5 ms·

Abusing the Cache: Tracking Users without Cookies

55 points by madars 17y ago

wglb 17y ago
Wow. No javascript required, cookies turned off, just the browser cache and he will find you and hunt you down.
- Batsu 17y ago
  The only thing missing is purpose.
  - dagobart 17y ago
    I guess once you can tell who is who, you can start targeted marketing. Or collect data on people. Likely only a matter of time until you can build up a complete record, including name, address, social security number.
amalcon 17y ago
This could be defeated easily by a good, old-fashioned web proxy. Other than that, or blacklisting, there's no efficient way around it. Wow.
qeorge 17y ago
Perhaps a simple fix at browser level would be to treat cached files with future etags like cookies, clearing or ignoring them with the same policy. Its a genius trick though.
teej 17y ago
Chrome's incognito window shields you from this attack - it starts you off with a fresh set of history/cache/cookies every time you start it up.
- appathy 17y ago
  It's not an attack.
  - deleted 17y ago
    [deleted]
- blasdel 17y ago
  But you still get the same flash cookies, which are persisted across browsers.
- Tichy 17y ago
  like FF's private browsing, I suppose.
giardini 17y ago
And for users who disable caching?
- cfpg 17y ago
  And for users who disable cookies?
wanderr 17y ago
That's a pretty ingenius hack. More limited in use than a real cookie (real cookies are sent along with every request; even for images etc), but still pretty cool.
appathy 17y ago
Very clever. Props for creativity and originality.
mey 17y ago
http://panopticlick.eff.org/ http://panopticlick.eff.org/
- dagobart 17y ago
  IIRC this was on Hacker News less than a week ago. 4 points for simply repeating it? I'm startled.
  - mey 17y ago
    It was on HN. but the title was only panopticlick, so I figured people may have skipped over it, and it's relevant to this conversation.
  - bhiggins 17y ago
    Startled, yeah. I know, four whole points. I almost stopped breathing...
kree10 17y ago
It's neat, but it's not a new idea. http://sourcefrog.net/projects/meantime/ http://sourcefrog.net/projects/meantime/
dageroth 17y ago
one purpose is webtracking, especially in the affiliatemarketing niche, which "suffers" from cookie deletion because the cookiebased-tracking then does not recognize visitors and thus affiliates don't get paid... fingerprint methods are another alternative, although less precise and more difficult to implement.

55 points by madars 17y ago

wglb 17y ago

Wow. No javascript required, cookies turned off, just the browser cache and he will find you and hunt you down.

Batsu 17y ago
The only thing missing is purpose.
- dagobart 17y ago
  I guess once you can tell who is who, you can start targeted marketing. Or collect data on people. Likely only a matter of time until you can build up a complete record, including name, address, social security number.

amalcon 17y ago

This could be defeated easily by a good, old-fashioned web proxy. Other than that, or blacklisting, there's no efficient way around it. Wow.

qeorge 17y ago

Perhaps a simple fix at browser level would be to treat cached files with future etags like cookies, clearing or ignoring them with the same policy. Its a genius trick though.

teej 17y ago

Chrome's incognito window shields you from this attack - it starts you off with a fresh set of history/cache/cookies every time you start it up.

appathy 17y ago
It's not an attack.
- deleted 17y ago
  [deleted]
blasdel 17y ago
But you still get the same flash cookies, which are persisted across browsers.
Tichy 17y ago
like FF's private browsing, I suppose.

giardini 17y ago

And for users who disable caching?

cfpg 17y ago
And for users who disable cookies?

wanderr 17y ago

That's a pretty ingenius hack. More limited in use than a real cookie (real cookies are sent along with every request; even for images etc), but still pretty cool.

appathy 17y ago

Very clever. Props for creativity and originality.

mey 17y ago

http://panopticlick.eff.org/ http://panopticlick.eff.org/

dagobart 17y ago
IIRC this was on Hacker News less than a week ago. 4 points for simply repeating it? I'm startled.
- mey 17y ago
  It was on HN. but the title was only panopticlick, so I figured people may have skipped over it, and it's relevant to this conversation.
- bhiggins 17y ago
  Startled, yeah. I know, four whole points. I almost stopped breathing...

kree10 17y ago

It's neat, but it's not a new idea. http://sourcefrog.net/projects/meantime/ http://sourcefrog.net/projects/meantime/

dageroth 17y ago

one purpose is webtracking, especially in the affiliatemarketing niche, which "suffers" from cookie deletion because the cookiebased-tracking then does not recognize visitors and thus affiliates don't get paid... fingerprint methods are another alternative, although less precise and more difficult to implement.