I worked on designing tracking scripts for six months (fortunately they aren't in production). Flash cookies aren't a very useful tracking mechanism anymore, mainly because Google and other browsers now clear Flash cookies when you clear your regular cookies. Fingerprinting was very difficult to pull off in practice: even with canvas fingerprinting, font enumeration, plugin enumeration, etc. etc. most mobile phones are indistinguishable, and even when you find devices with unique fingerprints (usually because of the unique set of plugins installed) it's difficult to be certain the new device you've seen is the same as the old device unless they are coming from the same ip address.<p>Now, the one mechanism that was very effective was ETag tracking. When you request a picture or other asset from a website, the website can send you an etag id which is supposed to signify the picture's version. When the client revisits the page, the client sends back the etag to confirm the version cached is the same as the version on the server. The security leak is that the etag protocol allows arbitrary text to be set as an etag, so to set an etag cookie all you have to do is place a 1x1 pixel on each page with a random GUID, and when the user revisits the page the browser will resend the tracking etag in its request for the 1x1 tracking pixel. This works for browsers with cookies disabled, and will remain when cookies are cleared. The only way to clear it is to clear all browsing history entirely, including cached images.
REI knows how to close the deal:<p>I was shopping a while back for a new tent. Wondered if I should wait for a 20% off single item coupon event like they do a couple times a year. Googled "when is the next rei 20% coupon?". I got the expected results: probably around labor day.<p>Lo and behold, a couple days after this I received an email from REI with a 25% off single item offer code.<p>I don't know of I should be frightened or not, but I got a new tent!
Is there any tool that tries to prevent fingerprinting by unifying browsers' behavior into one single promoted "common" one? Well, completely preventing is probably impossible, but at least lower the number of unique properties.<p>E.g. a software-only... err... shim (or how should I call it?) for canvas and audio APIs, and only allow fast native one to a trusted whitelisted parties. And an uniform list of fonts and plugins, despite of what's actually installed.<p>Of course, I know about NoScript. It can't be mass-used as a "just install this and you're good" strategy, thus doesn't help much - the fingerprints would still remain quite unique. Yet, if something is less obtrusive - just slow at times (and then it asks "hey, this site does something fancy with canvas, maybe allow it to speed up at the cost of your privacy?") may work.