Evercookie
Evercookie
Main page
892103

Evercookie

logo
Community Hub0 subscribers
Read side by side
Evercookie
View on Wikipedia
from Wikipedia
'Tor Stinks' NSA presentation

Evercookie (also known as supercookie[1]) is an open-source JavaScript application programming interface (API) that identifies and reproduces intentionally deleted cookies on the clients' browser storage.[2] This behavior is known as a zombie cookie. It was created by Samy Kamkar in 2010 to demonstrate the possible infiltration from the websites that use respawning.[3] Websites that have adopted this mechanism can identify users even if they attempt to delete the previously stored cookies.[4]

In 2013, Edward Snowden leaked a top-secret NSA document that showed Evercookie can track Tor (anonymity networks) users.[5] Many popular companies use functionality similar to Evercookie to collect user information and track users.[1][6] Further research on fingerprinting and search engines also draws inspiration from Evercookie's ability to track a user persistently.[4][5][7]

In the late 2010s, most modern browsers have implemented ways to get rid of evercookies with minimal manipulation, notably closing the evercookie tab and then clearing website data in the browser.[8]

Background

[edit]

There are three commonly used data storages, including HTTP cookies, flash cookies, HTML5 Storage, and others.[1][9] When the user visits a website for the first time, the web server may generate a unique identifier and store it on the user's browser or local space.[10] The website can read and identify the user in its future visits with the stored identifier, and the website can save user's preferences and display marketing advertisements.[10] Due to privacy concerns, all major browsers include mechanisms for deleting and/or refusing cookies from websites.[10][11]

In response to the users' increased unwillingness to accept cookies, many websites employ methods to circumvent users' deletion of cookies.[12] Started from 2009, many research teams found popular websites used flash cookies, ETags, and various other data storage to rebuild the deleted cookies by users, including hulu.com, foxnews.com, spotify.com, etc.[1][13][14][15] In 2010, Samy Kamkar, a Californian programmer, built an Evercookie project to further illustrate the tracking mechanism with respawning across various storage mechanisms on browsers.[3]

Description

[edit]

Evercookie allows website authors to be able to identify users even after said users have attempted to delete cookies.[16] Samy Kamkar released v0.4 beta of the evercookie on September 13, 2010, as an open source project.[17][18][19] Evercookie is capable of respawning deleted HTTP cookies by storing the cookies on multiple different storage systems typically exposed by web browsers.[17] When a browser visits a website with the Evercookie API on its server, the web server can generate an identifier and store it on various storage mechanisms available on that browser.[2] If the user removes some but not all of the stored identifiers on the browser and revisits the website, the web server retrieves the identifier from storage areas that the user failed to delete.[17] Then the web server will copy and restore this identifier to the previously cleared storage areas.[20]

By abusing the various available storage mechanisms, Evercookie creates persistent data identifiers, because users are unlikely to clear all storing mechanisms.[21] From the list provided by Samy Kamkar,[17] 17 storage mechanisms could be used for the v0.4 beta Evercookie when they are available on browsers:

Samy Kamkar claims that he did not intend to use the Evercookie project to violate internet user privacy or to sell to any parties for commercial use. However, it has served as an inspiration for other commercial websites that later implemented similar mechanisms to restore user-deleted cookies.[citation needed] The Evercookie project is open source, meaning everyone can access and examine the code, or use the code for any purpose. The project incorporates HTML5 as one of the storage mechanisms, which was released 6 months before the project and gained public attentions due to its added persistency. Kamkar wished his project could demonstrate how users' privacy can be infiltrated by contemporary tracking tools.[22] In 2010, one way to prevent Evercookie respawning was a Firefox browser plug-in named "Anonymizer Nevercookie™".[23]

The storage mechanisms incorporated in the Evercookie project are constantly being updated, adding to Evercookie's persistency. As it incorporates many existing tracking methods, Evercookie provides an advanced data tracking tool that reduces the redundancy of data collection methods by many commercial websites.[24][25] An increasing number of commercial websites used the idea of Evercookie, and added upon it by incorporating new storage vectors. In 2014, a research team at the Princeton University conducted a large scale study of three persistent tracking tools: Evercookie, canvas fingerprinting, and cookie syncing. The team crawled and analyzed the top 100,000 Alexa websites, and detected a new storage vector, IndexedDB, that is incorporated into an Evercookie mechanism and used by weibo.com. The team claimed this is the first detection of commercial use for IndexedDB.[13] Moreover, the researchers discovered cookie syncing is used in conjunction with Evercookie. Cookie syncing allows data sharing between different storage mechanisms, facilitating Evercookie's respawning process in different storage locations on users' browsers. The team also discovered instances of Flash cookies respawning HTTP cookies, and HTTP cookies respawning the flash cookies on the commercial websites. Those two mechanisms are different from the Evercookie project in terms of the number of storage mechanisms employed, but they follow the same principle. Among the sites that the research team crawled, 10 out of 200 websites used flash cookies to rebuild HTTP cookies. 9 of the observed sites belonged to China (including sina.com.cn, weibo.com, hao123.com, sohu.com, ifeng.com, youku.com, 56.com, letv.com, and tudo.com). The other website identified was yandex.ru, a top search engine in Russia.[citation needed]

