Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit20d08d8

Browse files
author
Luc
committed
link to a better version someone made
and other updates that I apparently forgot to commit,as well as small text fixes
1 parentbaae832 commit20d08d8

File tree

2 files changed

+71
-8
lines changed

2 files changed

+71
-8
lines changed

‎etag.diff‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
13,15d12
2+
< if (!ctype_xdigit($etag)) {
3+
< die("");
4+
< }
5+
18c15
6+
< $etag = substr(sha1($secret . rand()), 0, 18);
7+
---
8+
> $etag = substr(sha1($secret . sha1($_SERVER["REMOTE_ADDR"]) . sha1($_SERVER["HTTP_USER_AGENT"])), 0, 18);
9+
60,85c57,59
10+
< header("Content-type: image/png");
11+
<
12+
< $im = imagecreatetruecolor(400, 60);
13+
<
14+
< // Create some colors
15+
< $white = imagecolorallocate($im, 255, 255, 255);
16+
< $grey = imagecolorallocate($im, 128, 128, 128);
17+
< $black = imagecolorallocate($im, 0, 0, 0);
18+
< imagefilledrectangle($im, 0, 0, 399, 59, $white);
19+
<
20+
< // The text to draw
21+
< $text = 'visitor id: ' . $etag;
22+
< // Replace path by your own font path
23+
< $font = './font.ttf';
24+
<
25+
< // Add some shadow to the text
26+
< //imagettftext($im, 15, 0, 11, 21, $grey, $font, $text);
27+
< // Add the text
28+
< imagettftext($im, 15, 0, 10, 20, $black, $font, $text);
29+
< $text = "number visits: " . $session["visits"];
30+
< imagettftext($im, 15, 0, 10, 50, $black, $font, $text);
31+
<
32+
< // Using imagepng() results in clearer text compared with imagejpeg()
33+
< imagepng($im);
34+
< imagedestroy($im);
35+
<
36+
---
37+
> header("Content-type: image/jpeg");
38+
> header("Content-length: " . filesize("fingerprinting.jpg"));
39+
> readfile("fingerprinting.jpg");

‎index.php‎

Lines changed: 32 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,9 @@ function storesession($etag) {
8787
</div>
8888
<h2>Cookieless cookies</h2>
8989

90-
There is another obscure way of tracking users without using cookies or even Javascript. It has already being
91-
used by numerous websites but few people know of it. This page explains how it works and how to protect yourself.<br/>
90+
There is another obscure way of tracking users without using cookies or even Javascript. It has
91+
<a href="http://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags" target="_blank">already been used</a>
92+
by numerous websites but few people know of it. This page explains how it works and how to protect yourself.<br/>
9293
<br/>
9394
<br/>
9495
This tracking method works <b>without</b> needing to use:<br/>
@@ -98,10 +99,10 @@ function storesession($etag) {
9899
<li>LocalStorage/SessionStorage/GlobalStorage</li>
99100
<li>Flash, Java or other plugins</li>
100101
<li>Your IP address or user agent string</li>
101-
<li>Any methods employed by <a href="https://panopticlick.eff.org">Panopticlick</a></li>
102+
<li>Any methods employed by <a href="https://panopticlick.eff.org">Panopticlick</a> (at the time of writing, 2013)</li>
102103
</ul>
103104

104-
Instead it uses another type of storage that is persistent between browser restarts: <b>caching</b>.<br/>
105+
Instead, it uses another type of storage that is persistent between browser restarts: <b>caching</b>.<br/>
105106
<br/>
106107
Even when you disabled cookies entirely, have Javascript turned off and use a VPN service, this technique will
107108
still be able to track you.<br/>
@@ -110,8 +111,10 @@ function storesession($etag) {
110111

111112
<a name="demo"></a>
112113
<h3>Demonstration</h3>
113-
As you read this, you have already been tagged. Sorry. The good news is that I don't link your session id to any
114-
personally identifiable information. Here is everything I store about you right now:<br/>
114+
<i>Update (2025): Someone else made a better version here: <a href='https://potatocrunchcereal.com/cookielesscookies/' target='_blank' rel=noopener>potatocrunchcereal.com/cookielesscookies/</a></i><br/>
115+
<br/>
116+
As you read this, you have already been tagged. Sorry. The good news is that I don't link your session identifier to any
117+
personal information. Here is everything I store about you right now:<br/>
115118
<br/>
116119
<form method="POST" action="./">
117120
<b>Number of visits:</b><?phpecho$session["visits"];?><br/>
@@ -147,6 +150,8 @@ function storesession($etag) {
147150
<br/>
148151
<a name="#demotech"></a>
149152
<b>Technical stuff (and bugs) specifically about this demo</b><br/>
153+
<i>Update (2025): Note that the better version linked <a href='#demo'>above</a> should not have these problems.</i><br/>
154+
<br/>
150155
To demonstrate how this works without having to use Javascript, I had to find a piece of information that's relatively
151156
unique to you besides this ETag. The image is loaded <i>after</i> the page is loaded, but only the image contains the
152157
ETag. How can I display up to date info on the page? Turns out I can't really do that without dynamically updating the
@@ -200,8 +205,27 @@ function storesession($etag) {
200205
This would be another good alternative for 99% of the users because it has a relatively low performance impact
201206
while still limiting the tracking capabilities.<br/>
202207
<br/>
203-
204-
<div style="margin-top: 20px; color: #888; font-size: 0.9em;">
208+
<b>Update (2013):</b> I've heard the Firefox add-on SecretAgent also does ETag overwriting to prevent this kind of tracking
209+
method. You can whitelist websites to re-enable caching there while blocking tracking by other domains. It has been
210+
<a href="https://nodpi.org/forum/index.php/topic,4418.msg51737.html#msg51737" target="_blank">confirmed</a> that this
211+
add-on stops the tracking. <a href="https://www.dephormation.org.uk/index.php?page=81" target="_blank">SecretAgent's website</a>.<br/>
212+
<br/>
213+
<br/>
214+
<b>Update (2020):</b> A reader made a tool similar to EFF's Panopticon. It tries to check a few more things, and while it
215+
bugged out for me in Firefox, it's another interesting approach that might give you more insight if it works for you.<br/>
216+
<a href="https://privacy.net/analyzer/" target="_blank" rel=noreferrer>https://privacy.net/analyzer/</a><br/>
217+
<br/>
218+
<br/>
219+
<b>Update (2025):</b> Another reader made an improved version, I added the link in the text <a href='#demo'>above</a>.
220+
Their page does not have a source code link, but a diff was shared with me under the same license: <a href='etag.diff'>etag.diff</a>.
221+
Thanks!
222+
<hr/>
223+
<br/>
224+
Liked this? Follow me on <s><a href="https://twitter.com/lucb1edotcom">Twitter</a> or <a href="http://gplus.to/lucb1edotcom">Google Plus</a>!</s>
225+
So as of, ehm, a while, I'm not on Twitter anymore and RIP G+. To get in touch, use <a href='https://lucb1e.com/email-address'>lucb1e.com/email-address</a>.
226+
I'm on Mastodon but under a different name, feel free to ask it by email
227+
228+
<div style="margin-top: 40px; color: #888; font-size: 0.9em;">
205229
Written by lucb1e in 2013.<br/>
206230
All text, resources and methods on this page are hereby released as WTFPL - <a rel='license' href='http://www.wtfpl.net'>www.wtfpl.net</a>
207231
</div>

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp