Slashdot Mirror
Introducing the Invulnerable Evercookie
An anonymous reader writes "Using eight different techniques and locations, a 'security' guy has developed a cookie that is very, very hard to delete. If just one copy of the cookie remains, the other locations are rebuilt. My favorite storage location is in 'RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out' — awesome."
evercookie is written in JavaScript and additionally uses a SWF (Flash) object for the Local Shared Objects and PHP for the server-side generation of cached PNGs.
[...]
If a user gets cookied on one browser and switches to another browser as long as they still have the Local Shared Object cookie, the cookie will reproduce in both browsers.
Well, the site's EXAMPLE failed on my box. That's NoScript at work. If you use BetterPrivacy (another FF extension), it removes the LSO at browser shutdown.
YMMV
Trolling is a art,
Well, html is unable to save session information. So you need cookies for that. There is no other reliable and non-user-unfriendly alternative.
When you 'log in', you are given a cookie, which the page reads and uses to identify you. That's one of the more common 'useful' uses for cookies.
Cookies can also store small amounts of data in them (ever been to a website which tells you "Pick Language" and then lets you "[ ] Always remember this choice"? That's also a cookie.
And last but not least, they're good at identifying you so that other adverts (on other sites) note the cookie and are able to link your presence on Site A to the one on Site B then data-mine
No kidding. It was bad enough in the days when there were all sorts of cookies throwing illegal characters (wildcards, normally path-related characters, etc) in the filename to prevent deletion. Particularly when the "cookie" itself didn't actually have data, they just tried to stick every bit of info into the fucking filename.
And of course there have been all the programs that hide "registration" data - or even, sometimes, "never work again" flags - somewhere deep in randomly-named registry keys as pure numeric values to be next-to-impossible to hunt down unless you know precisely what you're looking for. I remember one of these that had a bomb in it designed to fuck up the program if you changed your system clock more than a few hours (non-permanent license, paranoid schizophrenic fucktards at the company afraid that people would reset their clock to keep the program running...Hi SPSS!) Boy was my coworker surprised when she went overseas and tried to resync her laptop to local time.
But just wait, pretty soon someone's going to take the Everlasting Gobstopper Cookie, add in a more malicious payload, and we're off to the races. There's no possible justification for this project.
it's not his research either. this has already been observed in the wild and already reported by ars technica.
http://arstechnica.com/tech-policy/news/2010/08/ad-firm-sued-for-allegedly-re-creating-deleted-cookies.ars
the advertisement company got already sued for it.
So basically if you clear your cache, as well as your cookies/LSO's all should be well. At least at the end of the browser session.
Another YAYdiots to the Mozilla Developers, for scrapping one of the best features in FF: Clearing the History window on exit. So sad you need an extra extension now what, as this story demonstrates again, should be an integral and visible part of any browser.
symlink the LSO folder to /dev/null
90% of everything is crap. Also, crap is relative.
Programmers don't always equate to good designers. And good designers probably aren't good programmers. (Exceptions exist, but true for the most part).
Otherwise, we wouldn't have terms like "programmer art".
That's something different.
With Firefox 3.6.10 on win 7: - visited evercookie page - Tools -> clear recent history - close browser - run ccleaner - visited evercookie page again and got new cookie ID I'd say it is not as persistent as it says...