Über-zombie cookies give us the fear
Say hello to invulnerable evercookies
Posted in Security, 23rd September 2010 13:25 GMT
Watch Now : Virtual Machine Movement with Hyper-V
Privacy activists got hot under the collar about the use of flash cookies to respawn traditional website cookies* but an even more persistent type of cookie that's almost impossible to kill off may lie just around the corner.
So-called in invulnerable evercookies use eight different techniques and locations to hide on tagged systems, including web history, HTML5 session storage and even the "RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out" as well as in flash or regular cookies. Providing just one copy of the cookie remains, the other locations are rebuilt.
The concept echoes Lord Voldemort hiding fragments of his soul in horcruxes in the Harry Potter books.
Developer Samy Kamkar explains the point of his idea: "Evercookie is designed to make persistent data just that, persistent. By storing the same data in several locations that a client can access, if any of the data is ever lost (for example, by clearing cookies), the data can be recovered and then reset and reused.
"Simply think of it as cookies that just won't go away."
Kamkar reckons using Private Browsing in Safari will stop ALL evercookie methods following a browser restart. He hasn't tested whether this approach work with other browsers. ®
* A Walt Disney internet subsidiary faces a civil lawsuit over its alleged use of Flash cookies to track users, including minors, as we reported here.
Send corrections
Data control in the cloud
The new Office Garage series:
IT infrastructure monitoring strategies
