×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Un-killable 'Evercookie' Killed ... Sometimes

CmdrTaco posted more than 3 years ago | from the use-silver-bullets dept.

Privacy 186

Trailrunner7 writes "The persistent method that security researcher Samy Kamkar introduced last week for storing tracking data on a user's machine, known as the 'Evercookie,' is even more worrisome when used on mobile devices, according to another researcher's analysis. The Evercookie is a simple method for forcing a user's machine to retain browser cookies by storing the data in a number of different locations. The method also has the ability to recreate deleted cookies if it finds that the user has removed them. Created by Kamkar as a demonstration of a way that sites could use to persistently track users even after they clear their browser cookies, the Evercookie has drawn the attention of a number of other researchers who have spent some time looking for methods to defeat it. A researcher in South Africa took a look at the way the the Evercookie works on both Safari on the desktop and on mobile devices, and found that it can be undone in some circumstances. However, he also found that the mobile version of Safari fares far worse in its handling of the Evercookie than the standard version does."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

186 comments

Solution: (-1, Redundant)

DarkKnightRadick (268025) | more than 3 years ago | (#33954200)

Don't accept cookies.

Re:Solution: (1, Insightful)

Anonymous Coward | more than 3 years ago | (#33954264)

Better solution. Do all your browsing from a virtual machine running in non-persistent mode.

Re:Solution: (5, Insightful)

Anonymous Coward | more than 3 years ago | (#33954296)

That's not the solution. The whole point of the "evercookie" is that it doesn't just use regular HTTP cookies to store information, but also abuses all kinds of common browser features related to CSS, caching, embedded Flash objects and anything else that can be exploited to store state. If all he did was store a cookie only, then any browser worth its salt could easily purge it from the browser history.

So even if you just block cookies, that doesn't prevent this hack to work. You may need to block a whole range of features from JavaScript to HTTP caching to Flash support. It's certainly possible, but not something that an average user is prepared to do.

Killing the evercookie is easy (1, Interesting)

Anonymous Coward | more than 3 years ago | (#33955006)

Just boot up a VM, with the user's home account created in ramdisk upon bootup. The rest of the system is read-only (ala diskless linux).

The evercookie is cleared upon each bootup.

Re:Killing the evercookie is easy (2, Funny)

dvhh (763607) | more than 3 years ago | (#33955234)

I am pretty sure that my mom is ready to do that, and especially like the part where she can't seem to keep her bookmak

Haha! (1, Funny)

Anonymous Coward | more than 3 years ago | (#33954322)

A researcher from AFRICA is looking into these cookies on SAFARI! That's a great joke.

Re:Haha! (0, Funny)

Anonymous Coward | more than 3 years ago | (#33954546)

It's this kind of blatant racism that made me move to Reddit.

Re:Haha! (0)

Anonymous Coward | more than 3 years ago | (#33954652)

Actually, wouldn''t that be continentism?

Re:Haha! (1, Funny)

Anonymous Coward | more than 3 years ago | (#33954730)

Isn't the very name "Reddit" rascist? How offensive...

Re:Haha! (0)

Anonymous Coward | more than 3 years ago | (#33955010)

Hey dude, I thought you moved to Reddit

Re:Solution: (3, Informative)

Anonymous Coward | more than 3 years ago | (#33955020)

Don't accept cookies.

No, not a solution. RTFA. It doesn't matter whether you accept cookies or not. The only two methods of protection are (a) use Safari in private browsing mode, and quit and restart the browser between each and every site; or (b) block absolutely all javascript everywhere without any exception ever. Neither of these is really satisfactory.

Plus, these evercookies transfer from one browser to another because they get stored as LSOs.

Re:Solution: (1)

DarkKnightRadick (268025) | more than 3 years ago | (#33955226)

That is pretty nasty.

Did anyone test FF or Chrome private browsing mode? (and no, I won't RTFA, who wants to risk a cookie like that?)

