On Mon, 22 Aug 2016 19:45:52 -0000 "William Mattison" <mattison.computer(a)yahoo.com&gt; wrote: There is a program? called CCleaner that apparently will remove evercookies, as well. Here's a discussion about it. https://forum.piriform.com/index.php?showtopic=35769&&page=2

On Tue, 23 Aug 2016 20:05:31 +0930 Tim <ignored_mailbox(a)yahoo.com.au&gt; wrote: So, this brought evercookies to my attention. I noticed that even when offline, there was a google cookie in my cookie directory, even though google is not whitelisted. So, I deleted it. And, lo and behold, it came back. Like that old song, "The very next day, the cat came back, 'cause it couldn't stay away." This makes me suspect that google is using something like an evercookie. I have self-destructing cookies plugin, delete lso cookies, have html5 storage turned off, keep the cache cleared, and yet, there it is, while I'm offline. "Do no evil" indeed.

On 08/23/2016 09:32 AM, Drew Samson wrote: How would google dns go about setting an evercookie?

Allegedly, on or about 23 August 2016, Drew Samson sent: I get really sick of these sociopaths that build and release some evil thing allegedly to prove the concept. Like hell, they do it for their own pleasure, and for it to be used by the service they claim to be exposing. We all know that it's going to get used. -- Boilerplate: All mail to my mailbox is automatically deleted, there is no point trying to privately email me, I only get to see the messages posted to the mailing list. America, you've had a Bush show you that any idiot can become president, don't let a Trump prove that any asshole can.

On 08/23/2016 12:20 PM, stan wrote: Assuming that somebody wanted to use DNS to set a cookie, how would they go about it? Your browser doesn't interact with the DNS service directly, it asks your networking to set up a connection with a server and that uses DNS to translate the machine name into an IP address and make the connection. Google's DNS servers can't set or use a cookie on your browser both because they don't interact with it and because the DNS protocol doesn't have any way of setting or retrieving a cookie. Yes, I know that you aren't claiming that Google's DNS servers are manipulating evercookies, I'm just using your comment as a hook to describe just how absurd the idea is. It's just as foolish as thinking that you can get a STD by watching a video of unprotected sex.

On 08/23/2016 11:41 PM, Tim wrote: Except, of course, for the fact that most servers aren't running browsers, and if they are, that cookie will identify them, not you. The point I was making, and you didn't address is that there is no way to use the DNS protocol to set or retrieve a cookie in an end-user's browser.

Allegedly, on or about 24 August 2016, Joe Zeff sent: To be blunt, the points you missed, were: a. Not that it's the DNS protocol, but a DNS server, that was implicated. DNS servers can keep access logs, too. b. We were talking about web servers. It's kind of implicit that it's webservers and webbrowsers when talking about cookies. And since the exposé of the exploit talked about JavaScript, Flash, Silverlight, webhistory, and a variety of other website related things, the point was quite clear. But just to be sure, this link is practically a one-page list of things: https://en.wikipedia.org/wiki/Evercookie c. Cookies *do* identify *you* (or are able to). If you log into to anywhere that's in the middle of this spiderweb, it identifies you. If you don't log in, just browsing the web anonymously, it may not identify you, but certainly categorises you. And with a service that has a massive database at their disposal, and the longer you're on-line, it may well be possible to follow that through to an identification. e.g. You've posted on a public list, something will be databasing this list, recording messages and headers. It has your IP and your email address. Marry that up with something else logged on internet using the same IP at the same time, and it's a 99% chance that it's you. If they're lucky, some time while your browsing you'll use a server that they can set a cookie with. And use that as an aid to them further keeping track on you. You really do have to be one of the tinfoil hat brigade, never logging in, using things like TOR, stealing other people's WiFi, changing IPs, etc., all of the time to be able to avoid that kind of big brother watching (in the Orwellian sense) -- [tim@localhost ~]$ uname -rsvp Linux 3.9.10-100.fc17.x86_64 #1 SMP Sun Jul 14 01:31:27 UTC 2013 x86_64 Boilerplate: All mail to my mailbox is automatically deleted, there is no point trying to privately email me, I only get to see the messages posted to the mailing list. Hooray! I finally finished typing this email.

