How to find out whether an ISP adds a perma-cookie to my requests?

Question

I am interested in finding out whether my (or any) current ISP (Internet Service Provider) uses a technology known as "perma-cookie" oder "sticky cookie" when I am browsing the internet.

This consists of inserting a special HTTP header into every HTTP Request sent via their network. It would allow the visited site to uniquely identify a user (household/ISP customer) and, with the help from the ISP, get specific personal information about that user.

Verizon and AT&T in the US are currently known for doing this, according to the following articles:

• Security Now! Podcast #479, show notes
• Post by the WIRED magazine
• Test page by @kennwhite

I am not located in the US, so this specific case does not apply to me. However, how can I find out whether my (or any) ISP is using such cookies? Are there any other (international) test pages?

Note: I am not talking about the evercookie.

Note2: If any of the mods thinks this is off-topic because of the request of (off-site) test pages, feel free to remove that part and this note. I am mostly interested in how to find out generally.

Answer 1

Send a request to a server you control and see it it was altered in transit; you may also use a online service like HTTPBin, it's designed to test HTTP client libraries and has pages that return the exact request content, so you'll see if additional cookies were added.

Note that ISPs can be sneaky about this and only add the cookies in requests to their partner's websites, in this case I don't see an easy way to detect this without getting access to their partner's servers, but a reliable way of mitigating this would be to use HTTPS which prevents MITM attacks like the one you describe.

For HTTP sites you'll need to pass your traffic through an encrypted (IPSec ?) tunnel to a server behind a reliable and respectful ISP.

Answer 2

To address user42178's point in his answer:

Note that ISPs can be sneaky about this and only add the cookies in requests to their partner's websites, in this case I don't see an easy way to detect this without getting access to their partner's servers

You could try to use legal methods where IT methods fail. In the UK there is the Data Protection Act, which has similar versions throughout the EU.

Under the Data Protection Act, you may make a Subject Access Request to any organisation that holds data about you. They may charge you a maximum of £10 for the request and must respond within 40 days. A "perma-cookie" as you described would almost certainly fall within this law as it personally identifies you. You could likely send such requests to both the ISP and the company hosting the server, provided they are within the jurisdiction of the EU.

Note that the data stored in the cookie does not itself have to be capable of personally identifying you in order for you to be able to request it. It is sufficient that it be linked to your name via other data. For example, if they can link the cookie to your IP address (likely), and have a record of which customer they have allocated an IP address to (almost certain), then the cookie is personal data and you have the right to request it.

From the ICO's "Determining what is personal data" booklet:

1 Identifiability

Can a living individual be identified from the data, or, from the data and other information in the possession of, or l ikely to come into the possession of, the data controller?