Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies),

I was wondering does other plugins like Silverlight and Java have this problem?

Effectively, the question is:

When I use Incognito, what technologies will allow webpages to escape this incognito cage ?

share|improve this question
    
If the provider could save the same state with a unique server side cookie would the be less of a concern? I'm thinking about the high probability your browser is itself unique (panopticlick.eff.org) or you have authenticated. –  zedman9991 Oct 18 '11 at 15:15
    
What security issue are you interested in: confidentiality (privacy), integrity (using state to exploit a vulnerability, or some other issue related to protecting some asset? –  this.josh Oct 19 '11 at 6:44

4 Answers 4

Actually, depending on the browser and plugins used, there are many ways for a website to store persistent information on users' computer. It's not cookies and cache anymore. Some of these new methods require user confirmation, some don't - it also varies by browser. Flash has Local Shared Objects, Silverlight has Isolated Storage, HTML5 itself gives Offline Application cache, Session Storage and Local Storage.

It's not easy to clean them all at once. In fact, there is a proof-of-concept project that uses all those tricky ways and many others to create a super-persistent-and-resurecting-cookie - Evercookie. Of course, there is also an Evercookie killer called Nevercookie.

share|improve this answer
    
So who's the Nevercookie killer? –  Pacerier Oct 20 '11 at 7:38
    
@Pacerier If only one client uses the same IP, you could use that to resurrect cookie. Of course, it isn't very efficient for Internet connexions with frequently changing IP. –  curiousguy Nov 7 '11 at 21:12

You are right. There are really many ways for a website to store persistent data on you, even if you dont want them too. Evercookie by Samy Kamkar is an example of this.

Quotede from the site of Evercookie it stores persistent data on you with the help of these storage mechanisms:

  • Standard HTTP Cookies
  • Local Shared Objects (Flash Cookies)
  • Silverlight Isolated Storage
  • Storing cookies in RGB values of auto-generated, force-cached
  • PNGs using HTML5 Canvas tag to read pixels (cookies) back out
  • Storing cookies in Web History
  • Storing cookies in HTTP ETags
  • Storing cookies in Web cache
  • window.name caching
  • Internet Explorer userData storage
  • HTML5 Session Storage
  • HTML5 Local Storage
  • HTML5 Global Storage
  • HTML5 Database Storage via SQLite
share|improve this answer
    
But incognito will basically defeat everything other than the the 2nd and 3rd point right? –  Pacerier Oct 20 '11 at 7:46
    
@Pacerier, Chromes incognito window defeats all the points in the list :) –  Chris Andrè Dale Oct 20 '11 at 12:25
    
What about Tor Browser? –  Pacerier Oct 22 '11 at 16:40
    
@Pacerier, Tor Browser also safe. Once you restart it it does not manage to refind the evercookies. –  Chris Andrè Dale Oct 22 '11 at 19:10
1  
@Pacerier "Vidala Control Panel's "use new identity" is only about Tor exit point. Tor does not know or care about HTTP cookies, HTTP ETags, HTML5 Session Storage, Flash super cookies... –  curiousguy Nov 7 '11 at 21:09

Since 6u10 Java applets have been able to store "muffins" (effectively cookies) using java.jnlp.PersistenceService.

Also from the same release, Java applets can also open files through FileOpenService, FileSaveService and ExtendedService.

share|improve this answer
    
Are muffins built on top of cookies? In other words do muffins stay after I have cleared my cookies? –  Pacerier Oct 20 '11 at 7:40
    
Muffins are an entirely separate bit similar mechanism. You don't even need a browser installed to use them with Java WebStart applications. –  Tom Hawtin - tackline Oct 20 '11 at 17:19

Silverlight can actually access the local filesystem, depending on the permissions granted. It is subject to .NET security mechanisms, but if these are badly configured, it is possible to read a user's files, or even change them.

share|improve this answer
    
holy, so basically if I surf with Silverlight enabled, just visiting a site could invite a virus in? –  Pacerier Oct 20 '11 at 7:47
    
Yes, it could, but not just like that - you'd have to grant silverlight permission to write to 'interesting' locations, which it is not normally allowed to. The .NET security model is quite complicated, but it does make sense - silverlight plugins in the internet zone are mostly untrusted and will only be granted very limited access to system resources, so they can't just modify any registry key or dump dlls in windows\system32 or anything. –  tdammers Oct 20 '11 at 19:59
    
but they could install "programs" into my computer which if I unknowingly "run as administrator" that's all it takes to destroy my computer? –  Pacerier Oct 22 '11 at 16:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.