Visitor Tracking Without Cookies (or How To Abuse HTTP 301s)

http://www.scatmania.org/2012/04/24/visitor-tracking-without-cookies/

by jaynate • 14 years ago

128 32 14 years ago

eli• 14 years ago

The more common way to do this is to stuff data in the ETags or Last-Modified date on a cacheable piece of content. This "hack" is at least a decade old, by the way.

Kissmetrics was actually using it in the wild for a while, but I think they stopped after there was a public outcry.

erichocean• 14 years ago

It's so old it's even in Wikipedia: http://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags

s_henry_paulson• 14 years ago

Being in Wikipedia is rarely associated with something being "old"

spjwebster• 14 years ago

Never mind the public outcry - Kissmetrics were being sued because of this technique and ended up settling out of court:

http://www.wired.com/threatlevel/2012/10/kissmetrics-trackin...

SquareWheel2• 14 years ago

Demo site appears down, but I get the gist of it. It's just abusing browser caching.

Rather than a bunch of ad networks and analytics companies finding workarounds, I'd rather sites just stand up to this obviously flawed rule. It's ill thought out, and I have no plans to offer one of those annoying "Hey, this site uses cookies, just like every other site on the internet!" alerts.

anonymouz• 14 years ago

So in your opinion the flaw with the rule is that it violates your natural right to store cookies on your visitors browsers without asking?

If your visitors have to log in you might as well show them such a message. If they don't have to log in, there is probably also no reason for them to accept your cookies.

While almost every site on the Internet uses cookies, most of them are of no benefit to a visitor. And yes, technical solutions exist, but they are not really suitable for a vast majority of the population that simply does not know about cookies, and which cookies to accept.

archangel_one• 14 years ago

My problem is that since it came into force, every website bothers me with these popups and of course most of the time you click 'yes' because you wanted something off the website and clicking 'no' probably won't help you get it. The flaw is that while they seemed to expect that lots of companies would stop using cookies on their websites, instead you just get these damn popups from them all to which 99% of everyone is clicking 'yes' because even asking that kind of question is not really suitable for a vast majority of the population that simply doesn't know about cookies.

It hasn't significantly improved privacy for anyone but has made the Internet a bit more annoying.

SquareWheel2• 14 years ago

It's not a natural right, it's a technical right. It's a fundamental storage mechanism of browsers. It means you don't have to log in every time you browser to my site, or you don't have to enter your birthday every time you want to browse mature content. It means advertisers are delivering the right ads, and that site owners can see where the bounce rates are highest for users and fix that page. Cookies are important, and the web functions better with them enabled and accessible to site owners.

Personally, I get annoyed when I'm badgered by notices, and sometimes even modal windows, for cookie notices. Of course your site uses cookies, it's just like every other site on the web. I shouldn't have to agree to a notice every time I visit a new domain. I have a browser toggle and if cookies offend me for some reason I can disable them.

d0m• 14 years ago

The irony with the demo... "Passager, rails deployments that just works" with a huge Error page showing security-sensitive stack traces.

tmister• 14 years ago

See also evercookie http://samy.pl/evercookie/.

brianchu• 14 years ago

Unless you want to get sued (http://www.extremetech.com/internet/91966-aol-spotify-gigaom...), I would avoid doing this until the legal grey area surrounding non-cookie tracking is resolved. I suppose you might be able to get a user to "agree" to this if you have them agree to a ToS when they sign up, but even then I'm not too sure of that.

rhizome• 14 years ago

Is it just me being perfectionist, or does needing to OCD your cookie data down to census level indicate that maybe your business model needs a little work? Are there certain niches where this degree of tracking is really necessary?

akaru• 14 years ago

As others have mentioned, this is old news. And this site should really be ignored as trash..."Scatman Dan"?

sasoon• 14 years ago

Why not just use localStorage instead of cookies?

prima-facie2• 14 years ago

Because localstorage may pop a message window on some browsers.

mixedbit• 14 years ago

Standard HTTP headers carry values that are distinct enough to uniquely identify most visitors: https://panopticlick.eff.org/

ErikD• 14 years ago

That uses mostly data collected clientside using javascript and flash. HTTP headers alone are no way enough.

paulsutter• 14 years ago

The laws don't define cookies narrowly. Just because you're not using an http set-cookie header doesn't mean you've circumvented privacy laws. For example, UK law:

http://www.aboutcookies.org/default.aspx?page=3

6. - (1) Subject to paragraph (4), a person shall not store or gain information, or to gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met.

(2) The requirements are that the subscriber or user of that terminal equipment -

(a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and

(b) has given his or her consent.

rmc3• 14 years ago

Agreed, the new EU ePrivacy directive is not about "cookies" per se, but storing and re-accessing data you store on people's computers. Cookies are the main example of that, but it also applies to anything that can re-identify a user.

blauwbilgorgel• 14 years ago

In a sense the "Cookie law" is a confusing misnomer. Not only "cookies", but also local storage, flash cookies, plugins, toolbars, and even resources like images, HTML, CSS and JS fall under this law.

The Dutch minister spoke of (freely translated): "Everything that reads or stores your data on your appliance, without permission, without a functional goal other than tracking".

Some techniques like browser fingerprinting ( https://panopticlick.eff.org/ , but also possible with http://modernizr.com/ ) don't store anything on your appliance, but would still fall under the "reading your data from your appliance" part of our law, if used for tracking purposes.

You would need permission to use the "grey" technique from the article. Even if you were to store that data in aggregated form.

ukjamster• 14 years ago

I agree with paulsutter - this does not comply with the law, nor do any of the hacky workarounds that I've seen mooted (except perhaps server side log file analysis - old school). I've added a comment to that site, which is awaiting moderation.

prima-facie2• 14 years ago

Can be done with ETags too.

16s2• 14 years ago

Ironic that the first thing that site does is try to set a cookie in my browser. I denied it. Also, I have JavaScript turned off.

fooyc• 14 years ago

How does the web look like from the 90's ?

16s2• 14 years ago

It looks like the Web without privacy snoops whoring out visitor clicks to the highest bider.

patrickmay• 14 years ago

This paper on browser fingerprinting shows that it is possible to identify a particular user, with reasonably high reliability, without using cookies or other tricks: https://panopticlick.eff.org/browser-uniqueness.pdf

Visitor Tracking Without Cookies (or How To Abuse HTTP 301s)

Related Stories