Supercookies

Regular cookies are like name tags—easy to remove. Supercookies are like tattoos: persistent, hard to erase, and often invisible to the user.

These tracking mechanisms abuse legitimate browser features (caching, security headers, storage APIs) to store identifiers that survive:

• Cookie deletion ("Clear browsing data")
• Private/Incognito browsing
• Browser cache clearing
• Some even survive browser reinstallation

HTTP Strict Transport Security (HSTS) is a security feature—it tells browsers to always use HTTPS for a domain. But it can be weaponized for tracking.

How the Attack Works

1. Tracker controls multiple subdomains: a.tracker.com, b.tracker.com, etc.
2. On first visit, specific subdomains are set as HSTS (HTTPS-only)
3. This creates a binary pattern: a=1, b=0, c=1, d=1 = "1011"
4. On return visits, browser's HSTS behavior reveals the stored pattern
5. Pattern = unique identifier that survives cookie deletion

User ID: 42 (binary: 101010)

Subdomains set as HSTS:
✓ bit0.tracker.com (HSTS ON)  = 0
✗ bit1.tracker.com (HSTS OFF) = 1
✓ bit2.tracker.com (HSTS ON)  = 0
✗ bit3.tracker.com (HSTS OFF) = 1
✓ bit4.tracker.com (HSTS ON)  = 0
✗ bit5.tracker.com (HSTS OFF) = 1

Reading: Check if HTTP → HTTPS redirect occurs
Result:  Decode binary → User ID 42

Your browser caches favicons (the little icons in browser tabs) to speed up loading. This innocent feature becomes a tracking vector.

The Technique

1. Website serves a unique favicon per user on first visit
2. Favicon is cached—browser won't request it again
3. On return visits, server checks which favicon the browser requested
4. Cached = returning user; new request = new user

Why it's nasty: Favicons are rarely cleared. Most "clear browsing data" options don't touch them. Even switching to Incognito mode might not help if the favicon is already cached.

ETags (Entity Tags) help browsers know if cached content is fresh. When abused, they become persistent identifiers.

Normal ETag Flow

Server: ETag: "abc123"
Browser: (caches image with ETag "abc123")

Later...
Browser: If-None-Match: "abc123"
Server: 304 Not Modified (use cached version)

Tracking Abuse

First visit:
Server: ETag: "USER-ID-7a3b9f2c" ← Unique per user!

Return visit:
Browser: If-None-Match: "USER-ID-7a3b9f2c"
Server: "Ah, user 7a3b9f2c is back!"

→ Identifier stored in HTTP cache
→ Survives cookie deletion
→ Works across sessions

KISSmetrics scandal (2011): This company was caught using ETag tracking to respawn deleted cookies. They settled a class-action lawsuit but the technique lives on.

Modern browsers provide powerful storage APIs. While not as sneaky as HSTS or ETags, they're commonly abused for tracking persistence.

"Cookie syncing" combines these methods: if one storage mechanism is cleared, others restore the ID. Evercookie demonstrated respawning from 17 different storage locations.