Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
as explained here and lots of other cases , what is this tracking story ? browser vendors say we have same origin policy and for example google.com can only read cookies saved by google.com or read cookies that saved by google.com, if its true so how this tracking by google and advertising companies and other agencies works ?
Edit: please describe an example (java html etc) code to do a tracking
The contents of a Web page do not necessarily come from a single server. Web page from www.example.com contains a link <img src="http://ad.server.elsewhere.com/this-is-from-www-example-com"> which your browser will dutifully follow. That secondary server stores a cookie in your browser stating "I have been through www.example.com".
Later, you visit www.sample.org which contains a link <img src="http://ad.server.elsewhere.com/this-is-from-www-sample-org">. Your browser also follows that link, and since it is for the same server than previously (ad.server.elsewhere.com), the browser sends the previously stored cookie. Boom ! You've been tracked.
Happens every day. Happens right now. Happy Web surfing !
Cookie tracking isn't really so much a "threat" as it is a privacy concern. Cookie tracking is generally done with full permission of the sites that you are being tracked across. The contents of a webpage can come from multiple websites as Tom indicated. In order to generate revenue or to gather analytic information about their visitors, the site you are visiting has agreed to put a link to a third party tracker's server. Your browser follows this link and supplies the tracking cookie to the company that does the analytics or advertising. Since the link is specific to the site you are coming from, the tracking service also knows where you were visiting.
If you want to see cookie tracking in action, try the Collusion plugin for Firefox. Here's a morning's browsing through sites like slashdot, a few security vendors and security stackexchange. See how they have indirect links.
