4 ms·

If he can only associate my previous page view with my current requests, then how does he know it's me again? I mean, the image request is separate from the pag

by sspiff 13y ago

If he can only associate my previous page view with my current requests, then how does he know it's me again? I mean, the image request is separate from the page request, and in any case only comes later. So he would need to store a mapping from something he already knows (from the headers of my request for his html page, or my IP) to my ETag "cookie" to know what my previous ETag was. Wouldn't that require using some of the features he wasn't going to use (like user agent) to work? What am I missing?

miken123 13y ago
As it turns out, he simply uses your IP and User Agent string. See https://github.com/lucb1e/cookielesscookies/blob/master/index.php#L15 https://github.com/lucb1e/cookielesscookies/blob/master/inde... No E-Tag tracking is taking place, since the E-Tag is never send to the server for the index.php request (only for the image request). In theory he could update the session after your IP changed, but he does not seem to do that (the image requests hold on to the old E-Tag). So, basically, to me it seems like the whole point/post is invalid. Please correct me if I'm wrong.
- Gurrewe 13y ago
  You're wrong. That line of code is just to create something random, he could have used rand() if he wanted to, but it's not as "random". And if you take a look in the .htaccess file, you'll notice that the images request also goes to index.php.
  - miken123 13y ago
    I saw the .htaccess, but that still doesn't link the request of index.php to the request of index.php?tracker. I just tested it by changing my IP while staying in the same browser session. After an IP change the page only displays '1' for the number of visits, exactly as you would expect when reading the code (since the E-Tag for the image is kept (and the image request updates the counter), but the index.php uses your IP+UA combo to determine the session). This code is flawed and doesn't do a thing.

by sspiff 13y ago

miken123 13y ago

As it turns out, he simply uses your IP and User Agent string. See https://github.com/lucb1e/cookielesscookies/blob/master/index.php#L15 https://github.com/lucb1e/cookielesscookies/blob/master/inde... No E-Tag tracking is taking place, since the E-Tag is never send to the server for the index.php request (only for the image request). In theory he could update the session after your IP changed, but he does not seem to do that (the image requests hold on to the old E-Tag). So, basically, to me it seems like the whole point/post is invalid. Please correct me if I'm wrong.

Gurrewe 13y ago
You're wrong. That line of code is just to create something random, he could have used rand() if he wanted to, but it's not as "random". And if you take a look in the .htaccess file, you'll notice that the images request also goes to index.php.
- miken123 13y ago
  I saw the .htaccess, but that still doesn't link the request of index.php to the request of index.php?tracker. I just tested it by changing my IP while staying in the same browser session. After an IP change the page only displays '1' for the number of visits, exactly as you would expect when reading the code (since the E-Tag for the image is kept (and the image request updates the counter), but the index.php uses your IP+UA combo to determine the session). This code is flawed and doesn't do a thing.