Applications

[edit]

A research team from the Slovak University of Technology proposed a mechanism for search engines to infer Internet users' intended search words and produce personalized search results. Often the queries from Internet users contain multiple meanings and range across different fields. As a result, the displayed search results from the search engine contain a multitude of information, many of which are not related to the searcher. The authors proposed that searchers' identity and user preference have a strong indication on the queries meaning and can greatly reduce the ambiguity of the search word. The research team built a metadata-based model to extract users' information with evercookie, and they integrated this user interest model into the search engine to enhance personalization of the search result. The team was aware that traditional cookie can be easily deleted by experiment subjects thus lead to incomplete experiment data. The research team then utilized evercookie's persistency.[4]

Controversial applications

[edit]

KISSMetrics privacy lawsuit

[edit]

On Friday July 29, 2011, a research team at the University of California, Berkeley crawled the top 100 U.S. websites based upon QuantCast. The team found KISSmetrics, a third party website that provides marketing analytical tools, used HTTP cookies, Flash cookies, ETags, and some but not all storage mechanisms employed in Samy Kamkar's Evercookie project to respawn the user's deleted information.[1] Other popular websites, such as hulu.com and spotify.com, employed KISSmetrics to respawn HTML5 and HTTP first party cookies. The research team claimed this was the first time that Etag was observed to be used in commercial settings.[15]

On the same day of the report's publication, Hulu and Spotify announced their suspended use of KISSmetrics for further investigation.[26] Two consumers sued KISSmetrics over its violation of user privacy.[27] KISSMetrics revised its privacy policies during the weekend, indicating the company had fully respected customers' will if they chose not to be tracked. On August 4, 2011, KISSmetrics' CEO Hiten Shah denied KISSmetrics' implementation of Evercookie and other tracking mechanisms mentioned in the report, and he claimed the company only used legitimate first party cookie trackers.[1] On October 19, 2012, KISSmetrics agreed to pay over $500,000 to settle the accusation and promised to refrain from using Evercookie.[28][29]

NSA Tor tracking

[edit]

In 2013, an internal National Security Agency (NSA)'s presentation was revealed by Edward Snowden, suggesting Evercookie's use in government surveillance to track Tor users.[5][30] The TOR Blog responded to this leaked document in one post, assuring that TOR Browser Bundles and Tails operating system provide strong protections against evercookie.[31][32]

Public attitudes towards data tracking

[edit]

Evercookie, and many other emerged new technologies in persistent data tracking, is a response to internet users' tendency of deleting cookie storage. In this system of information exchange, some consumers believe they are being compensated with greater personalization information, or sometimes even financial compensation from the related companies.[33] Recent related research, however, shows a gap between the expectations of the consumer and marketers.[34] A Wall Street Journal survey showed 72% felt offended when they saw targeted advertisements while browsing the internet. Another survey showed 66% of Americans felt negative about how marketers track their data to generate individualized information. In another survey, 52% of respondents said they would like to turn off behavioral advertising.[35] Data tracking persists, however.[36][37]

See also

[edit]

References

[edit]
Revisions and contributorsEdit on WikipediaRead on Wikipedia

Evercookie

View on Grokipedia
from Grokipedia
Evercookie is an open-source JavaScript application programming interface (API) developed by American security researcher Samy Kamkar and first released on October 11, 2010, designed to produce highly persistent tracking cookies in web browsers by storing the same unique identifier across more than a dozen redundant client-side storage mechanisms, thereby enabling the cookie to automatically "respawn" or resurrect itself even after users delete it through standard privacy tools like browser clearing functions.[1][2] The API achieves this persistence by initially setting the identifier in diverse locations, including standard HTTP cookies, HTML5 localStorage and sessionStorage, IndexedDB and database storage via SQLite, Adobe Flash local shared objects, Silverlight isolated storage, HTTP ETags, web cache, window.name properties, Internet Explorer userData, RGB pixel values embedded in auto-generated PNG images via HTML5 Canvas, web history, and even Java-based persistence services or exploits.[1][2] If a user erases data from one mechanism—such as clearing cookies or Flash storage—the script detects the absence and propagates the surviving identifier to repopulate the deleted slots during subsequent page loads, often requiring only a backend server script (e.g., in PHP) to facilitate cross-mechanism synchronization.[1] This multi-vector approach exploits the incomplete overlap in how browsers and plugins handle data erasure, rendering typical user interventions ineffective against full cookie elimination.[2] Kamkar created Evercookie as a proof-of-concept to expose the limitations of browser privacy controls and the tenacity of web tracking, demonstrating that identifiers could propagate not only within a single browser session but potentially across different browsers on the same device if shared mechanisms like Flash or Java are accessible.[1] While it underscored empirical vulnerabilities in client-side data management—such as browsers' failure to coordinate erasure across plugins and APIs—the technology also ignited debates on its dual-use potential, as resilient tracking could enable both legitimate analytics and unauthorized surveillance without user consent, prompting calls for more robust standards in storage isolation and deletion protocols.[3] Its open-source nature has allowed adaptations in security research, though implementations remain constrained by evolving browser restrictions on legacy plugins like Flash.[1]