Re:Solution: (1)

AHuxley (892839) | more than 3 years ago | (#33955298)

yes someone when to much trouble to get deep tracking in every web device sold or 'given' away.
Some strange "law enforcement" junk ad banner on a site of interest could be very useful.
Who would give it a second thought or think to do some deep clean.
One visit via a spammed link in a dark forum, chatroom and you track yourself with your own hardware.

Re:Solution: (1)

Sulphur (1548251) | more than 3 years ago | (#33955268)

Don't accept evercookies.

They are made in highly automated hollow trees by elves with no visible means of support in a forest alleged to be enchanted.

Re:Solution: (2, Insightful)

thePowerOfGrayskull (905905) | more than 3 years ago | (#33955556)

Don't accept cookies.

Also use Links2. (Links is crap, of course. ANd only losers use lynx...)

Back in the real world, some of us do actually want to use the web for doing more than viewing static HTML pages. One or two of us even appreciate those awful persistent logins that cookies enable...

Re:Solution: (1)

Lumpy (12016) | more than 3 years ago | (#33955894)

And do not run flash.

I find sandboxie does a fantastic job of killing the evercookie every single time. Are CS professors lacking in education lately?

If your browser runs in a sandbox that is destroyed when you exit the browser, the evercookie cant live... No way no how.

Frist Psot (-1, Offtopic)

Anonymous Coward | more than 3 years ago | (#33954216)

Frist Psot

Evercookie is clever (3, Informative)

Nichotin (794369) | more than 3 years ago | (#33954232)

For forum administrators, it is a very clever way to keep many ban evaders out. While it is not un-killable, it is pretty much a pain in the ass to get rid of, since it will get back if you miss a single one and visit the site again. Read the list of the places it stores its cookies, and be amazed how many there actually are. So, 1) ban user, 2) place cookie, 3) user signs up again, 4) your site detects the evercookie + new registration, 5) verify and ban again (unless the user suddenly becomes a good user, of course).

Re:Evercookie is clever (5, Insightful)

Anonymous Coward | more than 3 years ago | (#33954286)

While it is not un-killable, it is pretty much a pain in the ass to get rid of, since it will get back if you miss a single one and visit the site again.

Didn't we used to call this kind of stuff "malware"? When did it become acceptable, no matter how annoying or unwanted the user is, to put something on their computer without their knowledge that is hard or near-impossible to remove?

Re:Evercookie is clever (2, Interesting)

Yvan256 (722131) | more than 3 years ago | (#33954412)

Malware is executable software. The evercookie isn't software, it's a simple marker.

Re:Evercookie is clever (2, Interesting)

Anonymous Coward | more than 3 years ago | (#33954586)

Oh please. There are plenty of malicious sites that do unwanted things to your computer that don't leave an executable. It doesn't have to be "executable software" to be malware.

Re:Evercookie is clever (3, Insightful)

tehdaemon (753808) | more than 3 years ago | (#33954596)

Malmarker then? Maldata? Evilbytes? I suppose at some level pedantry about word definitions makes sense, so fine, don't call it malware. But it is in the same 'badness' class as most malware, and needs an equally bad name to go with it.

T

Re:Evercookie is clever (1)

severoon (536737) | more than 3 years ago | (#33955596)

Well, ok, it's just data, not software. But what ought we call the algorithm that nestles that data gently on the tip of a steel-toed boot and then forcefully plants that data squarely in your browser's brown-eye?

Re:Evercookie is clever (4, Insightful)

The Wild Norseman (1404891) | more than 3 years ago | (#33954608)

Malware is executable software. The evercookie isn't software, it's a simple marker.

The cookie resides on my hardware, doing something (tracking -- albeit doing something passively in this case) which I only wish to grant it for a limited amount of time. When the makers of this cookie make it extremely difficult to delete, which takes away the control I have over the data on my computer, then I see no practical difference between this passive cookie and active malware. Just MHO.

Re:Evercookie is clever (3, Interesting)

Yvan256 (722131) | more than 3 years ago | (#33954668)

If we on Slashdot start calling cookies "malware" then it's no different than when ordinary computer users don't know the difference between a virus and a trojan.

