10

There is a Javascript library called Evercookie designed to track the user. It writes cookie information into every possible location:

  • Standard HTTP cookies
  • local shared objects (Flash cookies)
  • Silverlight Isolated Storage
  • Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out --- pretty clever idea
  • Storing cookies in Web history
  • Storing cookies in HTTP ETags
  • Storing cookies in Web cache
  • window.name caching
  • Internet Explorer userData storage
  • HTML5 Session Web storage
  • HTML5 Local Web storage
  • HTML5 Global Storage
  • HTML5 Web SQL Database via SQLite

Is it possible to block this for all the sites except those I trust? For now the only robust way I see is to turn off javascript and cookies completely.

I am using squid HTTP proxy, can it do at least part of the job?

Improve this question
4
  • A radical method which would prevent all that (and more) would be to set up a virtual machine with a web browser, create a snapshot, and restore that snapshot after every session. But the question is if that's a convenient solution.
    – Philipp
    Apr 8, 2017 at 22:27
  • UMatrix extension makes it easy to manage JavaScript and cookies so that solution is viable.
    – Tanath
    Apr 15, 2017 at 13:35
  • @Tanath Interesting, but squid can do the same.
    – user4035
    Apr 15, 2017 at 15:37
  • Not as easily. And with default deny it should block all of those.
    – Tanath
    Apr 15, 2017 at 15:40

1 Answer 1

Reset to default
7

Blocking access to this specific library can be done with the acl mechanism in squid if you know the full URL of the library or a relevant part of the path which should of course match only against this library and not against innocent files.

If the URL is not known you can try to do content analysis using the ICAP or eCAP interface of squid. But note that the evercookie Javascript library is only an example how such a cookies could be created and while somebody could use the original library he could also modify the library to change typical variable names or just use the ideas of the library in his own library or even interweave the functionality with other code so that the whole web site fails if you try to block the evercookie. This means the chances are high that even content analysis will not result in a sure blocking of the library. Depending on how you match you might even block innocent data (i.e. false positives).

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .