Cookieless cookies (2013)

That's a surprise to see pop up again! Author here. Now I wish I had improved the demo in the past years... It still generates the etag from a few static parameters to make it work without JavaScript (as the page notes near the bottom), a real implementation doesn't have that limitation because they don't care to echo data (such as your note and visit count) back to you before the image with etag even loaded. I should have switched it to display the data in the image, so it works more accurately.

I was surprised to see that this tracking works across both regular and private browsing in Firefox (67.0.4 on macOS). I can see the number of visits increment and whatever message I've saved on either side is displayed to both.

Wikipedia has a list of websites known to use this technique already: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;HTTP_ETag#Tracking_using_ETags" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;HTTP_ETag#Tracking_using_ETags</a><p>Looks like KISSmetrics are getting sued with a class action lawsuit over using this technique.

Discussed at the time: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6231039" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6231039</a>

In Firefox, setting<p><pre><code> browser.cache.disk.enable browser.cache.memory.enable </code></pre> to false, seems to stop some of this from working. The last visit date still works, but the text storage and number of visits does not.

I am shocked firefox still has such gaping privacy holes:<p>It&#x27;s just one of many: <a href="https:&#x2F;&#x2F;samy.pl&#x2F;evercookie&#x2F;" rel="nofollow">https:&#x2F;&#x2F;samy.pl&#x2F;evercookie&#x2F;</a><p>In the old discussion (<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6231039" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=6231039</a>) it was revealed that some parties were sued and settled for $500,000. Relatedly British Airways was just fined £183m. That&#x27;s a beginning.

<i>&quot;Even when you disabled cookies entirely, have Javascript turned off and use a VPN service, this technique will still be able to track you.&quot;</i><p>It doesn&#x27;t work if you disable image loading.<p>For 90%+ of the web browsing I do, I don&#x27;t need to see images at all, and browsing using emacs-w3m which I have set up to show only text and not load any images suffices. Occasionally there might be some image I want to see on a website and then I&#x27;ll usually load it and view that one (or handful of images) manually. Very very rarely, I&#x27;ll visit a site with an image gallery, where loading and viewing images one at a time is too painful, and then I&#x27;ll just open it in Firefox, which I have set up to load images.<p>I know not loading images by default is not a solution for most people, but it&#x27;s worked great for me for many years.<p>Update: A lot of replies are mentioning CSS. Just for the record: emacs-w3m does not process CSS

This is a fundamental property of caching.<p>To avoid an extra fetch, <i>you have to explicitly tell the data source</i> that you already have this piece of data, and sending it is not required.

I tried this on the 0.66.99 version of Brave and it works.

I wasn&#x27;t familiar with etags, so for anyone else curious I&#x27;ll save you the google search:<p><a href="https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;HTTP&#x2F;Headers&#x2F;ETag" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;HTTP&#x2F;Headers&#x2F;ET...</a><p>&gt;If the resource at a given URL changes, a new Etag value must be generated. Etags are therefore similar to fingerprints and might also be used for tracking purposes by some servers. A comparison of them allows the determination of whether two representations of a resource are the same. They might also be set to persist indefinitely by a tracking server.

<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;HTTP_ETag#Tracking_using_ETags" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;HTTP_ETag#Tracking_using_ETags</a>

Interesting. You can store the data in a regular browser window, and it&#x27;s still there if you open the URL in a private window.<p>The private mode should have its own cache that is initially empty.<p>Idea: since private sessions are typically short-lived, they never have to validate ETags. Basically just cache resources indefinitely and never ask &quot;is this item still valid&quot;. the cache is thrown away when the private session is closed; that&#x27;s what invalidates it.

Also read: clear gifs &#x2F; web beacons<p>You may see this in your email to track how many times you open newsletters and other items.

Firefox 69.0b3 here, works across refreshes but not when restarting the browser or opening a private window.

Of course this can also be applied to all other forms of tracking for extra persistence: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=1714446" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=1714446</a>

It&#x27;s worth noting that when you do a hard refresh, obviously you won&#x27;t get a 304 Not Modified, which is what this tracking relies on. So, if you wanted to clear the state, that would be one way.

Interesting technique, I learned something new about ETags.<p>Probably a dumb question but: any reason this couldn&#x27;t be reliably used instead of cookies to track sessions, e.g. login status etc.?

Before anyone thinks this (and similar) approaches are a way around the GDPR&#x27;s cookie consent tracking crackdown: It&#x27;s not.<p>The GDPR talks about online identifiers, of which cookies, IP address and fingerprints are examples. If you read any regulator&#x27;s guidance carefully, you&#x27;ll see they talk about &quot;cookies and similar technologies&quot;, with just &quot;cookies&quot; being used alone for brevity.<p>To rephrase tracking of any kind is the issue, not cookies. Don&#x27;t mistake the implementation for the activity.<p>Disclosure: Founder of a non-tracking web analytics service because of this exact issue.

Clever but as you can’t analyze cross domain images I don’t think you can use this to track people across the web.

On Chrome for Android it does not work with data saver enabled. Disabling it causes it to work for me.

Doesn’t appear to work with DuckDuckGo browser on iOS.