

[BrentH]

NoScript (and NotScript, which I use in Chromium these days) should have an option to tenp-allow JS from the domain you're on automaticaly. I think it would get n00b-proof for non-techies to use it.

Re:Not hard to beat at first glance.

[JustABlitheringIdiot]

Well, the site's EXAMPLE failed on my box. That's NoScript at work. If you use BetterPrivacy (another FF extension), it removes the LSO at browser shutdown.

So NoScript blocks this? It also says on the page that clearing the LSO will no matter so I don't think that BetterPrivacy will help with this.

Re:Not hard to beat at first glance.

[Anonymous Coward]

True enough. My brother uses FF and AdBlock+ but won't install NoScript. Flat out refuses to, saying he hates having to whitelist everything. I've tried explaining that over (reasonable) time the sites you visit are all categorized and you rarely need to add exceptions. Even newly visited sites are fine much of the time.

Use PrefBar.

Cost: One horizontal toolbar's worth of vertical space.

Benefit: User-configurable single-click access to toggle checkboxes that control not only Javashit, Flash, and Java, but also automatic geolocation reporting, image loading (tired of seeing 10 copies of an almost-NSFW 300x480 .gif of bouncing boobs that some idiot used as a .sig when all you want to do is read about how his turbocharger install went?), colors (hate that web designer who put red text on a blue swirly background?), cookies, send-Referrrer-ID, a dropdown to select a user-agent (lookin' at you ExpertSexChange, who hides the answer from everyone but the Google Crawler), and more.

Re:Not hard to beat at first glance.

[h00manist]

who doesn't know what a cookie is probably won't be affected by this in any way (i.e. they're already being tracked through regular cookies).

There's all kinds of databases on people available. Search and you shall find.

All data circulates easily and is simply very hard to stop. It is indeed like speech, it just happens, anyone can do it. Copyrighted data, personal data, credit data, secret data, whatever. Bottom line, gathering and selling various gray-black-market data is illegal immoral etc, and very doable and very interesting for companies and organizations of all types. Not unlike downloading movies is for many - illegal but easy and interesting data. It's the interests that are different.

Re:Not hard to beat at first glance.

[Anonymous Coward]

NoScript (and NotScript, which I use in Chromium these days) should have an option to tenp-allow JS from the domain you're on automaticaly. I think it would get n00b-proof for non-techies to use it.

It (NoScript) does.

You can Temp allow all, or just temp allow certain domains. Close your browser and they are blocked again on your next visit.

Re:Not hard to beat at first glance.

[Kvasio]

running browser in Sandboxie would also do the trick

Re:Not hard to beat at first glance.

[jridley]

I also run NoScript + BetterPrivacy. Also CsFire, though it's difficult to leave that enabled, since so many sites (like PayPal) won't work with it enabled.

If all that ever fails, I'll just start running PortableFirefox and restoring all the files from a read-only master image on every browser startup.

Re:Not hard to beat at first glance.

[interval1066]

"...most people use neither of these things..."Then woah unto them. If you're not clued in by now to simple web security measures I recommend you do so. I use ff exclusively because of NoScrypt and BP. Doing anything different is simply stupid. Sorry Chrome.

Re:Not hard to beat at first glance.

[Anonymous Coward]

Yup. Turns out these won't stick in my primary browser.

1. HTML cookies: Session only. Browser closes, cookies gone.
2. Flash cookies: No Flash. Where Flash is enabled, it can't store Flash cookies.
3. Cached PNGs: No persistent cache, RAM only. Browser closes, cached files gone.
4. Web history: No history.
5. HTML5 Session Storage / Local Storage / Global Storage / Database Storage via SQLite: Not available.

Re:Not hard to beat at first glance.

[mlts]

Thanks for the reminder. Last time I looked into sandboxie, it did not support 64 bit operating systems, which is does now. Using it is a lot easier on the CPU and more convenient than creating a VM with a Web browser in it and rolling it back when done for that session.

With Unity mode on VMWare Workstation or the equivalent on Windows 7 and XP Mode, keeping a Web browser in a sandbox isn't that much work, especially if one is having to use a backlevel version of IE for some websites that force IE6, and even does JS/VBScript checks to check for a changed UserAgent field.

Re:Not hard to beat at first glance.

[js_sebastian]

evercookie is written in JavaScript and additionally uses a SWF (Flash) object for the Local Shared Objects and PHP for the server-side generation of cached PNGs. [...] If a user gets cookied on one browser and switches to another browser as long as they still have the Local Shared Object cookie, the cookie will reproduce in both browsers. Well, the site's EXAMPLE failed on my box. That's NoScript at work.

Same here. But what if this script were used by a website for which you need or want to enable scripting?

If you use BetterPrivacy (another FF extension), it removes the LSO at browser shutdown.

Which helps, but doesn't solve the problem, since the cookie is also stored in a cached PNG's RGB values and in your browser history, and in a bunch of HTML5 related storage options that your browser may or may not support and betterprivacy may or may not have been updated to take care of.

Re:Not hard to beat at first glance.

[dc29A]

Firefox 4 Beta 6 with AdBlock+ and changing %homepath%\Application Data\Macromedia from folder to a system file stops this. You do have to set Firefox to clear all browsing data upon exit. Tested also flushing the browser data while browser being open and it works as well. The site can't keep 'evercookies' on my machine. However changing Macromedia folder from folder to file will break a few websites that use heavily flash.

Re:Not hard to beat at first glance.

[cgenman]

Javascript seems to be key to getting HTML 5 to work. I wouldn't count on being able to broadly NoScript forever.

Re:Not hard to beat at first glance.

[dkleinsc]

Thhe purpose of "Private Browsing" isn't to protect your privacy from websites while you surf, it's to protect your privacy from your SO when she comes home and sees your web history.

Re:Not hard to beat at first glance.

[wvmarle]

Not having NoScript, but FlashBlock, some interesting observations - that indicate a bug in FF even.

The cookie stored in the history data is not updated. I haven't poked through my history but guess I have several stored there now, and evercookie only reads the first it finds. Hence that's the oldest one always. A bug in the storage algorithm.

More seriously, it seems there is data leaking from Private Browsing to normal browsing mode, while Private Browsing shouldn't leave any traces of the session. When in Private Browsing the history storage fails (FF doesn't keep history so it should fail), the rest works fine.

However when switching back from Private to normal mode (with the evercookie web site still open in a tab, reopening when switching to normal mode), the pngData mechanism still shows the last cookie ID from the Private browsing session! If private is as private as it should be, this should not be possible. I'm not in the mood to start poking deeper, not too familiar with JS anyway, I bet there are /.ers that can do that much better than me. This to me appears to be a bug in FF (version 3.6.10 for me).

Re:Not hard to beat at first glance.

[0111 1110]

Actually it doesn't perfectly support 64 bit, but it will run and probably do a good enough job. You might also want to try Shadow Defender. It has fully supported 64 bit for a long time. It is paid software, but I think there are some free versions floating around if you have a parrot on your shoulder.

Re:Not hard to beat at first glance.

[hairyfeet]

Actually there is an even easier way to make it noob friendly, we just need a good coder to implement it. Being a PC repairman I get to watch noobs all day, and the one hangup they all seem to have with NoScript is having to click through a dozen blocked elements to play a video. They quickly get frustrated and either ask me or find a way to just turn it off. So what we need is a choice at first install between a "simple" and an advanced interface, with advanced being the current default and an easy way to switch between the two. On the simple interface one would have two buttons: Play Video, and temporarily allow all.

With this simple change we could get NoScript into the hands of the masses, and surely there has to be a simple way to scan for the main video on a page, after all there are only a few main containers being used on the web these days.

Re:Not hard to beat at first glance.

[edxwelch]

It probably could easily be modified to work even with javascript disabled, as it's using flash and java as well.

Re:Not hard to beat at first glance.

[advid.net]

Well, the site's EXAMPLE failed on my box. That's NoScript at work.

Also failed on mine. NoScript and AddBlockPlus here.

I think this is a clear demonstration of the advantage of those modules : they protect you against unknown and future risks.

I think it's worth the white list management, not that much work.

Re:Not hard to beat at first glance.

[Anonymous Coward]

NosSript is great... but it can't catch everything. An excellent addition to NoScript is https://www.requestpolicy.com/faq

How does RequestPolicy help you where NoScript does not? RequestPolicy will protect you from various attacks that NoScript will not (such as CSRF attacks, though there some special cases that NoScript protects against) and will give you greater privacy while browsing. Also, RequestPolicy will give you finer-grained control over JavaScript and plugins when you use it with NoScript. For example, if you whitelist a domain with NoScript to allow it to run JavaScript, then that domain will also be allowed to run JavaScript when you are on any other site that you have whitelisted with NoScript. RequestPolicy makes sure that when it is JavaScript from a third-party site, it will still be restricted unless you have allowed those cross-site requests.

Re:Not hard to beat at first glance.

[Anonymous Coward]

I love retards who think they know tech.. the option you refer to has existed in NoScript for a long time..

"Temporarily allow top-level sites by default"

Re:Not hard to beat at first glance.

[rjstanford]

I love retards who think they know tech.. the option you refer to has existed in NoScript for a long time..

"Temporarily allow top-level sites by default"

I don't use NoScript personally, but I'm far from a tech-newbie. Having said that, nothing in the line you quoted would cause me to believe that this would "Allow javascript from the site you're on to run while blocking 3rd party scripts." Nothing at all. If anything, "Top-level" would seem to imply that JS from "domain.com" would be enabled, but "somewhere.domain.com" would not - which is just weird. Also, the conjunction of "temporarily" and "by default" is very strange and hard to read, even once you know what its supposed to mean. I'd guess that checking that would allow "top-level" JS to run by default, but the next time I started the browser it would go back to being disallowed - but I don't think that's what you're describing either.

"Allow javascript from the site you're on to run while blocking 3rd party scripts." - much harder to mis-understand.

Re:Not hard to beat at first glance.

[ne0n]

indeed, Chromium's Incognito mode circumvents this "everlasting cookie" neatly. Firefox Private mode might do the same. No telling what IE will do.

Re:Not hard to beat at first glance.

[Max Romantschuk]

I just use an alternate Firefox profile for this. That way you are still free to keep bookmarks. ;)

Re:Not hard to beat at first glance.

[Anonymous Coward]

The option in question is only the first one on the first tab when you open the NoScript options screen.

Re:Not hard to beat at first glance.

[Onymous Coward]

The people who won't be affected are the ones who are already vulnerable to regular cookies, he means to say. Or, the new technique of making cookies persistenter has no additional effect on folks who don't delete cookies because they're already easily tracked.

Though I did find your comment interesting. "... gathering and selling various gray-black-market data is illegal, immoral, etc. ..." What would happen if people built an open database and gave it all away?

Grassroots gratis database of personal data.

It would have some technical challenges, but what ideas does this concept prompt?

Re:Not hard to beat at first glance.

[Anonymous Coward]

So where's the ACTA to protect my privacy?

Re:Not hard to beat at first glance.

[Anonymous Coward]

"Allow javascript from the site you're on to run while blocking 3rd party scripts." - much harder to mis-understand.

This is exactly what RequestPolicy does. Much nicer to use than NoScript. Too bad I'm on Chrome now.

Re:Not hard to beat at first glance.

[fishbowl]

>I take your point, but most people use neither of these things and will be at the mercy of persistent tracking.

Life is too short to worry about horses that won't drink when led to water.

Re:Not hard to beat at first glance.

[rjstanford]

The option in question is only the first one on the first tab when you open the NoScript options screen.

And how, exactly, does that make the language I was complaining about easier to understand? It doesn't matter how accessible the checkbox is if nobody knows what happens when you check it.

Re:Not hard to beat at first glance.

[Entropy98]

I uploaded the example code, you can try it out here

For me it stores data using only 2 methods in FF though "Clear Recent History" fails to remove both.

In IE8 the script fails to work for me:

Message: Object doesn't support this property or method
Line: 263
Char: 3
Code: 0
URI: http://fiestafan.com/ec/evercookie.js

Message: Object doesn't support this property or method
Line: 263
Char: 3
Code: 0
URI: http://fiestafan.com/ec/evercookie.js

Message: Object doesn't support this property or method
Line: 263
Char: 3
Code: 0
URI: http://fiestafan.com/ec/evercookie.js

Message: Object doesn't support this property or method
Line: 263
Char: 3
Code: 0
URI: http://fiestafan.com/ec/evercookie.js

Re:Not hard to beat at first glance.

[Danse]

I love retards who think they know tech.. the option you refer to has existed in NoScript for a long time..

"Temporarily allow top-level sites by default"

I don't use NoScript personally, but I'm far from a tech-newbie. Having said that, nothing in the line you quoted would cause me to believe that this would "Allow javascript from the site you're on to run while blocking 3rd party scripts." Nothing at all. If anything, "Top-level" would seem to imply that JS from "domain.com" would be enabled, but "somewhere.domain.com" would not - which is just weird. Also, the conjunction of "temporarily" and "by default" is very strange and hard to read, even once you know what its supposed to mean. I'd guess that checking that would allow "top-level" JS to run by default, but the next time I started the browser it would go back to being disallowed - but I don't think that's what you're describing either.

"Allow javascript from the site you're on to run while blocking 3rd party scripts." - much harder to mis-understand.

I don't think that will help as much as you're hoping it will. So much is served up through CDNs with different domain names, that the video you're trying to play probably still won't play.

Re:Not hard to beat at first glance.

[h00manist]

I think the place to start is in releasing the data of the most powerful people, those that should be accountable to everyone. Airing out out the secrets in these databases, and causing some social stirs. Most people don't even know such data on them exists, and they would ignorantly blame the leaks do everything to shut it down, some would be smarter and attack the original sources. Say someone published all credit databases, experian etc, credit cards data, banking data, transfers, all police records, all phone call records. Everyone published everything they know about everyone else. Everyone would know about who is amassing millions and billions, who they work with, and where it came from. The end of secrets. Of course a black market of off-record transactions would start, but it may not thrive. And there would be anger, controversy, physical aggression, police and fbi action, etc.

