I know about HTTP cookies, flash cookies, ETag when dealing with user tracking on the web.
Are there other technologies, known or less known?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Less known are:
The most reliable method i can think of (except cookies) is in fact abusing the HSTS header.
The problem with this approach is you require a valid (not self signed) certificate for n (sub)-domains (or a wildcard cert) to save a number up to 2**n.
I do not know if this technique is used today, but I'd guess it is not.
Here is a POC using HSTS for tracking purposes. (Disclaimer: my code)
Last-Modifiedheader can be used for tracking.
HTTP is a stateless protocol, cookies are used to offer persistence. While a same cookie will be used for a specific website, a different cookie will be generated for a different website.
At an higher level (ISP, corporations, government) your Public IP address + login to web services (Dropbox, Gmail, Office 365, Evernote) using your credentials + web analytics --including cookies, http headers (user agent, referrer) would allow anyone with access this data to monitor your activity.