1

I was exploring how websites track users with how paywalls are implemented. WSJ.com has the best ways to detect users who have read content (which I am unable to figure out how they have done it).

The standard mechanisms known to track users (to put up a paywall) is with

  1. Request Parameters (including Referral headers)
  2. Cookies / LocalStorage / File Storage
  3. Private Browsing or Different browser (kind of related to cookies)
  4. ETag headers (lesser known way of tracking users)
  5. IP addresses
  6. WebRTC / Service Workers (that run in the background)
  7. SSL Certificate caching related (read an article, was not clear how its done)
  8. FingerPrinting the Browser sent information

Regarding wsj.com, the page loads tons of javascript from nearly 10s of domains. Their SSL certificate is shared by 10s of websites (this could be because they use Akamai to serve content)

I am concerned how a website is tracking me across browsers even though I have (almost) a clean slate

2

If I had to implement a paywall, I'd probably go with a combination of the methods you mention.

For example, cookies will work just fine for many users, and it's efficient, so that would be the first "line of defense": If I got a cookie back from a customer, I'd use that to allow or deny entry.

If I didn't get a cookie back, I might employ ETags, and if that didn't work either, I'd fall back to Browser Fingerprinting in combination with fuzzy source IP address matching.

Browser fingerprinting is very effective (see EFF's Panopticlick for a demo) when javascript is enabled. It will yield false positives, but if you combine it with a look at the ip address block someone's connection comes from, it will be very accurate. We have a lot of computers based on an installation image at work, so you'd assume they have the same browser fingerprint - but after a few weeks of use, I did a cursory check and several fingerprints had changed. I'm not sure why. Maybe it was due to having installed additional software, which installed additional fonts on the machine.

I'd do it in this order because cookies are the standard way to do it, etags are somewhat sneaky, and fingerprinting last, because I may make false decisions with fingerprinting which impact innocent customers. Still, it would be easy to allow innocent victims access -- if I locked someone out, I'd just display a message that if they believed the message to be in error, they should accept cookies from my domain in the future.

You can find out how WSJ does it by forbidding all cookies - if WSJ still identifies you, it's not doing it solely with cookies. Do the same for local storage. Then you install a plugin which lets you block ETag-related headers, and see if they still identify you. If they do, disable Javascript. If that doesn't help, play with changing the values of various other headers, such as the Accept header, and so on.

  • I have did it upto disabling cache (not sure if it will disable ETag related headers). Disabling javascript is not working. The response only has the snippet. Will have to try with the Accept header and changing fonts etc., My IP address changed across blocks, but was within the same ISP though. – Sairam Mar 2 '17 at 11:11
  • This may not be the right forum, Would it feasible to make a Chrome plugin to randomize Fingerprints which the browser is exposing? – Sairam Mar 2 '17 at 11:14
  • There are solutions such as privoxy which help. That said, consider that paywalls are there for a reason. Good journalism costs money, and I think we should't expect it to be free. If you torpedo the effectiveness of paywalls, you push publishers into questionable directions, such as having them make you their product and selling information about your interests, usage patterns etc. This impacts all our privacy. – Out of Band Mar 2 '17 at 12:08
  • I agree. I am majorly curious on how stuff works from the technology side. – Sairam Mar 2 '17 at 12:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.