ua-client-hints VS evercookie

The Client Hints specification covers a lot of this already - https://wicg.github.io/ua-client-hints/#content-adaptation-u... ... DPR, width, and viewport-width are already available in some browsers. Hopefully other hints will be available soon.

I encourage you to review the decision making and engage in the discussion here: https://github.com/WICG/ua-client-hints

chrome is starting to implement UA-CH, which splits up user agent info into individual headers sent by the client: https://wicg.github.io/ua-client-hints/

As a Firefox/FreeBSD user occasionally annoyed by this nonsense, but not being knowledgeable about modern web standards evolution, I wonder if https://wicg.github.io/ua-client-hints/ will fix this by killing User-Agent headers.

ua-ch might reduce the amount of data browsers send, though it's gonna take a while to move away from regular user agents: https://wicg.github.io/ua-client-hints/

There is a JS companion to this proposal that splits up the information in a similar way

https://wicg.github.io/ua-client-hints/#interface

For a bad actor, this is easily work-around-able using various local persistence mechanisms like evercookie. https://samy.pl/evercookie/

If you're talking about the https://samy.pl/evercookie script, for what it's worth, you can defeat it (at least I can with my settings and no extensions) by...

This reminded me of something I haven't thought about in awhile: evercookie - https://github.com/samyk/evercookie

Sure, as Sevetarion said earlier "There is no actual cooke, it's just a metaphor". In contrast to "fingerprinting" a user's unique device configuration (as the rest of this demo does), anti-tracking folks use the term "cookie" broadly to refer to various ways sites can store unique values to be retrieved later. This usage grew out of Samy Kamkar's awesome "Evercookie" work in 2010 (later aka "supercookie") https://samy.pl/evercookie/

Nothing comes to mind directly, sorry. It’s something I want to look deeper into myself as well. One cool thing to look at is evercookie which is a GitHub project that allows you to make tracking cookies and the likes. The repo itself hasn’t been updated in a while but can probably be a good source of information.

Evercookie and the Favicon vuln

Client side: Use Evercookie

Also note, something like the Evercookie may also still be a thing that works. It stores data not only in cookies, but also in everything else that can retain any form of state (localStorage, HTTP browser history, HTTP cache for custom fingerprinted images generated by the server, etc.), and if even one spot doesn't get cleared by the user, the script can re-populate all the spots making for a very persistent "cookie."