Status of CCleaner & evercookies

[anna24]

I found one old post on the forum about evercookies & CCleaner cleaning them. http://forum.pirifor...ie&fromsearch=1

 

Posted 23 December 2010 - 08:40 PM

Does CCleaner combat regenerative cookies like EverCookie?

Yes.

 

Haven't seen anything recent nor anything I remember in any release notes of new CCleaner versions. Surely, if the devs were confident it could handle them, they'd put it in the Features??

 

 

BUT, I've yet to find out how to identify these evercookies in Firefox (now v12). Maybe I've never gotten one, but I don't know exactly what to look for - where.

 

On one of Bruce Schneier's posts about evercookies https://www.schneier...vercookies.html

he mentions these possible locations they could be stored (but still doesn't say / show what the cookies look like).

ALSO doesn't say which browser these locations (below) would be for:

 

"Specifically, when creating a new cookie, it uses the following storage mechanisms when available:

• Standard HTTP Cookies
  
• Local Shared Objects (Flash Cookies)
  
• Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out
  
• Storing cookies in Web History (seriously. see FAQ)
  
• HTML5 Session Storage
  
• HTML5 Local Storage
  
• HTML5 Global Storage
  
• HTML5 Database Storage via SQLite"
  

What do (might) evercookies look like in Firefox & where would these locations be - in the profile, in a folder on C:\ - similar to where Flash stores LSO cookies, or...?

Thanks!

[Nergal]

??? You know that the thread you found is the FAQ, right? You know that FAQ stands for "Frequently Asked Questions", right? The Stresser is on Frequently in that phrase

 

That said, I did your homework for you, because the search function in ipBoard is not very good

 

okay, I just gave it a shot (running the simple test on evercookie site) with CCleaner (latest 2.36) >>> running CC when the browser is closed gets rid of everything, including the "evercookie" thing. At the opposite, only relying on FF4 self cleaning feature is not enough.

 

And a few more Threads http://www.google.com/search?hl=en&q=site%3Apiriform.com%20evercookie

 

in the future you can usually use this formula to find older threads on this and many other sites:

Go to Google

type into the searchbox

{What You are Looking For} site:{The Website You Wish to Search}

Note the {} stand for wild cards, replace them with actual stuff (without the {} )

[anna24]

OK, Nergal. I appreciate the tip about searching, because you're right - the search function on this & many sites stinks. That post was also talking about FF 4 - we're eons past that now on v12. HTML5 wasn't being used back then. Sarcasm's unnecessary. Please cut me some slack - spent several hrs today reading articles trying to find out what an evercookie would LOOK like & found nothing.

 

Finally wound up here & search isn't that great. I can say, nothing in web searches for +evercookie brought up any CCleaner related hits - at all.

 

Point was, AFAIK - Piriform's never officially mentioned cleaning evercookies (other than buried in that post, which most people in Cyberland will never see).

I really wonder why. Is it because they don't think users care? That can't be it.

Is it because it doesn't work consistently enough to advertise it as a feature? Possible.

Is it because they don't want to look too appealing, causing excessive sales hikes? Nah.

 

OK, little sarcasm of my own - but really, why don't they use it as a selling point, if it works well?

[Alan_B]

Point was, AFAIK - Piriform's never officially mentioned cleaning evercookies (other than buried in that post, which most people in Cyberland will never see).

I really wonder why. Is it because they don't think users care? That can't be it.

A surgeon who saves lives on the operating table with a wide range of procedures is unlikely to showcase his skill at curing ingrowing toenails.

 

If Piriform published a list that detailed everything that CCleaner could do,

I would not want to read it,

and I certainly would not want to be the guy that had to document everything.

[login123]

Hi, anna24.

In the topic below there is a screenshot of windows explorer showing some evercookies in a sandbox. It's on page 2. Might give you some idea of what to look for on your "real" system to see if CCleaner removes them.

http://forum.piriform.com/index.php?showtopic=29862&st=0

 

Edit: Topic is sort of long. I always try to check for myself how a software works ... but if you don't want to do that, maybe one of the moderators will say whether CCleaner gets at evercookies at this time.

[anna24]

ubertweakerneverhapn, thanks, but image link doesn't open for me. Usually no problem - esp. if working for others. I'd like to see the entries.

One issue - I may not have evercookies now, so software that can detect them (but doesn't say so) - wouldn't find any. I wouldn't know if I'm clean or a prgm can't / didn't detect them. Image link not withstanding, how would I know if a prgm detects xyz, if I've never seen it?