Next thing you know we have teachers who think Linux is a Windows program and that no computer can run without a Microsoft OS.

Re:Evercookie is clever (1, Insightful)

Anonymous Coward | more than 3 years ago | (#33954846)

It's not a cookie either. A cookie goes in one place via an established set of rules and I can get rid of it by telling my browser to delete all cookies, none of which describes this thing.

Re:Evercookie is clever (4, Insightful)

CCarrot (1562079) | more than 3 years ago | (#33954918)

If we on Slashdot start calling cookies "malware" then it's no different than when ordinary computer users don't know the difference between a virus and a trojan.

Ordinary cookies don't actively fight removal by the user, and once they're gone, they're gone.

Ordinary (non-malware) applications don't actively fight removal by the user, and once they're gone, they're gone (okay, other than some leftover user/config data sometimes, but the program itself is gone and no longer does what it was designed to do).

The 'Evercookie', on the other hand, behaves exactly like malware in that it actively resists being deleted by the user, even to the point of rebuilding itself after deliberate removal attempts, and all for the benefit of a third party.

Re:Evercookie is clever (0, Redundant)

drcheap (1897540) | more than 3 years ago | (#33954964)

Next thing you know we have teachers who think Linux is a Windows program and that no computer can run without a Microsoft OS.

Some do.

Re:Evercookie is clever (1)

LoudMusic (199347) | more than 3 years ago | (#33955354)

I think you misunderstand. This is just going to the trouble of using all methods that the client computer allows to uniquely identify the client computer in the future. It's not doing any haxy work to maliciously place markers. It's only doing things that the client PC is already set to allow.

Re:Evercookie is clever (0)

Anonymous Coward | more than 3 years ago | (#33956412)

So you'd happily trade in your current evercookies for viruses?

Re:Evercookie is clever (2, Insightful)

drcheap (1897540) | more than 3 years ago | (#33954952)

Malware is executable software. The evercookie isn't software, it's a simple marker.

And what puts that "simple marker" on your computer? Oh yeah, JavaScript, which last time I checked is executable software.

Re:Evercookie is clever (1)

ls671 (1122017) | more than 3 years ago | (#33955976)

Not directly, more precisely; javascript is 'indirectly' executed ("interpreted") by an interpreter program.

I realize that I am picking on you a bit but still, I consider the precision worthy ;-)

Re:Evercookie is clever (4, Insightful)

Firehed (942385) | more than 3 years ago | (#33954954)

It's a fairly complex storage mechanism, designed to get around a user's preferences. In the wrong hands, it's very dangerous. I'd certainly call it closer to malware than, for example, the recent iPhone jailbreaks - which are so kind as to patch the security flaw that let the software run in the first place. Yet by your reasoning, jailbreaking is malware and evercookies are harmless. If you think that ad retargeting (ads that basically follow you around the web) is creepy, wait until they know with 100% certainty that you're a known user in some known demographic.

Re:Evercookie is clever (0)

Anonymous Coward | more than 3 years ago | (#33954986)

If only they knew how wasted it is to show me ads about Microsoft anything, they would stop instantly.

Re:Evercookie is clever (0)

Anonymous Coward | more than 3 years ago | (#33954966)

It's more than a marker if it's capable of detecting attempts to remove it and respawning itself.

Re:Evercookie is clever (1)

KiloByte (825081) | more than 3 years ago | (#33955190)

How do you store a marker on a computer without software? Does it leave a physical marker other than a magnetic charge on the disk?

"Software" means a "string of bits", not a "program". This is the definition I was taught, and it is the most popular one.

As for example the Wikipedia article [wikipedia.org] mentions, there is also a rare narrower definition which says what you meant. It has gained some popularity recently, but it suffers from being badly imprecise: what about PostScript? What about Perl's POD? What about PHP which can range from 100% HTML to 100% code? What about Windows metafiles? What about PDF? What about a "picture" file that causes a buffer overflow to pass some shellcode?

