3 ms·

The innovations that make trackers possible are: - browsers cache results - cookies If you do neither of these things trackers become much harder to implemen

The innovations that make trackers possible are: - browsers cache results - cookies If you do neither of these things trackers become much harder to implement.

szc 8y ago
I think this list is missing: - HTML5 "local storage" - Plugin detection - Javascript (particularly xml-rpc) - fetching embedded content based on a URL (images, movies, css, javascript, ...) - Hidden frames and/or WebRTC - can scan your local network There are probably more. [Edited: Updated to clarify that local network scanning can be done with hidden frames or WebRTC. A followup comment from me gives a public example of how]
- voxadam 8y ago
  Do you have any more information on the local network scanning?
  - danShumway 8y ago
    Not sure if this is what grandparent is referring to, but DNS rebinding[0] is what springs to mind. It's simultaneously kind of smart and also really stupid. Basically, you give a valid 3rd-party domain multiple IPs, one of them normal and one of them resolving to a local IP. Then you cut off the normal one and the browser just allows you to make calls to whatever local interface you want. There was a good defcon video about this a while back[1]. It's a much bigger problem than most people realize. This is why it's good practice to have at least some security around devices even if they're only connected to your LAN. [0]: https://www.twistlock.com/2018/02/28/dear-developers-beware-dns-rebinding/ https://www.twistlock.com/2018/02/28/dear-developers-beware-... [1]: https://www.youtube.com/watch?v=stnJiPBIM6o https://www.youtube.com/watch?v=stnJiPBIM6o
  - szc 8y ago
    Here is an example. Start at https://mycloud.com/setup https://mycloud.com/setup. Load the web inspector, find and read scanner.js. The Javascript isn't minimized and there are some comments.
- partycoder 8y ago
  It is my impression that most of the tracking happens through "tracking pixels" or 1x1 images, usually with 0 alpha so they're transparent... and cookies.
beagle3 8y ago
Evercookie[0] was state of the art in 2009. That's centuries ago in Internet time - and it doesn't even include fingerprinting. Cache and cookies are just a small part. [0] https://samy.pl/evercookie/ https://samy.pl/evercookie/

The innovations that make trackers possible are: - browsers cache results - cookies If you do neither of these things trackers become much harder to implement.

szc 8y ago

I think this list is missing: - HTML5 "local storage" - Plugin detection - Javascript (particularly xml-rpc) - fetching embedded content based on a URL (images, movies, css, javascript, ...) - Hidden frames and/or WebRTC - can scan your local network There are probably more. [Edited: Updated to clarify that local network scanning can be done with hidden frames or WebRTC. A followup comment from me gives a public example of how]

voxadam 8y ago
Do you have any more information on the local network scanning?
- danShumway 8y ago
  Not sure if this is what grandparent is referring to, but DNS rebinding[0] is what springs to mind. It's simultaneously kind of smart and also really stupid. Basically, you give a valid 3rd-party domain multiple IPs, one of them normal and one of them resolving to a local IP. Then you cut off the normal one and the browser just allows you to make calls to whatever local interface you want. There was a good defcon video about this a while back[1]. It's a much bigger problem than most people realize. This is why it's good practice to have at least some security around devices even if they're only connected to your LAN. [0]: https://www.twistlock.com/2018/02/28/dear-developers-beware-dns-rebinding/ https://www.twistlock.com/2018/02/28/dear-developers-beware-... [1]: https://www.youtube.com/watch?v=stnJiPBIM6o https://www.youtube.com/watch?v=stnJiPBIM6o
- szc 8y ago
  Here is an example. Start at https://mycloud.com/setup https://mycloud.com/setup. Load the web inspector, find and read scanner.js. The Javascript isn't minimized and there are some comments.
partycoder 8y ago
It is my impression that most of the tracking happens through "tracking pixels" or 1x1 images, usually with 0 alpha so they're transparent... and cookies.

beagle3 8y ago

Evercookie[0] was state of the art in 2009. That's centuries ago in Internet time - and it doesn't even include fingerprinting. Cache and cookies are just a small part. [0] https://samy.pl/evercookie/ https://samy.pl/evercookie/