(Hi Slashdot & The Register readers. Make sure to check the 2nd part on killing iPhone Evercookie's too)
Samy Kamar recently released his tool, evercookie. This uses multiple persistent data stores to set unique identifiers that can be used to identify your browser to a website. While my default Firefox browsing setup is safe against it, I noticed that the "disposable" Safari instance I used was not. I sometimes use a clean Safari instance to test or access things the tinfoil on my Firefox does not let me. After each use I reset everything in it. However, I noticed that evercookie would persist. Here's how to delete it and others using the same mechanisms for Safari on OSX 10.6 (working out the same for other browsers/OS' isn't too difficult):
userData mechanism: undefined
cookieData mechanism: 362
localData mechanism: 362
globalData mechanism: undefined
sessionData mechanism: 362
historyData mechanism: undefined
pngData mechanism: 362
etagData mechanism: 362
dbData mechanism: 362
lsoData mechanism: 362
If I reset Safari, but don't restart it, the cookie persists in these four locations. The force-cached PNG uses an RGB value as the identifier and is only cleared after a reset and restart:
pngData mechanism: 362
etagData mechanism:
userData mechanism: undefined
cookieData mechanism: undefined
localData mechanism: 362
globalData mechanism: undefined
sessionData mechanism: null
historyData mechanism: undefined
dbData mechanism: 362
lsoData mechanism: 362
However, even a reset and restart leaves us with the two HTML5 localData and SQLite locations, and a flash cookie:
pngData mechanism: undefined
etagData mechanism:
userData mechanism: undefined
cookieData mechanism: undefined
localData mechanism: 362
globalData mechanism: undefined
sessionData mechanism: null
historyData mechanism: undefined
dbData mechanism: 362
lsoData mechanism: 362
To this end, I wrote a small script (which Bernd turned into a GUI app for OSX) which will remove these and other cookies:
cat evercookie-kill.sh
#!/bin/bash
echo "Deleting evercookie locations Safari missed (see samy.pl/evercookie)"
rm -r ~/Library/Safari/Databases/*
rm -r ~/Library/Safari/LocalStorage/*
rm -r ~/Library/Preferences/Macromedia/Flash\ Player/\#SharedObjects/*
Running the script while Safari is running will have no effect. For it to work fully, you will need to reset Safari, exit, then run the script. This will clear out all the locations currently implemented in evercookie. While checking these locations, I was surprised to find data from all sorts of other sites, hence the removal of "*", but you can replace it with "samy.pl" if you want to target Samy's evercookie specifically (note, that's not the same as someone else's site implementing the evercookie). While the flash cookies had a large number of sites, there were a couple (cnn, foxnews, twitter and a few others I can't remember) using the HTML5 locations.
Tracked: Oct 13, 16:59
Tracked: Oct 16, 05:52
Tracked: Oct 19, 22:58
Tracked: Oct 21, 18:58
Tracked: Oct 21, 21:23
Tracked: Oct 25, 14:55
Tracked: Oct 25, 16:36
Tracked: Oct 25, 17:03
Tracked: Oct 26, 00:35
Tracked: Nov 01, 15:43
Tracked: Nov 02, 15:39
Tracked: Nov 02, 15:40
Tracked: Nov 02, 19:41
Tracked: Jul 08, 08:41
Tracked: Apr 05, 22:42