 

Super Hero, spoken like a true politician. Part of CCleaner's main "Features" page:

Internet Explorer

Temporary files, history, cookies, super cookies, Autocomplete form history, index.dat files.

Firefox

Temporary files, history, cookies, super cookies, download history, form history.

......

Point: supercookies not = evercookies / zombie cookies / respawning cookies. Evercookies & their ilk have potentially far more serious implications than super cookies (assume mean LSOs) or temp files. CCleaner probably needs to update their website. I'll drop 'em a line.

 

Most people don't understand what evercookies can do, or even heard of them. An ounce of prevention is worth a pound of cure.

[hazelnut]

anna24 you have to copy and paste that link into a web browser to see it, It is not a clickable link.

[Andavari]

maybe one of the moderators will say whether CCleaner gets at evercookies at this time.

 

There's no mention of them at all in the change log/history which I keep in a text document.

[Nergal]

Because there was no need for any change log. IIRC ccleaner was already cleaning at least 98% (est.), if not all*, of the problem areas at the time of the revelation of the Evercookie. was an evercookie ever sent out into the wild? AFAIK the only place that was actually serving them was the Proof of concept site.**

 

 

*I'm pretty sure it was all the locations that an upgrade to ccleaner was not even needed in order to cover the removals via all browsers at the time

 

**A google Duck Duck Go search provides no further results past the original opening on my thread on evercookie, the one to which I linked.

[anna24]

Hazelnut, I got to the linked post fine. the image link wouldn't open by clicking or by copy / paste. The site the image(s) was stored on opened, but the images wouldn't. Not by any means. Even looked at page source & tried copy / paste the link from that. Maybe it doesn't like some ad or tracker blocker I have. If offsite images are still active, I usually have no problem - but I've not seen that hosting site before.

 

Nergal,

AFAIK the only place that was actually serving them was the Proof of concept site.**

That appears to be incorrect.

http://ashkansoltani...pawn_redux.html

Additionally, Hulu, Spotify, and many others were also respawning using code provided by analytics firm KISSmetrics.

Also, see section 3) PREVALENCE, for how many sites in studies were found to be using some form of evercookie / respawning / zombie cookies.

This thing is definitely alive & well in the wild.

 

That is only one article that has research on which / how many sites are using this technology. I believe a few, after being "outed" were "shocked" that those type cookies could be so privacy invasive & "claimed" to stop the practice. But only a few.

ccleaner was already cleaning at least 98% (est.), if not all*, of the problem areas at the time of the revelation of the Evercookie

CCleaner 3.18 doesn't seem to find webappstore.sqlite in any of my Firefox 12 (or earlier) profiles. The files exist in some profiles & that is where some HTML5 data is stored (mentioned as one of the "hiding" places).

 

Could be a problem on my system - maybe others can confirm if CCleaner is finding webappstore.sqlite in Firefox to clean.

[hazelnut]

anna, pixpipline is a commonly used image hoster on this forum. As you say it must be some kind of ad blocker or setting you have.

 

I've taken a screenshot of the link and uploaded it here so you should be able to see what member login123 was talking about.

[anna24]

Thanks hazelnut,

Thanks you. Interesting - they can have different file type extensions.

 

Were those 2 entries w/ .swf & .pl extensions from ONE cookie? I wonder if an evercookie script writer wanted to, one cookie hidden in ~ 12 - 15 common locations could all have diff names & extensions?

 

This site that did statistics on usage of many variants of evercookie technology (provided by diff companies) shows a LARGE # of variants, along w/ # of sites they found using each. Just a snapshot in time, of course. http://trends.builtw...ics/KISSmetrics

 

 

 

Technologies with similar web coverage to KISSmetrics (just a FEW from the list).

 

Name..........Sites FireStats 498 SiteSpect 4,001 Gemius 218 Ignition One 1,733

 

What is "Peek" that you used to view the cookie contents & is it generally available?

[login123]

Hi, anna24. Here is the clickable link. http://forum.piriform.com/index.php?showtopic=29862&st=0

You can read the whole topic if you like.

 

Didn't post it that way before for obscure security reasons. Don't really understand them myself, but it seems to be better.

 

For what it's worth, the only reason I posted the pictures was to show where some of the files were, so anyone could check for themselves if they wanted to. The process of doing that is a pain in the neck, and probably not absolutely necessary, but I usually do it to see if a software is behaving as advertised.

 

CCleaner did work.

[Nergal]

also that's the thing with the ever"cookie" it's a burst of multiple files into multiple identity locations (flash cookie, local storage, cookies, privacy cookies, java etc (note these may not be the exact locations used, I'm kinda too lazy today to check))

[anna24]

ubertweakerneverhapn, thanks.??No, I COULD read the post - I just couldn't open the image links.??Actually, the pic site opened, but images wouldn't display - which Hazelnut took care of by posting the image inline.??Thanks anyway.

