Slashdot Log In
Delete Cookies, Inflate Net Traffic Estimates
Posted by
kdawson
on Tue Apr 17, 2007 12:29 PM
from the throwing-them-off dept.
from the throwing-them-off dept.
eldavojohn writes "In my browser, I regularly go to the tools menu and clear my private data. This includes my cookies. As a result, people like me who destroy cookies by the thousands may be inflating estimates of Web traffic by up to 150 percent. People have good reasons for clearing out cookies — we've heard about bad cookies before (and I think the FCC is still investigating the issue). But every time you delete cookies, many of the sites you've visited count you as a new visitor next time."
Related Stories
[+]
FCC Meets To Investigate Cookie Abuse 159 comments
PreacherTom writes to tell us BusinessWeek is reporting that the FCC and the Center for Digital Democracy plan to meet in order to discuss abuses with regard to cookies. From the article: "Online advertisers have a sweet tooth for cookies. Not the kind you bake, but the digital kind — those tiny files that embed themselves on a PC and keep tabs on what Web sites are visited on which machines. But cookies could have a bad aftertaste for consumers. Privacy advocates say the files are being force fed in large quantities to computer users, and they're demanding that the government put some advertisers on a diet."
[+]
IT: The Dangers of Improper Cookie Use 191 comments
shifted89 writes "Over the last year, the security community have exposed web application security for what it is — extremely lacking. However, for all the focus on XSS, CSRF, history stealing, etc., not much attention has been given to the cookie. Unfortunately, cookie misuse can be just as dangerous, if not more so than XSS attacks and InformIT illustrates why. In short, the author clearly demonstrates what can happen when a website improperly uses cookies for customer tracking — including a working illustration."
[+]
Technology: Point-and-Click Gmail Hacking Shown at Black Hat 260 comments
not5150 writes "Using Gmail or most other webmail programs over an unsecured access point just got a bit more dangerous. At Black Hat Robert Graham, CEO of errata security, showed how to capture and clone session cookies very quickly over connections without encryption. He even hijacked a shocked attendee's Gmail account in the middle of his presentation. 'While Ou was typing, Graham was running Ferret and sniffing all the cookies that were being sent from Ou's laptop and Google. Graham then clicked on Ou's IP address and Gmail page, complete with Ou's recently sent message on the screen. We photographed both Graham's and Ou's laptop at that time and posted it to the picture gallery. You'll see that the contents are exactly the same.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
On the other hand... (Score:2, Informative)
Re:On the other hand... (Score:5, Interesting)
That way no one has visited but another web spider!
Parent
Re: (Score:3, Funny)
Re:On the other hand... (Score:5, Funny)
Parent
Oh boy... (Score:5, Funny)
So, you're the little bastard who keeps forwarding me that crap.
This year... no presents for you!!!
Sincerely,
Santa H. Claus
santa@northpole.net
Parent
Re: (Score:3, Interesting)
Of course, a site could also try tagging me by serving me a uniquely timestamped file modification date on some piece of server content. Assuming I cache, that'd also serve for tracking.
Isn't like everything is just cookies and IP tracking.
Or heck, SSL session ID makes for short-lived tagging to determine a visitor, as does analysing site access patterns.
Re:On the other hand... (Score:5, Interesting)
After all,
1) it's geeks who tend to both use FF *and* block cookies
2) the FF extension architecture makes it easy to use selective cookie blocking tools
3) FF settings allow automatic cookie deletion each time it exits, unlike IE (=IE6, at least)
All in all, I suspect that (*IF* the subject article is accurate) FF users probably account for a disproportionately large chunk of those "re-visits".
I bet M$FT hates that.
Parent
Re:On the other hand... (Score:4, Funny)
On the other hand, this is slashdot and that kind of behavior is not allowed here. We demand you say something funny.
Parent
Re: (Score:3, Interesting)
First, if any ~/.flock ~/.mozilla or ~/.opera happens to be in
http://www.geocities.com/rapidweather/web.html [geocities.com]
A default set of RSS feeds is on the Firefox favorites toolbar, the "My News
...And? (Score:2, Funny)
Re: (Score:2)
Re: (Score:3, Funny)
Re:Not users fault (Score:4, Insightful)
What you say there is absolutely correct, but it begs the question: How would it ever be the fault of the user in any possible case? I have a newsflash for the advertisers -- you do not have a God-given inalienable right to store data on my computer. It's mine, I paid for it, and I will selectively accept or freely remove any data that you attempt to place on it, for any reason or for no reason at all. The world does not owe anyone a reliable way to track the Web surfing of others.
