Comments on: Abusing the Cache: Tracking Users without Cookies

By: Dmitry Vl.Bondar

Dmitry Vl.Bondar — Wed, 28 Apr 2010 09:20:45 +0000

The technique doesn’t work if web address contains port number like http://www.mysite.com:8082

By: Josh

Josh — Mon, 05 Apr 2010 20:46:12 +0000

Thanks Nathan. Good spot.

By: Nathan Friedly

Nathan Friedly — Mon, 05 Apr 2010 20:40:54 +0000

heh, I topoed my corection, lol. it should say:

header(“Last-Modified: $modified GMT”);

By: Nathan Friedly

Nathan Friedly — Mon, 05 Apr 2010 20:40:09 +0000

I think you have a mistake in your code.

Line 56 reads:
header(“Last-Modified: $expires GMT”);

You probably meant:
header(“Last-Modified: $emodified GMT”);

As it is now, you’re claiming the last-modified date is 10 years in the future.

By: JasonMorrison.net

JasonMorrison.net — Wed, 10 Feb 2010 08:17:16 +0000

Three Ways Sites Can Track Visitors Without Cookies, Part 2…

In part 1, I wrote about the EFF’s Panopticlick project and the implications for anonymity. I’ve got two more methods up my sleeve. 2. Use the cache. Cookies aren’t the only thing your browser downloads and keeps around, and for good reaso….

By: admin

admin — Fri, 29 Jan 2010 21:35:00 +0000

@Mogden, that’s a good point. I haven’t done much testing as to how long the data is retained as this was more a proof of concept. Like I said in the post I believe it would be more suited towards being used with cookies to make sessions more sticky.

By: admin

admin — Fri, 29 Jan 2010 21:28:39 +0000

Ray, the initial request is marked with Cache-control: private so intermediate proxies should know not to cache the page. Only the client will keep the cache.

By: uberVU - social comments

uberVU - social comments — Fri, 29 Jan 2010 15:27:36 +0000

Social comments and analytics for this post…

This post was mentioned on Reddit by k4st: That is surprisingly cool. I think that if the author can make this method work without Javascript and show that it is a cross-browser solution then it could be used (almost) anywhere where a cookie could be u…

By: Ray

Ray — Fri, 29 Jan 2010 13:39:05 +0000

And what happens if the user is behind a caching proxy? Do all users of this proxy occur as a single user?

By: Josh on the Web Â» Blog Archive Â» Abusing the Cache: Tracking Users without Cookies « Netcrema – creme de la social news via digg + delicious + stumpleupon + reddit

Fri, 29 Jan 2010 10:55:35 +0000

[...] Josh on the Web Â» Blog Archive Â» Abusing the Cache: Tracking Users without Cookiesjoshduck.com [...]