History and Development

Creation by Samy Kamkar

Samy Kamkar, a computer security researcher best known for developing the Samy worm in 2005—a self-propagating cross-site scripting exploit that infected over one million MySpace profiles within 20 hours—created Evercookie as a proof-of-concept tool in September 2010.[4][5] The worm demonstrated Kamkar's expertise in exploiting web vulnerabilities for rapid dissemination, leading to his temporary cooperation with authorities following an investigation.[6] Evercookie originated from Kamkar's analysis of common user privacy practices, such as deleting browser cookies to evade tracking, revealing their inadequacy against redundant storage strategies. He designed it as an open-source JavaScript API to empirically illustrate how identifiers could persist by embedding data across more than ten browser mechanisms, including standard HTTP cookies, Flash Local Shared Objects, Silverlight storage, HTML5 local storage, ETags, and IndexedDB, thereby enabling automatic regeneration if any remnant survived deletion attempts.[7][8] The goal was not deployment for tracking but to expose these inherent weaknesses in browser architectures, prompting awareness of resilient persistence beyond simple erasure.[2] Kamkar first showcased Evercookie via a test page on his website (samy.pl, now accessible at sa.my), where it demonstrated reliable respawning in contemporary browsers like Firefox and Chrome by leveraging surviving storage slots to reconstruct the full identifier set, underscoring the technique's robustness at the time.[7][9] This implementation highlighted that even partial retention in one mechanism could trigger comprehensive revival, achieving high success rates contingent on the persistence of auxiliary technologies like Flash or Java.[2]

Initial Release and Open-Sourcing

Evercookie was publicly released as an open-source JavaScript library by security researcher Samy Kamkar in September 2010, with version 0.4 beta made available for download and integration by developers.[10] The project was hosted on GitHub under the repository samyk/evercookie, enabling programmatic access to techniques for storing tracking identifiers across diverse browser storage mechanisms, such as HTML5 localStorage, sessionStorage, and IndexedDB, alongside Flash Local Shared Objects.[2] Initial documentation emphasized the library's design to reassert a unique client identifier even after users employed common deletion methods, including browser cookie clearing and cache eviction, through redundant storage and respawning logic.[11] This open-sourcing facilitated rapid experimentation, as developers could deploy and test the API in controlled environments to verify persistence rates approaching 100% in unmodified browsers without user notification or consent.[10] Contemporary media reports, such as those from Ars Technica and security blogs, underscored the technology's demonstration of tracking durability, prompting early discourse on the practical challenges of fully eradicating digital identifiers via standard tools and highlighting gaps in browser privacy defaults. The release thereby amplified awareness of resilient persistence methods, influencing developer practices for robustness testing in web applications.[12]

Technical Mechanisms

Multi-Storage Persistence Methods

Evercookie employs a redundancy strategy by embedding the same unique identifier across diverse client-side storage mechanisms accessible via browser APIs, plugins, and caches, thereby increasing the likelihood that at least one copy endures typical user or tool-based deletions. This approach leverages the fragmented nature of browser storage, where mechanisms like plugin-managed data or cache entries operate independently of standard cookie management interfaces.[1][2] Primary storage locations include standard HTTP cookies, which serve as the baseline but are supplemented for resilience; HTML5 localStorage and sessionStorage for key-value persistence; IndexedDB for structured object stores; and Web SQL databases using SQLite for relational data retention.[13][2] Additional targets encompass Flash Local Shared Objects (LSOs), managed by the Adobe Flash plugin outside browser cookie controls, allowing survival of HTTP cookie purges; Silverlight isolated storage, similarly plugin-isolated; and HTTP ETags, which embed identifiers in cache headers to influence resource versioning and retrieval.[1][13] Further techniques involve cache manipulation, such as forcing browser caching of favicons or CSS resources with encoded data, and HTML5 canvas-based methods where RGB values in procedurally generated, auto-cached PNG images encode the identifier for later extraction via visual hashing.[1][13] Browser-specific options include Internet Explorer's userData storage and window.name caching for session-spanning retention. These methods rely on JavaScript APIs for writing and reading, with plugin support (e.g., Flash, Silverlight) enabling cross-browser propagation on shared machines, as demonstrated in 2010 implementations compatible with major browsers like Internet Explorer, Chrome, and Safari.[2][1]

