4

I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies),

I was wondering does other plugins like Silverlight and Java have this problem?

Effectively, the question is:

When I use Incognito, what technologies will allow webpages to escape this incognito cage ?

Improve this question
2
  • If the provider could save the same state with a unique server side cookie would the be less of a concern? I'm thinking about the high probability your browser is itself unique (panopticlick.eff.org) or you have authenticated.
    – zedman9991
    Commented Oct 18, 2011 at 15:15
  • What security issue are you interested in: confidentiality (privacy), integrity (using state to exploit a vulnerability, or some other issue related to protecting some asset?
    – this.josh
    Commented Oct 19, 2011 at 6:44

4 Answers 4

Reset to default
4

Actually, depending on the browser and plugins used, there are many ways for a website to store persistent information on users' computer. It's not cookies and cache anymore. Some of these new methods require user confirmation, some don't - it also varies by browser. Flash has Local Shared Objects, Silverlight has Isolated Storage, HTML5 itself gives Offline Application cache, Session Storage and Local Storage.

It's not easy to clean them all at once. In fact, there is a proof-of-concept project that uses all those tricky ways and many others to create a super-persistent-and-resurecting-cookie - Evercookie. Of course, there is also an Evercookie killer called Nevercookie.

Improve this answer
2
  • So who's the Nevercookie killer?
    – Pacerier
    Commented Oct 20, 2011 at 7:38
  • @Pacerier If only one client uses the same IP, you could use that to resurrect cookie. Of course, it isn't very efficient for Internet connexions with frequently changing IP.
    – curiousguy
    Commented Nov 7, 2011 at 21:12
4

You are right. There are really many ways for a website to store persistent data on you, even if you dont want them too. Evercookie by Samy Kamkar is an example of this.

Quotede from the site of Evercookie it stores persistent data on you with the help of these storage mechanisms:

  • Standard HTTP Cookies
  • Local Shared Objects (Flash Cookies)
  • Silverlight Isolated Storage
  • Storing cookies in RGB values of auto-generated, force-cached
  • PNGs using HTML5 Canvas tag to read pixels (cookies) back out
  • Storing cookies in Web History
  • Storing cookies in HTTP ETags
  • Storing cookies in Web cache
  • window.name caching
  • Internet Explorer userData storage
  • HTML5 Session Storage
  • HTML5 Local Storage
  • HTML5 Global Storage
  • HTML5 Database Storage via SQLite
Improve this answer
12
  • But incognito will basically defeat everything other than the the 2nd and 3rd point right?
    – Pacerier
    Commented Oct 20, 2011 at 7:46
  • @Pacerier, Chromes incognito window defeats all the points in the list :)
    – Chris Dale
    Commented Oct 20, 2011 at 12:25
  • What about Tor Browser?
    – Pacerier
    Commented Oct 22, 2011 at 16:40
  • @Pacerier, Tor Browser also safe. Once you restart it it does not manage to refind the evercookies.
    – Chris Dale
    Commented Oct 22, 2011 at 19:10
  • 1
    @Pacerier "Vidala Control Panel's "use new identity" is only about Tor exit point. Tor does not know or care about HTTP cookies, HTTP ETags, HTML5 Session Storage, Flash super cookies...
    – curiousguy
    Commented Nov 7, 2011 at 21:09
3

Since 6u10 Java applets have been able to store "muffins" (effectively cookies) using java.jnlp.PersistenceService.

Also from the same release, Java applets can also open files through FileOpenService, FileSaveService and ExtendedService.

Improve this answer
2
  • Are muffins built on top of cookies? In other words do muffins stay after I have cleared my cookies?
    – Pacerier
    Commented Oct 20, 2011 at 7:40
  • Muffins are an entirely separate bit similar mechanism. You don't even need a browser installed to use them with Java WebStart applications.
    – Tom Hawtin - tackline
    Commented Oct 20, 2011 at 17:19
3

Silverlight can actually access the local filesystem, depending on the permissions granted. It is subject to .NET security mechanisms, but if these are badly configured, it is possible to read a user's files, or even change them.

Improve this answer
3
  • holy, so basically if I surf with Silverlight enabled, just visiting a site could invite a virus in?
    – Pacerier
    Commented Oct 20, 2011 at 7:47
  • Yes, it could, but not just like that - you'd have to grant silverlight permission to write to 'interesting' locations, which it is not normally allowed to. The .NET security model is quite complicated, but it does make sense - silverlight plugins in the internet zone are mostly untrusted and will only be granted very limited access to system resources, so they can't just modify any registry key or dump dlls in windows\system32 or anything.
    – tdammers
    Commented Oct 20, 2011 at 19:59
  • but they could install "programs" into my computer which if I unknowingly "run as administrator" that's all it takes to destroy my computer?
    – Pacerier
    Commented Oct 22, 2011 at 16:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .