Beware the cookie monster
A virulently persistent form of user tracking has cropped up in the virtual wilderness
By G.F. | SEATTLE
NO FEELING makes chills run more feverishly up and down a spine than the sense that its owner is being watched. People whose spines tingle a bit too often are typically branded as paranoid. Go on the web, however, and your spine ought reasonably to go into crisis mode. Internet users are indeed being tracked all the time. And shaking off a virtual tail can be tough.
The reason is a tiny chunk of text called a cookie. It is inserted by websites into a browser to help them identify a user as he loads pages in succession, or returns on subsequent visits. They come with an expiration date, which can be minutes or years ahead, after which the browser deletes them.
Cookies are a staple on sites which require users to log in, allowing for a continuous session after a single authentication. They may also be used to store preferences without an account, such as text-viewing size. Millions of sites use cookies for analytics; they permit a user's page requests to be divided into sessions and then aggregated into visitor counts and other metrics that tell a site's owners what people are reading, where they come from and how they move about. Cookies have a more directly commercial purpose, too. They are used to track behaviour, and so target advertising. Cookies let marketers pinpoint the sorts of offers likely to attract a particular user. That lets sites demand higher fees for virtual hoardings.
Last October Babbage described the evercookie, a practical experiment by a programmer to demonstrate how persistent tracking codes might be embedded in a browser to follow users around, even when they made every effort to delete such tracking elements. The evercookie, designed by Samy Kamkar, used a grab bag of techniques to tuck away a unique identifier in non-obvious spots in a browser's cache, and packaged them together into a single chunk of programming code. To get rid of the evercookie, a user would have to delete the tag from every nook it was hiding in. Leaving even a single one would lead to the tag being multiplied and restored, or respawned, in the browser's cookie jar.
Recently, a group of researchers released a report describing commercial use of two previously unseen types of tracking components, and the persistent use of an older technique. All three approaches enable indelible tracking. Worse, one of the methods follows a user even through a privacy mode where all pages, actions and caches are ostensibly deleted at the end of a browser session. Privacy modes are used on shared computers in libraries or hotels to prevent divulging previous users' private information, as well as for more lurid online activity which users would rather others (like parents or spouses) did not find out about.
In 2009 the same group revealed that Adobe's Flash multimedia plug-in could store identifiers independently of the browser and that many websites would reinsert—or, more colourfully, respawn—a deleted browser cookie by consulting the Flash cache. Their new report examines these techniques. More cheerily, it also notes a substantial reduction in privacy-invading behaviour by the 100 most frequently visited websites. Ashkan Soltani, one of its authors, has just posted more extensive technical details to back up the report's conclusions.
Flash storage of cookies persists, the report shows, but respawning has all but disappeared. Of Quantcast's top 100 sites, it was only found on the sites of Fox News and Hulu. That is an improvement from the six discovered by researchers in 2009; dozens more major portals outside the top 100 used the same third-party tracking firm. (Unrelated to this report, a researcher at Stanford said a few days ago that Microsoft's MSN.com portal was also respawning cookies; Microsoft immediately disabled what it said was outdated code.)
Hulu got the most flak. One of its ruses employed the ETag, a randomly generated snippet of code assigned by a web server uniquely to each item, like a file, it sends to a browser. Whenever the item is modified on the server—as when the text on a page is updated or an image replaced—its ETag changes. When a user requests the item from the server, the browser can send the ETag stored in its cache back to the server to see whether it matches the latest iteration. If it does, the requested item has not changed since the last time it was retrieved. The browser can then load the unchanged item directly from the cache without needing to download it again. This saves the user time and bandwidth. Every user should receive the same ETag for each item on a page, too.
In Hulu's case, however, ETags were tinkered with. Instead of each user receiving a generic ETag, one object on a web page—a single icon, say—had an ETag that was in fact just the the user's unique browser cookie in disguise. As a result, the browser would, on visiting Hulu's site, send the doctored ETag, and with it the user's identity, back to the server. Deleting conspicuous cookies from the browser's cache would be no use, since browsers do not treat ETags as cookies. Private modes, too, are helpless against this stratagem because, unlike other records, a file's ETag is not deleted at the end of a private-browsing session. The only way to get rid of it is to empty the entire cache, which means having to download everything on the site from scratch on future visits.
Another trick unearthed on Hulu's site relies on a feature of HTML5, the latest standard for how sites deliver pages and content to be displayed by a browser. HTML5 lets a browser store information in databases on the same computer on which the browser runs. This allows, among other things, offline reading of Amazon Kindle books or retaining information used by web apps without requiring a round-trip to a remote server, which can actually enhance privacy and security. However, such databases also turn out to be a perfect place to hide a user's virtual ID, which can then be respawned in the browser.
On publication of the report, Hulu immediately discontinued using KISSmetrics, the firm to which it contracted some of its user tracking. Two other firms, Spotify and Gigaom, which the report noted sharing identifiers with Hulu, followed suit. For its part, KISSmetrics assures that identifiers were not exchanged among unrelated sites. All the same, the firm quickly changed its code, ditching persistent-tracking and respawning methods.
The desire to track users continues to outstrip privacy features in browsers. Perhaps one day the cookie equivalent of anti-virus software will emerge. Until then, the more watchdogs sniffing around for intruders in the virtual marketplace, the better.
More from Babbage
Why 10, not 9, is better than 8
For Microsoft, Windows 10 is both the end of the line and a new beginning
Future, imperfect and tense
Deadlines in the future are more likely to be met if they are linked to the mind's slippery notions of the present