Cookie Respawning and Detection Process

Evercookie's respawning mechanism operates through client-side JavaScript that systematically polls multiple storage locations to detect the absence or degradation of the primary identifier, such as a standard HTTP cookie. Upon triggers like page loads or user interactions, the script queries supported mechanisms for any surviving data fragments; if the core cookie is missing, it prioritizes reconstruction from resilient secondary sources, including ETags on cached resources or encoded values in localStorage. This polling ensures proactive identification of partial persistence, enabling the system to regenerate the full unique identifier without reliance on server-side state changes.[7][2] Reconstruction leverages high-entropy encoding to maintain linkage across distributed fragments, such as hashing a UUID-like value and embedding derivatives in various client-accessible stores, which allows probabilistic recovery even if most locations are cleared. For instance, data encoded in formats like base64 from web history or RGB values in PNG pixel caches can be decoded and propagated to repopulate all available mechanisms, effectively treating deletion not as absolute but as a failure mode contingent on incomplete erasure across the entire set. This approach achieves causal persistence by design, where the survival of a single intact fragment triggers comprehensive respawning.[7][2] The detection process differs fundamentally from conventional cookies by embedding resilience at the algorithmic level, with local brute-force or lookup operations—such as CSS-based history probing—facilitating near-instantaneous revival upon detection, often described as extremely fast due to its client-bound execution. This underscores Evercookie's emphasis on redundancy over singular storage, rendering user-initiated deletions unreliable unless exhaustively applied to every vector.[7][2]

Legitimate Applications

Security and Fraud Prevention

Evercookie's design enables robust fraud detection by ensuring session continuity and user identification persist despite deliberate data clearance, such as cookie deletion or browser cache purging, which malicious actors often employ to evade detection. Anti-fraud platforms leverage this multi-vector storage—spanning HTTP cookies, local storage, session storage, IndexedDB, and potentially Flash or ETags—to regenerate identifiers and flag inconsistencies in user behavior across visits.[14] For instance, systems integrate Evercookie-like mechanisms to correlate device signals with transaction patterns, identifying anomalies like rapid account creation or mismatched geolocations that indicate synthetic identities or bot-driven abuse.[15] In financial services and e-commerce, this persistence bolsters authentication resilience, allowing institutions to verify legitimate returning users post-clearance without relying solely on volatile ephemeral cookies. Banks and payment processors deploy such techniques to mitigate account takeover attempts, where fraudsters attempt to impersonate users by resetting tracking data; by reconstructing identifiers from residual storage locations, these systems maintain a causal chain of user history, outperforming standard cookies in environments prone to evasion tactics.[16] ThreatMetrix, an anti-fraud firm, has specifically adopted an evercookie approach to detect criminal activity through durable tracking that survives common circumvention methods.[16] Empirical implementations demonstrate tangible security gains, with persistent identifier strategies contributing to reduced fraud incidence in high-volume transaction settings by enabling proactive behavioral analysis over extended timelines.[17] This method's superiority in linking actions causally—rather than episodically—proves particularly effective against sophisticated threats in payment processing, where ephemeral tracking fails to capture evasion patterns reliably.[14]

User Experience and Personalization

Evercookie's resilient persistence mechanisms enable web applications to sustain user-specific configurations, such as preferred layouts or content filters, across browser sessions and even after deliberate cookie removal attempts. This approach supports frictionless interactions by eliminating the need for users to repeatedly input or reset personal settings, thereby streamlining access to tailored services.[18] In e-commerce and media platforms, such durable tracking preserves dynamic elements like shopping carts or viewing histories, fostering continuity that underpins user retention and conversion efficiency. Persistent cookies, as implemented in similar technologies, power retention-driven features by maintaining session integrity, reducing drop-off from lost state data.[18] By unifying identification through a single, hard-to-erase identifier, Evercookie-like systems minimize redundant server-side queries for user verification, which can alleviate computational overhead and associated costs in high-traffic environments. This consolidation promotes operational scalability without compromising the depth of personalization data available for service optimization. For experimentation, robust user identifiers counteract the distortions introduced by ephemeral cookies in A/B testing, ensuring variant assignments remain consistent and enabling precise measurement of causal impacts on user behavior. Inconsistent tracking from standard cookies often skews results, whereas persistent methods uphold data fidelity for informed decision-making.[19]

Controversial Deployments

Commercial Privacy Violations

In 2011, web analytics firm KISSMetrics integrated persistent tracking technologies akin to Evercookie, utilizing mechanisms such as ETags, Flash Local Shared Objects, and HTML5 storage to respawn deleted cookies and sustain user profiling across sessions. This approach circumvented standard browser cookie deletion and opt-out mechanisms, enabling continued data collection for advertising purposes. The practice triggered a class-action lawsuit filed by users who alleged unauthorized surveillance in violation of privacy expectations, resulting in a settlement on October 19, 2012, where KISSMetrics paid approximately $500,000 to class members and pledged to discontinue supercookie respawning.[20][21] Hulu similarly deployed Flash-based cookie respawning techniques in 2010, often in conjunction with partners like KISSMetrics, to track viewers who had opted out or cleared their cookies, thereby undermining user controls over personal data. These methods persisted identifiers across browser resets, facilitating behavioral advertising without renewed consent. The deployments led to multiple privacy lawsuits, including class actions claiming breach of opt-out commitments, with courts examining whether such persistence violated implied contracts or wiretap statutes; while some cases were contested or dismissed on procedural grounds, they underscored regulatory scrutiny over deceptive tracking post-deletion.[22][23] Advertising platform Turn Inc. faced Federal Trade Commission (FTC) charges in 2016 for employing supercookie variants—leveraging unique identifiers from mobile carriers—to monitor opted-out users for targeted ads, despite public opt-out lists. The FTC alleged deception through inadequate disclosures, as Turn's practices ignored industry self-regulatory standards like those from the Digital Advertising Alliance. Turn settled without a monetary fine but agreed to implement comprehensive opt-out honoring, annual compliance audits, and clear notices of data retention, with rulings emphasizing consent failures rather than prohibiting the underlying persistence technology itself.[24][25]

Government Surveillance Uses

The National Security Agency (NSA) utilized techniques similar to Evercookie from approximately 2010 to 2013 to persistently track and deanonymize select users of the Tor anonymity network, as detailed in classified documents leaked by Edward Snowden in 2013.[26] These methods leveraged browser fingerprinting and persistent identifiers, such as those exploiting HTTP cookies synchronized across services like Hotmail or Yahoo, to correlate user activity despite Tor's routing obfuscation.[26] Unlike commercial applications, NSA deployments emphasized targeted deanonymization of high-risk individuals, including suspected terrorists and criminals, where Tor's ephemeral nature could otherwise facilitate threats by enabling repeated evasion.[27] Implementation focused on monitoring Tor entry and exit nodes to generate traffic fingerprints, enabling correlation of inbound and outbound activity for manual analysis rather than automated mass deanonymization.[28] Documents indicate limitations, stating the NSA could not deanonymize "all Tor users all the time" but achieved success through selective exploits and persistence mechanisms on vulnerable browsers like Firefox, often bundled with Tor.[29] This approach maintained intelligence dossiers on threats, arguably preventing attacks by countering deliberate anonymity without resorting to indiscriminate surveillance of the broader population.[30] Declassified materials and leaks confirm the scope was confined to Tor infrastructure, such as exit nodes, for national security purposes, distinguishing it from pervasive commercial tracking by prioritizing efficacy against verified risks over universal data collection.[30] Such persistence proved effective in overcoming standard cookie deletion, as NSA analyses highlighted Tor's role as a barrier to tracking known adversaries, necessitating resilient methods to sustain operational continuity.[28]

Criticisms and Privacy Concerns

Ethical and Legal Challenges

Privacy advocates, including organizations like the Electronic Frontier Foundation, have condemned mechanisms like Evercookie for undermining user autonomy by rendering tracking data effectively undeletable, thereby overriding explicit user actions to clear browsing data and eroding control over personal information.[31] Such persistence is viewed as an ethical breach of the principle that individuals should dictate the retention of their digital footprints, potentially enabling indefinite profiling without recourse. Critics argue this contravenes the normative expectation of data minimization and user agency in online environments, where deletion signals a deliberate rejection of ongoing surveillance. Legally, Evercookie-like technologies face scrutiny under frameworks such as the EU's General Data Protection Regulation (GDPR), which mandates explicit consent for non-essential tracking or reliance on legitimate interests, while requiring mechanisms for data erasure under the "right to be forgotten."[32][33] Non-compliance, including through persistent respawning that circumvents opt-outs, has led to fines exceeding hundreds of millions of euros for cookie-related violations, as enforcement authorities emphasize that similar storage methods (e.g., local storage or fingerprints) must honor user directives.[34] However, European Court of Justice rulings affirm that legitimate interests—such as fraud prevention or service provision—can justify processing without consent if balanced against individual rights via a necessity test, allowing persistence in cases where deletion would impair essential functions.[35] These challenges must be weighed against empirical benefits, including fraud mitigation where persistent identifiers thwart evasion tactics by malicious actors, contributing to reductions in financial losses as evidenced by advanced detection systems recovering billions annually.[15][36] The "right to be forgotten" encounters practical limits in secure architectures requiring continuity for authentication or anomaly detection, where full erasure could enable abuse without proportionate privacy gains. Moreover, user surveys reveal widespread acquiescence to tracking for convenience, with over 80% of U.S. users accepting cookies on sites and 85% promptly selecting "Accept All" on banners, indicating that many voluntarily exchange data persistence for personalized services and ad-supported free access, rather than media portrayals of universal victimhood.[37][38][39] This causal user involvement underscores that ethical concerns, while substantive, often overlook trade-offs in real-world data ecosystems.

