background preloader

Digital Body Language

Facebook Twitter

Google Analytics

BrowserSpy.dk. Evercookie - virtually irrevocable persistent cookies. Samy's home page || follow my twitter || email me || samy kamkar October 11, 2010: Reported on the front page of the New York Times Find the latest details, code, and implementations on github @ Cookie found: uid = currently not set Click to create an evercookie. Don't worry, the cookie is a random number between 1 and 1000, not enough for me to track you, just enough to test evercookies. Now, try deleting this "uid" cookie anywhere possible, then or evercookie is written in JavaScript and contains portions in Java, SWF/ActionScript (Flash) and C# (Silverlight).

What is the point of evercookie? Csshack, best website ever See CONTACT. Questions or comments, email me: code@samy.pl. A Primer on Information Theory and Privacy. If we ask whether a fact about a person identifies that person, it turns out that the answer isn't simply yes or no. If all I know about a person is their ZIP code, I don't know who they are. If all I know is their date of birth, I don't know who they are. If all I know is their gender, I don't know who they are. But it turns out that if I know these three things about a person, I could probably deduce their identity! There is a mathematical quantity which allows us to measure how close a fact comes to revealing somebody's identity uniquely. Because there are around 7 billion humans on the planet, the identity of a random, unknown person contains just under 33 bits of entropy (two to the power of 33 is 8 billion).

ΔS = - log2 Pr(X=x) Where ΔS is the reduction in entropy, measured in bits, and Pr(X=x) is simply the probability that the fact would be true of a random person. In the examples above, each starsign and birthday was assumed to be equally likely. An Application To Web Browsers.

Proof of Concept

Visitor statistic - Detecting a "unique" anonymous user. Panopticlick.