Introducing the Invulnerable Evercookie

An anonymous reader writes "Using eight different techniques and locations, a 'security' guy has developed a cookie that is very, very hard to delete. If just one copy of the cookie remains, the other locations are rebuilt. My favorite storage location is in 'RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out' — awesome."

Comments

Not hard to beat at first glance.

[grub]

evercookie is written in JavaScript and additionally uses a SWF (Flash) object for the Local Shared Objects and PHP for the server-side generation of cached PNGs.
[...]
If a user gets cookied on one browser and switches to another browser as long as they still have the Local Shared Object cookie, the cookie will reproduce in both browsers.

Well, the site's EXAMPLE failed on my box. That's NoScript at work. If you use BetterPrivacy (another FF extension), it removes the LSO at browser shutdown.

YMMV

Re:Not hard to beat at first glance.

[Shrike82]

That's NoScript at work. If you use BetterPrivacy (another FF extension), it removes the LSO at browser shutdown. YMMV

I take your point, but most people use neither of these things and will be at the mercy of persistent tracking. Of course anyone who doesn't know what a cookie is probably won't be affected by this in any way (i.e. they're already being tracked through regular cookies). Especially since "Private Browsing" modes have been shown to retain information.

Re:Not hard to beat at first glance.

[h00manist]

who doesn't know what a cookie is probably won't be affected by this in any way (i.e. they're already being tracked through regular cookies).

There's all kinds of databases on people available. Search and you shall find.

All data circulates easily and is simply very hard to stop. It is indeed like speech, it just happens, anyone can do it. Copyrighted data, personal data, credit data, secret data, whatever. Bottom line, gathering and selling various gray-black-market data is illegal immoral etc, and very doable and very interesting for companies and organizations of all types. Not unlike downloading movies is for many - illegal but easy and interesting data. It's the interests that are different.

Re:Not hard to beat at first glance.

[Kvasio]

running browser in Sandboxie would also do the trick

Re:Not hard to beat at first glance.

[mlts]

Thanks for the reminder. Last time I looked into sandboxie, it did not support 64 bit operating systems, which is does now. Using it is a lot easier on the CPU and more convenient than creating a VM with a Web browser in it and rolling it back when done for that session.

With Unity mode on VMWare Workstation or the equivalent on Windows 7 and XP Mode, keeping a Web browser in a sandbox isn't that much work, especially if one is having to use a backlevel version of IE for some websites that force IE6, and even does JS/VBScript checks to check for a changed UserAgent field.

Re:Not hard to beat at first glance.

[dkleinsc]

Thhe purpose of "Private Browsing" isn't to protect your privacy from websites while you surf, it's to protect your privacy from your SO when she comes home and sees your web history.

"That's the great thing about evercookie"

[tomalpha]

From TFA:

That's the great thing about evercookie

I disagree. Strongly.

I guess it's good that this is out in the open so we know about it, and hopefully the major browsers can all do something to help prevent it. But still: don't like, don't like at all.

Re:"That's the great thing about evercookie"

[Pharmboy]

You can't blame someone for a "method" when it is openly explaining how it is doing what it is doing, using the existing software. Yes, he is pushing it as a "feature", when it is in fact due to a flaw in the overall design of all browsers. It is much better for the information to be released like this than to find out a year after it is fully integrated into every piece of malware.

Hacking at its finest.

Re:"That's the great thing about evercookie"

[Anonymous Coward]

it's not his research either. this has already been observed in the wild and already reported by ars technica.

http://arstechnica.com/tech-policy/news/2010/08/ad-firm-sued-for-allegedly-re-creating-deleted-cookies.ars

the advertisement company got already sued for it.

Re:"That's the great thing about evercookie"

[PhilHibbs]

There's no possible justification for this project.

"To show everyone what the black hats and spammers are going to be doing", sounds good enough to me.

Remember?

[Pojut]

Remember a time back in the mid-to-earlylate 90's when cookies had a super negative connotation to them? I find it interesting how integral they've become to experiencing the Internet in a timely fashion...

Re:Remember?

[Haedrian]

Well, html is unable to save session information. So you need cookies for that. There is no other reliable and non-user-unfriendly alternative.

When you 'log in', you are given a cookie, which the page reads and uses to identify you. That's one of the more common 'useful' uses for cookies.

Cookies can also store small amounts of data in them (ever been to a website which tells you "Pick Language" and then lets you "[ ] Always remember this choice"? That's also a cookie.

And last but not least, they're good at identifying you so that other adverts (on other sites) note the cookie and are able to link your presence on Site A to the one on Site B then data-mine

Re:Remember?

[cgenman]

Hidden form values have the annoying tendency of breaking the back button. That, in my mind, is a far greater sin than cookies.

And now...

[Haedrian]

Whenever someone goes through all the trouble of adding additional ways of tracking people - someone goes through all the trouble of finding ways of removing it.

There's no such thing as Invulnerable - See also: DRM and Copy-Protection

Re:The PNG thing isn't that unexpected

[The MAZZTer]

Firefox already has.

Developers take note

[Monoman]

If you have to go to great lengths to work around customers doing things like deleting cookies then you are doing something wrong or evil.

Browser on a VM then?

[Natales]

This leaves me no option but running my browsing session in an undoable-mode VM, where after a reboot, all comes back to the previous state. Will this be the only way to maintain my privacy going forward?

Re:Browser on a VM then?

[NevarMore]

No. You could also stop using the Internet.

Not Really

[Greyfox]

It might just drive more users to noscript and flashblock. I have to explicitly trust a site before I allow it to do those things, and if I happen to run across a site that requires them during casual browsing, I do not allow them access to those capabilities. If you're the sort to look over your shoulder that much, being able to browse the web with some level of comfort should more than offset any degradation of the web experience.

Advertisers and site operators might complain that this behavior costs them revenue, but they should have thought about that before going all Big Brother on us. If you're going to try to trick me into clicking an ad on your site, I don't want anything to do with your site anyway. And I do occasionally click through ads on Slashdot and Google.

At least Linux users can...

[WarmBoota]

symlink the LSO folder to /dev/null

Wonka

[Anne_Nonymous]

The Invulnerable Evercookie sounds like something dangerous from Willy Wonka's factory.

Cookie?

[kurokame]

Let's see. A remote website infects your computer with code which does things on your system without your consent and resists your attempts to delete it through the use of hidden copies. I think we have a word for this already. Starts with a V.

Re:Cookie?

[Haedrian]

Vista?

Re:nietzsche quote applies:

[MozeeToby]

Rather than disabling and trying to defeat all these tracking mechanisms I think it would be easier to flood them with false information. Someone should set up a cookie sharing site and FF extension that trades (safe, non-identifying) cookies amongst all the users of that extension. Why yes, I did visit mylittlepony.com directly between visits to journalofparticlephysics.edu and horsesluts9.com, why do you ask?