This and DRM are two categories where marketers act like my personal property is theirs to do with as they please, and I'm sick of the way the average "consumer" puts up with this concept or anything resembling it.
Any Web site owner who doesn't like this can feel free to block me from their Web site; since it is theirs after all, I certainly do not dispute their right to do that (they would do so to find that I can live quite well without them). But please, let's dispose of this idea that some marketer not being able to track me is somehow my fault or my problem.
I say that if your business model relies on the ability to effectively spy on people, often without their knowledge or consent, then your business model is flawed and any difficulties you encounter are well-earned. I further say that the current situation exists only because of widespread ignorance; that is, if every single person who ever went online were a thoroughly educated uber-geek and fully aware of all tracking techniques used, then no one or practically no one would ever allow any of it and the marketers would have to come up with a more reasonable way to make money.
Parent
Re: (Score:3, Insightful)
I'm fully aware of the tracking techniques used.. and I don't delete my cookies. I'm an anonymous number to them.
I bet you go shopping in a ski mask too, because every store video tapes you.
Re: (Score:3, Informative)
No surprise (Score:4, Insightful)
Brilliant.
So what? (Score:3, Insightful)
Re:So what? (Score:4, Informative)
This is why there is research out there to use methods other than cookies and IP addresses to identify users -- see this article [slashdot.org] from last September.
I'm sure this concept can get some VC if companies begin distrusting current traffic anlayses -- it would be a useful adjunct to traditional traffic monitoring.
Parent
150%? (Score:5, Informative)
I don't do it because it is a pain to constantly log back in everywhere. But I seriously doubt more than 2% of the non-slashdot crowd does it.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
As someone who has cookies automatically deleted when I close my browser...
You don't actually need to log in to every site you visit - Only if you want to buy or post something, in general (in fact, I prefer they can't track me while "just looking").
And not only do I get a somewhat increased level of privacy, I get massively increased security as well - Someone needs to actually know my passwords, not just sit at my computer, to
Re: (Score:3, Informative)
1. Whitelist sites whose cookies you want to keep.
2. Blacklist cookies from some sites (doubleclick, anyone?).
3. Set most other cookies to be killed after you exit FF.
I know Firefox lets you do that anyway, but the difference is that Cookiesafe lets you do it easily.
FTC, not FCC (Score:4, Informative)
Re:FTC, not FCC (Score:4, Informative)
http://yro.slashdot.org/article.pl?sid=06/11/15/1
Parent
Re: (Score:3, Funny)
I thought the FDA was responsible for investigating cookies...
Re: (Score:3, Informative)
Re:FTC, not FCC (Score:4, Informative)
The worst part is that they didn't fire Cookie Monster him until the letter Q and the number 4 pulled their sponsorship. Of course, I think he didn't need to go on Bert and Ernie's talk radio program either because they're hypocrites themselves.
Parent
What I do in my computer is my business (Score:5, Insightful)
Re:What I do in my computer is my business (Score:4, Insightful)
Parent
Re: (Score:3, Interesting)
Sometimes that's for traffic, though. (Score:3, Interesting)
Unfortunately the best board relating to Knoppmyth is like this; it was just too expensive for the maintainer to run openly; the traffic cost too much. By requiring registration to read, it cut do
Re: (Score:3, Insightful)
CookieSafe is my current favourite (Score:4, Informative)
Cookiesafe allows me to keep my permanent cookies to a minimum, yet allow me all the functionality of session cookies. Of course, it does inflate the stats as the article mentions. In my previous job I worked with stats quite a bit (using WebSideStory/Hitbox), and it is such an inexact science that it ranks right up there with Lies and Damn Lies.
https://addons.mozilla.org/en-US/firefox/addon/249 7 [mozilla.org]
Anyone have other suggested software they prefer?
Not a surprise (Score:3, Insightful)
Anonymous user stats are always going to be an estimate. Cookies aren't reliable, because people clear them. IP addresses aren't reliable, because some are dynamically generated, some are shared, and people move around.
You can only really know how many users you have if (a) they're registered and (b) they visit the site while logged in. (And even then, people could be sharing accounts -- bugmenot, anyone?)
Personally, I don't think this is a problem, as long as you're willing to look at the estimates for what they are and not treat them as if they were precise.
