Undeletable Cookies

http://www.schneier.com/blog/archives/2011/08/new_undeletable.html

by wicknicks • 15 years ago

157 47 15 years ago

schneier.com

icode• 15 years ago

Not undeletable. Just not deleted via the browsers "delete cookies" function.

davidu• 15 years ago

I would not advise that argument as a legal defense strategy.

wingo2• 15 years ago

Very interesting, and evil: abusing the ETag mechanism for user tracking. (If a user requests some sort of unchanging resource without an etag, you give them a fresh one; and if they request a resource with an etag, you give it to them, with the supplied etag, and record the user.)

Even if Hulu turned off cookie respawning via etags, you can still track users this way, on the server side. I guess the tricky thing is to correlate the etag of the tracker resource with the rest of the requests that a user makes on a site.

apgwoz• 15 years ago

> Even if Hulu turned off cookie respawning via etags, you can still track users this way, on the server side. I guess the tricky thing is to correlate the etag of the tracker resource with the rest of the requests that a user makes on a site.

The important distinction is that the ETag is literally no different than a cookie, when used this way. Turning off caching is the new turning off cookies.

wingo2• 15 years ago

There is a difference: cookies get sent on requests to any resource in a domain, whereas etags get sent only to specific resources.

rjbond3rd2• 15 years ago

> ...the tricky thing is to correlate the etag of the tracker resource with the rest of the requests that a user makes...

Not tricky though. Just put 1-pixel Etagged gif on every page. It gets requested on each page. Or just associate (server-side or client-side) the user's session cookie with the Etag.

nbpoole• 15 years ago

ynniv• 15 years ago

ETag and cache based cookies are old news. I assume that Schneier didn't notice these components last time he reported on evercookie.

[ http://google.com/search?q=evercookie ]

nikcub2• 15 years ago

It is a lot older than evercookie. I remember porn affiliate scripts that were using ETag back in 01-02. It is a well known method, as is using Last-Modified.

gmac• 15 years ago

I wonder how this will be treated under the EU's Directive on cookies...

Edit: sorry, not found an answer yet, but the top Google result for 'EU cookies' is rather fun: http://www.davidnaylor.co.uk/eu-cookies-directive-interactiv...

route66• 15 years ago

Schneier does not tell so much here, instead he links to this article giving more details:

http://ashkansoltani.org/docs/respawn_redux.html

nirvana4• 15 years ago

I believe Google is doing this with its google voice product. We're unable to access our google voice accounts outside the USA, despite disabling flash, deleting all cookies, etc. The ironic thing is, of course, that this is when we need it the most, as we miss more calls being in a radically different time zone.

dchest• 15 years ago

I'd say they disable access by IP, but I can access my account from two countries that are far outside the US.

nirvana4• 15 years ago

Well, I'm using different IPs than the "home" IP we used when we signed up. Any attempts to get into google voice for me, though, say that it is not allowed outside the USA.

randomdata• 15 years ago

I sometimes run into a problem with Google that when I try to log out, I remain logged in. Even after deleting my cookies, I find myself logged in still. This may explain why.

abraham• 15 years ago

That should never happen. You should email security@google.com.

drivebyacct22• 15 years ago

They're using GeoIP. Use a US proxy. (Source: me trying to open a Google Account and use Voice via Tor)

nirvana4• 15 years ago

Tried that, no dice. Hulu and the rest of the world thinks I'm in silicon valley, but google voice is more clever... somehow.

mahyarm• 15 years ago

Why wouldn't google want people to access their voicemail,texts,etc and make web calls with their GV number all on the computer when they are outside of the country??

nirvana4• 15 years ago

Because Google Voice is USA Only right now. I don't know why but that's the policy... and they've gone to surprising lengths to enforce it

tlrobinson• 15 years ago

Shouldn't you be able to "delete" them by clearing your browser cache?

frozenflame• 15 years ago

What do you mean by this? I've always been able to send and receive texts through Google Voice in Canada, I can also call (only have it set up to call my gmail) using the web interface. What I've never managed to do is activate the app on my android phone to allow my send/receive texts there even if I couldn't do calls without a US phone number.

ck23• 15 years ago

Reminds me to write a firefox plugin to strip etags and "if-none-match" - pretty sure most pages can function just fine without them and use last-modified, etc instead. Kind of surprised to not find anything yet on addons.mozilla.org

CGamesPlay• 15 years ago

You do that, and I'll just assign a unique UNIX timestamp to each visitor.

ck23• 15 years ago

That's a good point and this would not be practical in a regular browser session but if someone chooses private browsing, an extension could be sure to strip "last-modified" as well as "if-none-match".

