4 ms·

"KISSmetrics tracking techniques worked even if a user had cookies turned off and private browsing mode turned on" Where can I read more about this 'unstoppabl

"KISSmetrics tracking techniques worked even if a user had cookies turned off and private browsing mode turned on" Where can I read more about this 'unstoppable tracking'? (how) can one counter such attempts?

jonah 14y ago
"evercookie"[1] [1] http://samy.pl/evercookie/ http://samy.pl/evercookie/ etc.
- evoxed 14y ago
  Interesting: > PRIVACY CONCERN! How do I stop websites from doing this? Great question. So far, I've found that using Private Browsing in Safari will stop ALL evercookie methods after a browser restart. I wonder if Safari is the only one or if it's just the only one the creator put to the test (i.e. what about Chrome Incognito).
  - TeMPOraL 14y ago
    I can confirm that Chrome Incognito doesn't do much. After setting the cookie, and then closing the Incognito window and starting a new one, I could see: userData mechanism: undefined cookieData mechanism: 677 localData mechanism: 677 globalData mechanism: undefined sessionData mechanism: 677 windowData mechanism: 677 pngData mechanism: 677 etagData mechanism: 677 cacheData mechanism: 677 dbData mechanism: 677 lsoData mechanism: 677 slData mechanism: undefined (where 677 was the number assigned to me and stored in the evercookie)
    - buro9 14y ago
      The important part is restarting the browser after using Incognito. Works fine.
nikcub 14y ago
I write about this stuff on my blog. For eg. using Last-Modified for the same effect as the ETag in OP: http://www.nikcub.com/posts/persistant-and-unblockable-cookies-using-http-headers http://www.nikcub.com/posts/persistant-and-unblockable-cooki... also posts with tips and more info in the archives: http://www.nikcub.com/archive http://www.nikcub.com/archive What I do is I use 3 different browser, 2 is ok. All your 'apps' such as webmail, facebook, etc. you use on one browser. Install Disconnect, AdBlock, NoScript etc. and disable flash, java etc. on the second browser and use that for all your web browsing. Kill the history and cookies on this browser regularly. Don't ever be tempted to 'browse' using the browser you have your apps logged in on. I have a third browser with flash enabled where I copy paste URLs into if I ever need flash for something, which is less and less often.
losvedir 14y ago
> (how) can one counter such attempts? I think I'm mostly safe the way I browse: Firefox with Cookie Monster denying everything (except whitelist), NoScript blocking all javascript (except whitelist), and RequestPolicy blocking all cross site requests (except whitelist). In theory, this would not protect against the ETag header technique being used if it were being implemented by the site itself, but since I believe it was actually done via a 3rd party request to KISSmetrics' domain, RequestPolicy should block it.

jonah 14y ago

"evercookie"[1] [1] http://samy.pl/evercookie/ http://samy.pl/evercookie/ etc.

evoxed 14y ago
Interesting: > PRIVACY CONCERN! How do I stop websites from doing this? Great question. So far, I've found that using Private Browsing in Safari will stop ALL evercookie methods after a browser restart. I wonder if Safari is the only one or if it's just the only one the creator put to the test (i.e. what about Chrome Incognito).
- TeMPOraL 14y ago
  I can confirm that Chrome Incognito doesn't do much. After setting the cookie, and then closing the Incognito window and starting a new one, I could see: userData mechanism: undefined cookieData mechanism: 677 localData mechanism: 677 globalData mechanism: undefined sessionData mechanism: 677 windowData mechanism: 677 pngData mechanism: 677 etagData mechanism: 677 cacheData mechanism: 677 dbData mechanism: 677 lsoData mechanism: 677 slData mechanism: undefined (where 677 was the number assigned to me and stored in the evercookie)
  - buro9 14y ago
    The important part is restarting the browser after using Incognito. Works fine.

nikcub 14y ago

I write about this stuff on my blog. For eg. using Last-Modified for the same effect as the ETag in OP: http://www.nikcub.com/posts/persistant-and-unblockable-cookies-using-http-headers http://www.nikcub.com/posts/persistant-and-unblockable-cooki... also posts with tips and more info in the archives: http://www.nikcub.com/archive http://www.nikcub.com/archive What I do is I use 3 different browser, 2 is ok. All your 'apps' such as webmail, facebook, etc. you use on one browser. Install Disconnect, AdBlock, NoScript etc. and disable flash, java etc. on the second browser and use that for all your web browsing. Kill the history and cookies on this browser regularly. Don't ever be tempted to 'browse' using the browser you have your apps logged in on. I have a third browser with flash enabled where I copy paste URLs into if I ever need flash for something, which is less and less often.

losvedir 14y ago

> (how) can one counter such attempts? I think I'm mostly safe the way I browse: Firefox with Cookie Monster denying everything (except whitelist), NoScript blocking all javascript (except whitelist), and RequestPolicy blocking all cross site requests (except whitelist). In theory, this would not protect against the ETag header technique being used if it were being implemented by the site itself, but since I believe it was actually done via a 3rd party request to KISSmetrics' domain, RequestPolicy should block it.