3 ms·

I like to always use incognito browsing sessions when logging into Facebook. At some point I cleared all my cookies too. I remember a while back an article wa

by sbov 11y ago

I like to always use incognito browsing sessions when logging into Facebook. At some point I cleared all my cookies too. I remember a while back an article was posted about how to uniquely identify users without cookies though. I don't recall the exact method though, or if in this scenario it would require javascript and not just a link to a like button.

kaybe 11y ago
Basically you're using the specs the browser sends about the computer - OS, screen size, add-ons installed.. this gets pretty unique. I've been able to identify friends on a local site just by knowing them and their computers. Check yourself here: https://panopticlick.eff.org/ https://panopticlick.eff.org/
- sbov 11y ago
  Was able to find it. Actually it's using etags. They work even if you disable cookies. Perfect identification, similar to cookies. Sites were using it before it came to light: https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags
  - pdkl95 11y ago
    You don't even need ETags - if the server sends out a unique (or mostly unique) "Last-Modified" header, the browser will return the cookie in "If-Modified-Since".
jlarocco 11y ago
I'm not sure incognito browsing actually helps much. User tracking isn't a 100% accurate science, and your browser name, browser version, operating system, OS version, IP address, screen resolution, etc. are still getting sent along and they don't change by going incognito. It's no big deal for Facebook to just assume it's still you if the only thing that's changed is that you're no longer sending the same session cookie.
pdkl95 11y ago
Protecting against 2nd and 3rd party tracking was never the goal. "Incognito"/"Private Browsing" mode on browsers was a feature to protect against leaving local browsing records. It's often nicknamed "pr0n mode" for that reasons, by people that didn't want pr0n websites showing up in their browser history.

by sbov 11y ago

kaybe 11y ago

Basically you're using the specs the browser sends about the computer - OS, screen size, add-ons installed.. this gets pretty unique. I've been able to identify friends on a local site just by knowing them and their computers. Check yourself here: https://panopticlick.eff.org/ https://panopticlick.eff.org/

sbov 11y ago
Was able to find it. Actually it's using etags. They work even if you disable cookies. Perfect identification, similar to cookies. Sites were using it before it came to light: https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags
- pdkl95 11y ago
  You don't even need ETags - if the server sends out a unique (or mostly unique) "Last-Modified" header, the browser will return the cookie in "If-Modified-Since".

jlarocco 11y ago

I'm not sure incognito browsing actually helps much. User tracking isn't a 100% accurate science, and your browser name, browser version, operating system, OS version, IP address, screen resolution, etc. are still getting sent along and they don't change by going incognito. It's no big deal for Facebook to just assume it's still you if the only thing that's changed is that you're no longer sending the same session cookie.

pdkl95 11y ago

Protecting against 2nd and 3rd party tracking was never the goal. "Incognito"/"Private Browsing" mode on browsers was a feature to protect against leaving local browsing records. It's often nicknamed "pr0n mode" for that reasons, by people that didn't want pr0n websites showing up in their browser history.