Supercookies
If you don't know what these are, then you'll want to read this post. Are your browsing habits and data really safe?
Join the DZone community and get the full member experience.
Join For FreeSupercookies, also known as evercookies or zombie cookies, are like browser cookies in that they can be used to track you, but are much harder to remove.
What Is a Supercookie?
The way I first heard supercookies described was as a cookie that you can appear to delete, but as soon as you do, software rewrites the cookie. Like the Hydra from Greek mythology, cutting off a head does no good because it grows back [1].
This explanation is oversimplified. It doesn't quite work that way.
A supercookie is not a cookie per se. It's anything that can be used to uniquely identify your browser: font fingerprinting, flash cache, cached images, browser plugins, and preferences, etc. Deleting your cookies has no effect because a supercookie is not a cookie.
However, a supercookie can work with other code to recreate deleted cookies, and so the simplified description is not entirely wrong. A supercookie could alert websites that a cookie has been deleted, and allow those sites to replace that cookie, or update the cookie if some browser data has changed.
What About 'Do Not Track'?
You can ask sites to not track you, but this works on an honor system and is ignored with impunity, even (especially?) by the best-known companies.
Apple has announced that it is removing Do Not Track from its Safari browser because the feature is worse than useless. Servers don't honor it, and it gives a false sense of privacy. Not only that, the DNT setting is one more bit that servers could use to identify you! Because only about 9% of users turn on DNT, knowing that someone has it turned on gives about 3.5 bits of information toward identifying that person.
How to Remove Supercookies
How do you remove supercookies? You can't. As explained above, a supercookie isn't a file that can be removed. It's a procedure for exploiting a combination of data.
You could remove specific ways that sites try to identify you. You could, for example, remove Flash to thwart attempts to exploit Flash's data, cutting off one head of the Hydra. This might block the way some companies track you, but there are others.
It's an arms race. As fingerprinting techniques become well known, browser developers and users try to block them, and those intent on identifying you come up with more creative approaches.
The Economics of Identification
Given the efforts companies use to identify individuals (or at least their devices), it seems it must be worth it. At least companies believe it's worth it, and for some it probably is. But there are reasons to believe that tracking isn't as valuable as it seems. For example, this article argues that the most valuable targeting information is freely given. For example, you know who is interested in buying weighted blankets? People who search on weighted blankets!
There have been numerous anecdotal stories recently of companies that have changed their marketing methods in order to comply with GDPR and have increased their sales. These are only anecdotes, but they suggest that at least for some companies, there are profitable alternatives to identifying customers who don't wish to be identified.
Related Posts
[1] In the Greek myth, cutting off one head of the Hydra caused two heads to grow back. Does deleting a supercookie cause it to come back stronger? Maybe. Clearing your cookies is another user behavior that can be used to fingerprint you.
Published at DZone with permission of John Cook, DZone MVB. See the original article here.
Opinions expressed by DZone contributors are their own.
Comments