So the question is how to detect cookie stuffing attacks and how to protect against them? In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore consider this GET request as well as sent cookie invalid. But what about iframe-based cookie stuffing?
|show 1 more comment|
There is no one solution to this complex problem.
A client can enable the Do Not Track http header element. But there is no guarentee that the server will respect it. The PrivacySuite addon goes one step further to actively block tracking gadgets. There are *MANY* other anti-tracking addons for firefox as well as some for Chrome and I have no idea which one(s) are the best.
Ad-block Plus will keep your browser from loading many of these tracking gadgets, and even if such a gadget where to be loaded it will block the targeted ads. This solves the symptom but not the root of the problem.
Relivent TED talk: Tracking the Trackers
Also its wroth while to learn about Google's "Remarketing" feature for advertizes.