Windows 7: The next front in the cookie wars: Fighting the Evercookie

Borg 386 · 01 Nov 2010

Read More:

The next front in the cookie wars: Fighting the Evercookie | IT Security | TechRepublic.com

Quote:

“Evercookie is a JavaScript API that produces extremely persistent cookies in a browser. Its goal is to identify a client even after they’ve removed standard cookies, Flash cookies, and others.”

Here we go again.

Quote:

Let’s assume the cookie data we want to store is “bcde”. Evercookie then accesses the following URLs in the background:

google.com/evercookie/cache/b
google.com/evercookie/cache/bc
google.com/evercookie/cache/bcd
google.com/evercookie/cache/bcde
google.com/evercookie/cache/bcde-

These URLs are now stored in the browser’s history. When checking for a cookie, Evercookie loops through all the possible characters on google.com/Evercookie/cache/, starting with “a” and moving up, but only for a single character.
Once it sees a URL that was accessed because it’s in the browser’s history, it attempts to brute force the next letter. This process occurs extremely fast because no requests are made to the server in question. Evercookie knows it has reached the end of the string as soon as it finds a URL that ends in “-”.

Quote:

TechRepublic: Can Evercookie be defeated by disabling JavaScript or using an application like NoScript?
Samy Kamkar: Yes, NoScript or turning off JavaScript will prevent the Evercookie from being created.

Fayla · 01 Nov 2010

Yet more marketers trying to profile browsing habits.

This is really sad, as it's hard enough controlling the flow of your personal data currently, but it seems like things will only get worse in the near future~

Thanks for the info

Quote: Originally Posted by Borg 386

Read More:

The next front in the cookie wars: Fighting the Evercookie | IT Security | TechRepublic.com

Quote:

“Evercookie is a JavaScript API that produces extremely persistent cookies in a browser. Its goal is to identify a client even after they’ve removed standard cookies, Flash cookies, and others.”

linnemeyerhere · 01 Nov 2010

Someone needs to develop a program and call it warm milk as warm milk dissolves cookies! Or better yet cookie monster to eat up the evercookies.

xarden · 01 Nov 2010

"C" is for cookie.

Thats good enough for me.

marsmimar · 01 Nov 2010

Still don't understand why we have to resort to plug-ins or add-ons like NoScript to accomplish what should be a standard feature of all browsers.

Fayla · 02 Nov 2010

I found this to be a interesting read: In the war of Internet privacy, Internet Explorer 8 limit the default credentials of third-party cookie tracking | My Computers Land

"Microsoft engineers initially wanted to feature in Internet Explorer 8 to limit the default credentials of third-party cookie tracking, Wall Street Journal reported today. But the leaders, concerned about the implications for online advertisers, has won"

"Only one – Safari from Apple – is set to deny third-party cookies based on privacy."

Quote: Originally Posted by marsmimar

Still don't understand why we have to resort to plug-ins or add-ons like NoScript to accomplish what should be a standard feature of all browsers.

Windows 7: The next front in the cookie wars: Fighting the Evercookie

The next front in the cookie wars: Fighting the Evercookie problems?