Would hurt the server a little and reduce speed because there would not be any caching but still helps guarantee no tracking.

bwag• 15 years ago

Interesting. Wikipedia references two add-ons written back in 2007 for this purpose. No idea if they still work on more recent versions of FF.

http://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags

ck23• 15 years ago

The writeup about the two extensions for firefox is wrong, those two were meant to block the trick where you can determine if a user has visited a specific site/page by looking at the link color/state.

nikcub2• 15 years ago

Last-modified is just as vulnerable as ETag are since you can set any string as the modified date (it doesn't have to parse as a date) and the browser will replay it

See my comment on the previous thread:

http://news.ycombinator.com/item?id=2825564

I am currently in the midst of writing a browser plugin to block all this bullshit:

http://github.com/nikcub/parley

considering just doing a browser fork since the browsers are so uncooperative.

hammock• 15 years ago

From wikipedia:

ETags may be flushable by clearing the browser cache (but browser implementations may vary).

In 2007, two Mozilla Firefox add-ons were made to prevent the usage of ETags for tracking.[5][6]

[5]https://addons.mozilla.org/en-US/firefox/addon/safecache/ [6]https://addons.mozilla.org/en-US/firefox/addon/safehistory/

jim_h• 15 years ago

The safehistory plugin doesn't seem to work for the newer versions based on the comments on their page.

yaix• 15 years ago

Even better is the paper (written 2003) linked in the comments of the article:

http://www.arctic.org/~dean/tracking-without-cookies.html

youngtaff• 15 years ago

The potential of etags as a way of tracking has been known about for a while...

To put the other side of this argument Kiss Metrics put up a pretty strong denial that they were using etags for tracking http://bit.ly/r5lPbx

Guess it might need a bit more research

RyanGWU822• 15 years ago

Well, they said that they "made the following changes" -- one of which is not using eTags. So I guess they stopped that.

(That said, they never aggregated this data across multiple websites, so I really don't get what the whole fuss was about.)

mtogo3• 15 years ago

They tried to make their cookies undeletable. Why would they do something like that? The fuss is that it's a bad, dishonest, skeezy thing to do. Kissmetrics has shown that they are not an honest company, they're a dishonest one that will disregard the privacy concerns of their user's visitors.

rjbond3rd2• 15 years ago

Even if -they- never aggregated the data, does that really mean that nobody aggregated the data? If the clients get raw data, couldn't they (privately) swap data with another client? I assume that if it can be done, it will be done.

mtogo3• 15 years ago

Just don't post shortened links on HN. It's nice that you want click analytics for your post, but nobody wants that but you.

Here's where that bit.ly link heads to: http://blog.kissmetrics.com/official-kissmetrics-response-to...

driverdan• 15 years ago

I don't understand why this keeps getting press. It's nothing new, this method has been around for at least 4 years. Schneier should be well aware of it.

woodall• 15 years ago

You blog to make OTHERS aware.

mtogo3• 15 years ago

This is not news. Evercookie has been doing this for years, and it's just as easy to defeat as it was years ago.

http://samy.pl/evercookie/

nodata• 15 years ago

Obligatory link to Panopticlick: http://panopticlick.eff.org/

praptak• 15 years ago

What it really boils down to is this: you cannot have both caching and privacy.

For the cache to work your browser must reveal to the server what it has already downloaded, this way or another. And the browser cannot really tell which of the downloaded pieces of data were specially generated to track this particular user.

A possible workaround is to create an intermediate cache to share it with multiple other people, but this creates other privacy concerns.

NiekvdMaas• 15 years ago

We created a PoC a while ago showing ETag + browser fingerprinting to replace cookies/client-side storage: http://www.adperium.com/tracking

It works in all major (desktop) browsers, but not in some mobile browsers.

I think the cookie debate (in the EU) is not in the best interest of users: with cookies, the user has full control of the data stored, can easily purge cookies, etc. With user-tagging technology moving server-side, this gets a lot more complicated.

Undeletable Cookies

Related Stories