"That's the great thing about evercookie"

[tomalpha]

From TFA:

That's the great thing about evercookie

I disagree. Strongly.

I guess it's good that this is out in the open so we know about it, and hopefully the major browsers can all do something to help prevent it. But still: don't like, don't like at all.

Re:"That's the great thing about evercookie"

[Pharmboy]

You can't blame someone for a "method" when it is openly explaining how it is doing what it is doing, using the existing software. Yes, he is pushing it as a "feature", when it is in fact due to a flaw in the overall design of all browsers. It is much better for the information to be released like this than to find out a year after it is fully integrated into every piece of malware.

Hacking at its finest.

Re:"That's the great thing about evercookie"

[Moryath]

No kidding. It was bad enough in the days when there were all sorts of cookies throwing illegal characters (wildcards, normally path-related characters, etc) in the filename to prevent deletion. Particularly when the "cookie" itself didn't actually have data, they just tried to stick every bit of info into the fucking filename.

And of course there have been all the programs that hide "registration" data - or even, sometimes, "never work again" flags - somewhere deep in randomly-named registry keys as pure numeric values to be next-to-impossible to hunt down unless you know precisely what you're looking for. I remember one of these that had a bomb in it designed to fuck up the program if you changed your system clock more than a few hours (non-permanent license, paranoid schizophrenic fucktards at the company afraid that people would reset their clock to keep the program running...Hi SPSS!) Boy was my coworker surprised when she went overseas and tried to resync her laptop to local time.

But just wait, pretty soon someone's going to take the Everlasting Gobstopper Cookie, add in a more malicious payload, and we're off to the races. There's no possible justification for this project.

Re:"That's the great thing about evercookie"

[Anonymous Coward]

it's not his research either. this has already been observed in the wild and already reported by ars technica.

http://arstechnica.com/tech-policy/news/2010/08/ad-firm-sued-for-allegedly-re-creating-deleted-cookies.ars

the advertisement company got already sued for it.

Re:"That's the great thing about evercookie"

[PhilHibbs]

There's no possible justification for this project.

"To show everyone what the black hats and spammers are going to be doing", sounds good enough to me.

Re:"That's the great thing about evercookie"

[clone53421]

It was bad enough in the days when there were all sorts of cookies throwing illegal characters (wildcards, normally path-related characters, etc) in the filename to prevent deletion. Particularly when the "cookie" itself didn't actually have data, they just tried to stick every bit of info into the fucking filename.

That would be a bug in Internet Explorer which moronically uses the system filesystem to index cookies instead of storing them in a more sane data structure. If it didn’t sanitize the names properly before creating files, well, that’s just icing on the cake when it comes to stupidity...

Re:"That's the great thing about evercookie"

[Lion XL]

yes, but now he has not only exposed these flaws, but created a working proof of concept which will only spur black hat usage. I see no reason why a a cookie needs to be persistent forever!!!

Bot writers will definitely exploit this, as will malware writers. I guess its time for me to jump on the 'I HATE JS TRAIN', even though I need to use it daily at work...

Why cant people accept and use things as they were intended? I mean..OK..its great he pushed the envelope, very creative, very insightful...but do we need it? Have we not yet learned that once Pandora's box is open you cant just shut it?

Re:"That's the great thing about evercookie"

[OhHellWithIt]

I'm hoping his site is slashdotted soon.

Re:"That's the great thing about evercookie"

[risinganger]

but closing your eyes and wishing really hard isn't a viable option either. When it comes to stuff like this it's as if everybody has access to Pandora's box and you're wanting everybody to a) not open it and b) not abuse it if they have opened it. This sort of thing needs to be publicised so that the developers of browsers help to plug the holes they didn't think of when they first designed these mechanisms.

Re:"That's the great thing about evercookie"

[mlts]

The thing is that people here on /. consider forever cookies pointless at best, and a security threat at worst, there are people out there who make their cash on identifying machines, correlating them with user behavior, and selling that to people so they are able to figure out at what time of day or week you are most interested in their crap and how much you are willing to pay for what they are selling.

Gambling websites use third parties whose sole job in life is keeping a list of unique Web browsers and assigning a weight of profitability on them. If someone seems to be cheating, that computer gets silently banned across all the sites the third party helps out, just as if someone gets banned from one casino for cheating, they get banned from almost every casino on the Strip at the same time. This is a big business. Look up "iesnare" for more on this.

Couple the ease of using the PNG data mechanism to store permanent results, with the fact that it is easy to get a unique signature of a user due to the fonts they have and other items reported, and you will find that being able to identify people uniquely is not just possible, but easy and automated for firms.

The solution? More than just clearing out cookies in the browser, due to all the stuff stored by shared objects. Stuff like the BetterPrivacy add-on in Firefox help, as well as add-ons that prevent it in the first place. However, the only real solution is either sandboxing everything browser related like sandboxie, or running the browser in a completely different OS space that dumps all its changes.

Re:"That's the great thing about evercookie"

[mcgrew]

is much better for the information to be released like this than to find out a year after it is fully integrated into every piece of malware.

Malware (viruses, trojans, etc) is already using similar tricks. And that's exactly what this is -- malware. Anything that takes control over someone else's eqipment not only without their permission but decidedly AGAINST what they want is malware. Using tricks like this should be illegal. Is it legal for me to cross two of the spark plug wires in your car not only without your permission, but after you've explicitly told me not to and have connected them properly after the first time I crossed them? That's vandalism, and it's exactly what this is doing.

Hacking at its finest

No, blackhatting at its "finest". Hacking at its finest would be hacking out something to defeat this malware.

Re:"That's the great thing about evercookie"

[rabtech]

"To show everyone what the black hats and spammers are going to be doing", sounds good enough to me.

Fixed it for you: "To show everyone what the black hats and spammers are doing".

Re:"That's the great thing about evercookie"

[riegel]

No, what he is doing is not wrong. What others might do with it may be wrong. Using your logic we should outlaw copiers as they might be used for copyright infringment.

I use web applications that I want to follow me from browser to browser, I want it to know who I am, and I want it to be convenient. Just because you see no positive use cases for this kind of thing doesn't mean anyone using it is using it for nefarious purposes.

I wholey agree that doing this sort of thing without someones consent or permission is wrong. That doesn't mean doing it is wrong.

Re:"That's the great thing about evercookie"

[Anonymous Coward]

"To show everyone what the black hats and spammers are going to be doing", sounds good enough to me.

Fixed it for you: "To show everyone what the black hats and spammers are doing".

Fixed it for you: "For teh lulz".

Re:"That's the great thing about evercookie"

[sc0p3]

I'm sure this logic could be applied to the atomic bomb?

Are we really better off having it?

Re:"That's the great thing about evercookie"

[mcgrew]

Just because you see no positive use cases for this kind of thing doesn't mean anyone using it is using it for nefarious purposes.

You might want to read my comment again; I may not have been clear. I like cookies when they're useful to ME. They store my slashdot and email passwords, for example. But if I want to delete or disable a cookie, it's wrong for the site to try to re-establish the cookie that I deliberately removed from my machine; that's blackhat to the hilt and is completely unacceptable.

Re:"That's the great thing about evercookie"

[quintin3265]

Well, I disagree with this disagreement. In well-designed browsers, cookies don't simply pull information out of the air. The user has to enter that information or take actions that are then reported back to the server. I've always been of the opinion that, if you don't want someone to know what you're doing, then you should seriously reconsider whether you should do it or not. We spend our lives attempting to hide our actions from others and present a "fake" persona to the world. Imagine what the world would be like if people actually told the truth. I can see an immediate positive aspect of these cookies: permanently banning people from forums. Anyone who has ever run a website that accepts user input knows that there are hackers or griefers who attempt to ruin things for everyone. With dynamic IP addresses, it's difficult to track these people down. However, unless the user reinstalls Windows, these cookies provide an easy way of denying access.

Re:"That's the great thing about evercookie"

[riegel]

Cookies have limitations. Evercookie helps me overcome some of those limitations. That could be a good thing and that could be a bad thing depending on who is using it and for what purpose. It also depends on whether you are iformed of this use.

But what evercookie is doing is NOT blackhat and is perfectly acceptable. There is nothing hidden about what Evercookie is doing. Now someone could use the technology that evercookie is offering in an unacceptable way that is no more the fault of evercookie than copyright infringment is the fault of the internet.

Re:"That's the great thing about evercookie"

[Pharmboy]

I'm sure this logic could be applied to the atomic bomb? Are we really better off having it?

Yes, because it was inevitable.

What if Russia (thus, Stalin) had figured it out 3 years before us and used it against German aggression, where would be be? Or if Japan has discovered years before and decided that delivering a nuke to Pearl Harbor (or anywhere on the West Coast) would be much safer for their military personel? If it was to be discovered (and it *was* inevitable) in the general era, who would you have rather have doing the discovery? Spain (Francisco Franco)? Italy (Benito Mussolini)? Heaven forbid, Germany? Even if France or the UK had it earlier, they might have been overrun in a single mass push by Germany (It is doubtful that Chamberlin, Philippe Pétain, or even Charles de Gaulle would have used it anyway). Keep in mind, back then, the US wasn't quite so Imperialistic, so everyone was plenty happy we figured it out.

Or you could wish that "no one ever will ever figure out how to make a nuclear bomb", which is downright silly. If any 'thing' is possible, then eventually it will be done, in its own time. The only reason we didn't figure it out even sooner was that the computer industry was in its infancy. Today, using the same math and designs (and people) used back then, you could do the same feat on a smart phone in a fraction of the time.

Re:"That's the great thing about evercookie"

[Anonymous Coward]

> I've always been of the opinion that, if you don't want someone to know what you're doing, then you should seriously reconsider whether you should do it or not.

Sometimes I have sex. Sometimes I take a big stinky dump. I don't particularly want people to know about either one. Should I stop?

Re:"That's the great thing about evercookie"

[Neil Boekend]

Cookies have limitations. Evercookie helps me overcome some of those limitations.

Please enlighten me: what limitations do cookies have that I do not want them to have (as customer) that are solved by evercookies?
If someone deletes a cookie it should be deleted. Evercookie is created to prevent the deletion of cookies. That is what I would call evil.
The limitations of cookies that are solved with evercookie are only a problem for people wanting to gather data against the wishes of the customer. Those are the people that I do not want to gather data.

Re:"That's the great thing about evercookie"

[yayazozzy]

You can "blame" someone if many people agree that the creating and the telling had an ulterior and potentially self beneficial, or destructive intent. Everyone who decided to click on the link to Samy Kumar's personal site got the Evercookies stuffed in their browser. You can confirm it with his handy little tools.

Re:"That's the great thing about evercookie"

[Anonymous Coward]

You can't blame someone for a "method" when it is openly explaining how it is doing what it is doing, using the existing software.

Awesome Pharmboy! So you won't mind at all when your mom receives spam from one of the nodes in my botnet that includes an executable attachment that adds her computer to the botnet when she clicks on it. I know that that's not technically a "feature", but rather a flaw in the overall design of her email client, which allows her to just click on an attachment from an arbitrary stranger and run it, but it's much better for information like that to be out in the open rather than find out a year after it is fully integrated into every dumb email client out there.

Hacking at its finest.

I appreciate that you won't blame me for this "method" because I openly explain how it's doing what it's doing, using the existing software.

Re:"That's the great thing about evercookie"

[Pharmboy]

You are an idiot that misses the entire point of the post.

Remember?

[Pojut]

Remember a time back in the mid-to-earlylate 90's when cookies had a super negative connotation to them? I find it interesting how integral they've become to experiencing the Internet in a timely fashion...

Re:Remember?

[Haedrian]

I sincerly doubt that evercookie has any use which isn't tracking.

Why else would you need a cookie which is hard to delete? You think saving your login information so that it is rebuilt when you press logout is a good idea?

Re:Remember?

[IndustrialComplex]

Remember a time back in the mid-to-earlylate 90's when cookies had a super negative connotation to them? I find it interesting how integral they've become to experiencing the Internet in a timely fashion...

How integral is it? I'm half suspicious and half curious. What can cookies do from a user perspective (Not interested in the ever so delightful 'targeted ads') that can't be accomplished by simply allowing your browser to manage your passwords and not the site? Granted it's how the site knows to keep you logged in right? Other than that, why do any of them need to persist and be public to other sites?

I've not ever designed something that needed cookies, so I'm ignorant on this subject.

Re:Remember?

[Haedrian]

Well, html is unable to save session information. So you need cookies for that. There is no other reliable and non-user-unfriendly alternative.

When you 'log in', you are given a cookie, which the page reads and uses to identify you. That's one of the more common 'useful' uses for cookies.

Cookies can also store small amounts of data in them (ever been to a website which tells you "Pick Language" and then lets you "[ ] Always remember this choice"? That's also a cookie.

And last but not least, they're good at identifying you so that other adverts (on other sites) note the cookie and are able to link your presence on Site A to the one on Site B then data-mine

Re:Remember?

[cheater512]

why do any of them need to persist and be public to other sites?

so I'm ignorant on this subject.

Erm they arent public to other sites?

HTTP has no 'state' information. Two hits from one user could very easily be two separate hits from two separate users.
There is no way to know without cookies. You dont exactly want the guy next to you getting logged in to your Twitter account.

Persistent cookies (that stay when you close your browser) are needed for stuff like 'Keep me logged in'.
Again, no other possible way to do it without cookies.

Re:Remember?

[drinkypoo]

Well, html is unable to save session information. So you need cookies for that. There is no other reliable and non-user-unfriendly alternative.

Yes, there is. It's called hidden form values, and it's actually more reliable than cookies, because you can't trivially block them.

Re:Remember?

[ByOhTek]

it's purpose is to inform us of the issues so they can be fixed ASAP (rather then ignored while people 'roll there own' and get away with it for longer).

