0

What piece of information can websites retrieve that would allow for later identification without cookies?

Intro Out of interest I jumped into the rabbit hole of online marketing scams. The site I visited* used a system called Proof** to show 'conversions' (cq. signups) to visitors and I was curious if this system could be fooled, since the traffic I witnessed seemed way too high.

Case The Proof homepage made an assumption about my identity even though I visited all these sites whilst in incognito mode. The assumption was pretty accurate: it assumed my identity was the company someone I share my WiFi with works for. Both on desktop as on mobile it printed:

Easily personalize COMPANYNAME website for every visitor.

It even came up with the correct domain name, COMPANYNAME.DOMAIN
It did however fail on Tor, and printed the generic message:

Easily personalize your website for every visitor.

Question How could this site that I've never visited assume my identity almost correctly whilst without cookies?

  1. I am aware of the possibility that this site gathers data through many other (junk) sites about things like browser use, screen size, device use, and location. However, this information alone is very generic (chrome, desktop) to make a prediction. In addition, I live in a densely populated area and this company does not the biggest employer of the area.
  2. This prediction was just a lucky shot.

What piece of information can websites track that would allow for identification without cookies?

Thanks for reading!

*https://www.bolmasterclass.nl/
**http://useproof.com/

EDIT: It was not my purpose to hide my identity, I am just curious on what data they could make this estimation. The incognito part is just interesting because it doesn't allow for cookie-based predictions.

Everyone's pointing at IP, so I believe my misconception (through sites like IP-lookup & rDNS that are 100 miles off) was that IP was not that specific.

Improve this question
10
  • 4
    The "piece of information" is simply the IP you came from. If your mate also browsed from your wifi network and signed up for something that Proof could track (through cookies used in the past), then that's an easy thing to correlate.
    – schroeder ♦
    Jan 21, 2020 at 22:56
  • 1
    This Q&A is relevant: security.stackexchange.com/questions/154382/…
    – schroeder ♦
    Jan 21, 2020 at 23:00
  • 1
    It may also be worth checking your reverse DNS name, depending on your ISP this might be customer-specific
    – jrtapsell
    Jan 21, 2020 at 23:25
  • 3
    @M.G.Poirot - While there might be millions of people in the geographic region, the number of people using that specific IP address is approximately One.
    – user10216038
    Jan 21, 2020 at 23:40
  • 1
    @M.G.Poirot which is in a way what you did when you used Tor
    – schroeder ♦
    Jan 22, 2020 at 7:30

1 Answer 1

Reset to default
1

Your IP address might be the reason of this scenario.

Despite your browser history remaining hidden, incognito mode does not improve your security in any other way, if you accept cookies for example, cookies will be stored on your computer and with those you can gather up a lot of information.

Incognito mode is not a complex security feature.

Incognito mode will NOT store your browsing history, but it will not protect your identity.

If you wish to keep your identity or increase your privacy try using duckduckgo browser

Improve this answer
4
  • Thanks for the quick reaction. There'd be over millions of people withing the area that could be assumed using my IP according to the accuracy I ascertained at sites like www.iplocation.net, I thought IP addresses weren't that specific?
    – M.G.Poirot
    Jan 21, 2020 at 23:18
  • Put your IP address here "ipstack.com" if it's close of your real location reply back and share your thoughts :)
    – IceeFrog
    Jan 21, 2020 at 23:30
  • Thanks for the link, but sadly, still 100 miles off! There's over 10M people in this radius so it still doesn't explain such an accurate prediction.
    – M.G.Poirot
    Jan 21, 2020 at 23:35
  • : it assumed my identity was the company someone I share my WiFi I can assume that company has a domain registered on the same IP address, therefor this is expected
    – IceeFrog
    Jan 21, 2020 at 23:46

Not the answer you're looking for? Browse other questions tagged .