Slashdot Mirror
Nevercookie Eats Evercookies
wiredmikey writes "Anonymizer, Inc. has developed Anonymizer Nevercookie, a free Firefox plugin that protects against the Evercookie, a javascript API built and made available by Samy Kamkar (same guy who brought you the Samy Worm and XSS Hacking to Determine Physical Location) who set out to prove that the more you store and the more places you store it, the harder it is for users to control a Web site's ability to uniquely identify their computer. The plugin extends Firefox's private browsing mode by preventing Evercookies from identifying and tracking users."
In development now: ForeverEverCookies, then NeverNeverCookies, then SuperCantTouchThisCookie, then ImGonnaEatYourDamnCookiesForBreakfast.
Liberal? Conservative? Compare perspectives at Left-Right
The company says that Nevercookie will be available as a free download later this month.
Premature story.
As an Anonymous Coward, I'm really getting a kick out of this plugin.
I look forward to reading this exact same story, except with details, in less than a month.
I live in constant fear of the Coming of the Red Spiders.
I do almost everything in VMs since it keeps my computer cleaner. My web browsing VM starts from scratch each time I load it (with a random MAC address inside the VM). Only the bookmarks get exported and imported. Evercookie doesn't stand a chance with me.
To further improve the situation, I have privoxy chained to squid. My iptables rules don't allow the user that runs the VMs to connect to the internet at all, not even dns. Only a connection to the local privoxy proxy which strips all ads and other annoying things.
It took a while to set this up for sure, but it is secure and most importantly an enjoyable browsing experience.
I hope that this "Nevercookie" addresses the issues raised by "Evercookie" in a systematic way, rather than just defeating Evercookie point-by-point.
Evercookie's creator explicitly noted that his work was a simple proof of concept, cooked up fairly quickly, as a way of raising the issue of covert persistent data storage on the web. He further noted that people who actually do evil for a living are probably at least as creative as he is, and have a whole lot more time to work on the problem. Simply defeating Evercookie, as released, will probably save you from a few of whatever the analytics world's equivalent of a script-kiddie is; but will do next to nothing against the issues that Evercookie was designed merely to demonstrate...
Please, just one cookie, I promise I'll go away!
What about Chrome? Why are its users still without a defense? Is this company policy?
I may have to switch back to Firefox. I'm getting crushed by spam using Chrome.
From the end of the article, " Specifically, Nevercookie prevents abuse to both the Adobe Flash Local Storage Object (LSO) and Microsoft's Silverlight Isolated Storage (MIS)." "
Doesn't BetterPrivacy already eliminate LSOs and other stored data?
I don't have Silverlight so I don't know if it eliminates that data but unless these "Evercookies" are somehow different than "Supercookies" you can eliminate this issue right now.
Obligatory:
Click Around - Look at what you see ... ...
On the Web - spammers, you and me.
Underneath the good sites, lies a host of sites unbound
by the rules of ethics, making hell all around!
They track you with the
Never-Ending Cookieeeeeeeee
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
wait wait, vaporware.. never.. associations coming in.. DukeNukemForNever!!!
Was not XSS, but based on insecure session ID generation. http://samy.pl/phpwn
If you ignore ACs because they are anonymous - you're an idiot.
My name is Geoff and I created "nevercookie". I'm a researcher at Anonymizer. I can assure you all that it is not vaporware, it works and has been pretty thoroughly tested, it's just that marketing wants to brand it and make it all slick before we release it to the general public (which should be in a week or two). I've sent out a few beta versions for friends in the security field to test out, and I might be able to send out a few more if anyone is interested in field testing it early (I'll ask my boss). To address concerns about how it works, it's pretty simple actually. When private browsing mode in firefox is initiated, the external data storage of Flash and Silverlight is quarantined (this is done because the browser normally can't touch these things cause they are browser independent, this is the most obvious place that an evercookie can respawn from (unless you clean it manually)). Then a clean, temporary user profile is spawned for the current browsing session, eliminating any lingering cached data. There's actually a decent explanation here: http://www.anonymizer.com/learningcenter/#lc_labs
Who are the web sites that use theses cookies? why do they remain unnamed? I think that knowledge is just as important as making blocking software.
Jack of all trades,master of none
Yo dawg, I herd you like cookies, so I put a nevercookie in your browser so you can eat cookies while it eats cookies.
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
I don't have this problem because I use Adblock Plus!
A pox on web designers who feel that window.innerWidth == screen.availWidth
Yes i use the firefox Noscript to only run javascript from trusted sources. I was not aware that the link needed that extension.
Because i am paranoid enough to disable javascript (and disbaleing javascript is also effective against a lot of evercookie stuff)
PS PLease note that if you run the link multiple times you might seem to get less unique, because your setup is detected twice that way.