Re:Firefox 85 cracks down on supercookies
by shakna on Tuesday January 26, 2021 @09:15PM
(#25923485)
> If you use a static URL, you'll know if you have a new session or not, but that doesn't tell you what the tracking ID was.
As Mozilla have said:
> "In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image."
The identifier is encoded into the image itself on a fresh fetch of the static URL, which can then be extracted by JS (which can access pixel data, and their RGBA channel values).
When a cache-hit is detected, you know you have an identifier that correlates to user history.
As Mozilla have said:
> "In the case of Firefox’s image cache, a tracker can create a supercookie by “encoding” an identifier for the user in a cached image on one website, and then “retrieving” that identifier on a different website by embedding the same image."
The identifier is encoded into the image itself on a fresh fetch of the static URL, which can then be extracted by JS (which can access pixel data, and their RGBA channel values).
When a cache-hit is detected, you know you have an identifier that correlates to user history.