Clearing browser cache might not clear tracking ETags due to transparent caching

From hxxp://lifecs.likai.org/2011/07/kissmetrics-and-life-of-etag.html :

 

Site that you can use to test for this: http://lucb1e.com/rp/cookielesscookies/.

 

I am running Chrome (Version 32.0.1700.76 m) on Win 7 and have enabled the following setting:

Chrome > Settings > Show advanced settings > Privacy > Content settings > Cookies > Keep local data only until I quit my browser.

At the http://lucb1e.com/rp/cookielesscookies/ web site, I save some text, and restart Chrome, it always says, Number of visits: 1

If instead I enable Allow local data to be set (recommended), it does remember my text and the "Number of visits" increases.

Mike

 

I have the same settings but they don't help on that site. It seems that your internet provider does not use caching.

 

In that particular test site, the same tracker image is used for everyone, so I'm not sure if this thread topic actually applies to it.

 

Well, I had entered some text into the field on that site, and that text was still there after I had cleared the cache and restarted the browser.

 

Right, because the site's server probably keeps your IP address on file, in case the ETag has been removed in the browser. I didn't know that when I first mentioned that test site.

http://aspartame.poc.ochronus.com/ uses only ETags.

 

I see - thanks! I will test it again with changing IPs.

Yes, and clearing the cache helps here.

 

You are right. I just performed that test again, cleared the cache and restarted my router to get a new IP from my provider - and that site did not recognize me.

 

so if I go there when my IP addr is 111.222.333.444 and they store/cache a cookie and then I get a new addr 222.333.444.555 and go back they won't know it's me again.

But...

someone else using the same ISP gets addr 111.222.333.444 at some point in time, maybe days later, will they appear to be 'me'? Or is there more involved?

 

@JW Clements: If your browser still has the ETag, you ought to be recognized whether or not your IP address changed. If your browser doesn't have the ETag anymore, then it seems to use your public IP address. According to another member in another thread who looked at the source code, your browser's user agent may also be involved as well.

 

This site provides a fake test according to JonDo's site:

https://anonymous-proxy-servers.net/blog/index.php?/archives/400-Cookieless-Cookie-Fake-Test.html

 

I have Firefox set to delete all data when I close it. I also use Sandboxie and I have Eraser configured to wipe all data when I delete the sandbox. What surprised me, and I did this several times, is that I deleted the sandbox and opened the browser and went to the site again and my text was there. So is there something to etags that is saved outside of the browser? Or is common belief that sandbox with Eraser deletes and wipes all content false?

Something else interesting. The text only reappears once. When I open the browser a third time it is gone. I did this several times with the same results.

Lastly, I have Shadow Defender installed. When I go to this site, enter the text, close the browser and reboot, the text does not reappear after I go back again. This may also be the case without Shadow Defender enabled but I didn't try it.

 

@caspian: See post #12.

 

LOL.... Thanks. I was really beginning to scratch my head on this one.