4 ms·

So this is the old E-tag trick? It's not new at all, but perhaps it hasn't been as widely published. This can also be done with the Date / If-Last-Modified head

by 0x0 13y ago

So this is the old E-tag trick? It's not new at all, but perhaps it hasn't been as widely published. This can also be done with the Date / If-Last-Modified header, manufacturing a cookie "date".

lucb1e 13y ago
I never claimed it was new :). But I never heard about it until recently, while it works frighteningly similar to cookies and I generally know most common things related to website security.
- leokun 13y ago
  Your tone is definitely one pushing it as a new and ominous discovery. Another criticism "It has already being used by numerous websites but few people know of it" without any more information. If you know of which websites, you should state so, if you don't, you should at least say why you know "numerous websites" use it. Also the "few people know of it" bit, a bit presumptive if you were referring to the engineering community, and flatout meaningless if you were referring to everyday people, of which many don't even know what a browser is. I did like the working example, but maybe tone down the hyperbole and more informative claims when the claims are also accusations.
  - lucb1e 13y ago
    Thank you for the constructive criticism, that's often rare these days. > Your tone is definitely one pushing it as a new and ominous discovery. I'm sorry if the tone gave a wrong impression, that wasn't my intention (English isn't my native language). It was quite a discovery to me though, perhaps that's why I made it sound like that without really meaning to. > Another criticism "It has already being used by numerous websites but few people know of it" without any more information Oh that's right! I had a source link elsewhere but forgot to move it when rearranging text. I'll add this again now. > Also the "few people know of it" bit, a bit presumptive if you were referring to the engineering community This was mostly my personal experience. I don't know anybody knowing about these etags being used for tracking, while I know that many friends and classmates could give me details on how cookies work or how localstorage works. Edit: Why are people downvoting the person I replied to?
    - biot 13y ago
      Using ETags was well known on HN years ago as one technique in the "Evercookie" arsenal: https://news.ycombinator.com/item?id=1714446 https://news.ycombinator.com/item?id=1714446
    - skrebbel 13y ago
      > Edit: Why are people downvoting the person I replied to? Two options: * Someone's grumpy and/or a jerk and/or an idiot * Someone's reading HN on a touch device, wanted to upvote, touched the wrong icon.
      - pqdbr 13y ago
        In this case, I think we can agree he was both grumpy and a jerk ?
- mattmanser 13y ago
  Just 2 years ago there was a massive backlash against KISSmetrics, Hulu and a few others for using this very trick. Can't find the HN story now, but it was a recurring story for a few days as people argued back and forth whether it was ethical.
nikcub 13y ago
Last-Modified doesn't even have to be a valid date string: http://www.nikcub.com/posts/persistant-and-unblockable-cookies-using-http-headers http://www.nikcub.com/posts/persistant-and-unblockable-cooki... As an update to that post from 2011, I never did get the browsers to update their parsers. This E-Tag bug has been known for over a decade. As part of my post I tried to find the earliest written record of it and found a post in 2003: http://www.arctic.org/~dean/tracking-without-cookies.html http://www.arctic.org/~dean/tracking-without-cookies.html It seems to get 'rediscovered' at least a couple of times a year.
- ghostdiver 13y ago
  You should use valid Last-Modified value with some randomness and join it with browser fingerprint: https://panopticlick.eff.org https://panopticlick.eff.org
- gsnedders 13y ago
  <https://bugzilla.mozilla.org/show_bug.cgi?id=114508> https://bugzilla.mozilla.org/show_bug.cgi?id=114508> is Gecko bug for this; can't find one for Chromium, and CORE-40723 for the privileged few with Zombie-Presto bug-tracker access.
bostik 13y ago
There are some pretty neat tricks one can pull by enumerating the contents of browser cache and/or history. Zalewski's "I know which sites you visit" asteroids clone is probably from the funkier end: http://lcamtuf.blogspot.fi/2013/05/some-harmless-old-fashioned-fun-with-css.html http://lcamtuf.blogspot.fi/2013/05/some-harmless-old-fashion...

