4 responses to “Zombie cookies won’t die”

1. 

   rc primak August 23rd, 2011 at 22:41

   Interesting and disturbing article.

   It appears that ETags can be thwarted by extensions which clean up the browser and certain other areas of Windows during or after a browsing session. Check out this article, which seems to know what it is talking about:

   http://lifecs.likai.org/2011/07/kissmetrics-and-life-of-etag.html .

   ClickNClean Extension for Chrome and Firefox, can control a lot of Web Trackers, Zombie Cookies, Evercookies,etc. But the ClickNClean site ( http://www.hotcleaner.com/clickclean_chrome.html ) makes no mention of ETags. So whether or not this extension or Abine’s ChromeBlock or Firefox’s Abine Privacy Suite or (Firefox Extension) Ghostery can block or remove ETags tracking is open to question. But these are among the more effective ways to defend against all sorts of web tracking and Locally Stored Objects (LSO) intrusions. NoScript and AdBlock Plus are ineffective in these situations.

   As for the script-based tracking mechanisms mentioned in this article, NoScript will block those scripts. Unfortunately, many web sites and services are blocking access when Firefox is detected with the NoScript add-on installed, even if NoScript is disabled for the site or page. Infoworld.com and its partner Disqus, which is used for logging in to post commments, do deny access to Firefox users with NoScript or Ghostery add-ons installed.

   Chrome handles script-based tracking differently from Firefox, so there is no security need for any NoScript type of add-on for Chrome. Chrome (when properly configured with a few extensions) is inherently resistant to the types of persistent tracking and script-based exploits to which Firefox and Internet Explorer are vulnerable. Chrome is not perfectly safe, but I have never had an infection, not even an active LizaMoon type of Fake Antivirus attack, escape Chrome’s sandboxing (process isolation) schemes. Your mileage may vary. So I can log in and post comments at Infoworld.com when using Chrome, due to the absence of script or ad blocking extensions. I do run ChromeBlock from Abine, which is a global opt-out extension for traditional web trackers. Beyond that, ClickNClean has been able to keep my Windows 7 Home Premium 64-bit laptop free from most if not all trackers.

   ETags operate via proxy servers, so there may be no way to “opt out” from this type of tracking at the present time. Simply clearing the browser cache will NOT prevent these web-based trackers from persisting, according to the article I referenced above. However, the article suggests that there are techniques which can increase the user’s chances of escaping from ETags tracking. (I am not technically knowledgeable enough to understand exactly what the avoidance techniques hinted at in the article are, and how to implement them.) Again, NoScritp and AdBlock Plus have no effect on proxy data storage. And neither do extensions which clean the local computer.

   Does anyone have additional information about avoiding or removing ETags?

2. 

   Ax Kramer August 25th, 2011 at 07:38

   Question: Do the zombie cookies “regenerate” if the “In Private” mode is used which is supposed to NOT keep cookies when the mode is exited?

3. 

   Ax Kramer August 25th, 2011 at 07:45

   I withdraw my previous question after re-reading your article more carefully. You do say that the “In Private” mode is no protection. But this brings to mind another question. If I delete my “history” and cookies (using CCleaner for example) does this get rid of the zombies? Does this clean out the cache where the zombies get their fix?

4. 

   rc primak August 26th, 2011 at 00:23

   @Ax Kramer –

   In a word, no. You need to do much deeper cleaning, such as that offered by ClickNClean. CCleaner can be set up to do a somewhat deeper cleaning, but this does not guarantee complete protection. And I am not convinced that ClickNClean can prevent the proxy method from regenerating tracking cookies. I still await any additional information on ETags.