Status of CCleaner & evercookies

I found one old post on the forum about evercookies & CCleaner cleaning them. http://forum.pirifor...ie&fromsearch=1

Posted 23 December 2010 - 08:40 PM

Does CCleaner combat regenerative cookies like EverCookie?

Yes.

Haven't seen anything recent nor anything I remember in any release notes of new CCleaner versions. Surely, if the devs were confident it could handle them, they'd put it in the Features??

BUT, I've yet to find out how to identify these evercookies in Firefox (now v12). Maybe I've never gotten one, but I don't know exactly what to look for - where.

On one of Bruce Schneier's posts about evercookies https://www.schneier...vercookies.html

he mentions these possible locations they could be stored (but still doesn't say / show what the cookies look like).

ALSO doesn't say which browser these locations (below) would be for:

"Specifically, when creating a new cookie, it uses the following storage mechanisms when available:

  • Standard HTTP Cookies
  • Local Shared Objects (Flash Cookies)
  • Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out
  • Storing cookies in Web History (seriously. see FAQ)
  • HTML5 Session Storage
  • HTML5 Local Storage
  • HTML5 Global Storage
  • HTML5 Database Storage via SQLite"

What do (might) evercookies look like in Firefox & where would these locations be - in the profile, in a folder on C:\ - similar to where Flash stores LSO cookies, or...?

Thanks!

??? You know that the thread you found is the FAQ, right? You know that FAQ stands for "Frequently Asked Questions", right? The Stresser is on Frequently in that phrase ;)

That said, I did your homework for you, because the search function in ipBoard is not very good

okay, I just gave it a shot (running the simple test on evercookie site) with CCleaner (latest 2.36) >>> running CC when the browser is closed gets rid of everything, including the "evercookie" thing. At the opposite, only relying on FF4 self cleaning feature is not enough.

And a few more Threads http://www.google.com/search?hl=en&q=site%3Apiriform.com%20evercookie

in the future you can usually use this formula to find older threads on this and many other sites:

Go to Google

type into the searchbox

{What You are Looking For} site:{The Website You Wish to Search}

Note the {} stand for wild cards, replace them with actual stuff (without the {} )

OK, Nergal. I appreciate the tip about searching, because you're right - the search function on this & many sites stinks. That post was also talking about FF 4 - we're eons past that now on v12. HTML5 wasn't being used back then. Sarcasm's unnecessary. Please cut me some slack - spent several hrs today reading articles trying to find out what an evercookie would LOOK like & found nothing.

Finally wound up here & search isn't that great. I can say, nothing in web searches for +evercookie brought up any CCleaner related hits - at all.

Point was, AFAIK - Piriform's never officially mentioned cleaning evercookies (other than buried in that post, which most people in Cyberland will never see).

I really wonder why. Is it because they don't think users care? That can't be it.

Is it because it doesn't work consistently enough to advertise it as a feature? Possible.

Is it because they don't want to look too appealing, causing excessive sales hikes? Nah.

OK, little sarcasm of my own - but really, why don't they use it as a selling point, if it works well?

Point was, AFAIK - Piriform's never officially mentioned cleaning evercookies (other than buried in that post, which most people in Cyberland will never see).

I really wonder why. Is it because they don't think users care? That can't be it.

A surgeon who saves lives on the operating table with a wide range of procedures is unlikely to showcase his skill at curing ingrowing toenails.

If Piriform published a list that detailed everything that CCleaner could do,

I would not want to read it,

and I certainly would not want to be the guy that had to document everything.

Hi, anna24. :D

In the topic below there is a screenshot of windows explorer showing some evercookies in a sandbox. It's on page 2. Might give you some idea of what to look for on your "real" system to see if CCleaner removes them.

http://forum.piriform.com/index.php?showtopic=29862&st=0

Edit: Topic is sort of long. I always try to check for myself how a software works ... but if you don't want to do that, maybe one of the moderators will say whether CCleaner gets at evercookies at this time.

ubertweakerneverhapn, thanks, but image link doesn't open for me. Usually no problem - esp. if working for others. I'd like to see the entries.

One issue - I may not have evercookies now, so software that can detect them (but doesn't say so) - wouldn't find any. I wouldn't know if I'm clean or a prgm can't / didn't detect them. Image link not withstanding, how would I know if a prgm detects xyz, if I've never seen it?

Super Hero, spoken like a true politician. Part of CCleaner's main "Features" page:

Internet Explorer

Temporary files, history, cookies, super cookies, Autocomplete form history, index.dat files.

ff_16.png

Firefox

Temporary files, history, cookies, super cookies, download history, form history.

......

Point: supercookies not = evercookies / zombie cookies / respawning cookies. Evercookies & their ilk have potentially far more serious implications than super cookies (assume mean LSOs) or temp files. CCleaner probably needs to update their website. I'll drop 'em a line.

Most people don't understand what evercookies can do, or even heard of them. An ounce of prevention is worth a pound of cure.

anna24 you have to copy and paste that link into a web browser to see it, It is not a clickable link.

maybe one of the moderators will say whether CCleaner gets at evercookies at this time.

There's no mention of them at all in the change log/history which I keep in a text document.

