Are first-party cookies a privacy risk?

MrBrian · Jun 6, 2014

From First-Party Cookies:

Is blocking of third-party cookies useful to avoid the tracking of browsing habits of users by third parties? Let's make a small test. We installed a fresh Firefox and disabled third-party cookies in the configuration. This configuration setting is a little bit more restrictive than the new Firefox cookie policy, but suitable for our demonstration. Afterwards we opened 3 websites and took a look at stored cookies.

[...]

Conclusion

Tracking services are using sophisticated methods to get first-party status for their tracking elements to avoid blocking.

[...]

It is not possible, to use first-party cookies for cross-domain tracking. These cookies are only valid and accessible within the context of one domain. But by using additional tracking features, it is possible to link tracking data of multiple domains together.
Click to expand...

MrBrian · Jun 6, 2014

From paper "Cookie Blocking and Privacy: First Parties Remain a Risk" (2010):
Code:
PDF download http://www.truststc.org/education/reu/10/Papers/GomezG,YalajuJ_paper.pdf
Abstract

HTTP cookies are small files that can make surfing the web faster and more convenient. They can allow sites to recognize returning users so that they can avoid repetitive log in procedures when they visit their favorite sites. Although these type of cookies can be beneficial, they can also be used by third parties to track users. When a user visits a domain and cookies are set on their machine directly from that site’s server, these are called first-party cookies. When a third-party site sets cookies on this same domain, these are referred to as third-party cookies. Many of these third-party cookies are used to track user activity as they navigate within the domain and even when they leave to visit other domains. In the past few years, the five major shipping browsers have all implemented new privacy settings to help stop users from having their activities tracked.

In this paper, we describe our investigation of the effects of cookie blocking and privacy. We conducted two experiments to determine the effectiveness of cookie blocking in different browsers. Our first experiment was to collect raw statistics from all five major browsers while visiting all of Quantcast’s top 100 sites. We wrote a code in Python that opened all 100 pages at once in each browser, and then counted the number of cookies that were set, prevalence of each cookie name and the number of unique domains that set cookies. We ran this experiment with third-party cookies blocked and unblocked to compare the difference in each browser. Our second approach was an analysis of traffic to get a closer look at the exchange of cookies between our machine and different web servers using Wireshark. When we opened individual packets, we were able to locate the source IP addresses and domain names that the cookies originated from so we could tell who was setting cookies.

In our numerical results, we found that tracking cookies make up about 25% of all of the cookies set throughout our testing. Through traffic analysis, we found that third parties are finding alternative ways to set cookies on user’s machines by making them appear as first party cookies. That being said, we can say that many first party cookies could still potentially be trackers.

[...]

Conclusion

After analyzing our results, we found that in order to avoid being tracked by third-parties, simply blocking third-party cookies is not enough. In Wireshark we were able to see this clearly, as cookies are set in JavaScript on the first party site so the browser picks them up as first party cookies. Cookie sharing through server synchronization is a possible way that third parties use to obtain user activity information. Although this method is undetectable, it is a possibility that we must consider since it is as simple as a regular site sharing user data with a third party advertiser or analytics company.
Click to expand...

MrBrian · Jun 6, 2014

You can test if first-party and third-party cookies can be set in your browser via various methods at https://www.grc.com/cookies/forensics.htm.

itman · Jun 7, 2014

MrBrian said: ↑

You can test if first-party and third-party cookies can be set in your browser via various methods at https://www.grc.com/cookies/forensics.htm.
Click to expand...

Here's another site I use to test 1st and 3rd party cookies: http://www.enhanceie.com/test/cookie/

MrBrian · Jun 11, 2014

From paper "Behavioral Advertising: The Offer You Can't Refuse" (2012):

Krishnamurthy and Wills also describe how third-party tracking sites disguise themselves as first parties. We call it "DNS aliasing," a practice where "what appeared to be a server in one organization (e.g. w88.go.com) was actually a DNS CNAME alias to a server (go.com.112.2o7.net) in another organization (Omniture)." Practically, this renders consumers' attempts to block third-party cookies ineffective because first parties (such as go.com in the above example) have built their servers to allow third parties (Omniture in the above example) to instate cookies as first parties.

Krishnamurthy and Wills found a doubling in such DNS aliasing: [...]
Click to expand...

Log in or Sign up

Are first-party cookies a privacy risk?

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

itman Registered Member

MrBrian Registered Member

Log in or Sign up

Are first-party cookies a privacy risk?

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

itman Registered Member

MrBrian Registered Member

Useful Searches