Re:Remember?

[Haedrian]

Do those work if you leave the site and return agian?

If I go to slashdot and post a bit. Close the tab and go there again will the hidden form values persist? The way my (quick research) understood them is similar to appending stuff to the URL, except that it doesn't show.

Re:Remember?

[drinkypoo]

Do those work if you leave the site and return agian?

Nope. But then, neither do cookies, necessarily; a user might have them disabled. Lots of sites force you to log in on every visit and browsers remember passwords these days so it's a totally valid model.

Re:Remember?

[nstlgc]

Except for that they don't get transmitted from page to page unless you're doing form submissions. Kind of a big deal, I'd say...

Re:Remember?

[somersault]

For a site like Slashdot that's running a database back end, all the session info could be stored directly on the database, so the only thing you need on the client side is the identification cookie.

You're kind of correct about the hidden form variables, though the thing that will determine whether data shows in the URL or not is whether the form submits via GET or a POST.

Re:Remember?

[imakemusic]

Also how would hidden form values persist when clicking on links? I imagine you'd have to set up each page as one big form... It doesn't sound ideal.

Re:Remember?

[gorzek]

Hidden form values would basically be passed along to each page for the duration of your session at the site. As soon as you close that tab, that state is lost and you'd have to login again.

Cookies get a bad rap but they're pretty useful for most sites. It's just the tracking cookies used to log your browsing history that have given them a bad reputation. But you can thwart those easily by using a custom hosts file, such as the one located on this page.

Re:Remember?

[DrgnDancer]

Unless something has changed recently in HTML, hidden values on forms are a much inferior method for storing state than cookies. Typically when a cookie is being used to store state (as opposed to to tracking info or something) is only stores a session ID. That session ID is the index to all of your stored values on the server. Let's say you have a multipage form, on the first page you enter your name, address and phone number, n the second your credit card information. The information from the first page isn't stored in the cookie and sent back and forth, it's stored on the server and a session ID identifies it. The ID is sent back and forth. This has the dual benefit of reducing bandwidth and reducing the number of times your info is sent back and forth (making it vulnerable to interception).

You could in theory send session IDs back and forth via hidden field data, but anytime there was a interruption in the session: You accidentally close the tab, your browser crashes, your Internet connection goes wonky and refuses to load the next page, You click a non-form link on the site, whatever... you'll have to start over. Because the session ID only exists on the page you currently have up, hidden in the HTML, not in a data structure (like a cookie).

Re:Remember?

[drinkypoo]

Except for that they don't get transmitted from page to page unless you're doing form submissions. Kind of a big deal, I'd say...

If you're using a CMS then it's trivial to make all links into form submissions one way or another, you don't even need javascript. Not a big deal, I'd say...

Re:Remember?

[Anonymous Coward]

Because every anchor you click submits a form? Don't be stupid.

Re:Remember?

[gad_zuki!]

>Remember a time back in the mid-to-earlylate 90's when cookies had a super negative connotation to them?

I remember a couple BS lawsuits from guys who thought they could get rich quick.

I guess there's an argument to tracking cookies, but if you are at war with the ad networks you might as well pull the nuclear option and install adblock and be done with it.

Nowadays, the bigger threat is that these ad networks get hacked frequently and start spreading malware. Its incredible how badly advertising on the net has gotten. Heck, yesterday I ran into a site that with a video ad that started automatically with audio and the mute button disabled.

Re:Remember?

[bigrockpeltr]

Roccooo!!! is that reallly you my italian +5 Funny man? We're sorry you got trolled to a +4 Finger man.,..

Re:Remember?

[b4dc0d3r]

It's not, but we have a name for it: ASP.NET

Seriously, everything is a form and everything gets posted back to the server. It even has checks to make sure the user didn't fiddle with the form data before re-posting it. It can do a basic sanity check, or it can do a more secure check if you like, if you're doing secure type stuff.

The problem with form fields is it's trivial for the user to edit it. A little knowledge is all that's required. So you store the user's name somewhere, the user changes the value, now they're logged in as someone else. So you put in there a single random identifier instead. Makes more sense to do it like ASP.NET, with cookieless state. It sends you a GUID type session cookie, and stores everything related to it on the server. Just a value appended to the querystring. And that seems to be the logicial conclusion to this - but the querystring can be sniffed and hijacked. Unless you're using SSL for everything, because the HTTP header (along with cookies) is encrypted. Which you should be doing in the first place.

And then we're back to the problem with history - if it's in the URL, CSS or other history sniffers can get your login credentials or session values from the browser and send them to a remote server, where they are used for evil.

Your best protection is HTTPONLY cookies, unfortunately, and if you can set up a site which posts back everything (like ASP.NET) and verifies it, that might be a decent alternative. But not ideal.

Re:Remember?

[Anonymous Coward]

Just add the necessary information to each Link on a page. No Form needed.

Re:Remember?

[Anonymous Coward]

Since I switched to Firefox back when it was called Firebird in 2003 or so I've been using the "clear all cookies on exit" option. I have a few cookies on the whitelist for the forums I frequent, but I wouldn't say cookies are integral to "experiencing the Internet".

Re:Remember?

[h00manist]

And last but not least, they're good at identifying you so that other adverts (on other sites) note the cookie and are able to link your presence on Site A to the one on Site B then data-mine

Seems the ad companies are the ones most interested in gathering and storing all data possible, to predict what to advertise and sell. Marketing can use all kinds of information on a user, their purchasing habits, address, income level, tv programs, car model, times of access, times of tv viewing, programs viewed, favorite colors, religion, beliefs, voting habits, favorite joks, everything can be converted to a sale and profit with the proper marketing. Of course all this data on the whole population can use used for vastly more nefarious purposes than merely indebting them and their children for their entire lifespan. For example, manipulating their desires, and making them nuts when they start to realize their desires are to buy everything for no reason they understand. But that's just marketing...

Re:Remember?

[Logic and Reason]

Well, html is unable to save session information. So you need cookies for that. There is no other reliable and non-user-unfriendly alternative.

I wouldn't consider putting a session ID in the URL to be "user-unfriendly". Maybe a little ugly, but how does it actually impact users?

Re:Remember?

[jridley]

It's pretty much impossible to use the modern web without cookies.

Heck, it's pretty difficult to use it without Javascript. Try disabling Javascript and see how far you get. Many sites simply don't work without JS turned on.

Cookies in and of themselves are not necessarily evil. You really need them to do shopping baskets, for instance. The problem is that they can be used for evil.

Re:Remember?

[networkBoy]

It's what I use on my other-other site's tools.
I have some pages devoted to small animal breeding and I use hidden CGI fields to maintain state data between pages. I also sign the data and check the signature before accepting it. Works fine for me.
-nB

Re:Remember?

[John Hasler]

Erm they arent public to other sites?

Good.

Persistent cookies (that stay when you close your browser) are needed for stuff like 'Keep me logged in'.

I have no need for that. If I want to stay logged in why would I close the browser?

Again, no other possible way to do it without cookies.

Good.

Re:Remember?

[Haedrian]

What happens when I change one of those pretty numbers?

Re:Remember?

[Anonymous Coward]

I do not use cookies. I enter my passwords every time. I select my language every time.

Hardly integral. Perhaps useful for the lazy, but I'll trade 10 seconds of work for a bit more privacy thank you very much.

Re:Remember?

[Anonymous Coward]

Yes, there is. It's called hidden form values, and it's actually more reliable than cookies, because you can't trivially block them.

Hidden form values are less reliable than cookies because they only address HTTP POST. To do the job right you need URL rewriting for all links on a page (PHPSESSID/JSESSIONID). Regardless of what implementation is used to track a logged-in user, it's still a "cookie" - especially if the cookie implementation used is session-based and not persistent.

Re:Remember?

[imakemusic]

The GP/GGP was specifically talking about using hidden form fields.

Re:Remember?

[meloneg]

URLs become unsharable. Or worse, sharing a link to my photo-posting folder includes the magic value that logs me in.

Re:Remember?

[cgenman]

Hidden form values have the annoying tendency of breaking the back button. That, in my mind, is a far greater sin than cookies.

Re:Remember?

[Anonymous Coward]

Persistent cookies are unnecessary. You can turn off persistent cookies and 3rd party cookies now and still use the web. The "referer" (sic) header is also unnecessary. You can turn it off now and almost everything will continue to work. Very few sites will mistakenly give an error "due to hotlinking" even though you're using their own links, but on the other hand quite a few sites will allow actual hotlinking which they would block with the referer header enabled.

Re:Remember?

[drinkypoo]

Hidden form values have the annoying tendency of breaking the back button. That, in my mind, is a far greater sin than cookies.

It's a tendency however, not a law. You need to specify a cache time, which permits the content to be cached, if the browser is not a gigantic fail. And you use the same URLs you would use if you had cookies working, and POST to them, which provides URLs which can be bookmarked. It's not a perfect solution, but neither are cookies. Ideally you'd use both and if one fails you can use the other mechanism.

Re:Remember?

[cgenman]

I'm still kind of baffled as to why people are so paranoid about cookies. If the police want to know what you've been reading, they don't need cookies. They go to your ISP and get a log of everything you've ever visited at any time. If amazon wants to know what you're interested in, they have entire teams of social scientists discovering the inner workings of your consumer brain. Google probably knows more about you than your children do, and your children have gone through all of your drawers. Really, the biggest threat with cookies is that you'll get ads served up to you that happen to know you visit car websites, instead of a random banner for Mrs. Smiths muffins. So what? It increases the value to the serving website, which means they have more money to generate the content you're looking at. On the flip side, the advertiser shows you something you might actually be interested in, though you'll probably just tune it out like all of the rest. And the entirety of the data that is compromised is A: pointless and B: already available through private databases anyway, albeit for a large fee.

It's not like people don't have databases on all aspects of your life already. It's just this way of getting that data is much cheaper. Anyone who would use that data for nefarious reasons has much better routes to it anyway. And who really cares if the ads are targeted?

It's a PITA to log in every time you visit a website, or to set preferences over and over and over again. This is the problem cookies were meant to solve: local persistent data in a system designed for single-shot non-interactive file requests. And while this does enable advertisers to swap in better targeted ads for less targeted ones... who really cares? And why? There are far huger privacy battles out there. This is like complaining about a hangnail when your leg's been lopped off.

Re:Remember?

[vegiVamp]

Those don't work across browser shutdowns, so don't remember your language permanently.

Re:Remember?

[John Hasler]

Heck, it's pretty difficult to use it without Javascript. Try disabling Javascript and see how far you get.

pretty far, actually. Only a minority of the sites I use actually need it.

Cookies in and of themselves are not necessarily evil. You really need them to do shopping baskets, for instance.

And so I enable them when necessary.

Re:Remember?

[Anonymous Coward]

> When you 'log in', you are given a cookie, which the page reads and uses to identify you. That's one of the more common 'useful' uses for cookies.

HTTP authentication can do that. It gives a nasty-looking username/password prompt, though. "Basic" authentication is not very secure, though, so do use Digest.

> Cookies can also store small amounts of data in them (ever been to a website which tells you "Pick Language" and then lets you "[ ] Always remember this choice"? That's also a cookie.

And there's the HTTP Accept-Language header, which should be set to the user's preferences.

So what can cookies do again that the protocol can't?

Re:Remember?

[riegel]

I have a web based application that uses cookies to validate a single machine, or a group of machines.

An administrator goes to each machine and logs in as the administrator and clicks "AUTHORIZE" this authorizes this machine for use. If a user attempts to use the application on any other machine/browser they will not be allowed access.

When a user uses the machine the cookie is rewritten with session information and that last used session validates the next use. The means the "valid" cookie changes with each new session. This makes copying the cookie difficult.

The application is a Time Clock and is designed with the premise that trust must be ensured to both the employee and also to the employer. So by design employees and also employers are not able to change any punch data, but employers are able to add notations that include adjustments.

I can see that evercookie would be a great way to allow my users to create more resilient cookies. I wonder if using cookies that are not the same but keypairs would help in my situationto to validate the machine more accurately. That way simply copying the cookie without copying the RGB data would not be sufficient to spoof a machine/browser. Hmmm. Interesting.

Re:Remember?

[riegel]

For that you would want the server to enforce IP security, and alternatively... put a cookie there, but looks like were full circle again.

Re:Remember?

[riegel]

Again, no other possible way to do it without cookies.

Good.

Well, actually there are other ways to do it like putting that infomation in the URL, or hidden form elements, or http://samy.pl/evercookie/...

Here is what evercookie tells me when I go there...

Cookie found: id = 34452062

cookieData mechanism: 34452062
localData mechanism: 34452062
globalData mechanism: undefined
sessionData mechanism: 34452062
historyData mechanism: undefined
dbData mechanism: 34452062
pngData mechanism: 23235035
lsoData mechanism: 34452062

Interesting to note that on my system the pngData doesn't match the rest. Perhaps thats because I am using OS X with Safari and ColorSync.

Re:Remember?

[DrSkwid]

your gushing admiration is misplaced

Re:Remember?

[rjstanford]

And no useful bookmarking and link-sharing possible.

Anyway, there's a big mental difference between session-cookies (set to delete when you close your tab/window/os-login/whatever) and persisted cookies... few people argue against the utility of session cookies.

Re:Remember?

[icebraining]

Or, you could add the ID to a GET parameter instead of fucking with the protocol and passing everything through POST. Or better yet, use the damn cookies, just set them to a reasonable time frame.

Re:Remember?

[Anonymous Coward]

Well, html is unable to save session information. So you need cookies for that. There is no other reliable and non-user-unfriendly alternative.

This is the real issue: HTTP has good login methods that don't use cookies (and are therefore safe from session hijacking), but they are rarely used because no one likes the UI that browsers use for them. This seems like it should be a priority for browser writers (a nice UI for client-side certs would be cool, too).

Re:Remember?