Because there was no need for any change log. IIRC ccleaner was already cleaning at least 98% (est.), if not all*, of the problem areas at the time of the revelation of the Evercookie. was an evercookie ever sent out into the wild? AFAIK the only place that was actually serving them was the Proof of concept site.**

*I'm pretty sure it was all the locations that an upgrade to ccleaner was not even needed in order to cover the removals via all browsers at the time

**A google Duck Duck Go search provides no further results past the original opening on my thread on evercookie, the one to which I linked.

Hazelnut, I got to the linked post fine. the image link wouldn't open by clicking or by copy / paste. The site the image(s) was stored on opened, but the images wouldn't. Not by any means. Even looked at page source & tried copy / paste the link from that. Maybe it doesn't like some ad or tracker blocker I have. If offsite images are still active, I usually have no problem - but I've not seen that hosting site before.

Nergal,

AFAIK the only place that was actually serving them was the Proof of concept site.**

That appears to be incorrect.

http://ashkansoltani...pawn_redux.html

Additionally, Hulu, Spotify, and many others were also respawning using code provided by analytics firm KISSmetrics.

Also, see section 3) PREVALENCE, for how many sites in studies were found to be using some form of evercookie / respawning / zombie cookies.

This thing is definitely alive & well in the wild.

That is only one article that has research on which / how many sites are using this technology. I believe a few, after being "outed" were "shocked" that those type cookies could be so privacy invasive & "claimed" to stop the practice. But only a few.

ccleaner was already cleaning at least 98% (est.), if not all*, of the problem areas at the time of the revelation of the Evercookie

CCleaner 3.18 doesn't seem to find webappstore.sqlite in any of my Firefox 12 (or earlier) profiles. The files exist in some profiles & that is where some HTML5 data is stored (mentioned as one of the "hiding" places).

Could be a problem on my system - maybe others can confirm if CCleaner is finding webappstore.sqlite in Firefox to clean.

anna, pixpipline is a commonly used image hoster on this forum. As you say it must be some kind of ad blocker or setting you have.

I've taken a screenshot of the link and uploaded it here so you should be able to see what member login123 was talking about.

post-1555-0-48251500-1336195326_thumb.jpg

Thanks hazelnut,

Thanks you. Interesting - they can have different file type extensions.

Were those 2 entries w/ .swf & .pl extensions from ONE cookie? I wonder if an evercookie script writer wanted to, one cookie hidden in ~ 12 - 15 common locations could all have diff names & extensions?

This site that did statistics on usage of many variants of evercookie technology (provided by diff companies) shows a LARGE # of variants, along w/ # of sites they found using each. Just a snapshot in time, of course. http://trends.builtw...ics/KISSmetrics

Technologies with similar web coverage to KISSmetrics (just a FEW from the list).

Name..........Sites FireStats 498 SiteSpect 4,001 Gemius 218 Ignition One 1,733

What is "Peek" that you used to view the cookie contents & is it generally available?

Hi, anna24. Here is the clickable link. http://forum.piriform.com/index.php?showtopic=29862&st=0

You can read the whole topic if you like.

Didn't post it that way before for obscure security reasons. Don't really understand them myself, but it seems to be better.

For what it's worth, the only reason I posted the pictures was to show where some of the files were, so anyone could check for themselves if they wanted to. The process of doing that is a pain in the neck, and probably not absolutely necessary, but I usually do it to see if a software is behaving as advertised.

CCleaner did work.

also that's the thing with the ever"cookie" it's a burst of multiple files into multiple identity locations (flash cookie, local storage, cookies, privacy cookies, java etc (note these may not be the exact locations used, I'm kinda too lazy today to check))

ubertweakerneverhapn, thanks.??No, I COULD read the post - I just couldn't open the image links.??Actually, the pic site opened, but images wouldn't display - which Hazelnut took care of by posting the image inline.??Thanks anyway.

Also, I've discovered that one site on one of the lists of sites using persistent tracking cookie technology, contained in the link from reply # 10, is a site closely assoc. w/ a very well known browser privacy addon.??It would be very hypocritical & a pretty big slap, if true.

I looked at the page source & at many of the scripts' code contained on the page, but don't have enough training to tell for sure if that site is still using the (java script) persistent tracking cookie technology.??The type of code used is spelled out pretty well on several site, but I don't know enough about it to be sure.

I need to find someone w/ excellent java script coding skills to look at the page before I confront them or make it public.??There is no doubt the site is on a list of sites using the technology at one time.??Doesn't mean they still are.

ubertweakerneverhapn

/OT btw the nick is login123, not ubertweakerneverhapn (that's just the "title").

Yes, I knew that... no, really!...I...uh

I bet you're a great tweaker - don't sell yourself short.

/OT btw the nick is login123, not ubertweakerneverhapn (that's just the "title").

:lol: Thats the second time that's happened, a new member using the title. Never happens to Andavari, nobody writes "Thanks, Captain Spectacular..." nor to Nergal, you never see someone write "Thanks Volunteer CCleaner Demon/Post Meddler ... "

I'm gonna change it, causes too much confusion, not sure why, but it does.

I'm gonna change it, causes too much confusion, not sure why, but it does.

We all have to login before we can post on this forum,

so it appears that 122 people logged in before you this morning :)

Never happens to Andavari, nobody writes "Thanks, Captain Spectacular..." nor to Nergal, you never see someone write "Thanks Volunteer CCleaner Demon/Post Meddler ... "

:D