jonasstrehle/supercookieArchived
Supercookie
Supercookie is a browser fingerprinting tool that assigns persistent, cross-session tracking identifiers by exploiting the browser's favicon cache. It operates without storing any data on the server, relying entirely on the browser's cache behavior to maintain tracking state across visits, including during incognito or private browsing sessions.
The technique works by encoding unique user identifiers through distinct favicon subpaths, creating separate cache entries for each tracking token. A sequence of HTTP redirects through multiple favicon subpaths writes and reads cache-based tracking patterns, while the favicon's special cache handling circumvents modern browser cache partitioning that would normally isolate tracking data. The system scales exponentially by adding more subpath redirects, increasing the number of distinguishable users at the cost of longer read and write times.
The tool provides a cache-based fingerprinting method that survives browser restarts and cache clearing, making the tracking token difficult to remove. It identifies users in private browsing sessions by leveraging the favicon cache's long-lived storage characteristics, bypassing standard privacy protections that other tracking methods cannot overcome.