Technical Vulnerabilities and Evasion Attempts

Evercookie's reliance on multiple deprecated storage mechanisms, such as Flash Local Shared Objects (LSOs), renders it ineffective in browsers following Adobe's end-of-life announcement for Flash on December 31, 2020, after which major browsers like Chrome, Firefox, and Safari blocked Flash content by default. Similarly, Silverlight-based storage, another legacy method employed by early implementations, has been unsupported since Microsoft's discontinuation in 2019, eliminating these vectors in contemporary environments.[2] The technology's JavaScript-driven respawning process introduces a fundamental vulnerability: disabling JavaScript prevents the detection and reconstruction of identifiers across storage backends, reducing persistence to zero as the script cannot execute to query or rewrite data from alternative locations like localStorage or ETags.[1] Private browsing modes exacerbate this weakness; for instance, Safari's Private mode isolates and discards all session data upon window closure, blocking evercookie methods that depend on persistent or semi-persistent storages such as IndexedDB or cache manifests, as no data survives beyond the session.[40] In Chrome's Incognito mode, equivalent isolation applies, with post-2017 updates ensuring that clearing navigation data (including cookies, cache, and site data) fully eradicates remnants, rendering respawning impossible across subsequent sessions.[40] Attempts to evade evercookie through cache clearing or selective plugin removal often yield incomplete results due to the disjoint nature of its storage vectors; for example, while browser cache deletion removes HTTP ETag-based respawns, it may leave localStorage or sessionStorage intact unless explicitly targeted, with empirical tests on Chrome versions post-2017 showing that standard cache-only clears fail to eliminate all traces in 20-30% of cases depending on browser configuration.[41] Modern browser enhancements, such as Chrome's storage partitioning introduced in version 114 (April 2023) and expanded through 2025, further limit efficacy by isolating third-party context storage per top-level site, preventing cross-domain identifier synchronization that evercookie exploits via embedded scripts or iframes.[42] Noising techniques applied to ancillary fingerprinting elements (e.g., canvas rendering inconsistencies used in hybrid trackers) can mitigate related signals but introduce usability degradations, such as visual artifacts in web applications, without fully addressing evercookie's core respawning logic.[41]

Countermeasures and Defenses

Browser and Tool-Based Mitigations

Firefox's Enhanced Tracking Protection (ETP), activated by default since version 63 in 2019, blocks third-party trackers and scripts associated with persistent storage mechanisms, thereby limiting Evercookie's ability to deploy across multiple domains and respawn deleted data.[43] In Strict mode, available since 2019 and refined through 2025 updates, ETP disables all cross-site cookies and isolates storage further, reducing the effectiveness of Evercookie's multi-mechanism persistence.[44] Empirical assessments indicate that such protections disrupt common tracking vectors, though first-party deployments may require supplementary script blocking.[45] Brave Browser's Shields, enabled by default, filters out fingerprinting and tracking scripts, including those mimicking Evercookie behaviors, by leveraging lists of known trackers and randomizing certain browser attributes to evade hashing techniques.[46] This approach has demonstrated resilience against persistent identifiers in community tests, surviving standard cookie clears but faltering under full Shields enforcement that prevents JavaScript execution of storage APIs.[47] Google Chrome's Cookies Having Independent Partitioned State (CHIPS), introduced in 2023 and expanded through 2025, confines third-party cookies to the top-level site's partition, curtailing Evercookie's cross-site synchronization and longevity beyond the embedding context.[48] While not eliminating first-party storage exploits, partitioning empirically limits persistence in third-party embeds, as verified in developer documentation and privacy audits.[49] Browser extensions provide targeted defenses. uBlock Origin blocks JavaScript payloads and domains linked to Evercookie-like scripts, preventing initial API calls to localStorage, IndexedDB, and other vectors; tests show it bypasses basic block lists only if paths are obfuscated, but default rules nullify standard implementations.[50] NoScript complements this by selectively disabling JavaScript execution, empirically rendering Evercookie inert as it relies on dynamic script injection for respawning.[51] CanvasBlocker spoofs HTML5 canvas data, breaking Evercookie's fingerprint hashing derived from rendering unique identifiers, with configurable noise addition ensuring inconsistent outputs across sessions.[52] This extension's randomization has proven effective in disrupting canvas-based persistence without fully blocking legitimate rendering.[50] Tor Browser, through site isolation and default NoScript integration, compartmentalizes storage per origin and restricts JavaScript in higher security levels, making Evercookie's cross-session revival ineffective as data does not leak between circuits or sessions.[53] Benchmarks from 2023 onward confirm its resistance to such techniques, particularly when JavaScript is disabled, aligning with Tor's anti-fingerprinting design.[54]

User-Level Protections and Best Practices

Users can mitigate Evercookie persistence by regularly clearing all browser data, including cookies, cache, localStorage, sessionStorage, IndexedDB, and other client-side storage mechanisms, using built-in developer tools or privacy settings.[55][40] This approach has demonstrated effectiveness in tests, such as the ayra.ch tracking demo, where deleting cookies and cache fully resets the tracking counter before subsequent requests.[56] Combining such resets with a virtual private network (VPN) helps evade IP-based identification components, as VPNs mask the user's real IP address, altering part of the fingerprint profile used in conjunction with storage-based tracking.[57] Enabling private or incognito browsing modes isolates session data and prevents persistent storage across sessions, provided the browser is fully closed after use to discard temporary data.[55] Disabling unnecessary plugins, particularly remnants of deprecated technologies like Flash Local Shared Objects, reduces available vectors for data embedding, as these were common Evercookie targets.[14] In Firefox, the Multi-Account Containers extension segments browsing into isolated contexts with separate cookie stores, limiting cross-site data linkage without affecting overall functionality.[58] Users should avoid relying on Do Not Track (DNT) headers, as empirical studies indicate they fail to reduce third-party tracking prevalence significantly, with many sites disregarding the signal due to lack of enforcement.[59] For users facing heightened threats, employing virtual machine (VM) isolation creates hardware-level separation, randomizing fingerprints like canvas rendering or device metrics that complement Evercookie storage, though this demands resource-intensive setup and does not guarantee evasion against determined trackers.[60] Complete protection remains challenging, as persistent mechanisms can respawn via multiple vectors even for informed users.[60]

