Introducing the Invulnerable Evercookie 332
An anonymous reader writes "Using eight different techniques and locations, a 'security' guy has developed a cookie that is very, very hard to delete. If just one copy of the cookie remains, the other locations are rebuilt. My favorite storage location is in 'RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out' — awesome."
"That's the great thing about evercookie" (Score:4, Insightful)
That's the great thing about evercookie
I disagree. Strongly.
I guess it's good that this is out in the open so we know about it, and hopefully the major browsers can all do something to help prevent it. But still: don't like, don't like at all.
And now... (Score:5, Insightful)
Whenever someone goes through all the trouble of adding additional ways of tracking people - someone goes through all the trouble of finding ways of removing it.
There's no such thing as Invulnerable - See also: DRM and Copy-Protection
Re:Not hard to beat at first glance. (Score:5, Insightful)
That's NoScript at work. If you use BetterPrivacy (another FF extension), it removes the LSO at browser shutdown. YMMV
I take your point, but most people use neither of these things and will be at the mercy of persistent tracking. Of course anyone who doesn't know what a cookie is probably won't be affected by this in any way (i.e. they're already being tracked through regular cookies). Especially since "Private Browsing" modes have been shown to retain information.
Developers take note (Score:5, Insightful)
If you have to go to great lengths to work around customers doing things like deleting cookies then you are doing something wrong or evil.
Re:And now... (Score:3, Insightful)
No, but the people who do the tracking dont care about you.
They want everyone else who doesnt try to evade tracking, which is a lot more people.
Re:Developers take note (Score:3, Insightful)
...or you're doing something that users expect to "just work". My grandmother had a perfectly fine time using GMail, until my uncle heard that cookies should be deleted for privacy. I got a phone call after that where I had to figure out why "email isn't working".
I can see valid uses for this, and I can see malicious uses. I suppose it's good that something's out there making us developers think about these techniques.
Re:"That's the great thing about evercookie" (Score:5, Insightful)
There's no possible justification for this project.
"To show everyone what the black hats and spammers are going to be doing", sounds good enough to me.
Re:Browser on a VM then? (Score:5, Insightful)
No. You could also stop using the Internet.
Not Really (Score:4, Insightful)
Advertisers and site operators might complain that this behavior costs them revenue, but they should have thought about that before going all Big Brother on us. If you're going to try to trick me into clicking an ad on your site, I don't want anything to do with your site anyway. And I do occasionally click through ads on Slashdot and Google.
Re:Developers take note (Score:2, Insightful)
That's not a problem with cookies being easy to delete, that's a problem with the user not understanding what they're deleting. In the same way that making it imposible to delete word documents is a bad idea, making it imposible to delete cookies serves no beneficial purpose to the user.
Re:Not hard to beat at first glance. (Score:5, Insightful)
who doesn't know what a cookie is probably won't be affected by this in any way (i.e. they're already being tracked through regular cookies).
There's all kinds of databases on people available. Search and you shall find.
All data circulates easily and is simply very hard to stop. It is indeed like speech, it just happens, anyone can do it. Copyrighted data, personal data, credit data, secret data, whatever. Bottom line, gathering and selling various gray-black-market data is illegal immoral etc, and very doable and very interesting for companies and organizations of all types. Not unlike downloading movies is for many - illegal but easy and interesting data. It's the interests that are different.
Cookie? (Score:5, Insightful)
Re:Not hard to beat at first glance. (Score:5, Insightful)
Thhe purpose of "Private Browsing" isn't to protect your privacy from websites while you surf, it's to protect your privacy from your SO when she comes home and sees your web history.
Re:Privacy for 99% of people doesn't exist (Score:1, Insightful)
You're confusing privacy and secrecy.
Re:Remember? (Score:4, Insightful)
Hidden form values have the annoying tendency of breaking the back button. That, in my mind, is a far greater sin than cookies.
Re:Not Really (Score:3, Insightful)
It will not drive more users to noscript and flashblock because then websites will not 'just work' anymore and it will be a pain to them to whitelist every script they don't know what they do for every websites one by one...