3

Definition of supercookie from the paper I am reading:

"Supercookies settle in parts of the system that are harder to erase, and include the usage of Flash Local Shared Objects and IE Local Storage"

With that said, I would like to emphasize that I am not intersted in ISP created cookies.

  • How can I know if a website gave me a super cookie? Is there a guide line to follow?

  • How does this cookie report back to the website? (Would I see it if I inspect HTTP headers?)

  • Where it is stored? (I would like to see what it looks "inside".)

  • How can I delete it(if possible)?

I came here because most of the websites found when searching for "super cookie" are of type qz, theverge, wikipedia barely mentions them, with large target audience. Therefore they omit details to satisfy a larger group of people. They entertain, not educate. I didn't mean to offend anyone with a straightforward question.

|improve this question
  • 3
    Define "supercookie". There are several versions, and you cannot ask us to list all of them and explain. Maybe you can do some research first? – user13695 May 5 '16 at 9:47
  • 1
    Also, most cookies just contain an identifier of some kind, referencing a record kept on the server somewhere - there isn't usually a lot to look at... – Matthew May 5 '16 at 10:11
  • I editem my question. – sanjihan May 5 '16 at 10:33
  • I think the term "supercookie" means "some way to track your browser other than a traditional cookie". So your question basically boils down to "How can I avoid being tracked over the internet?" which is WAAYYY too broad to answer (and certainly not a straightforward question). – Mike Ounsworth May 5 '16 at 11:15
3

The idea of a super cookie is that you cannot easily delete it. It consists of replicas of the information on multiple places and if you delete some of these the information will be restored from the remaining places. Some possible places are:

  • Simple cookies. These can usually be easily deleted. But one can make it harder if multiple sites cooperate so that the user does not know which cookies are relevant.
  • Flash cookies, Silverlight cookies etc. Depending on the browser and OS super cookies might spread between browser profiles or even different browser types this way and maybe also between normal and private mode of the browser.
  • HTML5 local storage.
  • Caching information, for example by misusing Etag and/or Last-Modified headers. Caching is an essential part of a good browsing experience but these information can also be used to track you and restore the super cookie.
  • ...

For a way more detailed and still not exhaustive list see Technical analysis of client identification mechanisms.

Based on how super cookies work the answer to your questions will probably be unpleasant:

How can I know if a website gave me a super cookie? Is there a guide line to follow?

There is no general guide since there are many different ways a super cookie could work. If you are curious about a specific site you might start with a freshly installed system (i.e. all plugins, cookies, cached data ... in initial state), visit the site and then do an analysis of the system what changed. I'm not aware of any tools which make a snapshot of all the ways information might hide and give you the difference between before and after visiting the site. And even then you would not know if the cached information are only used for speeding up access or also used for a super cookie.

How does this cookie report back to the website? (Would I see it if I inspect HTTP headers?)

Also lots of ways and with some of these (like use of caching information) it is not even clear if they are used for tracking or not.

Where it is stored? (I would like to see what it looks "inside".)

In lots of different places on your system, depending on the mechanisms used. This means that there is no single place you can look for the cookie.

How can I delete it(if possible)?

This depends on the mechanism used which you usually don't know. The best would probably be to use a virtual machine with a browser and reset the machine to its initial state after each browsing session. You might also try with private/incognito surf mode or fresh browser profiles but some plugins might still be used to share information in this case.

|improve this answer
  • Thank you, kind sir! I investigated mechanisms you provided which lead to even more questions :D First of all, do the cookies have access to any other folder than the browser's main folder?. On Mac, all Google Chrome information is stored inside /Aplications/Google Chrome. I guess that cookies can't be any other place, right? Secondly, caching information looks like it can be disabled in Google Chrome. Does that keep away the cookies that exploit cache? About HTML5 Local Storage, Chrome has a Local Storage folder, deleting it's content would presumably clear HTML5 Storage. – sanjihan May 5 '16 at 12:44
  • Oh and, do flash cookies need to have Flash enabled? – sanjihan May 5 '16 at 12:45
  • 3
    @sanjihan: of course you need Flash enabled for Flash cookies. Completely disabling caching seriously degrades the browsing experience and closes only a single vector. And while most of the data are stored in the browsers profile folder Silverlight stores its data per user and not per browser/profile according to the link I've provided. And like I said there are lots of other possibilities (how about TLS session tokens) so it makes not sense to focus only on few - if you really want to get rid of such cookies use a VM for the browser and reset it after each browsing session. – Steffen Ullrich May 5 '16 at 14:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.