[bucky0]

The problem with form fields is it's trivial for the user to edit it. A little knowledge is all that's required. So you store the user's name somewhere, the user changes the value, now they're logged in as someone else. So you put in there a single random identifier instead. Makes more sense to do it like ASP.NET, with cookieless state. It sends you a GUID type session cookie, and stores everything related to it on the server. Just a value appended to the querystring.

Wait. I'm confused. The GUID you speak about in ASP.NET sounds like the sessionIDs, and instead of passing them with cookies, you're passing them either in URLs or as form elements. Unless I'm missing something obvious, that's how (most) web frameworks handle fallbacks for users that don't have cookies enabled.

Re:Remember?

[clone53421]

Most of them change every time you reload the page. I think the demo is broken.

Re:Remember?

[daveime]

I sincerely hope you are using an anonymous proxy or TOR.

You aren't ? Then everything you do is a complete waste of time. The information gleaned from your User-Agent and IP data will probably be enough to identify you uniquely anyway.

Re:Remember?

[cheater512]

Stuff like email, forums and so on?

Some of us still use desktops in trustworthy environments (e.g. my house) so not having to log in for every single little thing is convenient.

Re:Remember?

[Man Eating Duck]

For a site like Slashdot that's running a database back end, all the session info could be stored directly on the database, so the only thing you need on the client side is the identification cookie.

Yes, a cookie *should* store only an ID string like an MD5 of the users preferences_id, which is meaningless to someone who doesn't already have the string in their preferences db. You, on the other hand, could use that MD5 to run a query against your db to provide an otherwise anonymous user with his preferred yellow on lilac colour scheme.

All this is of course meaningless nowadays when every man and his dog requires you to register and log in in order to track whatever you're doing serverside whether cookies are enabled or not. But you *could* do it :)

Re:Remember?

[Anonymous Coward]

So you're saying that the only way my bank knows that it's me who is logged in and not my GF (using the same internet connection) is by way of a cookie? I seariously doubt that cookies are the *only* way to keep track of sessions over the web.

And now...

[Haedrian]

Whenever someone goes through all the trouble of adding additional ways of tracking people - someone goes through all the trouble of finding ways of removing it.

There's no such thing as Invulnerable - See also: DRM and Copy-Protection

Re:And now...

[cheater512]

No, but the people who do the tracking dont care about you.
They want everyone else who doesnt try to evade tracking, which is a lot more people.

Re:And now...

[Haedrian]

So why would they need an "Invulnerable" cookie to do that?

If you're raising the bar to block people who purposely take down your ad cookies - you're expecting the same subset to attempt to take down your super-cookie.

Re:And now...

[nedlohs]

In which case why do you they so many ways of stopping simple evasion methods from working?

Re:And now...

[imakemusic]

Some people don't care as much as the average Slashdotter about tracking but will still clear their cache and cookies once in a while. It would be better (from the advertiser/tracker's point of view) if they didn't do that as it makes you (a bit) harder to follow.

Re:And now...

[networkBoy]

Also,
Many people have the following:
mindset cookies == evil
mindset tracking cookies == virus (thanks McAfee)
geek friend recommends adaware/spybot/etc.

Thus you need something that can bypass the basic automated tools that people may use.
There are three or four populations on-line:
* Joe Sixpack (zombie host, could care less as long as pr0n and ESPN.com work)
* Jack Newbie (possible zombie host, cares, asks geek friend for help, has AV and anti-spyware stuff installed)
* Private Private (likely most of us here on /.: runs AV passive, active when in high risk parts of the web. Scrubs system periodically. Doesn't run IE, likely Firefox, possibly chrome/opera/safari, likely uses no-script and adblockplus or hosts file.)
* Paranoid Frank (uses lynx only. Ever. Views jpgs as binary data before rendering. etc.)

Re:And now...

[Haedrian]

You forgot "Smug Joe Sixpack" who knows nothing but thinks he knows everything.

"Yeah a popup asked me whether I want to buy Super-Anti-Virus-Totally-Not-A-Scam. So I did. I also installed a firewall to stop bugs from appearing in my Windows"

Re:And now...

[Anonymous Coward]

..except the same subset was caught out by Flash cookies. The subset of tech-savvy people you're talking about are the people their friends and family go to for computer advice. Damn straight 'they' want to track that subset.

Re:And now...

[Anonymous Coward]

Working is this in ways but not to others for the recognizing the tracking. Why do they in who too many cookies?

Re:And now...

[Anonymous Coward]

So much is true, but there is such a thing as "takes 4 years to get it's first working crack". Of course, this isn't problem with open systems like the PC, but you can be sure that somewhere, someone is working day and night to bring forth the wonderful world of closed platforms to the PC market.

Do these people have no concept of web design?

[Anonymous Coward]

State of the art technology, website from the early 90s. Brilliant.

Re:Do these people have no concept of web design?

[SQLGuru]

Programmers don't always equate to good designers. And good designers probably aren't good programmers. (Exceptions exist, but true for the most part).

Otherwise, we wouldn't have terms like "programmer art".

Reminds me of IE

[bogaboga]

This cookie that is very hard to delete reminds me of IE bundled with Windows XP that I also failed to remove from my system. Even after manually deleting the program, typing `iexplore` at the run prompt would fire off IE without a hitch. What is man to do?

Re:Reminds me of IE

[BlindBear]

Ubuntu fixes most windows problems

Re:Reminds me of IE

[Anonymous Coward]

A real Unix system fixes most Linux problems

Re:Reminds me of IE

[Anonymous Coward]

A real Unix system fixes most Linux problems

Which is great, if you like a 15+ year old user interface, and I'm not talking about the GUI.

Re:Reminds me of IE

[Anonymous Coward]

Perhaps you should stop 'sperging and not try to delete system components

Re:Reminds me of IE

[somersault]

Problems such as games not being developed natively? Sweet, sign me up! Unless you're going to point me to OSX. I installed Ubuntu on my MBP to get around OSX problems.

The PNG thing isn't that unexpected

[vadim_t]

Now the history brute forcing is creative, and rather creepy as well. Browsers should close that hole.

Re:The PNG thing isn't that unexpected

[The MAZZTer]

Firefox already has.

Re:The PNG thing isn't that unexpected

[kill-1]

That's something different.

Re:The PNG thing isn't that unexpected

[Anonymous Coward]

Apparently not. I've just updated to the latest stable version and the linked CSS history hack still affects me.

Boy this stinks more than the time that

[Anonymous Coward]

vlad farted

And this why a Sandbox is great.

[Anonymous Coward]

Right Click -> Delete Sandbox. Done ! Next Cookie....

I just ate a cookie...

[Anonymous Coward]

it was yummy! Has anybody tried an evercookie yet?

Re:I just ate a cookie...

[TaoPhoenix]

Jesus spoke from the heavens. He wants his cookie that can feed the multitudes back.

Cookie found: id =

[evanh]

Doesn't work so well without javascript.

Re:Cookie found: id =

[Anonymous Coward]

I tried it in Chrome with Javascript enabled and it still didn't work.

virus

[tokul]

It is not a cookie, but virus written in Javascript. What is next?

Re:virus

[maxume]

The various techniques used have a lot more in common with cookies than they do viruses. And you have to visit a website with the javascript to make it all work.

Re:virus

[frizzantik]

It's written by the guy who wrote the myspace virus so it's not really surprising

Re:virus

[jafiwam]

The various techniques used have a lot more in common with cookies than they do viruses. And you have to visit a website with the javascript to make it all work.

So?

It seems to me like one of the characteristics of malware, is something that actively resists being uninstalled, or re-installs itself.

Maybe not _technically_ a virus, but still malware.

Someone will have a free open source program to remove that crap before long... and any company trying to use that technique for "tracking" against _MY_ wishes is going to get a load of nerd rage unloaded on them, probably covered in spooge.

Re:virus

[maxume]

There is no active. The various bits of data stored on the local computer are just nutrients for code embedded in web pages.

Re:virus

[John Hasler]

> Maybe not _technically_ a virus, but still malware.

Yes, of course it is malware. That doesn't make it a virus. A virus is a particular type of malware. This isn't it.

Developers take note

[Monoman]

If you have to go to great lengths to work around customers doing things like deleting cookies then you are doing something wrong or evil.

Re:Developers take note

[Sarten-X]

...or you're doing something that users expect to "just work". My grandmother had a perfectly fine time using GMail, until my uncle heard that cookies should be deleted for privacy. I got a phone call after that where I had to figure out why "email isn't working".

I can see valid uses for this, and I can see malicious uses. I suppose it's good that something's out there making us developers think about these techniques.

Re:Developers take note

[Anonymous Coward]

That's not a problem with cookies being easy to delete, that's a problem with the user not understanding what they're deleting. In the same way that making it imposible to delete word documents is a bad idea, making it imposible to delete cookies serves no beneficial purpose to the user.

Re:Developers take note

[h00manist]

If you have to go to great lengths to work around customers doing things like deleting cookies then you are doing something wrong or evil.

Yes. And therefore someone will pay you more for it. The choice is up to each one. But let's not be naive, lots of people are doing it, for a long time now, and getting away with it just fine.

Re:Developers take note

[oogoliegoogolie]

What feature in Gmail would require persistent cookies?

Re:Developers take note

[DoofusOfDeath]

If you have to go to great lengths to work around customers doing things like deleting cookies then you are doing something wrong or evil.

Or how about in violation of computer security laws? Any website that uses this technique is clearly trying to use the client's computer in an unauthorized fashion. Otherwise they'd just use a simple cookie.

Re:Developers take note

[Chris Mattern]

What feature in Gmail would require persistent cookies?

The feature where it remembers your sign-on information. Grandma is used to just going to the site and there's her email--now it's asking for a username and a password, and Lord, she doesn't know what it wants!

Re:Developers take note

[Sarten-X]

Remembering login information. I'm not sure if it was an actual cookie or some other form of local storage, but after clearing things out, I had to figure out what was wrong and walk her through the process of logging in without either of us knowing the name and password. It wasn't good.

Re:Developers take note

[Neil Boekend]

The problem is the knowledge, not the persistence of the cookie. Your grandfather thought he was doing something useful, but it messed everything up. The system did what it was supposed to do.

nietzsche quote applies:

[circletimessquare]

"when you look into the abyss, the abyss also looks into you"

cookies by steganography?

game over

i suppose you can browse without flash, javascript, cookies, AND images disabled. but that's not exactly a rockin' web experience

Re:nietzsche quote applies:

[NevarMore]

that's not exactly a rockin' web experience

I use w3m you insensitive clod!

Re:nietzsche quote applies:

[smallfries]

Why would you need to? Cached images don't get uploaded during normal page rendering. You need some sort of client-side scripting to look at the cached image. So disabling flash and javascript would be enough to turn this into a normal cookie, and disabling cookies as well would defeat it completely.

My browser was setup that way already, but that's just the way I roll...

Re:nietzsche quote applies:

[Anonymous Coward]

So you roll missing out on everything good about the web. Nice. People like you would rather the web still be as it was in 1995... just links and pictures. Stupid.

Re:nietzsche quote applies:

[MozeeToby]

Rather than disabling and trying to defeat all these tracking mechanisms I think it would be easier to flood them with false information. Someone should set up a cookie sharing site and FF extension that trades (safe, non-identifying) cookies amongst all the users of that extension. Why yes, I did visit mylittlepony.com directly between visits to journalofparticlephysics.edu and horsesluts9.com, why do you ask?

Re:nietzsche quote applies:

[smallfries]

No. I miss out on everything *bad* about the web. It is nice. You see I didn't say that I don't use flash / video, you assumed that. Actually there are only four sites in my whitelist that I reckon need that.

Re:nietzsche quote applies:

[IndustrialComplex]

Why would you need to? Cached images don't get uploaded during normal page rendering. You need some sort of client-side scripting to look at the cached image.

Granted he said steganography, so this is slightly tangential. (I'm more of an RF/radar engineer than a web designer, so this might not be possible but...)

Would it be possible to create a unique image which was designed to be cached. Create a set of these images, small things so that it doesn't bog down the server or storage system (10x10 pixels).

Would it not be possible to selectively embed these images in a website which causes a user to download them and store it in the temporary internet files. Then if you wanted to check if some anonymous person accessing a site was someone you have previously 'tagged' you could simply observe which image files were NOT downloaded because they were already cached?

Granted it would be highly influenced by the cache getting cleared. But it could be possible. You could even arrange the files to be downloaded as a binary pattern. 10001 would mean that the first and last images were not cached and thus were downloaded but images 2,3, and 4 were cached and therefore this could correspond to someone you tagged as 01110 at an earlier time.

Re:nietzsche quote applies:

[StuartHankins]

Thanks for the links -- I was missing the .edu site.

Re:nietzsche quote applies:

[MozeeToby]

Oh god... I just realized the unfortunate implications of mylittlepony.com and horsesluts9.com. I swear, I was trying to go for 3 complete unrelated, contradictory things and instead I just came up with something more than a little disturbing. I fail at life forever apparently. Still don't know how particle physics fits in, I leave that to someone else's deranged imagination.

Re:nietzsche quote applies:

[Edward Teach]

Hmmmm. Sorry, we can't find "horsesluts9.com". We suggest that you check the spelling of the web address or search above.
Now, that's just wrong.

Re:nietzsche quote applies:

[interkin3tic]

Why yes, I did visit mylittlepony.com directly between visits to journalofparticlephysics.edu and horsesluts9.com, why do you ask?

Wow, how did you get a cookie on my machine?

Re:nietzsche quote applies:

[thoromyr]

That would likely be very easy to cull. The cookies would be used from a wide range of IP addresses, set a threshold and throw those out. Also, you specify, "safe, non-identifying" so any that *are* identifying are good to go. Raises the bar slightly on the processing required, but probably less hassle than maintaining a plugin, having people install it, etc.

