I shouldn't overstate what I'm doing - this is largely an exercise in reversing what they're doing. And when I figure it out I might have a little fun by way of verifying I figured something out.

Tools - I use Charles Proxy and perl with WWW::Mechanize (substitute your recreational language of choice). Sometimes JMeter is helpful, but that's kind of a rathole if you haven't had reason to subject yourself to it before.

I think a very effective way is to get much better control over your cookies, when you allow them to be set, under which conditions, on which sites.

I use a combination of CookieBro and Umatrix on Firefox for this. Cookies are only allowed for sites I actively want to log into. For sites that require cookies to function, periodic auto-deletion via CookieBro handles those.