The next front in the cookie wars: Fighting the Evercookie

[Borg 386]

Read More:

The next front in the cookie wars: Fighting the Evercookie | IT Security | TechRepublic.com

“Evercookie is a JavaScript API that produces extremely persistent cookies in a browser. Its goal is to identify a client even after they’ve removed standard cookies, Flash cookies, and others.”

Here we go again.

Let’s assume the cookie data we want to store is “bcde”. Evercookie then accesses the following URLs in the background:

• google.com/evercookie/cache/b
• google.com/evercookie/cache/bc
• google.com/evercookie/cache/bcd
• google.com/evercookie/cache/bcde
• google.com/evercookie/cache/bcde-

These URLs are now stored in the browser’s history. When checking for a cookie, Evercookie loops through all the possible characters on google.com/Evercookie/cache/, starting with “a” and moving up, but only for a single character.
Once it sees a URL that was accessed because it’s in the browser’s history, it attempts to brute force the next letter. This process occurs extremely fast because no requests are made to the server in question. Evercookie knows it has reached the end of the string as soon as it finds a URL that ends in “-”.

TechRepublic: Can Evercookie be defeated by disabling JavaScript or using an application like NoScript?
Samy Kamkar: Yes, NoScript or turning off JavaScript will prevent the Evercookie from being created.

 

[Fayla]

Yet more marketers trying to profile browsing habits.

This is really sad, as it's hard enough controlling the flow of your personal data currently, but it seems like things will only get worse in the near future~

Thanks for the info

Read More:

The next front in the cookie wars: Fighting the Evercookie | IT Security | TechRepublic.com

“Evercookie is a JavaScript API that produces extremely persistent cookies in a browser. Its goal is to identify a client even after they’ve removed standard cookies, Flash cookies, and others.”

 

[linnemeyerhere]

Someone needs to develop a program and call it warm milk as warm milk dissolves cookies! Or better yet cookie monster to eat up the evercookies.

 

[xarden]

"C" is for cookie.

Thats good enough for me.

 

[marsmimar]

Still don't understand why we have to resort to plug-ins or add-ons like NoScript to accomplish what should be a standard feature of all browsers.

 

[Fayla]

I found this to be a interesting read: In the war of Internet privacy, Internet Explorer 8 limit the default credentials of third-party cookie tracking | My Computers Land

"Microsoft engineers initially wanted to feature in Internet Explorer 8 to limit the default credentials of third-party cookie tracking, Wall Street Journal reported today. But the leaders, concerned about the implications for online advertisers, has won"

"Only one – Safari from Apple – is set to deny third-party cookies based on privacy."

Still don't understand why we have to resort to plug-ins or add-ons like NoScript to accomplish what should be a standard feature of all browsers.