Slashdot Mirror
Beta Version of Nevercookie Released
wiredmikey writes "Anonymizer has released a beta version of Nevercookie, the recently announced Firefox plugin designed to protect against the Evercookie, a JavaScript API built and made available to prove that the more you store and the more places you store it, the harder it is for users to control a Web site's ability to uniquely identify their computer. Evercookie is a more persistent form of cookie that enables the storage of cookie data in a number of different locations, such as Flash cookies and various locations of HTML5 storage. This allows websites to track user behavior even when users have enabled private browsing. Because an Evercookie stores data in locations outside of where standard cookies are stored, an Evercookie can rebuild itself unless users go through a number of steps to completely clear and reset their local storage."
but as usual, only the technologically inclined who also care about privacy will use it. That is, not many.
"People don't want to learn linux" hasn't been a valid excuse since '03.
How long till EverEverCookie?
But kudos to the developers and ff (I am sure other browsers are not too far).
Not that it matters...
How is this extension different from similar privacy enforcing extensions?
Browse the internet in a virtual machine and reset the changes to the virtual hard disk afterwards. I'd like to see them get around that!
I dream of a nation where a man is not judged by his skin color but by an number assigned by a credit rating agency.
For just once, can someone design a trojan/worm that updates browsers to include useful addons like this instead of trying to steal banking information? Just sayin'.
#fuckbeta #iamslashdot #dicemustdie
I could say what I always say about Privoxy. But it never sinks in, so instead here's an amusing link
You could always disable cookies. Then the website requires cookies, and if you really want to use it, you accept cookies. The browsers could have had a setting that said, "delete cookies when navigating away from a domain in this list", but they didn't do that. So. I guess that's how we got into this mess.
As for browsers allowing a cookie to set stuff in obscure locations all over the system; that sounds like a bug that should have been fixed a long time ago. As for allowing 3rd parties to access cookies, that also seems like a bug--unless you also controlled that with another list. Yes. It should be a PiTA for users to have to modify a list in order to make your site work. That way, maybe you'll stop being a douche. Maybe.
It's going to be fun to watch the back and forth between evercookie and the anti-evercookie.
Four fifths of all our troubles in this life would disappear if we would just sit down and keep still. -C. Coolidge
For just once, can someone design a trojan/worm that updates browsers to include useful addons like this instead of trying to steal banking information? Just sayin'.
Tell me how you quarantee an innocent and useful payload.
Tell me why geek the who unleashes a trojan has won the right to decide how users should manage their systems.
Yeah, for the full privacy package you should combine this extension with an anonymizing proxy that you trust. As far as the panopticlick browser fingerprinting issue, I hope to integrate browser fingerprint manipulation into later versions of Nevercookie. This project is my 20 at work, we get 20% of our time for side projects. And yes, I expect Samy to counter with additional features to Evercookie, I'd be sad if he didn't :P.
This plugin is not yet compatible with SeaMonkey. Someone should fix that.
Your system's clock skew fingerprint will give you away, with a tiny bit of Javascript. Who needs cookies, when your computer has intrinsic characteristics / artifacts from manufacturing that uniquely identify it?
I have been using, for many years, a script that was originally intended to defeat Firefox's attempt to always run all browser windows under the same process. The method used is to create a fake home directory and populate it with some data that was derived from a "first run" of Firefox. The script applies a few tweaks to make the paths match the dynamically generated fake home directory. Firefox believes it is the home directory. It doesn't go so far to double check this in /etc/passwd or such ... why would Firefox want to be that pedantic. If I had to, I could go a step further and defeat even that.
The intent of that script was to keep Firefox from getting overly bloated by allowing me to full quit (exit the process) for each site visited, without killing the windows of other sites I am still currently visiting. In some cases, some sites have triggered bugs, or caused lockups. I can kill the browser for that site (if it didn't crash on its own), still keeping the windows of other sites. It might seem counter-intuitive to many, but this does work to keep the bloat level down. At least it does so with my style of browsing (I keep a number of individual sites up in a browser sometimes for weeks).
One effect I did notice early on is that tracking was not happening if I quit a browser for one site and later started a new one to return. All the old cookies disappeared when the reaper component of the script cleaned up the leftover fake home directories. Cross site tracking wasn't happening as long as I started a new browser for each site, which I usually did, except when following links (in which case, they can get a referrer URL which I have not yet bothered to suppress). Referrers are sometimes useful (like to get a special pass through a paywall when coming from a partner site).
If it turns out that Firefox is so leaky that cookies can be placed outside of the context of the fake home directory, then I'll just have to raise the stakes and use a chroot directory (definitely not secure once arbitrary code can be run), or go even further and use either BSD Jails or Linux Containers (LXC, based on kernel cgroups). That will just mean I have to hard link in some more libraries from a read-only bind mount or some such thing. Maybe I'd even have to make truly real home directories for user dynamically added to /etc/passwd or something. It might add several milliseconds to the Firefox start time. Hopefully, if that happens, the Firefox developers will realize they have holes and get them fixed.
In any event, there's plenty more room to raise even higher walls between instances, even concurrently, of Firefox. We'll go where we need to go. There's only so far that the scumbag versions of web developers can go with this.
now we need to go OSS in diesel cars
Started using it and had 2 new profiles each time I used private browsing mode. They weren't deleted. As someone who uses multiple profiles regularly, this is a dealbreaker. Nice idea, needs some work.
Not sure about earlier versions of 4.0, but it comes up as not compatible with Beta 6.
If you've never been modded as "flamebait" or "troll," you've never tried to argue a minority viewpoint here!
Unless I'm reading this the wrong way, evercookies can exist because of flaws in HTML processing. So, why not do something to fill that hole instead of sticking a band-aid on it in the form of Nevercookie?
Yes, nothing new in any of them, and of course it would be trivial to block all of them in the browser at a user's option (this misfeature of web standards be damned). So when is Mozilla going to provide a blocker option for users who want to close off all of those information leaking holes in the browser? Ah, I forgot Mozilla is completely corrupted by Google's sponsorship of Mozilla, they love information leaking channels like these, so they will not bite the hand that feeds (and we'll hear more of the usual vaguely plausible excuses as to why they can't and shouldn't). Hah!
I've been using the extension "Better Privacy" to kill the so-called 'super cookie' since the beginning of August this summer, works great.
Note to mods- if you're going to accept a story about cookie killers, at least find one that lists more than one specific piece of software. These aren't the only two extensions out there either.
Why does this site prompt to install Novell Moonlight plugin from the mono-project.com site, on Mozilla Firefox 3.6.
Here's a paper from 2007 (two years after the one we're discussing) demonstrating how to mask your skew: Skewmask: Frustrating Clock Skew Fingerprinting Attempts
Use my userscript to add story images to Slashdot. There's no going back.
The real problem is that your browser sucks! A decent browser would not allow a website(remote attacker) to execute malicious code(all remote code is malicious) or write data in unauthorized places. The browser should completely jail whatever happens within it. I realize that it's all about features but, the problem with features is flaws like this.
If the browser allows writing of data even via Java to the local drive, it should be jailed and in turn eliminated by Private Browsing mode. It should also be wiped by clearing the cache. Why must I still manually delete ~/.adobe and ~/.macromedia as well as all the other usual suspects?
Your browser sucks! Mine too!
Use a read-only drive for your OS, such as booting from a live Linux distro, then websurf from there. When you're done, turn off the computer. Poof. Histroy, cookies, flashcookies, 'nillacookies, all gone. :)