Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

As it turns out, he simply uses your IP and User Agent string. See https://github.com/lucb1e/cookielesscookies/blob/master/inde...

No E-Tag tracking is taking place, since the E-Tag is never send to the server for the index.php request (only for the image request). In theory he could update the session after your IP changed, but he does not seem to do that (the image requests hold on to the old E-Tag).

So, basically, to me it seems like the whole point/post is invalid. Please correct me if I'm wrong.



You're wrong. That line of code is just to create something random, he could have used rand() if he wanted to, but it's not as "random".

And if you take a look in the .htaccess file, you'll notice that the images request also goes to index.php.


I saw the .htaccess, but that still doesn't link the request of index.php to the request of index.php?tracker.

I just tested it by changing my IP while staying in the same browser session. After an IP change the page only displays '1' for the number of visits, exactly as you would expect when reading the code (since the E-Tag for the image is kept (and the image request updates the counter), but the index.php uses your IP+UA combo to determine the session). This code is flawed and doesn't do a thing.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: