I was listening to Pandora as I logged in here, and the next commercial was about InfoSec. That set me wondering as to whether that was a coincidence (probably) or if they knew somehow. To make a long story short, I was wondering whether a webpage could access cookies that it didn't put there (thus getting a rather accurate browsing history as well as information on the user). It seems to me that this should be (and probably is) defended against, but if it is, how? I can read cookies on my computer and at least see where they came from, so it doesn't seem that they are encrypted...
Yep this is defended against using the same origin policy, which generally prevents one site reading anothers cookies.
When you see behaviour where adverts seem to know where you've been it's likely due to 3rd party ad tracking cookies.
So as a simplified example if you go to site A which uses an ad network, that ad network can record that you were on that site by placing a tracking cookie on your PC.
Then when you go to Site B which uses the same ad network, the ad network reads the cookie that was set when you were on Site A (which it can do 'cause it's loading content from it's domains in both cases so it doesn't break same origin) and can then offer you adverts based on your browsing habits.
A properly designed browser will not allow a website to access another website's cookies, as this would violate the cross-domain policy and be a major security issue.
Unrelated websites can implement scripts which send information to a single ad tracking network, which can then serve up customized advertisements to these participating websites based on your reported activity.
Turning on "do not track" options aren't 100% reliable as "do not track" can only work if actively honored by the website receiving the "do not track" request. Cookies can be disabled or blocked, but there are still other simple ways ad networks can track your activity:
- Pages on unrelated sites can display an image file which resides on the ad network server. When your browser requests the image file, it will send your IP address and referral URL (the page on which the image is displayed) to the ad network server. The image URL could be enhanced with information parameters (generated by the page server). Fortunately, an Ad Blocker could block such an image.
- When your browser requests a web page, the page server could communicate directly with the ad network and share information such as your IP address and the content you requested. You can't block this form of tracking, but it can be potentially mitigated via the use of a VPN.
There could be a timing side-channel here. Supposed if a user is signed in he get a huge bunch of info, but if he signed out he gets a small sign in form. The throughput of internet channel is finite so the times user downloads the same page can he differrent depending on the content. JS allows to measure the time it takes elements to be loaded so it can be possible to determine if a user is signed in in some foreign uncooperative website. I haven't tested this idea and haven't even googled, but I know that the attack against hsts told last year on some conference uses timing side-channel.
I was wondering whether a webpage could access cookies that it didn't put there (thus getting a rather accurate browsing history as well as information on the user). It seems to me that this should be (and probably is) defended against, but if it is, how? I can read cookies on my computer and at least see where they came from, so it doesn't seem that they are encrypted...
You are correct, yes, you can read the cookies' contents, because it's your computer. But that doesn't mean that the browser will let any website read them. So, those are two different things. You may also have some personal files on your computer which YOU can read but a website can't.
You have an interesting question. Until now, I assumed that each web page has its own cookies. But that turns out to be false. The truth is each domain has its own cookies. At least that's how Firefox seems to work. So, if you have three pages on your website, they can access each others' cookies.
Cookies provide about 5KB of space for each domain to save data. It may be a little more or less. If a website needs to save a lot more data, then there is a new thing called localStorage. It works the same way as cookies, but it allows a website to save megabytes of data instead of just a couple of kilobytes. Again, as with cookies, the values in localStorage are shared across web pages within the same domain. So, if one page sets a value, another page can read that value within the SAME domain.