4

I know about HTTP cookies, flash cookies, ETag when dealing with user tracking on the web.

Are there other technologies, known or less known?

Thanks.

Improve this question
2

4 Answers 4

Reset to default
8

Less known are:

  • Using Verizons supercookie: Verizon adds an HTTP-header in every HTTP-request with an unique ID for each customer even after they changed their IP-address, cleared their cookies,...
  • using "Cookie Matching": You are tracked by tracker A and B. You delete the cookies of A. B manages to identify you (via cookie, ETag, ...) and inserts a tracking pixel loaded from A containing your ID so that A identifies you sets the cookie etc. again. A redirects the pixel to B containing his ID so they can later do it again. A Cookie Matching exchang network often exists of more than 100 different trackers.
  • Using user login: Many users stay logged in in facebook while they surf and even logging out doesnt delete the cookie. Facebook like buttons are on nearly every page. Combine it with Cookie Matching and you get very far. Same for google account/"double click" (default login on Chrome browser and on Android)
  • HTML5 local storage: javascript can store and retrieve data on client in the HTML5 local storage. Similar to cookies, but not sent with every request by default. It is not deleted when a user only deletes cookies. http://www.w3schools.com/html/html5_webstorage.asp
Improve this answer
2
4

There is a bunch of different ways to store data local via javascript (local storage/indexeddb,...) and also some nasty other ways like abusing the HSTS (HTTP Strict Transport Security) header.
In general there are many ways to create some reliable fingerprint but almost all (more) reliable ways require javascript to be activated.

HSTS
The most reliable method i can think of (except cookies) is in fact abusing the HSTS header.
The problem with this approach is you require a valid (not self signed) certificate for n (sub)-domains (or a wildcard cert) to save a number up to 2**n.
This method doesn't require javascript to be active, but might get disarmed if the user is using browser extension like uMatrix or RequestPolicy which only allows loading of data from other domains if they are whitelisted.
I do not know if this technique is used today, but I'd guess it is not.
Here is a POC using HSTS for tracking purposes. (Disclaimer: my code)

See some different "advanced/experimental" techniques here:
https://github.com/samyk/evercookie
Example with most tests here

Improve this answer
1
  • Similar to Etag, the Last-Modified header can be used for tracking.
  • The HTML canvas element can be used to fingerprint a computer.
  • JavaScript can be used for all kinds of tracking. E.g. identify a user by fingerprinting the average discharge rate of their battery (requires Firefox).

For a good list of tracking "ideas", have a look at the EFF's Panopticlick. It list some interesting sources of identifying information, like checking for system fonts, screen dimensions, and time zone. Most of those require JavaScript.

Improve this answer
1

HTTP is a stateless protocol, cookies are used to offer persistence. While a same cookie will be used for a specific website, a different cookie will be generated for a different website.

At an higher level (ISP, corporations, government) your Public IP address + login to web services (Dropbox, Gmail, Office 365, Evernote) using your credentials + web analytics --including cookies, http headers (user agent, referrer) would allow anyone with access this data to monitor your activity.

Improve this answer
2
  • This is not what I asked for, Florian
    – Andy K
    Dec 14, 2015 at 3:52
  • Fair enough, my answer included elements such as ISP tracking, logins, cookies, and http headers but the accepted answer is much more specific.
    – Florian Bidabé
    Dec 14, 2015 at 4:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.