1

I, user ABC, have an account on some financial website example.com. I have logged in from my browser many times before so cookies were saved. Each time I would log off after I finish browsing that website.

The next time I arrive at the page, I am at the log-in page again. Now if I do not log in and simply browse around that website, does that website know that the user ABC has been poking around on the website without logging in, based on cookies?

I ask this because I use proxies to log into the website. Sometimes I use a U.S. proxy, another time a Singapore proxy, etc. However recently this site begins to "flag" non-US IP addresses. Log-in from non-US addresses will raise additional security questions, and activities inside the site, like money transfers, are restricted.

So if I stick to logging in to this site using US proxy, I think I should be fine. But what if from the same browser and cookies, I browse around this website WITHOUT proxy and WITHOUT logging in. Can this website flag my account based on cookies?

2

... does that website know that the user ABC has been poking around on the website without logging in, based on cookies?

Cookies and other client-side stored information (i.e. cached pages, cached redirects, local storage ...) can be easily used to track a user over multiple visits, no matter if the user is logged in or not. If the user was logged in once these information than can also be associated with a specific user, so that it is possible to track future visits of this user even after logout. This does not mean that this is done though, but it is technically possible without the user being aware of it.

.... WITHOUT proxy and WITHOUT logging in ... Can this website flag my account based on cookies?

These information are stored locally at the client and are only associated with the target site. They are not associated with a specific way to access the target site, i.e. it also does not matter if a proxy or VPN is used or not or if the user is changing its location, changing the ISP etc. Thus the user can be tracked as long as the same browser on the same computer is used, independent from additional proxies, VPN etc.

5
  • Thanks so if I have 2 sessions on this site from the same browser with same cookies: Session 1: VPN with US IP address, not logged in Session 2: VPN with Singapore IP address, not logged in Then technically, the website can see that the same user was using US and Singapore IP addresses separately, right? So if a website is designed to flag people using multi-national IP addresses, they can surely see this behavior? So if I want to avoid that from happening, I should VPN using incognito mode right? That way there is no cookies and the site treats me as an unknown visitor.
    – Lun
    Dec 14 '20 at 6:14
  • @Lun: There are no separate sessions needed to detect that the user is using different VPN. The server sees the source-IP of the traffic, which is the endpoint of the VPN. Note that there are also some tracking which works even if incognito mode is used, for example when based on browser fingerprinting. It is not that reliable and granular though but your are definitely not fully anonymous. Dec 14 '20 at 6:25
  • It may be worth noting that sites usually won't associate unauthenticated sessions with an account they know has used that PC, though... because they have no way to know whether it was you poking around without logging in, or a friend or family member using your device; connecting the bits of data just adds uncertainty to the tracking, which is the last thing you want in your data.
    – Delioth
    Dec 14 '20 at 15:34
  • @Delioth: "... uncertainty to the tracking, which is the last thing you want in your data." - this depends on the actual use case. For targeted advertisement or recommendations uncertainty is not so much a problem. For making security decisions uncertainty can be a big problem though. Dec 14 '20 at 15:55
  • @Delioth yeah, I wouldn't jump to conclusions there. It is going to vary depending on the website and their own needs. If they are trying to meet financial regulations then they may be excessively cautious and would rather accidentally block a possibly legitimate user (and deal with the customer service complaints) then accidentally allow a transaction that violates rules and have to deal with the legal ramifications. The OP was asking about technical capabilities, so I think it is better to stick to that here. Dec 16 '20 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.