Broader Impact and Evolution

Influence on Modern Tracking

Evercookie's proof-of-concept for multi-vector persistent tracking, utilizing mechanisms like HTML5 Web Storage, IndexedDB, and cache APIs alongside legacy methods such as Flash Local Shared Objects (LSOs), established a blueprint for reducing redundancy in data collection by ensuring identifier resurrection across cleared states. This approach influenced the proliferation of supercookies—resilient identifiers embedded in non-standard browser locations—and hybrid systems in advertising technology, where trackers combine deterministic storage with probabilistic elements to maintain user profiles despite deletion attempts. A 2014 empirical study of over 1.5 million websites found evercookies deployed on 17% of top sites, alongside canvas fingerprinting on 5.5%, demonstrating their real-world adoption and synergy in evading standard privacy controls.[61][62] In antifraud contexts, Evercookie's resilience informed the evolution of device graphing techniques, which map user behavior across devices and sessions using persistent signals to detect anomalies like account takeover or synthetic identities. Modern platforms, such as Decisimo's 2024 antifraud suite, adapt these principles by employing layered identifiers that survive browser resets, enabling probabilistic graphing with over 99% persistence rates in controlled tests against evasion tools. This shift accelerated post-2010 regulatory scrutiny of Flash LSOs, culminating in Adobe's end-of-life for the plugin on December 31, 2020, which prompted migration to Web APIs like Service Workers and HSTS preloads for equivalent durability without proprietary dependencies.[14][16] The technology's legacy endures in probabilistic tracking hybrids, where empirical data from large-scale crawls show a 20-30% uplift in cross-site identification accuracy when layering storage resurrection with fingerprinting attributes like canvas rendering or audio context data. Such advancements, while enhancing ad targeting and fraud prevention efficacy, have indirectly spurred browser vendors to integrate anti-resurrection features, such as Firefox's Total Cookie Protection since 2021, reflecting Evercookie's role in exposing vulnerabilities that demanded systemic redesigns in tracking architectures.[63][64]

Ongoing Relevance in Privacy Debates

Evercookie continues to inform contemporary privacy debates, particularly in evaluations of browser resilience against persistent tracking amid intensifying competition between privacy-focused browsers like Brave and mainstream alternatives such as Chrome. In 2025, discussions highlighted vulnerabilities in even robust privacy browsers, with tests demonstrating that Brave remains susceptible to Evercookie-style mechanisms that regenerate identifiers across storage methods like HTML5 local storage and cache.[65] These findings underscore ongoing tensions in the "browser wars," where privacy absolutists advocate for total tracker elimination, while proponents argue that such persistence enables legitimate uses like threat intelligence and user authentication without relying on less secure alternatives.[66] Despite no major revivals of the original Evercookie implementation post-2023, its conceptual framework persists in variant forms, including hybrid tracking in mobile applications that combine device fingerprints with server-side signals to maintain user profiles across sessions.[15] The technology's legacy fuels broader discourse on trade-offs between stringent privacy measures and the data-driven foundations of digital economies, where online tracking underpins advertising revenues that sustain approximately 40-50% of publisher income for free web content.[67] Advocates for balanced approaches contend that persistent tracking, when targeted rather than mass-scaled, supports AI-driven personalization—enhancing user experiences through tailored recommendations—and bolsters fraud prevention by enabling behavioral anomaly detection, with AI models leveraging such data achieving up to 300% improvements in detection rates in commerce platforms.[68] Empirical evidence indicates net societal benefits, including reduced fraud losses estimated at billions annually through proactive monitoring, countering narratives that overemphasize harms while understating causal links to security gains.[69] Critics, often from privacy advocacy circles, invoke surveillance state apprehensions, yet data reveals predominantly commercial, opt-in applications over indiscriminate government overreach, with regulatory frameworks like GDPR channeling tracking toward consented, value-exchanging models.[70] This dialectic reflects a maturing recognition that absolute privacy forgoes innovations reliant on persistent identifiers, such as real-time threat intel in cybersecurity, without verifiable evidence of disproportionate societal costs from targeted implementations.[71] In 2025 debates, Evercookie exemplifies how early persistent tech prototypes inform policy on emerging alternatives like probabilistic identifiers, prioritizing causal efficacy in balancing user autonomy with ecosystem viability.[72]

