I'm one of the authors of the paper. One of our findings was that third-party cookie blocking is only marginally effective. See the tables under cookie syncing in our summary [1] or in our full paper [2]. Trackers bypass cookie blocking in a variety of creative ways. We're currently investigating the bypassing mechanisms in more detail.

On the other hand, add-ons like Ghostery work much better.

[1] https://securehomes.esat.kuleuven.be/~gacar/persistent/index...

[2] https://securehomes.esat.kuleuven.be/~gacar/persistent/the_w...

People need to stop promoting Ghostery. It's made by Evidon, yet another tracking company. Just checkout their website and it's clearly obvious that everyone that installs this extension is doing them a huge favor:

https://www.ghosteryenterprise.com/

It's identical to the adware companies that promise to help remove adware from your computer... but for some reason people keep using it!

Slightly off-topic but something with my Iceweasel/FF install (v31) borks the layout of the blog completely -- content is shifted far to the right of the viewport for some reason. Looked fine on another computer, so not sure what's up. Also works fine in chromium. FYI.

Can you summarize for us how to avoid this kind of tracking? Is there much we can do besides Ghostery?

I block tracking at the domain level via a custom hosts file: http://someonewhocares.org/hosts/

Actually, I went one step further than this, I dump that hosts file into dnsmasq and set that as my primary domain controller for the home network. So anything connected via WiFi or ethernet (phones, tablets, laptops, etc) will also have tracking blocked.

A belated thanks. Much appreciated.

Third party cookie blocking on all modern browsers is a joke. I turn third party cookies off as a start, but sites can play all kinds of games with cookies to create "first party" relationships you don't know about, and that's not even including things like flash cookies or browser fingerprinting.

As a start, consider that if you turn off third party cookies, logging into gmail also logs you into youtube.com. Yes, both are owned by the same company, but they are clearly different domains and so youtube should be a third party in your transactions with gmail.

> As a start, consider that if you turn off third party cookies, logging into gmail also logs you into youtube.com. Yes, both are owned by the same company, but they are clearly different domains and so youtube should be a third party in your transactions with gmail.

That's because you don't sign into youtube, you go through Google's single sign on stuff which is a different domain.

Check again. The two sites are on different domains. In order to log into both, at some point someone needs to convey state information to a third party. Gmail logins are managed through accounts.google.com, so either you have a third-party relationship with accounts.google.com when you are on youtube.com, or you have a third party relationship with youtube.com when you are on accounts.google.com. Either way, you pick up a third party cookie.

You'll notice that even if you never (deliberately) went to youtube and you have 3rd party cookies turned off, a cookie for "youtube.com" will show up when you sign in. I haven't looked at it carefully, but I think they just put you through a chain of redirects when you click "log in" so that you have a first party relationship with each of the domains they want to sign you in to, and that's when they give you the cookie.