How can I prevent tracking by ETAGs?

Question

An ETAG is a HTTP header that is sent-behind-the-scenes between a web browser and an web server. This value is intended to control how long a particular file is cached on the client side.

There is an interesting side effect to this technology; ETAGs are saved on a machine even if cookies are deleted. Some people / software have exploited this fact to make an ETAG "act" like a cookie.

This means that simply deleting cookies isn't enough. One has to delete the entire web cache as well. That is a painful process to go through every time I surf the net on my test machine.

Question

What is the most reliable way to prevent tracking that occurs by ETAG headers?

Answer 1

I don’t know of any great solutions. I can suggest three possible defenses, though all of them have limitations:

• Privoxy. Privoxy can block ETag headers.

  In particular, you can use crunch-server-header or server-header-filter in your Privoxy configuration to block ETag: headers from the server. Also, you can use crunch-client-header or client-header-filter in your Privoxy configuration to block If-None-Match: and If-Modified-Since: headers from the client. However, I don’t know of any off-the-shelf formula you can just grab and use: you’d have to build your own Privoxy configuration yourself.

• Your browser. If you use Firefox, you can configure Firefox to clear your cache each time you exit the browser. This may be bad for performance. Also, with this approach, ETags can still be used to track you within any one browser session, so it is not perfect, but it should clear any ETag cookie when you quit your browser.

• RequestPolicy. If you use Firefox, you could use the RequestPolicy extension. One writer has pointed out that RequestPolicy may help defend against ETag tracking. Often, web sites track you by including resources from third-party advertisers or analytics providers. RequestPolicy lets you control what third-party resources your browser will request, when visiting a web page, and thus can let you protect yourself against that kind of tracking: if your browser never loads the third-party advertiser’s resource, then the third-party advertiser doesn’t have a chance to track you (using an ETag or any other mechanism). This defense is less than ideal, because it requires you to laboriously assemble your policy, and because web sites can still track you directly if they don’t rely upon any third-party resources.

Unfortunately, if you access the web through a transparent proxy, the presence of the proxy may complicate your attempts to avoid being tracked.

Answer 2

In addition to the more involved solutions proposed by @D.W., you can consider using your browser's private browsing mode, ala InPrivate (IE), PrivateBrowsing (FF), Incognito (Chrome), etc.
The main thing here is that the browser cache is not used (or at least, not used beyond the length of the private session). As such the Etag is not saved by your browser.

There are still some drawbacks to this approach, such as tracking within the session, and proxies as @D.W. mentioned. That said, it is pretty simple to use.

Answer 3

If you're using Firefox, you might be interested in an (optional) feature of my SecretAgent add on... which creates spoof ETag headers to suppress tracking.

The downside is that spoofing ETags will obviously impair caching on those sites which use ETags to optimise traffic (though this seems to have very minor impact on performance).

See www.secretagent.org.uk.

  (Disclaimer: I am the author of SecretAgent).

Answer 4

update: wrote the answer differently and more clearly

I have a solution which works without modifying the current HTTP protocol. I'd love to see an implementation of this.

Instead of telling the server our Etag we ASK the server about its Etag, and we compare it to the one we already have.

Pseudo code:

If (file_not_in_cache)
{
    page=http_get_request();     
    page.display();
    page.put_in_cache();
}
else
{
    page=load_from_cache();
    client_etag=page.extract_etag();
    server_etag=http_HEAD_request().extract_etag();

    //Instead of saying "my etag is xyz",
    //the client says: what is YOUR etag, server?"

    if (server_etag==client_etag)
    {
        page.display();
    }
    else
    {
        page.remove_from_cache();
        page=http_get_request();     
        page.display();
        page.put_in_cache();
    }
}

HTTP conversation example with solution 1:

Client:

HEAD /posts/46328
host: security.stackexchange.com

Server:

HTTP/1.1 200 OK
Date: Mon, 23 May 2005 22:38:34 GMT
Server: Apache/1.3.3.7 (Unix) (Red-Hat/Linux)
Last-Modified: Wed, 08 Jan 2003 23:11:55 GMT
ETag: "ABCDE"
Content-Type: text/html
Content-Length: 131

Case 1, Client has an identical etag:

Connection closes, client loads page from cache.

Case 2, client has a mismatching etag:

GET...... //and a normal http conversation begins.

Edit: It is worth noting that there is a minor overhead, the server has to send the HTTP header twice: Once in response to the HEAD, and once in response to the GET. One theoretical workaround for this is modifying the HTTP protocol and adding a new method which requests header-less content. Then the client would request the HEAD only, and then the content only, if the etags mismatch.

Edit 2: I've followed makerofthings7's advice and posted this as a question on stackoverflow.

Answer 5

A future solution could be a browser preference that disables etags.

For Mozilla the issue is discussed in: ETag: filtering to counter web tracking.

Answer 6

Some technical details and a proof of concept demo of ETag tracking: http://ochronus.com/tracking-without-cookies/