What's a "super cookie"?

Cookies

Cookies are part of the http protocol that your computer (more specifically, your web browser) uses to request web pages and that web servers use to deliver them.

When you visit a site, say http://ask-leo.com, the web server may return with the page - a small text file that contains some data. In a sense, your computer says, "Please give me http://ask-leo.com/some_page.html", and the server replies, "Here's the page that you requested and here's some data that I'd like you to hold on to for me."

The data can be anything and is stored somewhere on your computer by your web browser.

The next time that the computer requests a page from that same domain - ask-leo.com, in this example - it automatically sends the contents of that text file along with the request. To continue the analogy above, your computer might say, "I'd like http://ask-leo.com/whatever.html, and here's that bit of data that you asked me to keep before."

That's it. That's a cookie.

As I said, a cookie can be anything, but perhaps the most obvious example might be something as simple as a unique number.

The server would make up a completely new and unique number the first time that it sends back a cookie to your computer. When your computer sends that back on subsequent requests, the server knows that it came from the same machine, and thus, can track what pages that machine has been visiting.

Pretty simple.

Super cookies

It's somewhat ironic, but what's commonly being discussed as "super cookies" aren't really cookies at all. By that I mean that they're not using http cookies.

A super cookie is simply some means of storing something unique from a website on your computer that can be retrieved the next time that you visit and that a) doesn't use http cookies and b) is often difficult or impossible to clear.

Let's say that the goal is, as in the example above, to simply assign your computer a number that can then be "read" somehow by subsequent website visits to track that it's the same machine visiting each time.

There are perhaps a dozen or more different approaches to do this that don't involve http cookies at all.

Here are just two examples:

• Flash Cookies: Many sites use Adobe's Flash player, not just for video but for animation, slide shows, and even just plain old static images. As a result, the Flash player is on most people's machines.

  As it turns out, Flash has a separate mechanism that works pretty much like http cookies. These so-called "Flash cookies" aren't http cookies at all, but are simply data managed by the Flash player in a very similar way. The "problem" is that your web browser can't clear Flash cookies because flash cookies aren't http cookies.

  The important take-away here is that is that Flash cookies are a cookie-like mechanism explicitly implemented in Flash by design.

• Pixel hack: At the other end of the spectrum, I call this a hack because it uses techniques that were never intended to achieve this goal.

  Using this technique, the web page that you're visiting includes an image that includes a pixel or two where the color values have nothing to do with visual appearance. The color values assigned to those pixels, when combined, are the unique ID that the web server is attempting to assign to your computer.

  Each time that a new computer comes along the server, it creates a completely new image with new unique values for these pixels, so once again, every computer gets a unique number.

  A small amount of Javascript elsewhere on the page can then read the pixel "colors" and report back to the server the number found.

  This technique relies on web browsers caching images on your hard drive for speed. The first time your computer needs the image that it's downloaded from the server with the uniquely assigned pixel values. Thereafter, the image is retrieved from your web browser's cache where the pixel values are unchanged from what was originally assigned.

As I said, these are just two examples; one is an intentional feature, and the other is an unintentional side effect of some clever programming. There are other approaches, and perhaps more that haven't yet been discovered or devised.

Ever-Cookies

Let's assume that a website uses all three techniques that I've discussed so far: http cookies, Flash cookies, and the pixel hack.

It only takes one of them to work for your computer to be uniquely identified.

In fact, if any one of them work, then the website can immediately reset the other two.

That's the concept behind what some have termed the "ever-cookie" - a technique that uses more like ten different approaches to identifying your computer. As soon as any one of those techniques work, the other nine can be reset no matter how aggressively you clear them.

Clear your browser's http cookies? The cookie can be immediately reset on your next visit because perhaps a Flash cookie wasn't cleared. Cleared the Flash cookie? Then the cookie can be immediately reset on your next visit because the image cache wasn't cleared. And so on for any number of techniques that could be used.

You get the idea. It turns into a game of whack-a-mole to keep your computer from being uniquely identified.

What I do

What do I do about all this?

Absolutely nothing.

I just don't believe that browser-based tracking represents as huge of a threat as some seem to feel.

Most tracking isn't done at the individual level. No one cares that Leo Notenboom visited this site and then that site and then that site. What they do care about is that 100 people did, and that perhaps those 100 people should now see ads related to that site.

As I said, I don't care. At worst, it's an annoyance when I see the same ad everywhere I go on the internet.

Oh well.

If you want to do something...

I'll admit, though, that as unlikely as I think it is, the technology certainly could be used to track me as an individual.

And some people simply don't appreciate their movements being used even in the relatively benign, anonymous aggregate way.

So how can you avoid it?

It's not easy. In fact, it's darned near impossible if the websites that you visit are determined to track you.

The only way is to be certain that nothing has been saved from a prior visit, and thus, there's nothing trackable being sent on subsequent visits.

And the only guaranteed way to do that is to start with a completely fresh computer each time that you browse.

Harsh. I know.

The problem is that with the various techniques that can be used to create super-cookie like behavior, we simply have no real confidence that we can clear them all. Yes, browser extensions will come along and clear more of them, but as the ever-cookie example illustrates, a determined site need only have one technique that slips through to be able to continue to track.

As I said, it's whack-a-mole and the moles are winning.

There are two approaches to making the "start with a clean machine every time" approach slightly more palatable:

• Do your browsing within a virtual machine that you reset each time.

• Use a live CD, such as the Ubuntu Live CD, that includes a web browser and saves nothing to your disk when it exits.

It's unclear, but I expect that "private browsing" will not cover all of the possible tracking techniques, although sandboxing - similar in many ways to virtual machines - might, depending on the specific technology being used.

The future

The investigation that you refer to, and any legislation that might result, is interesting, but it can go only so far. Even if so-called super cookies were completely outlawed, then that law would be in effect only for those countries that have it, and even there, those that choose to flaunt the law will carry on.

In other words, legislation won't make the technology go away. If super cookies are outlawed, only outlaws will have super cookies.

I expect that the arms race will continue - browser features and add-ons will be developed that increase your privacy, and new tracking techniques will be developed that bypass them.

The good news is that I do believe that most major sites and advertising networks will be monitored by various privacy watch dog groups - and perhaps law enforcement as well should legislation become a reality - and as a result, any that blatantly violate our privacy will be called to task.

I hope.

•

Note: I've intentionally glossed over some of the specifics as this can get incredibly complex very quickly. What's most important here are the general concepts.