The next front in the cookie wars: Fighting the Evercookie

Read More:

The next front in the cookie wars: Fighting the Evercookie | IT Security | TechRepublic.com

“Evercookie is a JavaScript API that produces extremely persistent cookies in a browser. Its goal is to identify a client even after they’ve removed standard cookies, Flash cookies, and others.”

Here we go again.

Let’s assume the cookie data we want to store is “bcde”. Evercookie then accesses the following URLs in the background:

• google.com/evercookie/cache/b
• google.com/evercookie/cache/bc
• google.com/evercookie/cache/bcd
• google.com/evercookie/cache/bcde
• google.com/evercookie/cache/bcde-

These URLs are now stored in the browser’s history. When checking for a cookie, Evercookie loops through all the possible characters on google.com/Evercookie/cache/, starting with “a” and moving up, but only for a single character.
Once it sees a URL that was accessed because it’s in the browser’s history, it attempts to brute force the next letter. This process occurs extremely fast because no requests are made to the server in question. Evercookie knows it has reached the end of the string as soon as it finds a URL that ends in “-”.

TechRepublic: Can Evercookie be defeated by disabling JavaScript or using an application like NoScript?
Samy Kamkar: Yes, NoScript or turning off JavaScript will prevent the Evercookie from being created.

Someone needs to develop a program and call it warm milk as warm milk dissolves cookies! Or better yet cookie monster to eat up the evercookies.

"C" is for cookie.

Thats good enough for me.