Re:Evercookie is clever (3, Interesting)

pclminion (145572) | more than 3 years ago | (#33954612)

Just put it in the ToS for the site that you use "advanced measures to track banned users." Presto, now you're not being underhanded about it, which is really the critical difference between malware and other forms of software.

Re:Evercookie is clever (0, Troll)

Sponge Bath (413667) | more than 3 years ago | (#33954706)

"advanced measures to track banned users."

"enhanced interrogation techniques" - A familiar meme.

Re:Evercookie is clever (1)

pclminion (145572) | more than 3 years ago | (#33954786)

Yes, installing a cookie on a user's system after informing them that you will be doing so, is equivalent to waterboarding enemy combatants in secret holding facilities. Get real.

Re:Evercookie is clever (2, Insightful)

Anonymous Coward | more than 3 years ago | (#33955500)

Putting something in your Terms of Service isn't the same thing as informing the user, even if it's legally regarded to be so.

Re:Evercookie is clever (3, Insightful)

Firehed (942385) | more than 3 years ago | (#33954974)

Putting something in the TOS to "not [be] underhanded" is, in itself, being underhanded. Or perhaps you're that one non-crawler in my server logs with the request to /about/terms, in which case I take that back.

Re:Evercookie is clever (2, Insightful)

countSudoku() (1047544) | more than 3 years ago | (#33954398)

Not if they visit using a Live CD based OS. Ooops, sorry, just broke your new thing there. :) I'm not above using a Live CD to do things, and to collect stuff, which is stored on other things. IPs won't even help that now. Looks pretty broken. Hope the evercookie is chocolate.

Re:Evercookie is clever (1)

MagicM (85041) | more than 3 years ago | (#33954624)

I'm not above using a Live CD to do things, and to collect stuff, which is stored on other things.

You sound like a fascinating person and I would like to subscribe to your newsletter.

Re:Evercookie is clever (1)

_Sprocket_ (42527) | more than 3 years ago | (#33954720)

Not if they visit using a Live CD based OS. Ooops, sorry, just broke your new thing there. :)

I would suspect you represent a very small minority.

Re:Evercookie is clever (1)

couchslug (175151) | more than 3 years ago | (#33954726)

"Not if they visit using a Live CD based OS."

VMs aren't just for running "installed" operating systems. :)

A live CD image boots nicely under QEMU and VirtualBox. Grab some .isos and enjoy.

http://www.damnsmalllinux.org/ [damnsmalllinux.org] is small, light, and fast, but you can run Ubuntu and similar images.

If you remaster your image with custom software, you can use it as easily as a premade .iso.

Re:Evercookie is clever (2, Insightful)

thePowerOfGrayskull (905905) | more than 3 years ago | (#33955588)

Not if they visit using a Live CD based OS. Ooops, sorry, just broke your new thing there. :) I'm not above using a Live CD to do things, and to collect stuff, which is stored on other things. IPs won't even help that now. Looks pretty broken. Hope the evercookie is chocolate.

Sooo... what's your point again? What percent of the population uses a LIveCD installation? And of that percentage, what further subset does so without any persistent storage (flash drive, etc) for user settings? (And if one person replies to me "I do, so there" [or its equivalent] , consider yourself virtually smacked for missing the point.)

I'd say it's not broken until there's a less drastic means of evading it. If the only way to do so means - a) clearing history after every page and b) disabling cookies and c) disabling javascript OR d) running a Live CD OS ... well, I think it's pretty safe to say this is gonna be around for a while.

Re:Evercookie is clever (0)

Anonymous Coward | more than 3 years ago | (#33954632)

And you can never visit any registration sites from a public or shared computer again... one user gets banned, all future users are detected as circumvention attempts.

Re:Evercookie is clever (1)

c0lo (1497653) | more than 3 years ago | (#33954912)

4) your site detects the evercookie + new registration, 5) verify and ban again (unless the user suddenly becomes a good user, of course).

