Comment by zwetan | Hacker News Reader

Comment by zwetan | Hacker News Reader

Parent Full thread

nope, there are number of ways to track visitors even when everything is blocked (like ga.js or whatever) and all cookies disabled.

With user-agent header, ip address, etc. you can uniquely identify a user because there is enough entropy, see https://www.eff.org/deeplinks/2010/01/primer-information-the...

and that basically allows you to emulate a session id without cookies and without appending it to the URL

You can also use the cache to know if the user already visited some content or not, explained here http://joshduck.com/blog/2010/01/29/abusing-the-cache-tracki...

And finally, you can use CSS custom styles to know if the user already visited some web sites or not, see spyjax http://davidwalsh.name/ajax-evil-spyjax

granted, the user can disable JS, change the user-agent, but I would argue they are still trackable

There isn't always enough entropy to uniquely identify a user - you can't rely on that to provide accurate tracking. If people are coming from a corporate environment using terminal servers then every single browser will identify as one user by that method.

Most browsers are now taking steps to stop the CSS custom styles hack working - for example this doesn't work in Chrome anymore. The website can show you which websites you've visited with the change in colour for the link state however it can no lonqer query it.

it would be as accurate as the server logs, the only difference is I don't need to analyse those logs I can keep using google analytics.

that's my whole point: "yadda yadda yadda ublock or adblock or whatever block ga.js on the client side haha you can not track the visitors anymore"

nope I can still track them and I don't need to even bother analysing the server logs

server side:

  1. I can detect if there is a _ga cookie
  2. if not, I can generate a UUID based on the user-agent and IP
  3. and I send my pageview from the server side

it is not perfect, I would certainly not use that UUID to identify a login session but it does work without me having to stop using google analytics.

> "There isn't always enough entropy to uniquely identify a user"

there is, read the EFF link it explains all that nicely

TL;DR

  - you can not send tracking client side anymore
  - OK, I can send tracking server side, go ahead try to ublock that

Reply on news.ycombinator.com