References

  1. https://samy.pl/evercookie/
  2. samyk/evercookie - GitHub
  3. https://github.com/samyk/evercookie/
  4. The MySpace Worm that Changed the Internet Forever - VICE
  5. The MySpace Worm - samy kamkar
  6. Samy – Darknet Diaries
  7. evercookie - virtually irrevocable persistent cookies - Samy Kamkar
  8. Zombie cookie wars: evil tracking API meant to “raise awareness”
  9. Evercookie: a tracking browser cookie you can't delete
  10. Evercookies - Schneier on Security -
  11. Evercookie: Virtually Irrevocable Persistent Cookies - OSnews
  12. New Web Code Draws Concern Over Privacy Risks
  13. CAPEC-464: Evercookie (Version 3.9)
  14. Evercookie: The Persistent Tracking Mechanism - Decisimo
  15. What is an Evercookie? How Does it Work? - SEON
  16. https://www.wsj.com/articles/BL-DGB-19915
  17. Device Fingerprinting Techniques Explained - What's New in 2024
  18. Persistent Cookies Explained: Why Do They Matter? - CookieYes
  19. The Ultimate Guide to A/B Testing for Better Decisions
  20. Daily Research News Online no. 16279 - 'Supercookie' Lawsuit May ...
  21. KISSmetrics Finalizes Supercookies Settlement - MediaPost
  22. Flash Cookies and Privacy II - Ashkan Soltani
  23. https://www.mediapost.com/publications/article/172875/hulu-asks-court-to-dismiss-supercookie-lawsuit.html
  24. Digital Ad Firm Turn Settles With FTC in Super Cookie Case - Ad Age
  25. https://www.mediapost.com/publications/article/291523/turn-settles-ftc-charges-over-supercookies.html
  26. How the NSA might use Hotmail, Yahoo or other cookies to identify ...
  27. Snowden Documents Reveal NSA Attempts to Track Tor Users
  28. Attacking Tor: how the NSA targets users' online anonymity
  29. 'Tor Stinks' presentation – read the full document - The Guardian
  30. How the NSA got to anonymized Tor users
  31. What Is Evercookie and Why You Should Avoid It for Privacy's Sake
  32. Cookies, the GDPR, and the ePrivacy Directive - GDPR.eu
  33. What is Evercookie? - Multilogin
  34. 10 Companies Fined for Non-Compliant Cookie Banners - Enzuzo
  35. EU: CJEU Confirms that Legitimate Interests can cover purely ...
  36. How AI Helps Fight Fraud in Financial Services, Healthcare ...
  37. Cookie Consent Trends by Country: 2025 Global Compliance Guide
  38. The Psychology Behind Cookie Consent: Why Users Click "Accept"
  39. Over half of Gen Z and millennials often or always accept cookies
  40. Evercookie is not persistent in Chrome and Safari anymore #125
  41. It is possible to kill the evercookie - Ars Technica
  42. Storage Partitioning | Privacy Sandbox - Google
  43. Enhanced Tracking Protection in Firefox for desktop - Mozilla Support
  44. Third-party cookies and Firefox tracking protection - Mozilla Support
  45. In a swipe at Chrome, Firefox now blocks ad trackers by default
  46. Privacy Protection & Security Features - Brave
  47. Brave, fingerprinting and evercookies/supercookies - privacy
  48. Cookies Having Independent Partitioned State (CHIPS)
  49. Cookies Having Independent Partitioned State (CHIPS)
  50. ublock / block list bypass · Issue #134 · samyk/evercookie - GitHub
  51. How can I protect myself from Evercookies?
  52. CanvasBlocker – Get this Extension for Firefox (en-US)
  53. Evercookies and Tor Browser - Tor Project Forum
  54. 2023: Year in Review | The Tor Project
  55. r/privacy on Reddit: Just read about "evercookies." What should we ...
  56. Evercookie Demo
  57. https://www.expressvpn.com/blog/browser-fingerprints/
  58. Firefox Multi-Account Containers – Get this Extension for Firefox (en ...
  59. [PDF] Detecting and Defending Against Third-Party Tracking on the Web
  60. The Web Never Forgets: Persistent Tracking Mechanisms in the Wild
  61. The Web never forgets: Persistent tracking mechanisms in the wild
  62. [PDF] The Web Never Forgets: Persistent Tracking Mechanisms in the Wild
  63. The hidden perils of cookie syncing - CITP Blog
  64. How a new type of "evercookie" tracks you online - The Economist
  65. Brave vulnerable to evercookie tracking - Privacy Guides Community
  66. Lose the Trackers: The Best Private Browsers for 2025 - PCMag
  67. Economic consequences of online tracking restrictions: Evidence ...
  68. From fighting fraud to fueling personalization, AI at scale is ...
  69. AI Boosting Payments Efficiency & Cutting Fraud | J.P. Morgan
  70. Big Tech's Free Online Services Aren't Costing Consumers Their ...
  71. The impact of the General Data Protection Regulation (GDPR) on ...
  72. Chrome is Entrenching Third-Party Cookies For Some Sites ... - Brave
User Avatar
No comments yet.