by 0x0 13y ago

So this is the old E-tag trick? It's not new at all, but perhaps it hasn't been as widely published. This can also be done with the Date / If-Last-Modified header, manufacturing a cookie "date".

lucb1e 13y ago

I never claimed it was new :). But I never heard about it until recently, while it works frighteningly similar to cookies and I generally know most common things related to website security.

leokun 13y ago
Your tone is definitely one pushing it as a new and ominous discovery. Another criticism "It has already being used by numerous websites but few people know of it" without any more information. If you know of which websites, you should state so, if you don't, you should at least say why you know "numerous websites" use it. Also the "few people know of it" bit, a bit presumptive if you were referring to the engineering community, and flatout meaningless if you were referring to everyday people, of which many don't even know what a browser is. I did like the working example, but maybe tone down the hyperbole and more informative claims when the claims are also accusations.
- lucb1e 13y ago
  Thank you for the constructive criticism, that's often rare these days. > Your tone is definitely one pushing it as a new and ominous discovery. I'm sorry if the tone gave a wrong impression, that wasn't my intention (English isn't my native language). It was quite a discovery to me though, perhaps that's why I made it sound like that without really meaning to. > Another criticism "It has already being used by numerous websites but few people know of it" without any more information Oh that's right! I had a source link elsewhere but forgot to move it when rearranging text. I'll add this again now. > Also the "few people know of it" bit, a bit presumptive if you were referring to the engineering community This was mostly my personal experience. I don't know anybody knowing about these etags being used for tracking, while I know that many friends and classmates could give me details on how cookies work or how localstorage works. Edit: Why are people downvoting the person I replied to?
  - biot 13y ago
    Using ETags was well known on HN years ago as one technique in the "Evercookie" arsenal: https://news.ycombinator.com/item?id=1714446 https://news.ycombinator.com/item?id=1714446
  - skrebbel 13y ago
    > Edit: Why are people downvoting the person I replied to? Two options: * Someone's grumpy and/or a jerk and/or an idiot * Someone's reading HN on a touch device, wanted to upvote, touched the wrong icon.
    - pqdbr 13y ago
      In this case, I think we can agree he was both grumpy and a jerk ?
mattmanser 13y ago
Just 2 years ago there was a massive backlash against KISSmetrics, Hulu and a few others for using this very trick. Can't find the HN story now, but it was a recurring story for a few days as people argued back and forth whether it was ethical.

nikcub 13y ago

Last-Modified doesn't even have to be a valid date string: http://www.nikcub.com/posts/persistant-and-unblockable-cookies-using-http-headers http://www.nikcub.com/posts/persistant-and-unblockable-cooki... As an update to that post from 2011, I never did get the browsers to update their parsers. This E-Tag bug has been known for over a decade. As part of my post I tried to find the earliest written record of it and found a post in 2003: http://www.arctic.org/~dean/tracking-without-cookies.html http://www.arctic.org/~dean/tracking-without-cookies.html It seems to get 'rediscovered' at least a couple of times a year.

ghostdiver 13y ago
You should use valid Last-Modified value with some randomness and join it with browser fingerprint: https://panopticlick.eff.org https://panopticlick.eff.org
gsnedders 13y ago
<https://bugzilla.mozilla.org/show_bug.cgi?id=114508> https://bugzilla.mozilla.org/show_bug.cgi?id=114508> is Gecko bug for this; can't find one for Chromium, and CORE-40723 for the privileged few with Zombie-Presto bug-tracker access.

bostik 13y ago

There are some pretty neat tricks one can pull by enumerating the contents of browser cache and/or history. Zalewski's "I know which sites you visit" asteroids clone is probably from the funkier end: http://lcamtuf.blogspot.fi/2013/05/some-harmless-old-fashioned-fun-with-css.html http://lcamtuf.blogspot.fi/2013/05/some-harmless-old-fashion...