Cookie without cookies

Tracking

How do we usually track site visitors? One of the following methods:

• cookies
• javascript
• local storage
• flash, java, other plugins
• ip address and useragent

')
Suppose the user has disabled all of this (and goes through a proxy or even vpn). Is there any way to track it?
It turns out - yes. This is a browser cache.

Demonstration of technology is on the page of the original article .

Job explanation

In order to determine whether to download static content, ETag is used in the communication between the browser and the http server. This is a checksum that should change as the file changes.

When you first download a file (for example, an image), the browser receives an ETag. Then he sends this etag to the server, and he checks whether the checksum has changed, and therefore the file.

It becomes clear that instead of being used as intended, the web server can use this etag as a user identifier.
If there is no etag, we give a new one. If you sent an etag, look for it in the user database, and give it to yourself.

The technology has drawbacks - the picture is loaded after the page loads, so the user will see the information from his previous visit. However, if this technology is used for hidden tracking, then it does not bother anyone.

Conclusion: if you want to be 100% protected from tracking, you have to disable all plugins, javascript, cookies and page caching. Although, I believe that mega-paranoids and so it all turned off.

The source code of the working prototype of the tracking program from the author of the article is available on github .