Good-bye posting from Internet cafe's from a guest account.

If only... (4, Funny)

NoobixCube (1133473) | more than 3 years ago | (#33954262)

I wish I had an evercookie. A magical cookie that regrows every time you take a bite out of it sounds like an amazing idea.

Re:If only... (1)

Pieroxy (222434) | more than 3 years ago | (#33954390)

So how does that work with Cookie Monster that eat up several cookies at once? Can it regrow if you eat it all up or do you necessarily have to have just a bite?

Re:If only... (0)

Anonymous Coward | more than 3 years ago | (#33954502)

You pick it out of your shit.

Re:If only... (1)

Yvan256 (722131) | more than 3 years ago | (#33954424)

Imagine what happens if you try to eat the whole cookie at once.

Re:If only... (1)

Erikderzweite (1146485) | more than 3 years ago | (#33954754)

It will obviously regrow as you digest it (giving you diabetes and making an average US citizen look thin in comparison to you).

Re:If only... (1)

_Sprocket_ (42527) | more than 3 years ago | (#33954590)

I wish I had an evercookie. A magical cookie that regrows every time you take a bite out of it sounds like an amazing idea.

Stay away from the one with blueberries in it.

Well for Linux anyway (4, Informative)

al0ha (1262684) | more than 3 years ago | (#33954300)

A combination of FlashBlock and perhaps RequestPolicy, combined with caching set to 0 and a block on the ever cookie creator domain results in no ever cookies being successfully set on FF 3.6.10 on RHEL 5.4 - I'd venture to guess it will be the same for other OS running FF at least.

If I don't block the domain cookie creation then just a standard cookie is created.

Re:Well for Linux anyway (0)

Anonymous Coward | more than 3 years ago | (#33955782)

Make the folder ~/.macromedia read only. Works with Linux, but not in Windows.

Re:Well for Linux anyway (3, Informative)

Jah-Wren Ryel (80510) | more than 3 years ago | (#33956222)

Make the folder ~/.macromedia read only. Works with Linux, but not in Windows.

I just tried it under linux.
When I made the empty ~/.macromedia directory read-only, the flash plugin consistently crashed.
So I made sure that Flash_Player sub-folder was created by the plugin first, deleted any cookie files and then did a recursive chmod -R a-w ~/.macromedia and it seems to work fine now.

That won't work (1)

psyclone (187154) | more than 3 years ago | (#33956414)

How does that prevent HTML5 local storage? How about the BrowserHistory storage? (e.g. domain/path/unique/1st-byte, domain/path/unique/2nd-byte, etc.) And CSS history storage? The most ingenious method is PNG RBG value storage! You block all images too?

I use NoScript (but I still temp-allow the primary site, otherwise why browse at all), CookieMonster in whitelist-only mode, and BetterPrivacy to delete flash LSOs on startup and shutdown. This still does not prevent the Ever Cookie.

Did anyone here read the original documentation [samy.pl]?

Ufortunately (3, Funny)

antifoidulus (807088) | more than 3 years ago | (#33954306)

Now that the Cookie Monster has gone all health food we cannot rely on him to help us out here.

Re:Ufortunately (-1, Flamebait)

Anonymous Coward | more than 3 years ago | (#33954566)

shows the Muppets have been taken over by faggots, just like Disneyland

how does it work? (0)

Anonymous Coward | more than 3 years ago | (#33954308)

so? how does it work?

well, actually (1)

bhcompy (1877290) | more than 3 years ago | (#33954394)

It mentions mobile devices.. you could just use Skyfire and get flash without having to worry about flash evercookie issues since it's rendered remotely

Re:well, actually (0)

Anonymous Coward | more than 3 years ago | (#33954464)

Don't forget to ignore all the permissions it asks for on Android...

Stopping this isn't hard (0)

Anonymous Coward | more than 3 years ago | (#33954414)

Just run the browser inside a sandbox http://www.sandboxie.com/ and regularly delete the sandbox contents.