Re:nietzsche quote applies:

[MozeeToby]

The basic point was to take control of the privacy fight, attack the systems they are using to track you rather than passively respond to their attacks on you privacy. It's a pretty much accepted fact that in the world of computers, it's easier to be on the attack than the defense, look how long it took to get Spam under some kind of control, and we're still fighting a never ending battle with malware creators. An extension especially I feel has promise because it could be relatively easily updated in response to changing tactics by the trackers. If they start to cull commonly used cookies, maybe start to generate fake cookies from scratch. If they single out cookies with identifiable information, start sharing the data portion of the cookie but swap out the identifying information. If they start using cached images and javascript, start scrambling suspicious images or sharing them instead of cookies. Take the fight to their servers, rather than keeping it on your doorstep.

Re:nietzsche quote applies:

[smallfries]

Not really.

The goal is to assign a unique identity to each visitor if they are new, and to work out their identity if they are a repeat. So for each visit you need to give them a set of images which is both unique (as a fingerprint for later tracking) and common to *all* of their possible identities (which is every hit on your site so far).

These criteria are mutually exclusive, and if you consider them separately the second one implies a completely infeasible amount of server-side processing. So, quite a nice idea, but it doesn't fly.

Re:nietzsche quote applies:

[Neil Boekend]

>

i suppose you can browse without flash, javascript, cookies, AND images disabled. but that's not exactly a rockin' web experience

Lynx FTW!

Re:nietzsche quote applies:

[Neil Boekend]

There should be a way to mod to +10000.

Re:nietzsche quote applies:

[thoromyr]

You are proposing a "war of escalation" where the side you are rooting for is always behind. You say to avoid being passive, but your proposal is entirely based on reacting to yesterday's news.

Fight differently.

Re:nietzsche quote applies:

[Anonymous Coward]

Rather than disabling and trying to defeat all these tracking mechanisms I think it would be easier to flood them with false information.

I actually do this. I run AtGuard, which examines the outbound port 80 HTTP GET and POST traffic and overwrites cookie data with random garbage as they leave the machine.

Re:nietzsche quote applies:

[Anonymous Coward]

Love the idea. I was talking to someone about this idea a while back. I already got ipflood add on that says I'm using proxy with HTTP_X_FORWARDED_FOR a constantly random changing ip address. The only thing is categorizing the cookies in such a way that nothing with too much info gets shared.

Browser on a VM then?

[Natales]

This leaves me no option but running my browsing session in an undoable-mode VM, where after a reboot, all comes back to the previous state. Will this be the only way to maintain my privacy going forward?

Re:Browser on a VM then?

[NevarMore]

No. You could also stop using the Internet.

Re:Browser on a VM then?

[Anonymous Coward]

Looks like something on the TODO list would make it so even that is not a safe option.
From the site: TODO: adding support for Silverlight Isolated Storage, and using Java to produce a unique key based off of NIC info

Re:Browser on a VM then?

[h00manist]

This leaves me no option but running my browsing session in an undoable-mode VM, where after a reboot, all comes back to the previous state. Will this be the only way to maintain my privacy going forward?

It would help, but ideally you would be able to run each browser tab in a different virtual machine partition.

Re:Browser on a VM then?

[Anonymous Coward]

Just disable cache altogether.

Re:Browser on a VM then?

[b4dc0d3r]

No. You could also stop using the Internet.

HA HA HA woooooo, good one. You sound like one of those abstinence-only fundies. Seriously, though, using virtual machines is the only option. Build your image and zip/rar/whatever it. Then you script it so the IE icon launches the VM, with your browser of choice set to autorun, and when the app exits it unzips the image over the VM you just used. Do this post-use so startup time is only marginally slow.

You'd have to have a web-based attack that could break the browser, the operating system, AND the hardware (aka the VM software) in order to store anything locally.

What about downloads? Get the link, copy and paste to wget locally. Or better yet wait till you're at work or a friend's house to download things. Or better still don't download anything, just read the docs in the VM and write a clone yourself locally. It's the only way to be sure.

Re:Browser on a VM then?

[Anonymous Coward]

No, you have no privacy on the Internet no matter what. Not even as an anonymous coward. Get used to it.

http://yro.slashdot.org/story/10/05/18/1225250/EFF-Says-Forget-Cookies-Your-Browser-Has-Fingerprints

Re:Browser on a VM then?

[MMC Monster]

Or, of course, the website can just track the IP addresses that are accessing the site.

Re:Browser on a VM then?

[Anonymous Coward]

It didn't work for me. All I have going is flashblock, plus clear cache and cookies on shutdown.
Given that the browser can store passwords, there is no point in having log-in cookies and such anyway.

Re:Browser on a VM then?

[tibman]

I use Firefox and Sandboxie. I also use noscript and betterprivacy plugins with FF. In my trusted sandbox, FF can direct write to the downloads directory and that's it. In the untrusted one it can't directly write to anything and the whole sandbox is deleted every day.

The only pain with this setup is i need to disable the secure sandbox to upgrade FF, since it can't actually modify system files. Thankfully it's only two clicks away from the sandboxie tasktray thing. I'm pretty sure you can allow FF to upgrade itself within the sandbox, but i'm not comfortable with that.

Re:Browser on a VM then?

[Anonymous Coward]

You also need to randomize your IP address, your browser version (not unique to you, but different every time), your screen resolution, your clock drift, your mouse acceleration, the sites you regularly visit, ... etc.

Re:Browser on a VM then?

[Anonymous Coward]

Do you remember the experiment where they tried to identify users by reading all sorts of configuration values, like the list of available fonts, the screen and toolbar sizes, the user-agent string, the list of enabled plugins and so on? I tested how identifiable the Microsoft Internet Explorer compatibility images are. I assumed that since they're widely distributed VM images, their characteristic configuration would show up quite often in that test. Turns out it was even more unique than my normal browser, which is also off the beaten path and quite identifiable.

Re:Browser on a VM then?

[Anonymous Coward]

Of course. This then leads us back to: "No. You could also stop using the Internet." which, unfortunately, no matter how much you go "Ha ha ha" over it it is still the truth.

Re:Browser on a VM then?

[the_denman]

what about multi user NATs?

Re:Browser on a VM then?

[Anonymous Coward]

You're still going to get tracked during your current browsing session aren't you? And remember that your VM setup might be near-uniquely identifiable anyways.

Re:Browser on a VM then?

[Anonymous Coward]

Looks like something on the TODO list would make it so even that is not a safe option.
From the site: TODO: adding support for Silverlight Isolated Storage, and using Java to produce a unique key based off of NIC info

I'm glad to see I haven't missed out by not having Java installed for many years. Back on Windows 3.11, I installed IE3 because it came with a Java VM as there wasn't one available for 16bit Netscape. What Java was used for then was unimpressive, and otherwise I have only seen the occasional corporate intranet that actually needed Java (one place I worked, the time recording system was a Java applet in the browser, served off the intranet. It was fucking awful, and only tolerable as it was the gateway to being paid!).

I hacked the following together to anonymise myself if I use a public AP, or one infected by a corporation (the BT home and business hubs are clearly controllable by BT[1], so fuck knows what they record about connected clients. They cannot possibly not be at least trying to track users, as the prospects of being able to sell that data in the future (once the DPA or similar is lobbied away) is too much for a corporation to ignore).

Save a copy of this http://standards.ieee.org/regauth/oui/oui.txt and then run the below. It will change your MAC to be a perfectly valid, but false, MAC. You might get lucky and get a fake MAC that is plausible, like a Linksys. Or you might appear to be on a Xerox machine, or a Cray. When attached via wireless, this could look dodgy! The odds of it being noticed are slim though, but intrusion detection might spot it.

ifconfig eth1 down hw ether `cat oui.txt | grep \(base\ 16\) | sed 's/\(..\)/:\1/g' | cut -b2-9 | shuf | tail -1``dd if=/dev/urandom bs=$RANDOM count=1 2> /dev/null | md5sum | sed 's/\(..\)/:\1/g' | cut -b1-9`

Change eth1 to the interface you want to modify. This doesn't work with all network drivers though, seemingly. The wireless in my laptop will not cope with having the MAC changed, an ath5k driven Atheros card. A USB wireless dongle I have that uses the rt73 module does cope with having its MAC changed, as does an old Orinocco PCMCIA card.

[1] IIRC, one guy I knew with a BT business hub at his small business got a phone call from BT telling him they had reset the BT supplied router's password to the one they initially allocated, as he had changed the admin password himself - for obvious reasons. The fact BT were able to still get back into the router means there is a backdoor, so there is no way I would ever do business with those fuckers. But sometimes a BT connection is the only internet connection available, so anonymising oneself is necessary.

Re:Browser on a VM then?

[Anonymous Coward]

I didn't realize you could just whitelist certain directories to be written to. That's the only reason I don't have firefox sandboxed. Due to the PITA of having to individually copy every download from the sandbox to the real download directory. Is it "Sandbox Settings -> Resource Access -> File Access -> Full Access -> Add" and then add the folder you want to whitelest? If this works I'm definitely going to sandbox firefox today. It may not be as secure to operate this way but seems a hell of a lot more secure than not sandboxing at all.

Re:Browser on a VM then?

[chris_7d0h]

Unless you also use a proxy such as Tor or Relakks, Google et'al will typically be able to piece together that you're you by looking at your IP address or network. A VM by itself won't do squat for your privacy.

If you have a dynamic IP which changes all the time, then it will take a bit longer (more clicks) through the web before "Google" can associate your current surfing session to the "file" they have on you.

So Tor/Relakks + short surfing sessions - logging into any site should hopefully keep your surfing somewhat private.

Re:Browser on a VM then?

[tibman]

I'm not at home to check, but that sounds right. You might have to have the purchased copy of Sandboxie though, i'm not sure. But like you, i don't enjoy moving things out of the sandbox constantly. Thankfully FF addons update within the sandbox just fine.. though they will have to always update if the sandbox is destroyed on browser closing.

At worst, an infection can write to your downloads directory. Which doesn't seem to be a useful target.

I've gone a bit crazy with sandboxing though. VLC, utorrent, and anything that interacts with outside files. I really like the forced programs option.. so even if your browser is launched from a 3rd party program, it'll be boxed.

Privacy for 99% of people doesn't exist

[h00manist]

Perhaps on paper there are privacy rights, but to a large extent only on paper. Some privacy (and security) exists for those who can pay for it, or know how to implement it.
- Hard question - if actual privacy is only for a few, who largely use it as cover to secretly abuse the rights of the other 99%, are we defending privacy rights just for them? Put simply, transparency in government and management, accountability, public participation, are not very compatible with secrecy.

Re:Privacy for 99% of people doesn't exist

[Anonymous Coward]

You're confusing privacy and secrecy.

Re:Privacy for 99% of people doesn't exist

[rabtech]

Perhaps on paper there are privacy rights, but to a large extent only on paper. Some privacy (and security) exists for those who can pay for it, or know how to implement it.
- Hard question - if actual privacy is only for a few, who largely use it as cover to secretly abuse the rights of the other 99%, are we defending privacy rights just for them? Put simply, transparency in government and management, accountability, public participation, are not very compatible with secrecy.

Privacy exists because we as a society are very two-faced in our dealings with each other. We present a certain face and claim to adhere to certain norms in public, while almost all of us engage in similar "deviant" behaviors behind closed doors. Almost no one is entirely 100% "clean"... whether they smoke (pot or tobacco), have an "interesting" sex life, watch TV programs their neighbors don't watch, etc. Even if it isn't true now, it is certainly true of everyone's past. For example: we can't just all admit that kids often go a little crazy when they get out from under their parents, so we have to hide photos of drunken shenanigans lest a potential employer see that you were a normal early-20-something five years ago and got the party bug out of your system... even though everyone involved in the hiring process did the exact same thing when they were the same age.

In the US, especially regarding sexual behavior, Kinsey proved pretty well that the facade we were all putting on in public was bullshit. It was very controversial at the time because people prefer to think "well this behavior is OK for me because I know what I'm doing/I'm morally superior/I can handle it" but God-forbid we actually admit to it in public... think of the children!

Whenever we get to the point that people aren't judgmental of others, we aren't jumping to conclusions, and we aren't forced to put on public faces, then the right to privacy won't be as important. The damage that invasion of privacy can do is limited if your public persona matches your private one because then there is nothing to expose. Politicians learned from Bill Clinton's "I did not inhale" gaffe and now readily cop to smoking pot in the past because it instantly diffuses any potential attack.

(P.S. Always be wary of someone leading the charge against some perceived moral depravity. This is often (though not always) a tactic used to elevate that person at the expense of others because that person is engaging in the same behavior and fears discovery/reprisals, even if that fear is only in their own mind and not from some external source. When accused of being the proverbial witch, the oldest trick in the book is say "I'm not a witch, but SHE is! Get her!")

Re:Privacy for 99% of people doesn't exist

[h00manist]

Hmm indeed. Although you ultimately have little privacy protection from the three-letter-agencies and many corporations, you do have it from the policeman, the religious nuts, and your neighbors, all of which you meet on a daily basis. The only real problem is, "Who is guarding the guards."

Re:Privacy for 99% of people doesn't exist

[minchazo]

Privacy has a *very* important aspect other than just hiding our little indescretions: It helps ensure the right to free speech.
It allows people to criticize their community without being ostracized.
It allows people to criticize their police or government without being imprisioned.
It allows people to criticize corporations without fear of reprisal.
If you can be distinctly indentified, you can be prosecuted/sued, regardless of whether or not you broke the law.

Re:Privacy for 99% of people doesn't exist

[Anonymous Coward]

You're confused in thinking that the only things one might want private are things they are ashamed of, and you share this failing with Eric Schmidt.

If I have an incurable cancer, and use the net to research this disease, or an online pharmacy, or find a support group, and I choose not to share that with strangers, or my employer because they might fire me to save money, or funeral companies that want to send me ads, that's not something I'm ashamed of but should be within my power to keep private. Likewise for my politics, or the charities I contribute to, or anything else I choose not to put up on a billboard outside my house or on a bumper sticker on my car.

