Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side.

There is an interesting side effect to this technology; ETAGs are saved on a machine even if cookies are deleted. Some people / software have exploited this fact to make an ETAG "act" like a cookie.

This means that simply deleting cookies isn't enough. One has to delete the entire web cache as well. That is a painful process to go through every time I surf the net on my test machine.

Question

What is the most reliable way to prevent tracking that occurs by ETAG headers?

share|improve this question
4  
For those of us unfamiliar with the problem: en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags –  logicalscope Mar 14 '12 at 0:35
1  
Shameless plug, I also made an info page about this: lucb1e.com/rp/cookielesscookies Includes demonstration and source code. –  Luc Aug 21 '13 at 12:39
    
Related: ETAGS can be read by javascript in some cases –  makerofthings7 Sep 10 '13 at 13:49
    
There are more ways. Instead of Etag you could provide a user specific date in the Last-Modified header and get it later back because the browser is including a If-Last-Modified header in the request. Not so much data as in a Etag or Cookie, but still enough to track users. –  Steffen Ullrich Jan 16 at 20:26
add comment

6 Answers

up vote 4 down vote accepted

I don't know of any great solutions. I can suggest three possible defenses, though all of them have limitations:

  • Privoxy. Privoxy can blog ETag headers.

    In particular, you can use crunch-server-header or server-header-filter in your Privoxy configuration to block ETag: headers from the server. Also, you can use crunch-client-header or client-header-filter in your Privoxy configuration to block If-None-Match: and If-Modified-Since: headers from the client. However, I don't know of any off-the-shelf formula you can just grab and use: you'd have to build your own Privoxy configuration yourself.

  • Your browser. If you use Firefox, you can configure Firefox to clear your cache each time you exit the browser. This may be bad for performance. Also, with this approach, ETags can still be used to track you within any one browser session, so it is not perfect, but it should clear any ETag cookie when you quit your browser.

  • RequestPolicy. If you use Firefox, you could use the RequestPolicy extension. One writer has pointed out that RequestPolicy may help defend against ETag tracking. Often, web sites track you by including resources from third-party advertisers or analytics providers. RequestPolicy lets you control what third-party resources your browser will request, when visiting a web page, and thus can let you protect yourself against that kind of tracking: if your browser never loads the third-party advertiser's resource, then the third-party advertiser doesn't have a chance to track you (using an ETag or any other mechanism). This defense is less than ideal, because it requires you to laboriously assemble your policy, and because web sites can still track you directly if they don't rely upon any third-party resources.

Unfortunately, if you access the web through a transparent proxy, the presence of the proxy may complicate your attempts to avoid being tracked.

share|improve this answer
    
also Proxomitron supposedly can filter out or block e-tags. –  user18238 Dec 31 '12 at 21:58
add comment

In addition to the more involved solutions proposed by @D.W., you can consider using your browser's private browsing mode, ala InPrivate (IE), PrivateBrowsing (FF), Incognito (Chrome), etc.
The main thing here is that the browser cache is not used (or at least, not used beyond the length of the private session). As such the Etag is not saved by your browser.

There are still some drawbacks to this approach, such as tracking within the session, and proxies as @D.W. mentioned. That said, it is pretty simple to use.

share|improve this answer
add comment

If you're using Firefox, you might be interested in an (optional) feature of my SecretAgent add on... which creates spoof ETag headers to suppress tracking.

The downside is that spoofing ETags will obviously impair caching on those sites which use ETags to optimise traffic (though this seems to have very minor impact on performance).

See www.secretagent.org.uk.

  (Disclaimer: I am the author of SecretAgent).

share|improve this answer
    
Hi Peter - welcome. Sounds interesting - do you have a link? and thanks for listing your affiliation. –  Rory Alsop Apr 12 '13 at 13:39
add comment

update: wrote the answer differently and more clearly

I have a solution which works without modifying the current HTTP protocol. I'd love to see an implementation of this.

Instead of telling the server our Etag we ASK the server about its Etag, and we compare it to the one we already have.

Pseudo code:

If (file_not_in_cache)
{
    page=http_get_request();     
    page.display();
    page.put_in_cache();
}
else
{
    page=load_from_cache();
    client_etag=page.extract_etag();
    server_etag=http_HEAD_request().extract_etag();

    //Instead of saying "my etag is xyz",
    //the client says: what is YOUR etag, server?"

    if (server_etag==client_etag)
    {
        page.display();
    }
    else
    {
        page.remove_from_cache();
        page=http_get_request();     
        page.display();
        page.put_in_cache();
    }
}

HTTP conversation example with solution 1:

Client:

HEAD /posts/46328
host: security.stackexchange.com

Server:

HTTP/1.1 200 OK
Date: Mon, 23 May 2005 22:38:34 GMT
Server: Apache/1.3.3.7 (Unix) (Red-Hat/Linux)
Last-Modified: Wed, 08 Jan 2003 23:11:55 GMT
ETag: "ABCDE"
Content-Type: text/html
Content-Length: 131

Case 1, Client has an identical etag:

Connection closes, client loads page from cache.

Case 2, client has a mismatching etag:

GET...... //and a normal http conversation begins.

Edit: It is worth noting that there is a minor overhead, the server has to send the HTTP header twice: Once in response to the HEAD, and once in response to the GET. One theoretical workaround for this is modifying the HTTP protocol and adding a new method which requests header-less content. Then the client would request the HEAD only, and then the content only, if the etags mismatch.

Edit 2: I've followed makerofthings7's advice and posted this as a question on stackoverflow.

share|improve this answer
    
Perhaps post this as a question asking if this is a viable workaround for the HTTP ETAG security / privacy flaw –  makerofthings7 Dec 2 '13 at 17:50
    
Why would I post this as a question? It is viable and practical. Everything is already implemented in HTTP (The HEAD and GET). –  Hello World Dec 2 '13 at 18:11
    
It's a great idea, but having it buried as an answer to my question may not get the visibility it deserves –  makerofthings7 Dec 2 '13 at 18:22
    
Thank you, I will do so. Is copying almost the exact content into a new question okay with Stackexchange rules? –  Hello World Dec 2 '13 at 18:23
1  
It's best on StackOverflow: "Will this protect me from etag tracking, and will it work with existing ETAG implementations" ... since its possible a weak and strong ETAG implementations may have different results. ... but try StackOverflow.com first, and perhaps link to this question via the share button so you can get "referrer" points. –  makerofthings7 Dec 2 '13 at 18:28
add comment

Some technical details and a proof of concept demo of ETag tracking: http://ochronus.com/tracking-without-cookies/

share|improve this answer
1  
Most of this was copied from lucb1e.com/rp/cookielesscookies (legally because it's WTFPL, but it's still mostly just a copy). Also it's recommended to include more details in an answer than merely a link, and you should disclose any affiliation with any website (if applicable). –  Luc Aug 21 '13 at 12:42
add comment

A future solution could be a browser preference that disables etags.

For Mozilla the issue is discussed in: ETag: filtering to counter web tracking.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.