(In-)Security of Cookies in HTTPS: Cookie Theft by Removing Cookie Flags

A Survey of Browser Fingerprint Research and Application

“…Traditional cookie-based user tracking technology has exposed more and more limitations. For example, cookies may be hijacked [70], modified [2], forged, and even injected from cookies [71]. More and more users choose to ban cookies or install privacy protection plug-ins, and even 10…”

“…Due to the powerful function of JavaScript, JavaScript code can be easily used to obtain many fingerprint information of the client's browser, such as browser version, operating system, and system architecture. Many researchers use JavaScript technology to obtain browser fingerprint [2][3][4][5]. Among them, Mowery et al also used the NoScript plug in the literature [9] to obtain its whitelist as part of the characteristic fingerprint.…”

“…For example, many websites abuse cookies for advertising [1]. And because cookies are stored in the local end of users, it is easy to lead to user information leakage and tampering [2]. These problems have led to a growing distrust of cookies, with many people installing add-ons to clear cookies or simply using private mode.…”

Browser Fingerprinting: Overview and Open Challenges

“…In this way, browser information such as operating system or browser version can be gained. Much research has utilized this approach, e.g., [3,4,9,10]. For example, Mowery et al used a plug-in known as NoScript and its whitelist for the characteristics of a fingerprint [14].…”

“…The most widely used technology for this purpose are cookies, and in recent years, they have grown increasingly problematic due to their misuse, such as for advertising [2]. Since cookies are stored locally (on the user's computer), user information leakage or tampering can be accomplished easily [3]. This resulted in a growing mistrust of cookies.…”