Slashdot Mirror
Nevercookie Eats Evercookies
wiredmikey writes "Anonymizer, Inc. has developed Anonymizer Nevercookie, a free Firefox plugin that protects against the Evercookie, a javascript API built and made available by Samy Kamkar (same guy who brought you the Samy Worm and XSS Hacking to Determine Physical Location) who set out to prove that the more you store and the more places you store it, the harder it is for users to control a Web site's ability to uniquely identify their computer. The plugin extends Firefox's private browsing mode by preventing Evercookies from identifying and tracking users."
In development now: ForeverEverCookies, then NeverNeverCookies, then SuperCantTouchThisCookie, then ImGonnaEatYourDamnCookiesForBreakfast.
Liberal? Conservative? Compare perspectives at Left-Right
The company says that Nevercookie will be available as a free download later this month.
Premature story.
As an Anonymous Coward, I'm really getting a kick out of this plugin.
I look forward to reading this exact same story, except with details, in less than a month.
I live in constant fear of the Coming of the Red Spiders.
I do almost everything in VMs since it keeps my computer cleaner. My web browsing VM starts from scratch each time I load it (with a random MAC address inside the VM). Only the bookmarks get exported and imported. Evercookie doesn't stand a chance with me.
To further improve the situation, I have privoxy chained to squid. My iptables rules don't allow the user that runs the VMs to connect to the internet at all, not even dns. Only a connection to the local privoxy proxy which strips all ads and other annoying things.
It took a while to set this up for sure, but it is secure and most importantly an enjoyable browsing experience.
I hope that this "Nevercookie" addresses the issues raised by "Evercookie" in a systematic way, rather than just defeating Evercookie point-by-point.
Evercookie's creator explicitly noted that his work was a simple proof of concept, cooked up fairly quickly, as a way of raising the issue of covert persistent data storage on the web. He further noted that people who actually do evil for a living are probably at least as creative as he is, and have a whole lot more time to work on the problem. Simply defeating Evercookie, as released, will probably save you from a few of whatever the analytics world's equivalent of a script-kiddie is; but will do next to nothing against the issues that Evercookie was designed merely to demonstrate...
A cross-browser, multi-platform, open source tool is BleachBit to delete evecookies, but for Firefox, this looks like
Please, just one cookie, I promise I'll go away!
What about Chrome? Why are its users still without a defense? Is this company policy?
I may have to switch back to Firefox. I'm getting crushed by spam using Chrome.
Just use a tiny, liveCD & no HDD. Don't hook up a HDD at all.
MAC addresses don't go over the internet due to networking, just javascript can do that, so disable it by default and only enable it for the 5 sites you actually support.
From the end of the article, " Specifically, Nevercookie prevents abuse to both the Adobe Flash Local Storage Object (LSO) and Microsoft's Silverlight Isolated Storage (MIS)." "
Doesn't BetterPrivacy already eliminate LSOs and other stored data?
I don't have Silverlight so I don't know if it eliminates that data but unless these "Evercookies" are somehow different than "Supercookies" you can eliminate this issue right now.
You idiot! You're not allowed to tell the truth about Islam in public! Terrorist sympathisers will mod you down to oblivion!
I'm sick of these motherfucking cookies on this motherfucking browser
Obligatory:
Click Around - Look at what you see ... ...
On the Web - spammers, you and me.
Underneath the good sites, lies a host of sites unbound
by the rules of ethics, making hell all around!
They track you with the
Never-Ending Cookieeeeeeeee
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
wait wait, vaporware.. never.. associations coming in.. DukeNukemForNever!!!
hmm vaporware.. never ever.. associations coming in.. DukeNukemForNever!!
Was not XSS, but based on insecure session ID generation. http://samy.pl/phpwn
If you ignore ACs because they are anonymous - you're an idiot.
Folks,
I think we'll see Duke Nukem Forever and the Bitboys Oy's "Glaze3d" video card before we'll ever see this "Nevercookie".
Nice try, Steven R. Williamson of 1228 Red Oak Lane, Springfield, Illinois, with bike lock combination 4321.
*rapidly immerses hard drive in vat of corrosive acid*
My name is Geoff and I created "nevercookie". I'm a researcher at Anonymizer. I can assure you all that it is not vaporware, it works and has been pretty thoroughly tested, it's just that marketing wants to brand it and make it all slick before we release it to the general public (which should be in a week or two). I've sent out a few beta versions for friends in the security field to test out, and I might be able to send out a few more if anyone is interested in field testing it early (I'll ask my boss). To address concerns about how it works, it's pretty simple actually. When private browsing mode in firefox is initiated, the external data storage of Flash and Silverlight is quarantined (this is done because the browser normally can't touch these things cause they are browser independent, this is the most obvious place that an evercookie can respawn from (unless you clean it manually)). Then a clean, temporary user profile is spawned for the current browsing session, eliminating any lingering cached data. There's actually a decent explanation here: http://www.anonymizer.com/learningcenter/#lc_labs
How was this offtopic troll-feeding modded UP?
Who are the web sites that use theses cookies? why do they remain unnamed? I think that knowledge is just as important as making blocking software.
Jack of all trades,master of none
I think that most of us who hold an active pro-privacy position regarding browser-based-tracking are ignoring one very fatal giveaway to our privacy -- our families' computers that are also sharing our internet connection. We geeks may delete all OUR cookies, LSOs, enable NoScript, adblock Plus, etc., on OUR computers, but when your wife (the one that thinks NoScript/flashblock is too much trouble) goes broadcasting your IP on facebook while you are surfing Slashporn^Wwikipedia, then you delete your cookies, while she doesn't. A week later, your modem has a new IP, you have a clean browser, your wife has the same unclean brwoser from last week. Now, if any one of the sites (say a large unnamed advertising agency that was showing ads on both websites) that you two visited are sharing IP and browser info, they can link her computer through time due to the browser's history/cookies/LSO/etc and then link your computer to her's due to the shared internet connection, and presto... they will be able to uniquely identify your computer-now from your computer-one-week-ago.
I don't have this problem because I use Adblock Plus!
A pox on web designers who feel that window.innerWidth == screen.availWidth
Yes i use the firefox Noscript to only run javascript from trusted sources. I was not aware that the link needed that extension.
Because i am paranoid enough to disable javascript (and disbaleing javascript is also effective against a lot of evercookie stuff)
PS PLease note that if you run the link multiple times you might seem to get less unique, because your setup is detected twice that way.