Tim: Joe Zeff: Not I... The information comes from someone else, originally. I did explain how, though. The majority of users, at this point, will probably be using a fixed device. Either their PC at home, or their mobile phone, on their own phone service provider. Either stands a good chance of always having the same IP, or some other way of fingerprinting them. And considering just how widespread google is, for instance, you can go to *almost* *any* website, and there'll be some google content incorporated into it (virtually every website I looked at yesterday). Just like doubleclick used to be. Making it all the more easy to keep tabs on you. It's a trivial databasing exercise, if you're familiar with actual relational databases, rather than flat spreadsheet barebones types of databases that people use from day to day. One database of DNS queries from one IP. Another database of websearches from one IP. Get the computer to join the dots for the overlapping records. It's what databasing used to be about - what things in this set of records co-relate to things in this other set of records (relational databasing), as opposed to just pull up the single file on John Doe and read his record (flat files). Then carry on and do the same co-relation exercise across some other records. Since it's actually a trivial thing (co-relating records when you're the world's biggest database), I say it would be cost effective, if you're actually trying to drive sales from the advertising, rather than just throw advertising at someone that's going to be ignored. Particularly when you're making the advertiser pay per advert, they want value for their money, and want their adverts to go to likely customers. -- [tim@localhost ~]$ uname -rsvp Linux 3.9.10-100.fc17.x86_64 #1 SMP Sun Jul 14 01:31:27 UTC 2013 x86_64 Boilerplate: All mail to my mailbox is automatically deleted, there is no point trying to privately email me, I only get to see the messages posted to the mailing list. Long ago I gave up on using Windows (TM) [Tantrum Machine], and I've never regretted it.

I was admittedly slow to learn this yet once I came to realize the overwhelming majority of their $ is made by advertisers paying them to be white-listed it seemed to me as if the fox was guarding the hen-house. They made a name for themselves doing a great job blocking ads yet to make $ in this effort they rely on advertisers paying them. They are funded by the folks they help frustrate. This just seems like a contradiction to me and rather than keeping tabs on how well they are adhering to their original intent I just sought an alternative and that's when I found uBlock Origin. I don't begrudge a company making $ and don't mind paying for a worthy service. However, the whole reason I use Fedora & switched from Windows was to use & advocate FOSS & the GNU approach to computing. It's also why I use GNOME & don't use Ubuntu. I understand AdBlock Plus uses the GPL...that's not the issue for me. Relying on what appears to me to be a company in conflict with itself is again why I moved on. I know Mozilla has in the past been primarily funded thru google; that would be $300,000,000.00 annually in years gone by. Their current contract with yahoo is not public at this time. I'm fine with that since imo it in no way contradicts their stated objectives and they provide great products to me at the same time. I'm not trying to be religious about this; I'm just trying to be helpful and answer your question. Drew

On Tue, Aug 23, 2016 at 09:03:02AM -0700, stan wrote: Firefox is doing this. You have to disable the spyware called "safe browsing" to get rid of it. And yes, it has been exploited by intelligence agencies around the world and may submit every single URL you visit to google if they want it. https://bugzilla.mozilla.org/show_bug.cgi?id=368255 Richard -- Name and OpenPGP keys available from pgp key servers