Sure, maybe I'm really hiding a preference for sex with ducks, and maybe I have cancer too, but neither of them are any of your business and you don't get to question what I'm hiding or why I'm hiding it.

Re:Privacy for 99% of people doesn't exist

[Anonymous Coward]

Nobody actually prints privacy policies.

Tor users

[RavenUK2600]

Will this affect users of Tor?

Visit a website through Tor.
Receive evercookie in Private Browsing Firefox.
Stop using Tor.
Tor user (now not anonymous) identified through evercookie
???
Profit

Do any of these techniques survive the browser's privacy scrubbing features?

Re:Tor users

[clone53421]

It says it uses the following methods:

- Standard HTTP Cookies
- Local Shared Objects (Flash Cookies)
- Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out
- Storing cookies in Web History (seriously. see FAQ)
- HTML5 Session Storage
- HTML5 Local Storage
- HTML5 Global Storage
- HTML5 Database Storage via SQLite

Of those, I think the only that should survive the private browsing session would be the Flash cookie, and you can get Firefox plugins that clear those.

Personal browsing habits for sale

[h00manist]

Yes but a great many people have had all their web browsing habits for sale for a long time. The tracking works.

Rage!

[Jugalator]

FFFFFUUUUUUUUU...

I just had a rage guy moment here. >:-(

RGB values of auto-generated...

[Rooked_One]

RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out.

I call the patent on this!!!

Re:RGB values of auto-generated...

[just_another_sean]

You might want to check for prior art.

Action already taken

[Anonymous Coward]

Privacy International have passed this on to a lawyer in the US who specialises in these cases and also published an open letter to the European Commission today about it:

http://tinyurl.com/3ac8vhd

Rest assured, if this is discovered in the wild, legal action will be forthcoming.

force-cached PNG's

[muckracer]

So basically if you clear your cache, as well as your cookies/LSO's all should be well. At least at the end of the browser session.

Another YAYdiots to the Mozilla Developers, for scrapping one of the best features in FF: Clearing the History window on exit. So sad you need an extra extension now what, as this story demonstrates again, should be an integral and visible part of any browser.

Re:force-cached PNG's

[mdm-adph]

Are you talking about the Firefox 4.0 beta? Because in the latest version of 3.6, you can still set it to clear the history on exit in the normal settings.

Re:force-cached PNG's

[CRCulver]

Another YAYdiots to the Mozilla Developers, for scrapping one of the best features in FF: Clearing the History window on exit. So sad you need an extra extension now what, as this story demonstrates again, should be an integral and visible part of any browser.

Firefox's built-in Private Browsing already does this.

Re:force-cached PNG's

[AndrewNeo]

So, the checkbox that lets you clear history without asking isn't good enough for you?

Re:force-cached PNG's

[muckracer]

> Because in the latest version of 3.6, you can still set it to clear the history on exit in the normal settings.

I am talking about having a visible "Clear History" window pop up on exit. One that has your pre-set choices from the browser preferences already checked, with the option of overriding the defaults.

Yes you still can delete the history automatically, but there is no indication that this actually is taking place.
It's less about what's being done or not...it's about *knowing*...in a very clear and obvious way...that something to protect your privacy is being done.
I have/had set this feature (never was browser default which is another FAIL IMHO) for everybody I hooked up with Firefox. Everybody loved it and thought it was very nice and helpful for the Firefox people to be concerned about their privacy (this is normal people we're talking about). They even started taking things more serious and checking things I had left out from the default settings (like browsing history). They became *aware* that it's even an issue.
Features like that is where the browser and other programs can distinguish themselves. When everybody started hyping IE and its 'private browsing', my friends merely shook their heads and wondered why...

The BetterPrivacy Plugin btw. is a poor replacement since the window is a lot uglier, suffers from sizing issues etc.. Aside from the fact, that people need to first install it to redo functionality that was inexplicably removed from FF.

Re:force-cached PNG's

[muckracer]

> Firefox's built-in Private Browsing already does this.

No, it doesn't. It's, although they overlap, a separate issue altogether.

Private browsing will not save pretty much anything while browsing (and subsequently leave no traces on exit). Certainly not a bad thing but somewhat unnecessary since:

Clearing the history on exit removes everything you check(ed). This gives you much more flexibility in multiple ways. The private browsing mode you mention may only be turned on during parts of the browsing session. So you still have data, and to stay on-topic, cookies from sites you went to while not in private browsing mode.
You may also decide to remove only parts of saved information. For example, you may elect to remove cookies but not the browsing history so you still have your blue already visited links. Even if set that way by default you can elect to keep the cookies because you're interrupting a shopping session (is that even possible in private browsing mode?) and want to keep your shopping cart between browser restarts.

Etc..

Re:force-cached PNG's

[imakemusic]

Which version are you using? Here in 3.6.10 on Windows I've got the option to "Clear History when Firefox closes" with it's own settings dialogue to customise what gets removed. I think you have to select "use custom settings for history" in order for the option to appear.

Re:force-cached PNG's

[muckracer]

> Which version are you using?

3.5.12

> Here in 3.6.10 on Windows I've got the option to "Clear History when Firefox closes"
> with it's own settings dialogue to customise what gets removed.

I am aware of it. But there used to be the additional option of having that same selection as a pop-up window on exit (closing the browser). This was done away with...dunno...with 3.5+, I think. That's what I mean. Install the BetterPrivacy Plugin to see roughly, what it was about.

Re:force-cached PNG's

[Anonymous Coward]

Wow, what a fucking tragedy.

Re:force-cached PNG's

[muckracer]

> Wow, what a fucking tragedy.

Despite your cynicism, yes it is, when a browser gets worse for no good reason.

Re:force-cached PNG's

[MobyDisk]

Clearing the cookies daily is what I always wanted. Track me over the course of a browsing session. But no long-term marketing. Clearing on exit is annoying because I close and reopen my browser 50 times a day and I get tired of logging in. Maybe I just need to learn to keep one browser window open all day.

Re:force-cached PNG's

[SmurfButcher Bob]

> Yes you still can delete the history automatically, but there is no indication that this actually is taking place.
> It's less about what's being done or not...it's about *knowing*...in a very clear and obvious way...that something to protect your privacy is being done.

Totally agree. And they should never have removed that "Firefox is shutting down" confirmation window, nor the "Firefox has exited" confirmation window either.
It's less about if the program actually quits or not.... it's about *knowing*... in a very clear an obvious way... that something to manage a running process is being done.

You seem to have confused "feel good" with actual results.

Re:force-cached PNG's

[Anonymous Coward]

I know I just love having pop-up dialog boxes ever time I try and close a damn program.

Re:force-cached PNG's

[muckracer]

> And they should never have removed that "Firefox is shutting down" confirmation window,
> nor the "Firefox has exited" confirmation window either.
> It's less about if the program actually quits or not.... it's about *knowing*...
> in a very clear an obvious way... that something to manage a running process is being done.

> You seem to have confused "feel good" with actual results.

Actually your example is a pretty bad one. I don't need a confirmation window to tell me the browser shut down. Because I *see* it.

But if you don't have a confirmation window about the History being cleared on exit, you have no idea. Or do you without looking deep into the preferences?? Right!
Besides, that's just one half of it as already explained: Having that window allows you to override your defaults (if you have them set at all...see above).

Re:force-cached PNG's

[muckracer]

> I know I just love having pop-up dialog boxes ever time I try and close a damn program.

It was *an option*, not a must. Isn't that the whole point of customizing *your own* experience? I preferred it that way along with many other people I know. You may not. Now neither of us has that *option* at all.

Re:force-cached PNG's

[Anonymous Coward]

It was removed? Check under privacy in options

Re:force-cached PNG's

[muckracer]

For what it's worth: The option in the FF preferences, besides the still existing "Clear History when Firefox closes", was a simple 2nd checkbox: "Ask me before clearing private data" (or 'Ask me before clearing history').
That would trigger the pop-up window on exit, giving you the options of simply accepting the defaults with OK and clearing the history according to your global preferences, manually overriding the defaults and clearing history custom-by-session or cancelling the deletion altogether. You do NOT have these options available anymore...it's either all or nothing. And that's a clear loss of functionality.

If you did not check the "Ask me before" box, it would simply delete the data as specified via Preferences as is now the only possible behavior.

Re:force-cached PNG's

[StuartHankins]

What? On Firefox 4.0b6:

• Click the "Privacy" tab.
• Choose "use custom settings for history".
• Check the box that says "clear history when Firefox closes". Optionally choose only certain items to be cleared.

Re:force-cached PNG's

[Anonymous Coward]

No, the history exposure is already disabled by Firefox. CSS styles differences for visited vs. unvisited links are restricted to non-layout-changing parameters, and cannot be queried by javascript - they always return the unvisited state to getComputedStyle.

Re:force-cached PNG's

[muckracer]

> there used to be the additional option of having that same selection as a pop-up window on exit (closing the browser).
> This was done away with...dunno...with 3.5+, I think. That's what I mean.
> Install the BetterPrivacy Plugin to see roughly, what it was about.

Sorry...the wrong plugin (even though BetterPrivacy is another must-have).

I meant, of course, AskforSanitize:

https://addons.mozilla.org/en-US/firefox/addon/13015/

Re:force-cached PNG's

[Anonymous Coward]

What the hell are you talking about? Deleting history, etc. is right there in the preferences. Now who's the idiot, dufus?

Re:force-cached PNG's

[muckracer]

> Clearing the cookies daily is what I always wanted.

Then you might like the AskforSanitize add-on too, because it gives you the option of removing history (or only the cookies if you like) via a time-span selection. See above in the thread for the link.

Re:force-cached PNG's

[muckracer]

> Deleting history, etc. is right there in the preferences. Now who's the idiot, dufus?

You are, because you demonstrate your lack of reading comprehension. Nothing personal. :-)

Re:force-cached PNG's

[clone53421]

But if you don't have a confirmation window about the History being cleared on exit, you have no idea. Or do you without looking deep into the preferences?? Right!

Actually, yes, since I can simply remember whether or not I set that option in this particular Firefox install on this particular computer... it’s not like it changes often without my knowledge.

Re:force-cached PNG's

[clone53421]

Tools, Clear Recent History, Select time range to clear (last hour, last 2 hours, last 4 hours, today, or everything), under Details pick which data to clear. If anything it’s more user-friendly than before. It just doesn’t automatically pop up when you exit.

Re:force-cached PNG's

[clone53421]

They left in the colour detection exploit. The link colour doesn’t change the layout of the page but it can still be detected using getComputedStyle. In the future they’re planning on making getComputedStyle return the colour of an unvisited link regardless of the link’s actual visited or unvisited status, but they haven’t done that yet. In the meantime there’s a config option to disable the CSS selector for colour of visited links.

Re:force-cached PNG's

[clone53421]

You do NOT have these options available anymore...it's either all or nothing.

You still have it, it’s just not automatic anymore. It’s called Clear Recent History.

Re:force-cached PNG's

[mdm-adph]

Yes you still can delete the history automatically, but there is no indication that this actually is taking place.
It's less about what's being done or not...it's about *knowing*...in a very clear and obvious way...that something to protect your privacy is being done.

Come on -- you're serious about this? Dude, if you've got trust issues with a browser, you might need to get off the internet entirely, because trust me, ain't nothing really that secure.

CSS

[roman_mir]

How about also adding CSS cookies as part of this cool evercookie thing? I am interested at looking into it. CSS has to have something there, some values to be stored as part of style sheet and then upon loading of the page check for CSS settings to get the values back. hhmmmmmmm.

The data black market

[h00manist]

The massive data black market has a little more information on you available. Its more expensive and harder to buy, but very available.

Not Really

[Greyfox]

It might just drive more users to noscript and flashblock. I have to explicitly trust a site before I allow it to do those things, and if I happen to run across a site that requires them during casual browsing, I do not allow them access to those capabilities. If you're the sort to look over your shoulder that much, being able to browse the web with some level of comfort should more than offset any degradation of the web experience.

Advertisers and site operators might complain that this behavior costs them revenue, but they should have thought about that before going all Big Brother on us. If you're going to try to trick me into clicking an ad on your site, I don't want anything to do with your site anyway. And I do occasionally click through ads on Slashdot and Google.

Re:Not Really

[Chatterton]

It will not drive more users to noscript and flashblock because then websites will not 'just work' anymore and it will be a pain to them to whitelist every script they don't know what they do for every websites one by one...

Re:Not Really

[Anonymous Coward]

It will not drive more users to noscript and flashblock because then websites will not 'just work' anymore and it will be a pain to them to whitelist every script they don't know what they do for every websites one by one...

Then the users will simply stop using the web.

I've taught a few people how to use NoScript/FlashBlock - but first they have to have already been infected a few times in the past month before they get the concept and why it's important to be paranoid. Even if they screw up 5% of the time in allowing permissions, they're still far better off then not using the tool.

(IOW, it's not that hard. Try the site without Javascript/Flash allowed. If it works mostly, don't allow anything. If things don't work, allow the parent domain. If things still don't work, go to another site.)

Re:Not Really

[mujadaddy]

If things don't work, allow the parent domain. If things still don't work, go to another site.

COMPLETELY agree. I've "missed out" on hours & hours of $dumbwebvideo every month b/c of NoScript. Thanks for raising my standards!

Re:Not Really

[0111 1110]

I've taught a few people how to use NoScript/FlashBlock - but first they have to have already been infected a few times in the past month before they get the concept and why it's important to be paranoid. Even if they screw up 5% of the time in allowing permissions, they're still far better off then not using the tool.

I just had this happen with a friend who for years resisted installing noscript. He was a big fan of javascript and web sites just working etc. He recently got totally raped by some malware that took control of his browser and desktop. It was some of the worst malware I have seen. The only reason I was able to get some control is because he had process explorer. So he finally installed noscript. He's not happy with the additional work involved, but he's grinning and bearing it because now he is aware of the alternative. Before he just didn't get it. No matter what I told him. He had to experience it for himself. I even got him to install ghostery, better privacy, and beef taco.