Hmm... how long before someone claims that Firefox's/Opera's/Safari's stats are inflated because they make it easier to wipe cookies than IE?
just plain wrong (Score:2, Funny)
Visitors vs. Unique Visitors..anyone? (Score:2, Insightful)
But every time you delete cookies, many of the sites you've visited count you as a new visitor next time.
Yea in like 1999 this was true. Don't most websites that actually care about traffic or try to reasonably measure it go off of UNIQUE VISITORS? I think the most basic of webstats programs for 5+ years now know and show the difference. What exactly is the point of all this? Who realistically tracks their users and bases their counts off of cookies? This is absurd. IP address has been the standard for quite some time now.
Re: (Score:3, Informative)
Unfortunately IP address doesn't work. NAT can put anywhere from a couple (small home network) to thousands (corporate networks) of individual machines behind a single IP address. The common ISP practice of using dynamic addresses can result in a single machine having anywhere from one address for years at a time to a different address every hour. Most web-statistics companies have abandoned IP addresses as a valid identifier.
Most of them do in fact rely on cookies of one sort or another. Most rely on brow
Re: (Score:3, Informative)
A single TCP-connection is identified by a quad: ip and port for the two destinations.
So, you only really need a new source-port for every internal user who visits the same site.
NAT is implemented by maintaining an internal table of what external ips/ports should be mapped to which internal ip/port. An example:
Inflate the estimate? (Score:2)
It would be like saying you don't count as traffic for streets you've previously driven on.
Umm... So? (Score:3, Insightful)
I have Firefox clear my cookies on browser close... So I look like a new visitor every time I visit a site.
Perhaps someone would explain to me why I should care about this? The only use I can see for unique visitor counts (other than the trivia value) involves ad revenue - And I aggressively block almost all adverts, so don't care about that, either.
Huh? (Score:2)
Huh? Isn't the entire POINT of cookies pretty much so sites recognize you when you return? Sorry, but this statement wins todays "No Duh" award.
server's fault, not the user (Score:2)
Every time you delete cookies... (Score:5, Funny)
Re:Every time you delete cookies... (Score:5, Funny)
Let's assume that the idiom is talking only about male masturbation. Let's further assume, highly conservatively, that males do not start masturbating until they reach age 15. Of the total U.S. male population, 107,199,356 [census.gov] would then be masturbation-age males. Again, let's conservatively estimate that teenagers masturbate no more frequently than adults, and that all men masturbate an average of 20 times [wikipedia.org] each month or 240 times per year. This means that each man in the United States masturbates approximately every 1.5 days. It also means that there are approximately 25,727,845,440 male masturbation sessions in the United States each year.
There are nearly 26 billion male masturbation sessions in the U.S., yet there are fewer than five million kitten deaths annually. Far from a one-to-one correlation, there are 5401.5 masturbation sessions for every single kitten death. This means that the average American man can masturbate regularly for 22.5 years before he is responsible for the death of a single kitten. Indeed, with a life expectancy of less than 75 years, the average man will be responsible for only two or three kitten deaths in a lifetime of vigorous masturbation.
Parent
That's nothing, think of people use muliple PC's (Score:4, Insightful)
And another one at home, well even two sometimes.
And a smart phone equipped with a browser.
So I inflate web usage statistics with 100 to 300%?
And then there are people sharing the same PC/account deflating the stats...
All of us who host websites know how unreliable statistics are. Nothing new there...
X.
Yeah, we know (Score:3, Insightful)
Oh boo hoo, cry me a river. Produce something people want and they'll come back time and again and you won't have to worry about your traffic.
Privacy is an illusion (Score:3, Informative)
There's a few fingerprinting companies out there, track you by stuff plugins give away(dates, versions, etc.. anything the plugin will give up). I've even heard of a company using the time offset from your computer from your web browser(which passes the time back in milliseconds since 1970, IIRC) and combined with some other methods it really helps you track people down. Not to mention you can combine all this with your IP address and you're pretty good. But deleting cookies doesn't really help you, it's more of a minor inconvenience to the small companies who don't really care to track you that much, and a tiny hurdle to larger companies who do care and who are already doing it and some that even know you before the cookie. (Don't accept cookies? Check for that, and IP address, flash version, time offset(if it's possible), what plugins are installed via navigator.plugins and you're pretty close to a positive ID. Of course there are many other ways and I don't know any of them. So, delete your cookies if you want, but realize it's not much of a help.
Adblock is, and ultimately those who really want to track you probably can.
Why would I care? (Score:3, Insightful)
Re:150%? Please (Score:5, Funny)
Parent
Re: (Score:2)