On Sat, Aug 27, 2016 at 08:48:58AM -0700, stan wrote: it is indeed enabled by default. Perhaps Fedora should disable that default. I can't remember when it ever warned me about a malicious site but it certainly causes extra traffic and additional spying opportunities. he also never answered valid concerns mentioned in the thread. It would have been quite easy to avoid many concerns and the later confirmed abuse of this cookie: just set the cookie against a different domain or the precise subdomain as requested in comment 16 and asked repeatedly again later in the thread. This would mean the cookie would be sent only for requests to safe-browsing and not for any other connection anywhere in google world (search,maps,mail, youtube...). This would have also reduced the network traffic they were so anxious about so it doesn't make sense technically to require a cookie against the main domain. The answer in comment 17 is less than convincing imho. I don't think the author of that comment is quite as naive about computer security and privacy as he pretends there. The good news however is that the cookie now seems to sandboxed, https://bugzilla.mozilla.org/show_bug.cgi?id=897516 although I haven't looked into the code if it is really enabled now. Some concerns remain, it appears impossible to expire this cookie and in principle a sophisticated attacker may still be able to get a complete list of the URLs that are visited - it will be only slightly more work to connect it with a particular user. google is not the only once who could be abusing this data. Richard -- Name and OpenPGP keys available from pgp key servers

On 08/24/2016 07:51 PM, William Mattison wrote: Have you checked bleachbit? I don't know if it works for evercookies, but it's worth checking out.

On Thu, 25 Aug 2016 02:51:56 -0000 "William Mattison" <mattison.computer(a)yahoo.com&gt; wrote: [snip] Privacy Badger. In fact, I've come to rely on it almost exclusively for active tracking denial. My reasoning is that surreptitious tracking is virus like. That is, the people doing it are actively evolving their attacks, and disregarding user preferences. So any fixed response is always one generation behind the bad guys. Privacy Badger is a form of AI, that looks for behavior that indicates tracking, rather than "making a list, and checking it twice". So, when a new tracker appears, it learns and automatically blocks it. I haven't looked at the code, so I don't know how sophisticated the algorithm is - given time and effort, I think it could become *very* sophisticated; intercepting javascript calls to determine who's calling, checking content creation, etc. Evercookies are like a real virus in that they *have* to do certain things if they are to survive, so blocking those things, or looking for them and removing them, will kill an evercookie. I also use self-destructing cookies and better privacy and no google analytics plugins. Ten seconds after I close a site, all cookies exclusive to that site are deleted. I have html5 local storage turned off, so I don't allow third parties to store data on my computer that way. I also have self-destructing cookies set to clear the local cache after a few minutes of inactivity (they suggest a few seconds, I think). I don't run flash. Sometimes a little inconvenient, but most sites are moving away from it. And in a few years (2018), when all the patents on mpg have expired (I think there are only two left), html5 will be able to use mpg as the fallback, and that will displace even more flash. Flash also seems to have regular security breaches. This link has a conversation about evercookies, and blocking them. It isn't very optimistic reading. One of the responses suggests using a technique very like what Drew Samson suggested, and took it further by using TOR, and remapping the MAC address of the virtual environment. A bridge too far for me. At some point, the mitigating measures become too burdensome. I notice that the suggestion of using private browsing got a downvote, but everything I've read suggests that this does block evercookies. http://security.stackexchange.com/questions/38101/how-can-i-protect-mysel... I used to use ghostery and noscript, and I think noscript definitely helps with blocking google and facebook, since it doesn't allow their ubiquitous content to run unless manually enabled. And I used to see ghostery blocking lots of sites - but it uses a static list of sites, sites which are trackers and good to block, but only as up to date as their information. I find privacy badger blocking the things I want blocked when I look. Noscript also keeps unwanted video from running when visiting sites. Hmmm, I've almost talked myself into enabling it again. :-) Maybe I'll try the uMatrix that Ahmad Samir suggested. I've been checking for where google is storing the data that re-creates their cookie after I delete it. I haven't found it yet, but I'll keep looking. It's the only cookie that does re-create itself, so that's an indication that what I'm doing is mostly working. Google has lots of smart people working there, so they could have taken the evercookie idea and moved it in new directions. And they could have put back doors into chrome and firefox. I doubt that they use the evercookie name or code, they'll have obfuscated it, perhaps made it part of a legitimate function call. I wonder how well creating a git, or other, repository around the .mozilla directory and doing diffs before and after browsing would work for finding hidden content? Or using the signature in the cookie, and doing a grep of the .mozilla directory, looking for that sequence. Ideas to try. The arms race continues.