Re:Not Really

[couchslug]

It will drive smart users. The rest don't care. Not my problem.

that is one tough cookie

[straz]

Golly, that's one tough cookie

At least Linux users can...

[WarmBoota]

symlink the LSO folder to /dev/null

Re:At least Linux users can...

[Anonymous Coward]

So can Windows users. The command might look a little different, but still completely doable.

Re:At least Linux users can...

[lavagolemking]

Not a bad idea, but it breaks a bunch of things. For example, you can no longer access pandora.com, which a lot of people I know do. I personally let BetterPrivacy clean up whatever I selectively let through NoScript. Then, I can simply have everything from my cache to Flash cookies deleted everytime I restart Firefox. Without any kind of persistent storage, none of those cookies can survive.

Re:At least Linux users can...

[c 0xFF]

Can they? Really? Please, do tell me how.

I know that you can redirect the output of a DOS command to "nul" but that only gets you about 1/3 the way there.

Re:At least Linux users can...

[clone53421]

I second this... how exactly would you do it?

The closest I can think of would be the trick that someone else mentioned: remove its folder, create a file with that name, and set its system attribute. That isn’t really the same thing, though, because creating a file in /dev/null will silently do nothing (the application won’t be the wiser unless it tries to read it back) whereas attempting to create a file within another file as though it were a folder will immediately fail less gracefully.

Re:At least Linux users can...

[Anonymous Coward]

AFAIK you can't. mklink won't accept NUL. You'd have to set non-write permissions on the directory, but that's not the same thing as /dev/null (the Flash runtime **may** fail on error returns after this).

Re:At least Linux users can...

[arantius]

They can't, literally. But they can get the same effect. I'm not at a windows box now but I've done it. Find the right folder, and in properties set the file permissions to deny writes in that folder. No more flash cookies.

And no more features on lots of sites. I.E. from then on every youtube video you load will be set to eardrum-breaking volume, no matter how many times you turn it down. (Well, for me at least, all flash sound comes out way louder than anything else on my system.)

mmmmm, Evercookie

[Tsavo]

My favorite storage location is in a DQ Blizzard.

I've heard of Zombie Cookies...

[Even on Slashdot FOE]

But some sort of Dracula cookie that has minions to bring it back from the dead? I think we need Belmont cookie hunters now.

Die monster! You don't belong in this world!

Invulnerable Cookie??!

[Anonymous Coward]

The cookie monster is not going to be amused!

There is ALWAYS another way

[way2trivial]

http://cookies.lcs.mit.edu/encyclopedia.html

Anti-Evercookie

[Madm3rlin]

Who else sees this leading to awesome exploits down the road? What is the best way to avoid the evercookie?

fuck you, Apple

[FuckingNickName]

canvas is crippled flash with better PR.

As Obama is to Bush.

That site!!

[setrops]

Is it trying to push a browser vulnerability!!!

Wonka

[Anne_Nonymous]

The Invulnerable Evercookie sounds like something dangerous from Willy Wonka's factory.

Re:Wonka

[Myopic]

It could also be a lame superhero from Marvel.

Samy is my hero

[thijsh]

a 'security' guy

You know this guy is Samy Kamkar, the hacker who also unleashed the first-ever XSS worm on the world that infected a million MySpace profiles in a matter of hours...

Tomorrow I happen to attend a meeting of OWASP where Samy will speak about the latest XSS exploits, other JavaScript tricks, and other things (like a nice new method of NAT penetration)... I could say the title 'security guy' is earned by him for finding some great hacks and sharing them with the world, and even taking time to talk about it in person to the open source community.

but most of all, Samy is my hero

Re:Samy is my hero

[Anonymous Coward]

but most of all, Samy is my hero

Doesn't work as advertised

[synackpshfin]

With Firefox 3.6.10 on win 7: - visited evercookie page - Tools -> clear recent history - close browser - run ccleaner - visited evercookie page again and got new cookie ID I'd say it is not as persistent as it says...

Re:Doesn't work as advertised

[RalphSleigh]

I think the evercookie page gives you a new id every time you hit it. I did a simple open chrome -> hit page -> close -> repeat and only the pngData was the same across the two pages. A better test may be needed.

Re:Doesn't work as advertised

[synackpshfin]

True. I noticed that to but I hit Submit first. :P

But does it handle Lynx?

[DBCubix]

Looks like its time to go back to Lynx http://en.wikipedia.org/wiki/Lynx_(web_browser). LOL!

Adult conversation here ...

[Zero__Kelvin]

"Problems such as games not being developed natively? "

You are confusing a computer with a game console. Yes, it can be a cool extra feature to be able to play games on your PC, but it has absolutely nothing to do with real computing. If you are really so cheap that you will pay $200.00 for Windows, but not $300.00 for a dedicated gaming console, then you are very much in the minority. Now please, when people are intelligently discussing computers, don't keep trying to enter into a discussion with the adults, clamoring that an OS is superior because it lets you tie up a $1600.00 machine to play games rather than just buy an actual machine designed to play games for far less.

Re:Adult conversation here ...

[meloneg]

Curious attitude. I have two game consoles and at least three portable game consoles in the house. My kids love them.

However, most of the games *I* play are unavailable on consoles. And would probably be unplayable on them. At least to me.

I'm that guy who plays all of his computer games with as little mouse contact as possible. Trying to access complex controls is a nightmare with a mouse (for me). Trying to do it without a decent pointing device sounds horrific.

Oh well. To each his own.

But then, I probably have less money in my computer than all the consoles combined. And most of those were bought second-hand. Wow! A $1600 computer. In this day-and-age. Must be amazing. Unless you're thinking of a laptop. Then, that's cheating. And, a console can't possibly match the portability anyway.

Re:Adult conversation here ...

[somersault]

I don't use Windows (outside of when I have to occasionally support it at work), and I have the most expensive games console currently available. I'm not cheap, I just consider the lack of commercial games available for Linux to be one of the main "problems" it faces, and the reason I stuck with Windows so long was that while I enjoyed consoles for some types of game, I wasn't looking forward to having to play my FPSes on a console. In the end I decided just to deal with the crappier control method for FPSes so that I didn't have to endure Windows any longer.

What exactly is "real computing"? I don't think many computer users these days are doing any of it on their real computers. Most of us use our computers for things like Slashdot and YouTube these days.

When did I claim Windows is superior? Good job on making illogical assumptions and trying to patronise me.

I'll point out that I was brought up (and cut my teeth programming on) Commodores and Amigas rather than Nintendo or SEGA toys because my dad was into his "real computing" too, but I don't see why I can't enjoy games and using the power of "real" computers to get an even better gaming experience than I can on a console. I'll be tempted to get another Windows box when something like Half-Life 3 comes out, but in the meantime, I'm resisting.

Re:Adult conversation here ...

[somersault]

Actually now that I think about it, I have 4 games consoles - PS3, Wii, DS and PSP - I just never use the last three.

Re:Adult conversation here ...

[Zero__Kelvin]

"A $1600 computer. In this day-and-age. Must be amazing. Unless you're thinking of a laptop. Then, that's cheating."

Why is having a laptop cheating? (Note: I am not even factoring in the cost of my multiple displays.)

... and yes, it is a remarkable computer. 8 Cores, 6GB RAM, 17.4" Display, 500 GB 7200 RPM Hard Drive, and $200.00 wasted dollars on an OS with a EULA that licenses me to run Windows 7 Home Premium on up to 2 whole cores (recall I have eight.)

The best part? The EULA for the OS I was essentially forced to buy had the words "required to use Windows" next to one checkbox (which is fine) and "required to use your computer" next to the other one ... but Microsoft isn't Anti-trust or anything.

As an added Irony, it is an ASUS G73 "gaming" PC, which I actually use to do real computing, e.g. Linux Kernel and Application development, etc.

Re:Adult conversation here ...

[Zero__Kelvin]

" ... but I don't see why I can't enjoy games and using the power of "real" computers to get an even better gaming experience than I can on a console."

Of course you can do that. My objection is to you asserting that it matters what games are available when discussing the merits of an OS. It is especially objectionable because it is usually advanced by people who aren't either informed enough or smart enough to figure out that they are saying, in effect: Windows is better, because Microsoft has removed all my options!

I misinterpreted your intent, which seemed to me prior to a second reading to be implying that Windows is better than Linux because of the games. Again, I was wrong about that and I apologize.

Re:Adult conversation here ...

[VGPowerlord]

" ... but I don't see why I can't enjoy games and using the power of "real" computers to get an even better gaming experience than I can on a console."

Of course you can do that. My objection is to you asserting that it matters what games are available when discussing the merits of an OS. It is especially objectionable because it is usually advanced by people who aren't either informed enough or smart enough to figure out that they are saying, in effect: Windows is better, because Microsoft has removed all my options!

I was under the impression that he was intentionally acting like Joe Average would act.

And yes, Joe Average, or in this case my parents, do care when they "can't run that game I got from Aunt Nancy." Did I mention that if my mother had Linux, this would have been a real life example?

Re:Adult conversation here ...

[somersault]

My objection is to you asserting that it matters what games are available when discussing the merits of an OS

Yep I think you read the opposite intent of what I had. I've been wanting to get away from Windows ever since it was basically forced on me in '98. My dad's reasoning was that if I wanted to be a developer I should really learn to write code for the most common OS rather than continue to mess around learning C on my Amiga, which I had to agree made sense. He developed software for both Windows and Macs btw, he wasn't some kind of Windows zealot, guess he was just trying to give me a good education.

The only good thing about that was being able to play all these games that I'd only heard people talking about but never experienced first hand. I guess I'd have to say it was worth it for Counter-Strike alone, that was a big part of my life, and I had fun writing bots for it :)

Well I guess you could say the fact that I learned how to troubleshoot PC hardware issues and Windows issues was all beneficial too, it has stood me in good stead in my professional life.

I don't think Windows bests any other OS in any way other than market penetration. Just because something is popular, definitely does not make it the best option. That's just an unfortunate reality in human society, but at least things are slowly drifting in the right direction. As the world moves more towards online services, things are becoming fairly platform agnostic, and the more people move to mobile devices and the like, the more open developers will be to making multi-platform apps and games.

I only mentioned games because personally I found it difficult to think of any actual "problems" that Linux has other than not being able to play games. There are plenty of people that like to complain and have wars over which window manager, text editor (ffs!), or sound system etc is better, but I see that flexibility as a bonus rather than a problem. Of course, I'm happy to get on with both work and home stuff on Ubuntu on an almost standard install, I guess I'm just boring.

Re:Adult conversation here ...

[Zero__Kelvin]

This is a discussion about the merits of an OS, not the lack of merits that my mom and your mom inject into the equation. It is time you step up and explain to your Mother that she can't run Aunt Jane's game or the viruses Aunt Jane is sure to send her way. I did so with my mom years ago, and she has successfully used Linux ever since, and is forever grateful that she no longer has to worry about if she should read her e-mail or browse the web.

Re:Adult conversation here ...

[bornagainpenguin]

I have 4 games consoles - PS3, Wii, DS and PSP - I just never use the last three.

Can I have them then? I mean if you're not using them any way...

At the very least, could I have the wii? I've been wanting to try the homebrew channel for some time now the only thing keeping me back is the inflated prices of a wii and concerns over bricking it if I didn't do something right the first time. With a free (or severely discounted) wii that wouldn't be as much of a concern.

--bornagainpenguin

Re:Adult conversation here ...

[VGPowerlord]

This is a discussion about the merits of an OS, not the lack of merits that my mom and your mom inject into the equation. It is time you step up and explain to your Mother that she can't run Aunt Jane's game or the viruses Aunt Jane is sure to send her way. I did so with my mom years ago, and she has successfully used Linux ever since, and is forever grateful that she no longer has to worry about if she should read her e-mail or browse the web.

Mom already knows not to run random attachments... or any attachments from people she doesn't know or wasn't expecting one from. I check her machine sometimes when I'm at my parents house, and I haven't seen her get any malware yet.

Also, the games I was talking about from Aunt Jane? That would be from a pressed CD, not email.

If you want another example, here's a better one:
I have Windows installed on my home PC because Linux doesn't have any games for it and the last time I tried to use Wine (several years ago) to set up the online games I do play, it was an absolute disaster.

Does that make you happy?

And yes, there are some games that are just inferior on, or not even available on, a game console. Team Fortress 2 is one where the console version is just plain inferior. This applies to FPS games in general. As for games that aren't available on game consoles, that encompasses something like 3 out of every 4 MMORPGs, including media darling World of Warcraft.

Re:Adult conversation here ...

[Zero__Kelvin]

"Mom already knows not to run random attachments...

You mom has been misinformed. First off, one doesn't run attachments; that is a pure Windows-ism. Secondly, there is absolutely nothing wrong with reading e-mails and opening attachments from people, even if you don't know them. There is however something wrong with running Windows, which is why you quite mistakenly believe such perfectly safe activities are "wrong".

Re:Adult conversation here ...

[somersault]

Actually, I already left it at my mum's house for my little sister to use, but technically it's still mine ;) I similarly gave the DS to my sis, don't think she uses it. PSP is lying in my room for when.. I don't know when.. my Dell Streak has a larger screen and way more uses. Considering getting a PSP emulator for the streak, or perhaps one of the latest PSPs. I like the games I have on my PSP, I just hate the stupid "analog nub" thing, I'd much rather have a mini joystick.

Re:Adult conversation here ...

[bornagainpenguin]

Dang. Well you can't blame me for trying can you? I hope your sister is having fun with them!

--bornagainpenguin

Cookie?

[kurokame]

Let's see. A remote website infects your computer with code which does things on your system without your consent and resists your attempts to delete it through the use of hidden copies. I think we have a word for this already. Starts with a V.

