Reminds me to write a firefox plugin to strip etags and "if-none-match" - pretty sure most pages can function just fine without them and use last-modified, etc instead. Kind of surprised to not find anything yet on addons.mozilla.org
Last-modified is just as vulnerable as ETag are since you can set any string as the modified date (it doesn't have to parse as a date) and the browser will replay it
That's a good point and this would not be practical in a regular browser session but if someone chooses private browsing, an extension could be sure to strip "last-modified" as well as "if-none-match".
Would hurt the server a little and reduce speed because there would not be any caching but still helps guarantee no tracking.
On a properly written server you could "fuzz" the date of "if-none-match". Then it would still work for caching, but would not uniquely identify you.
The trouble is that most servers are not written properly, the date is not parsed, rather it's string compared with the file date.
For example if the server sends the timezone as EST vs +0400 the browser will send it back exactly as it gets it, when normally you would think that should not matter.
The writeup about the two extensions for firefox is wrong, those two were meant to block the trick where you can determine if a user has visited a specific site/page by looking at the link color/state.
Comments
Reminds me to write a firefox plugin to strip etags and "if-none-match" - pretty sure most pages can function just fine without them and use last-modified, etc instead. Kind of surprised to not find anything yet on addons.mozilla.org
Last-modified is just as vulnerable as ETag are since you can set any string as the modified date (it doesn't have to parse as a date) and the browser will replay it
See my comment on the previous thread:
http://news.ycombinator.com/item?id=2825564
I am currently in the midst of writing a browser plugin to block all this bullshit:
http://github.com/nikcub/parley
considering just doing a browser fork since the browsers are so uncooperative.
You do that, and I'll just assign a unique UNIX timestamp to each visitor.
That's a good point and this would not be practical in a regular browser session but if someone chooses private browsing, an extension could be sure to strip "last-modified" as well as "if-none-match".
Would hurt the server a little and reduce speed because there would not be any caching but still helps guarantee no tracking.
On a properly written server you could "fuzz" the date of "if-none-match". Then it would still work for caching, but would not uniquely identify you.
The trouble is that most servers are not written properly, the date is not parsed, rather it's string compared with the file date.
For example if the server sends the timezone as EST vs +0400 the browser will send it back exactly as it gets it, when normally you would think that should not matter.
Interesting. Wikipedia references two add-ons written back in 2007 for this purpose. No idea if they still work on more recent versions of FF.
http://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags
The writeup about the two extensions for firefox is wrong, those two were meant to block the trick where you can determine if a user has visited a specific site/page by looking at the link color/state.