 

Also, I've discovered that one site on one of the lists of sites using persistent tracking cookie technology, contained in the link from reply # 10, is a site closely assoc. w/ a very well known browser privacy addon.??It would be very hypocritical & a pretty big slap, if true.

 

I looked at the page source & at many of the scripts' code contained on the page, but don't have enough training to tell for sure if that site is still using the (java script) persistent tracking cookie technology.??The type of code used is spelled out pretty well on several site, but I don't know enough about it to be sure.

 

I need to find someone w/ excellent java script coding skills to look at the page before I confront them or make it public.??There is no doubt the site is on a list of sites using the technology at one time.??Doesn't mean they still are.

[nodles]

ubertweakerneverhapn

/OT btw the nick is login123, not ubertweakerneverhapn (that's just the "title").

[anna24]

Yes, I knew that... no, really!...I...uh

I bet you're a great tweaker - don't sell yourself short.

[login123]

/OT btw the nick is login123, not ubertweakerneverhapn (that's just the "title").

 

Thats the second time that's happened, a new member using the title. Never happens to Andavari, nobody writes "Thanks, Captain Spectacular..." nor to Nergal, you never see someone write "Thanks Volunteer CCleaner Demon/Post Meddler ... "

 

I'm gonna change it, causes too much confusion, not sure why, but it does.

[Alan_B]

I'm gonna change it, causes too much confusion, not sure why, but it does.

We all have to login before we can post on this forum,

so it appears that 122 people logged in before you this morning

[nodles]

Never happens to Andavari, nobody writes "Thanks, Captain Spectacular..." nor to Nergal, you never see someone write "Thanks Volunteer CCleaner Demon/Post Meddler ... "

[DogAtMyFeet]

Hate to drag this back to Evercookies, but what is the state of play regrading CC removing them?

 

I installed the Firefox add-in suggested to disable "Referrer" and have not yet found a website the objects to it being set at zero for "no"

 

Can I assume from that there are no Evercookies being set?

 

If there are some being set, can I count on CC removing them?

 

Thanks to all who are helping with this vexing issue.

[Nergal]

re CC and evercookie: if you read this very thread, and the ones linked you'd wonder why you asked this question, not trying to sound rude but could think of no other words to call this (thus the Demon/Meddler in my title).

 

Because there was no need for any change log. IIRC ccleaner was already cleaning at least 98% (est.), if not all*, of the problem areas at the time of the revelation of the Evercookie

…and now covers all aspects of the "cookie burst"

 

 

note: by using DuckDuckGo (thanks @hazelnut) instead of google/yahoo/bing you can, in settings, turn off referrer from search engines

[DogAtMyFeet]

Nergal, if that first "meddling" comment was directed at me, then I find it strange you would say that. Yesterday, I did indeed read this thread and the others linked and I came back to re-read them again this morning.

 

I have yet to find any definitive statement that CC will actually handle all evercookies. Maybe I am stupid and too dense to see it, but it certainly alludes me. I am an Engineer and I deal with facts and realities, not suppositions, "should" and/or "maybe."

 

It is for these reasons I was requesting a qualified statement of fact.

[Alan_B]

I have yet to find any definitive statement that CC will actually handle all evercookies. Maybe I am stupid and too dense to see it, but it certainly alludes me. I am an Engineer and I deal with facts and realities, not suppositions, "should" and/or "maybe."

As an engineer you should define your terms.

What did you mean by Evercookies.

What will they be tomorrow.

It is my understanding that the original known evercookies have evolved. They are not static.

Are you really asking for an assurance that the current version of CCleaner will handle all future cookies that may arrive through all browsers including those not yet developed ?

 

Do you as an engineer give categorical assurances about what may happen in the future ?

[Nergal]

Ok Ok I did not mean to have any bickering

 

so I will just say this in the plainist words possible, and ones that are peppered throughout the entirity of all on these posts,

as well as the SUPERSIMPLE answer given in the FAQ which the OP linked in her initial post

 

CCleaner,at the time the Evercookie was first publicized and (granting that the make up of the EC is the same) now, removes all known traces of evercookie.

 

Honestly I think the FAQ really sums this up best

Does CCleaner combat regenerative cookies like EverCookie?

Yes.

perhaps we should change the words "combat regenerative cookies like EverCookie" to "completly remove all known traces of Evercookies and other EverCookie-like regenerative cookies", and this would avoid the confusion that seems to be abound.