Re:Cookie?

[Haedrian]

Vista?

Re:Cookie?

[Anonymous Coward]

"Let's see. A remote website infects your computer with code which does things on your system without your consent and resists your attempts to delete it through the use of hidden copies. I think we have a word for this already. Starts with a V."

Valuable Service?

Re:Cookie?

[Anonymous Coward]

Cookie virus! Om nom nom nom...

Re:Cookie?

[Anonymous Coward]

Vain attempt at knowing anything of computers and malware?

Re:ExpertSexChange

[b4dc0d3r]

ExpertSexChange also shows the results if you click from google. I think it tries to hide them by using a script to set things hidden, but I have NoScript. So if I get a link to a page, I put it in google, click from there to pick up the referrer, and with noscript I scroll down to the bottom past 3/4 of the page and everything's there.

I noticed recently that they changed their terms of use. You grant them an unlimited license to use your content, and also appoint them as a copyright enforcement agent. So every comment has a "this is copyrighted, pay us to be able to copy things" notice attached. And if that comment appears elsewhere they will attempt a takedown.

But what if you post GPL code? It's against the terms of use, since the user has to ensure they own the copyright to things they post, or it's free to use. What if you, who owns the copyright, post the same response on multiple sites? ExpertSexChange will, acting on your explicit agreement, ask the other site to take it down, despite it being your content posted by you.

Now, I know what they're doing, and they are probably only going to stop sites that bulk copy answers instead of one response. But as of right now, you can't re-post anything from MSDN, or snippets from wikipedia, or GPL code, or damn near anything else unless you compose it on the spot. I know what they're trying to do, but it's going to go downhill.

Now you know why I use NoScript in FireFox ;)

[Anonymous Coward]

To thwart these kind of 'attacks'

This looks like...

[Fantasio]

...a Bad Trip in Paranoland. I have to check that copying over with a fresh install of Firefox Portable can bypass it. I'm also waiting for a Firefox add-on to counter it

Re:This looks like...

[clone53421]

Firefox Portable is terrible about plugins. You can start up a completely fresh install and open the addons dialog only to find half a dozen plugins that were installed by Flash, Adobe, Silverlight, VLC, etc. on the computer and which Firefox helpfully located when it started up. That’s actually just how it’s designed, and the portable version isn’t sandboxed to keep it from doing this...

I wish they would fix it. Portable apps shouldn’t be loading stuff from the computer you’re running them on.

Re:This looks like...

[clone53421]

And then I forgot my main point, which was that I wouldn’t trust FF Portable to shield me from these tracking cookies in any way, shape, or form.

Clearing the history, cache, cookies, any HTML5 local storage, and the Flash cookies will defeat them, though, and the only one of those that Firefox won’t handle on its own is clearing the Flash cookies (plugins do exist that do it though).

how about fingerprinting instead?

[anton_kg]

You don't need to mark client's browser. it's not secure and yet possible to protect against. The best solution is to use browser fingerprint. Apparently, each browser is unique by itself. See the link bellow http://panopticlick.eff.org/

Re:ExpertSexChange

[jafiwam]

I think it doesn't hide the answers, it just makes them show below a bunch of ads and stuff.

Most people don't think to scroll down below the "subscribe to see!" crap.

Anybody with any sanity lands on that site via Google anyway...

Need a BetterPrivacy for HTML5 storage

[GameboyRMH]

Marketing scumbags are already exploiting the lack of privacy controls on HTML5 storage (window.localStorage for one) in the wild, and once scripts are running no plugin will take care of that. As browsers continue to be swiss cheese where privacy is concerned, a BetterPrivacy-like plugin to clear these storage locations will be needed.

Seriously, AFAIK NO browser even handles Flash cookies AT ALL by default, and those have been a problem for years. When are Microsoft/Apple/Google/Mozilla/Opera going to fix this instead of adding eye candy and having benchmark wars? Securing a browser these days is like making a cheese grater float. Average Joes are being left totally defenseless. Handling flash cookies, cache, and HTML5 storage like regular cookies is the minimum fix that all browsers should adopt RIGHT NOW.

Yeah, but what choice is there?

[SmallFurryCreature]

The web is no longer just a static place. It houses many applications and applications often need to be state aware. Users wouldn't accept that on slashdot, each post requires their login credentials or their session key posted in a form or get request.

So the cookie is the tool to turn the web state aware. Sadly a really useful tool can also be used for other practices.

NOT that it is to hard to defend against this. BLOCK third party cookies. If I am on slashdot, why am I getting cookies from site X.X? Why am I accepting them? I don't need them for slashdot to function (try, it, block third party cookies and see just how few sites seize to function).

First party cookies, the cookies from the site you visit have relative little impact. CNN.com is NOT going to request them (can't even) and hardly going to join in a scheme with slashdot to share data. Block the third party cookies by the ad agencies and you are golden.

Cookies, first party cookies, are integral to web apps (stateful browsing) because that is what they are for and the alternative (they exist) suck. In fact with the initial dislike gone, I don't think most people bother anymore with non-cookie capability of their site. Just like javascript and flash, if you don't have it, you can just go somewhere else.

It is almost impossible to store session data in the browser and not have it somehow abused. I could even think of ways of doing it by giving you a specific JS file with a generic url request, then see if I get a cached version or a new one.

The only way to stop this is to block the abusers. But how many here use ad-blockers and such to make a stand? No, many in fact oppose them because we "rob" those poor invaders of our privacy of their illgotten gains. Until that mentality changes, ad agencies will continue to find ever more devious ways to track us.

That's a virus then.

[zaax]

Hopefully anyone or company that uses these codes will be hung drawn and quartered like all virus makers should be

Evil

[medv4380]

Evil is good right?

KILL HIM NOW!

[bell.colin]

KILL HIM NOW! And send a message to any other A$$HOLE That might think along the same lines.

Marketers, Advertisers, and Spammers (Phone/E-Mail/Mail) must learn we Don't want or tolerate their crap!

Seriously why would he create this (other than to annoy people)

-- If you think the above is serious intent you do not belong on the internet and won't last long

Does anyone know

[DRAGONWEEZEL]

If in Win7, the startup time on the VM goes down if I flip the V switch in Bios?

w/o it, the time to start a virtual XP session takes a while on a pretty quick system.

Re:Does anyone know

[mlts]

Depends on the virtual machine software:

XP Mode or Hyper-V, without the VT switch on, it will just laugh at you.
VMWare, it will run, didn't notice a performance hit.
Virtualbox, same as VMWare.

Re:Does anyone know

[Fulg]

XP Mode or Hyper-V, without the VT switch on, it will just laugh at you.

Actually there was an update early this year that removed the limitation, presumably because plenty of cheapo Dell PCs (for example) don't even expose the VT switch in their BIOSes (even though the CPU supports it).

I haven't noticed any speed difference in XP Mode or VirtualBox with or without VT.

Example code is broken

[AC-x]

The example doesn't work properly - it regenerates the cookie each time you load the page so I can't actually tell if the cookie is being persisted between browser sessions. I was curious to whether Chrome's incognito mode can defeat it...

The horcrux of cookies

[Flexagon]

'Nuf said.

Why mess with this in the first place?

[marian]

Accept all cookies and change the permissions for your cookies file to read only. Done.

Looks like evercookie is a good method

[jcochran]

of flagging sites to blacklist.

Seems to me that it's an attempt to bypass privacy requests by users. If I get rid of a cookie, that means that *I* do not want that cookie to exist. Period. End of case. And if some site goes to the extreme measure of using evercookie to insure that their cookies are persistent even though the user has demonstrated that they don't want the cookie, well then that's a site that should be black listed.

GMail

[Frankie70]

How integral is it?

It shouldn't be. But it is.

Try logging into GMail with cookies turned off. It won't work.

Also Google Images search doesn't work for me with cookies turned off.

Old news

[Anonymous Coward]

Cue the David Spade "Hollywood Minute" voice:
"We've seen this before, when it was called a virus."

Or using a Live CD

[Anonymous Coward]

And re-boot often

Demo didn't work for me

[lullabud]

Am I the only one doing the demo on the page and having it fail completely? I just tried it in Firefox and Camino on OS X and neither worked.

Re:Demo didn't work for me

[Entropy98]

Im having problems too

I uploaded the example code, you can try it out here

For me it stores data using only 2 methods in FF though "Clear Recent History" fails to remove both.

In IE8 the script fails to work for me:

Message: Object doesn't support this property or method
Line: 263
Char: 3
Code: 0
URI: http://fiestafan.com/ec/evercookie.js

Re:Demo didn't work for me

[Anonymous Coward]

I had to enable JavaScript just to make it run:

cookieData mechanism: undefined
localData mechanism: undefined
globalData mechanism: undefined
sessionData mechanism: undefined
historyData mechanism: undefined
lsoData mechanism: undefined
pngData mechanism: undefined
cookieData mechanism: undefined
localData mechanism: undefined
globalData mechanism: undefined
sessionData mechanism: undefined
historyData mechanism: undefined
lsoData mechanism: undefined
pngData mechanism: undefined

FF 3.6. Regular and flash cookies are disabled by default.

No add-ons either

[lullabud]

It's worth noting that Camino and Firefox both failed without any spiffy add-on's either.

Failed on Opera

[wiedzmin]

Simple "delete private data" on latest Opera without any gimmicks got rid of all his cookies as well. What was this created for, IE6?

Re:Failed on Opera

[angelofdarkness]

A private tab in Opera defeats it too.

Re:ExpertSexChange

[clone53421]

Between RefControl (to tell it I came from Google) and the following AdBlock Plus filters, I can pretty much pretend that ExpertSexChange’s stupid restrictions don’t exist on the rare occasion that I actually would go there.

experts-exchange.com##*.relatedSolutions
experts-exchange.com##*.squareSignUp
experts-exchange.com##div.qStats+a
experts-exchange.com#div(blurredAnswer)
experts-exchange.com#div(sectionFour)
experts-exchange.com#div(startFreeTrialEcho)

A fitting response in kind might be...

[grikdog]

...one lash per supercookie instance per laptop or workstation per planet, on the bare ass of the perp.

Dear FSM, WHY?!

[Ustice]

Why would you release such an abomination? Do we REALLY need more tools to track us? The ONLY good thing that can come of this is that browser developers see this, and finally realize that people don't want to be tracked, and do something serious to stop it.

Working on it! Windows 7 Edition.

[Joe U]

This is a pet project of mine actually. I'm trying to find the least obtrusive way to do it. RemoteApp and VMWare is where I'm looking this week.

Also, I'm using a ramdisk for temp files. Supercookie is not an issue with my setup. I figured I'm not using 8GB all the time, why not dedicate 1 to temp files. If I'm doing dev work, I run a batch file to point back to HDD and shut down the drive. MKLINK.exe, gotta love it.

Can your browser read you MAC?

[pseudorand]

From TFA TODO: adding support for: ...
  - Using Java to produce a unique key based off of NIC info

Someone please tell me browsers (at least FF on Linux) don't support reading my MAC address.

Use cron

[Khopesh]

I've posted on this before, but here's an update based on some info from that link, hopefully doing a better job of limiting the damage from blowing away actively used LSOs:

Put this in your crontab:

* */4 * * * find .adobe .macromedia -type f -mtime +1 2>/dev/null |xargs rm -f

If you're on a laptop (test this first!), you can limit it to when you're plugged in:

* */4 * * * acpitool -a 2>/dev/null |grep -q online && find .adobe .macromedia -type f -mtime +1 2>/dev/null |xargs rm -f

This uses short circuiting in sh. You need to verify with this command first:

acpitool -a 2>/dev/null |grep -q online && echo it works || echo it failed

If you're not using GNU grep but acpitool works fine, try using grep online >/dev/null instead.

Re:Use cron

[Khopesh]

find .adobe .macromedia -type f -mtime +1 2>/dev/null |xargs rm -f

I forgot to mention what that does. It searches your .adobe and .macromedia directories for all files older than one day, ignores errors, and then removes the hits, ignoring failures like those from an empty file list.

Because I use ac power as a prerequisite for several cron tasks, I've actually worked the acpitool command into its own shell script, but I wanted to keep it simple for this post.

hash it up

[Anonymous Coward]

Should be easy to modify cookiepecker.pl to make a hash of this. See http://www.pckswarms.ch/beomar99.html

I, for one,

[Anonymous Coward]

Welcome our new flatulent overloards and would love to take thier teeny peeny in my pooshoot

Here's the trouble, though

[sean.peters]

Many, many sites require Javascript to work AT ALL. You can argue that they should degrade gracefully so that they still work without JS, and you'd be right. But the fact is: they don't. So as a user, I'm now left with the choice of an almost completely broken (but secure) web, or a web that mostly works but can zap me with "evercookies". In practice, I end up using NoScript to block all 3rd party scripts, but I mostly allow scripts from the sites I visit frequently. Which means that, say, Slashdot could hit me with an evercookie as long as they hosted it on their own domain.

Reboot after installing updates

[tepples]

I have no need for that. If I want to stay logged in why would I close the browser?

When you update some components of your operating system, the update doesn't finish until you close the browser and restart the computer.

Re:Reboot after installing updates

[cheater512]

Or say when your using your computer in your locked house, do you really need to enter your password in to read your email every single time?

The Turing Test:

[aquila.solo]

You fail it.

Re:Sandboxie

[Anonymous Coward]

Is there an OS X (via fink or WINE, maybe) alternative? What about Linux?

Quoth the raven, evermore...

[yayazozzy]

I'm sure you were smart enough NOT to visit Samy Kamar's site to see just who the heck this guy is. But if you did, you got 8 cookies for free. Never ending, ever sending cookies. Quoth the raven evermore.

cookie sharing

[Anonymous Coward]

Firefox addon, called GoogleSharing hides google search-terms from Google
http://googlesharing.net/download.html

Some more privacy tests and solutions
http://web.comhem.se/u79/Privacy.php