2

I decided to post on Security as it's more a privacy-oriented question. I could post it on Superuser as a browser question.

These days I am experiencing a strange behaviour with Firefox 92.0.1 equipped with AdBlocker Ultimate, I Don't Care About Cookies and Cookies AutoDelete plugins. The browser is configured to reject all third party cookies.

The idea is that IDCAC will accept any cookie banner, but the browser blocks 3rd party cookies in the first chance. And at the end of the session, CAD will drop all cookies from non-whitelisted sites.

I spend a lot of time on Github and StackExchange. And it is in my CAD whitelist so I don't log in to it every time.

Every while and then, CAD notifies me of clearing content from arstechnica.com. Easy as spending one minute still on a page on Github or StackExchange and find the notification

CookieAutoDelete removed data from 2 domains, including addons.mozilla.org, arstechnica.com

CookieAutoDelete removed data from arstechnica.com

But it's not just Github. A number of web sites (even non-English newspapers) look like containing data from arstechnica.

I explored the network connections from Firefox but none is made to domain arstechnica.com.

I explored the source code of a Github page and no script or content from arstechnica.com was hardcoded. Obviously, I can't tell about scripts hosted on Github,

Adblock blocks a number of trackers.

Looking at CAD log, looks like the cookie set by arstechnica is cneplayercount

I tried to search for it but it can't be found on github or other favourite websites

I also tried to open HPE iLO4 firmware administrator page of a physical server I own. Still, a popup from arstechnica.

CAD says to have cleaned:

  • IndexedDB from arstechnica
  • Service workers from arstechnica
  • Cookie (cneplayercount) from arstechnical "Because it's not in white or grey list"

I also checked for all of my extensions and after the three linked above, there is another open source extension Offline QR code generator

I looked into about:serviceworkers and none is active

Question

What is going on? Why is CAD finding stuff from arstechnica everywhere? How can I investigate further?

Improve this question
6
  • I didn't add screenshots being them localized
    – usr-local-ΕΨΗΕΛΩΝ
    Commented Oct 6, 2021 at 15:40
  • 1
    Did you try just going to the cookies list in the browser settings and searching for that cookie? It might just be that there's a cookie stuck in there that's somehow being misattributed due to a bug in CAD.
    – Polynomial
    Commented Oct 6, 2021 at 16:16
  • @Polynomial I tried with F12, no cookie seems related to arstechnica
    – usr-local-ΕΨΗΕΛΩΝ
    Commented Oct 7, 2021 at 8:16
  • I mean the cookie list in the browser settings, not devtools.
    – Polynomial
    Commented Oct 7, 2021 at 16:10
  • 3
    You probably have configured CAD to remove cookies after some timeout. So: visit Ars, navigate to Github, wait for some time, Ars cookie gets deleted. The site where you currently are and the domains mentioned in the popup don't have anything to do with each other. It could also be that CAD has some bug that prevents proper deletion, so that it retries regularly. E.g. there are sometimes reports that cookies get stuck.
    – amon
    Commented Oct 7, 2021 at 16:52

1 Answer 1

Reset to default
2

Arstechnica is a news site. Maybe one of your plugins or news feeds is using it to try and help entertain you but is leaving cookies behind on your machine.

You could try the HTTP debuggers like Fiddler to figure it out. Or you could go even more low level wireshark, but that gets messy.

Improve this answer
1
  • 1
    I don't use feeds. I double checked that my Firefox plugins (all I have listed) are at least open source, so I'll try to go for the bug, somewhere :-)
    – usr-local-ΕΨΗΕΛΩΝ
    Commented Oct 7, 2021 at 8:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .