Is this as bad as it sounds?
Supercookie uses favicons to assign a unique identifier to website visitors.
Unlike traditional tracking methods, this ID can be stored almost persistently and cannot be easily cleared by the user.
The tracking method works even in the browser's incognito mode and is not cleared by flushing the cache, closing the browser or restarting the operating system, using a VPN or installing AdBlockers. 🍿 Live demo.
This repo was created 4 years ago. Questions:
Good point about the age of the repo. I found out about it because Alex Lewin mentioned it. I'm not sure what brought it across his radar.
Seems like consensus here is that it requires so many redirects that it's not particularly practical.
Is that a browser security researcher?
To me it's more that this is easy to fix within a few days, let alone 4 years. I can go test it out though... but I fear I'd waste my time.
It's probably a waste of time.
Alex Lewin is a lightning developer, who I believe works on fedi.
Alright. I'll try it out at some point, just so we know whether they should be listened to.
I believe he came to a similar conclusion as others here (just after I posted it here):
source
The attack requires
floor(log2(id))+1redirects whereidis a numerical identifier.They have a chart here which expresses the feasibility in terms of how many seconds it takes to perform the redirects required for generating ids in ranges of a certain size.
If someone were to use this attack at scale, they would probably pair it with some other kind of browser fingerprinting, because this is basically another, expensive but precise, method of fingerprinting.
If your browser redirects you more than a few times when you visit a website, I don't know what would make you stay/return.
Don’t browsers stop redirecting after a certain number? I think there’s literally an error code in chromium for too many redirects
Their demo manages to do 36 of them. Perhaps the limit only applies to server side redirects
Oh yea, probably so.
fonts are worse
It's cute but doesn't seem very practical. It also only lets them identify that a browser visited their site previously. I don't think it lets them track any of your internet activity outside that website even if they've identified your browser