What does HackerNews think of evercookie?

Produces persistent, respawning "super" cookies in a browser, abusing over a dozen techniques. Its goal is to identify users after they've removed standard cookies and other privacy data such as Flash cookies (LSOs), HTML5 storage, SilverLight storage, and others.

Language: JavaScript

Using a date-modified header to detect unique visitors without using cookies | Nov 2022

This reminded me of something I haven't thought about in awhile: evercookie - https://github.com/samyk/evercookie

Firefox 85 Cracks Down on Supercookies | Jan 2021

Expand Context ↕

Evercookie is a Javascript project that produces respawning super cookies:

https://github.com/samyk/evercookie

It's quite dead now, stopped working around 2017: https://github.com/samyk/evercookie/issues/125

Show HN: Server-Side Tracking Without Cookies in Go | Jun 2020

Expand Context ↕

I first saw ETAG method on evercookie project. HTML5 Canvas is also a funny/smart technique that I saw there. https://github.com/samyk/evercookie

One of the purposes of the evercookie project was to have a collection of tracking methods that browser vendors can test against their implementation.

Private client-side-only PWAs are hard, but now Apple made them impossible | Mar 2020

This is really in response to the irresponsible use of APIs for trackers. Evercookie is a stunning example of how far it can go... From their repo:

- Standard HTTP Cookies - Flash Local Shared Objects - Silverlight Isolated Storage - CSS History Knocking - Storing cookies in HTTP ETags (Backend server required) - Storing cookies in Web cache (Backend server required) - HTTP Strict Transport Security (HSTS) Pinning (works in Incognito mode) - window.name caching - Internet Explorer userData storage - HTML5 Session Storage - HTML5 Local Storage - HTML5 Global Storage - HTML5 Database Storage via SQLite - HTML5 Canvas - Cookie values stored in RGB data of auto-generated, force-cached PNG images (Backend server required) - HTML5 IndexedDB - Java JNLP PersistenceService - Java exploit CVE-2013-0422 - Attempts to escape the applet sandbox and write cookie data directly to the user's hard drive.

https://github.com/samyk/evercookie

In short, everything and more can be used for tracking, and that has really killed the party for the many people who have created responsible, useful applications of these browser APIs.

ImmortalDB – A resilient key-value store for the browser | Jan 2019

Expand Context ↕

> what caused you to write this library?

On smaller devices, a few kb of important data in LocalStorage was periodically deleted without user intervention.

> do you believe it will be used for nefarious purposes?

If one is nefarious of heart, https://github.com/samyk/evercookie supersedes ImmortalDB.

ImmortalDB – A resilient key-value store for the browser | Jan 2019

Expand Context ↕

It's based on Evercookie https://github.com/samyk/evercookie which is a little less... friendly.

Show HN: IronDB – a resilient key-value store for the browser | Oct 2018

Expand Context ↕

> save all values everywhere: why not select the one that would last the longest (that people delete least often)?

For improved resiliency.

You can also configure IronDB to only use any two datastores of your choice, if you so desire: IronStorage's constructor takes an Array of storage implementations of your choice. See https://github.com/gruns/irondb#api.

> So you delete data when the user wants to delete data. Which database doesn't have this feature?

A database where the data therein can be deleted without warning. Browsers unceremoniously delete IndexedDB, LocalStorage, and SessionStorage under storage pressure. See https://developers.google.com/web/fundamentals/instant-and-o...

> doesn't use Flash, Silverlight, or Java -- which do?

Evercookie, a similar library, uses Flash, Silverlight, and/or Java.

See https://github.com/samyk/evercookie.

> No offence to the author but all this sound malicious. Perhaps this is why evercookie isn't maintained?

No offense taken.

Thank you for your feedback, kreetx. Don't hesitate to let me know if I can answer any other questions, or if there's anything else I can do for you.

Side-channel attacking browsers through CSS3 features | May 2018

This goes beyond just identification to actual data leakage, but ties into a larger point about GDPR and other regulations that we've been discussing ad nauseum here, which is questions like: "Why don't the GDPR regs just tell me what I need to do?"

The GDPR being deliberately vague is a response to issues like these, it serves neither the interests of the users or the regulation to say "Get consent before getting cookies and only cookies" only to have sites and services turn around and use methods like this, or:

BrowserFingerprinting - https://panopticlick.eff.org/

Super/Ever Cookies - https://github.com/samyk/evercookie

HSTS identification - https://www.owasp.org/index.php/HTTP_Strict_Transport_Securi...

or whatever the new sneaky identification via browser features hack happens to be.

HTTP Immutable Responses | Sep 2017

Expand Context ↕

It makes it another place that they can store the tracking cookie and have your browser give it back out to them. Deleting the cookies or other such things wouldn't remove the tracking ID as long as the browser continues to use the cached immutable resource. Similar to how this[1] works by using multiple storage methods.

https://github.com/samyk/evercookie

PoisonTap, a $5 tool that invades password-protected computers | Nov 2016

I didn't realize PoisonTap's creator, Samy, is also the creator of the Evercookie[0], a persistent identifying cookie that remains sharded(then recombines) in your system even after clearing your cookies. While a very cool project, it has some scary implications on users not trained in their removal.

[0] https://github.com/samyk/evercookie

Privacy Badger – Block spying ads and invisible trackers | Aug 2015

Expand Context ↕

What other tracking methods does Privacy Badger plan to block in future releases? One can always test against evercookie.[0] And perhaps EFF could host a trustable demo site, along the lines of Panopticlick. I do get that this is an arms race, and that proprietary methods may be running under the radar, as Verizon's UIDH did for two years.[1]

[0] https://github.com/samyk/evercookie/

[1] http://www.theregister.co.uk/2015/01/30/verizon_uidh_super_c...

Technical analysis of client identification mechanisms | Sep 2014

This is a good guide to some of the ways that evercookie uses to live on even after you've cleared cookies:

https://github.com/samyk/evercookie

Expand Context ↕

Random cookies probably wouldn't suffice. Evercookie[1] uses thirteen different storage mechanisms, making it almost impossible to delete.

[1] - https://github.com/samyk/evercookie