Why Safari (2, Interesting)

willoughby (1367773) | more than 3 years ago | (#33954478)

I admit I didn't RTFA but why are they talking about Safari? Are other browsers immune? Is any browser immune?

Re:Why Safari (2, Interesting)

BUL2294 (1081735) | more than 3 years ago | (#33954746)

For some reason, TFA only mentions Safari. No mention of IE (though Silverlight is mentioned) or Firefox, just Safari & Chrome. I don't know if that's because the author hasn't gotten around to testing Firefox or if it's immune--but Silverlight & Flash could be holes for FF.

Frankly, I never trusted Google's ability to vet Apple's (Webkit) code for security holes... And I just don't trust Apple.

And what the hell is "HTML5 database storage"--and why would I want to give any app persistent storage? Seems like a great way to store malware...

Re:Why Safari (1)

CODiNE (27417) | more than 3 years ago | (#33955674)

And what the hell is "HTML5 database storage"--and why would I want to give any app persistent storage? Seems like a great way to store malware...

If you use gmail on an iPad in Safari when you log in for the first time with a username it'll as if you give permission to make a 10MB storage file on the device for that users email cache.

It does this for every gmail account you log on with. If you accept, then the next time you go to gmail it loads the default view with the cache and then the new emails pop up at the top of the inbox much quicker than loading it all from scratch.

It's just a faster way of loading your emails and giving it more of an "app" feel.

I'm assuming the database is encrypted.

Re:Why Safari (1)

jimshatt (1002452) | more than 3 years ago | (#33955074)

As far as I can tell, Safari handles evercookies the best (the least bad) of all browsers. I haven't tested Safari, but FF and IE are not immune. TFA states that in some cases evercookies can be undone on Safari (after thoroughly purging data and restarting).

Evercookie = Nevercookie (3, Interesting)

the_raptor (652941) | more than 3 years ago | (#33954540)

With Adblock plus, NoScript and BetterPrivacy Firefox addons I had to whitelist the domain before "Evercookie" would even work. And even then as soon as I revoked permissions for everything except NoScript the only bit that stuck was the cache image "cookie". Considering there are already addons to prevent normal cookies and flash cookies it would take all of a day, after this method for "eternal cookies" appeared in the wild, for an addon to be released that blocked it.

The only message from this and previous articles is "most people are stupid and don't follow basic steps to maintain their security and privacy".

Re:Evercookie = Nevercookie (2, Interesting)

Anonymous Coward | more than 3 years ago | (#33955744)

Because from what you just described as necessary to keep out these Evercookies, this isn't "basic steps". This is advanced knowledge of how cookies and browser technology work and interact. Four different browser specific addons should not be required to maintain privacy, and that is the point. People aren't stupid, they just don't know. Arrogance about it won't help.

people aren't stupid, software is stupid (0)

Anonymous Coward | more than 3 years ago | (#33956272)

why do users have to jump through FLAMING HOOPS to get privacy?
Every new "security update" brings with it unwanted features that compromise your security (webstore...)

Re:Evercookie = Nevercookie (1)

psyclone (187154) | more than 3 years ago | (#33956556)

The problem with that method is that you still have to clear your entire cache (specifically PNG files and HTML5 local storage, though you can't pick and choose) AND browser history, even when using privacy enhancing extensions. Samy's method uses external sites for the browser history hack, but it could easily use the same domain.

I'm one of the few that likes the 'awesome bar' and I rarely use bookmarks anymore as history serves my needs, and is quicker from the keyboard too. (Versus a hierarchy of bookmarks I must mouse through.)

Perhaps we need a whitelist like system for storing history and disk cache... only allow the sites we need/want to trust.

Evercookie my ass (1)

Wolfling1 (1808594) | more than 3 years ago | (#33954610)

Workstation rebuild every couple of months. Its a great way to scrub out those nasty zero day trade viruses too.

Re:Evercookie my ass (1)

MichaelKristopeit 47 (1919590) | more than 3 years ago | (#33954642)

and once they log in to any service that is a member of the evercookie corporation of sites that share data, all the links are recreated.

Re:Evercookie my ass (1)

psyclone (187154) | more than 3 years ago | (#33956562)

Exactly. We need to prevent the storage in the first place, just like CookieMonster does in whitelist-mode, not clean it up later.

CCleaner to the rescue. (1)

DigiShaman (671371) | more than 3 years ago | (#33954672)

For Windows PCs.

Install CCleaner. De-select the option to only remove files older than 24 hours. Flush all browser cache, temp files, and temp application items. Basically, select all except for the "Wipe Free Space" option. Reboot, run again to be sure.

Evercookie should be nuked from orbit.

Ever cookie (0)

Anonymous Coward | more than 3 years ago | (#33954878)

This is no different than hacking your placing something on a computer that dont belong to you.
That the owner of said computer dont want.
You should be able to file charges.

Any attorney general not all over this is a pile of human shiit.

Evercookies don't exist! (0)

Anonymous Coward | more than 3 years ago | (#33955060)

Some of these comments are fun as hell. In a moving attempt to show manhood, the random slashdotter boldly states: "Heck not on my machine, y'all! I use a combination of rat poison, anthrax and a couple nukes every 3-4 days on the hard drive: the evercookie can't do anything to me"... Fun times.

Chrome removes w/out restart or 3rd-party software (0)

Anonymous Coward | more than 3 years ago | (#33955204)

While the "Evercookie" is a mildly clever way to track people who don't know how to set up their computers properly, it's far from permanent on a moderately well set-up system.

I just tested myself, in Google Chrome. I can clear the "Evercookie" from my system so it can't recognize me, without using any third-party software or extensions, and without even having to restart the browser or close any tabs except that which set the cookie. (Might not even have to close that, but couldn't be bothered trying.)

All that's required is to visit the Silverlight and Flash websites, disable local application storage, then go to Tools :: Clear Browsing Data in Chrome's menu.

Hey presto, the cookie is completely gone and can't be restored by the site. It really couldn't be a whole lot easier.

Why I dont run my browser as me anymore (3, Interesting)

DarkOx (621550) | more than 3 years ago | (#33955974)

Its reasons like this and others I no longer run my browser under my own user account. I have a separate account I run the browser as, actually two there is one I use just to access my bank, and give it permissions on my X server. It has no group memberships that will let it do anything other than read access to system binaries and libraries, basically its only a member of users. I than give my own user account permission to run the browser as the other user with sudo.

This way I can delete the entire home directory from time to time, or anytime I suspect something fishy has happened.

Re:Why I dont run my browser as me anymore (1)

DarkOx (621550) | more than 3 years ago | (#33956004)

replying to my own post--

  yes sometimes its a bit of a headache if I want to upload a file or anything I usually have to chmod it long enough to accomplish that and than put it back.

Re:Why I dont run my browser as me anymore (1)

PReDiToR (687141) | more than 3 years ago | (#33956416)

You're not the only one doing this.

I have several browsers and several accounts on my machine.

Love Linux, hate malware.

ok who has the right to place a cookie, (1)

Stan92057 (737634) | more than 3 years ago | (#33956212)

ok who has the right to place a cookie, that cant be deleted by the computer owner? That sound like malware to me even if its not an exe it collects data and sends the data when requested. Who would be stupid enough to place undeleteable cookies anyways? the repercussions would not be very good for there business. On a side note i don't believe web sites,business have the right to spy on where i come from or where i go outside of there site,they do however have the right to see what we do on there site. If you want information from a user ASK,don't TAKE without asking

It's not just this one researcher. (0)

Anonymous Coward | more than 3 years ago | (#33956286)

The technique he dreamed up will be copied by thousands of not-so-nice people and companies.

And since most internet users are idiots, the new evercookie system will work on >95% of computers.

All slashdot readers know how to sidestep this sort of thing.

But most non-slashdot people are clueless.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...