How is this website tracking me?

[globoy]

Like a lot of you I run an adblocker and privacy badger to remove the clutter of advertising and to prevent some tracking (on Chrome and Firefox).  However some websites refuse to work at all when they detect I'm doing that so I also use Safari without any adblockers for those websites.  Then I tell Safari to clear history and all website data when I'm done.  It's been a successful strategy so far.

However one website (nationalreview.com) still knows I've visited it and refuses to let me read articles after it thinks I've read enough free ones for the month.  This is after I clear everything and close Safari.  I've gone and looked and Safari says it has no cached website data or cookies at all after a clear.

Of course that's their prerogative but I'm still curious how they do it.  Anyone have any ideas or the tools to investigate?  This is the only website that I've found that is smart enough to have knowledge of my use survive the clears.  Is there something Safari isn't clearing or is there some other way a clever website can recall previous visits?

[tggzzz]

Like a lot of you I run an adblocker and privacy badger to remove the clutter of advertising and to prevent some tracking (on Chrome and Firefox).  However some websites refuse to work at all when they detect I'm doing that so I also use Safari without any adblockers for those websites.  Then I tell Safari to clear history and all website data when I'm done.  It's been a successful strategy so far.

However one website (nationalreview.com) still knows I've visited it and refuses to let me read articles after it thinks I've read enough free ones for the month.  This is after I clear everything and close Safari.  I've gone and looked and Safari says it has no cached website data or cookies at all after a clear.

Of course that's their prerogative but I'm still curious how they do it.  Anyone have any ideas or the tools to investigate?  This is the only website that I've found that is smart enough to have knowledge of my use survive the clears.  Is there something Safari isn't clearing or is there some other way a clever website can recall previous visits?

I would guess IP address plus browser fingerprinting.

[edpalmer42]

Although CCleaner has a mixed reputation, it seems to be able to find find a long list of 'cookies' that don't appear in Firefox's list of cookies.  They're not actual browser cookies, but are still able to store cookie-like information.  CCleaner is free so it might be worthwhile to see what it has to say.

Custom Clean -> Applications Tab -> Change checkboxes as necessary (not really necessary since this is just the analysis stage) -> Blue Analyze button at the bottom of the window -> Double click on the browser cookies line listed above the Analyze button.

At this point nothing has been changed.

Ed

[globoy]

I would guess IP address plus browser fingerprinting.

Thanks.  Wonder what all is in a browser fingerprint.  I did change the user agent from safari to edge but they still blocked me.  Someday I'll try when I've moved to a different network.

[ejeffrey]

JavaScript fingerprinting goes well beyond just the user agent and other advertised setting like language.  For example:

https://github.com/fingerprintjs/fingerprintjs

[golden_labels]

Before you even obtain and run their webapp, nationalreview.com attempts to run at least the following spyware: Alphabet, Instiengage, LiveIntent, Olytics, Sailthru, and Scorecard. With that much thrown against you, chances of something sliping through are high and defence is almost impossible.

As for the specific technique, it may be everything: starting from what has been mentioned above (fingerprinting based on address, browser characteristics), through biometrics and behavioral patterns (like lacking or having insufficient prior tracking history, activity hours), finishing at hiding tracking information in various places (service workers, local storage, browse history, IndexedDB).

It may as well be a false positive and you are simply unlucky to be in a minority that has fallen into a wrong bin.

I’m giving an “everything” answer, because — even if I wished to donate my time to analyzing all these programs — they may differ by geographical location, prior tracking history, or time of delivery. So, after huge effort spent on analysis, I may find nothing or my findings would be useless to you.

[Whales]

What version of Safari?  You might not be clearing localStorage, which acts similarly to cookies.

https://superuser.com/questions/236558/how-to-clear-all-html5-local-storage-from-safari

FWIW I can visit that site fine and read pages with my adblocker in Firefox (ublock Origin).  I also run an addon to help me clear cookies & localStorage (cookie autodelete)

[Whales]

I would guess IP address plus browser fingerprinting.

Thanks.  Wonder what all is in a browser fingerprint.  I did change the user agent from safari to edge but they still blocked me.  Someday I'll try when I've moved to a different network.

IP address is useless these days, too many ISPs do CGNAT. 

Browser fingerprinting is definitely a thing.  It's not always effective ("most" users might look the same or similar) but possibly effective enough to ID the sort of people that would frequent a technical site like these forums. 

A page to test out your fingerability(TM): https://coveryourtracks.eff.org/   I'm of course 100% unique (yay system installed fonts and canvas) but only if I enable javascript for them

[DiTBho]

I don't understand why we should be alarmed if a site keeps track of its visitors.

In every modern shopping center we have at least 2 rolling camera views per 10m^2 to ensure that you do not commit acts of vandalism, break windows, steal goods, etc.

There are at least double the number of cameras on the street (in the USA, UK and Japan), to ensure that no problems occur, and if necessary, to allow the police to identify who caused them.

Yup, Big Brother Tecnology, but why would a web-site let anyone in without supervision, including those who enjoy pooping on the walls?

[mikerj]

I don't understand why we should be alarmed if a site keeps track of its visitors.

In every modern shopping center we have at least 2 rolling camera views per 10m^2

And we should be concerned about that too.

[DiTBho]

And we should be concerned about that too.

Have you ever been to the automated store in New York? There are no human shop assistants, there are no human staff, just thousands of cameras and sensors.

You'd better get used to it, in the future it will be like this, everywhere, not just in New York in an experimental store, and, anyway, it wasn't a problem to do the shopping: I successfully weighed and e-paid two bars of chocolate and a packet of biscuits.

[globoy]

Thanks all.  I learned some stuff.  As I mentioned, I think they get to do what they want and I'm a freeloader (I pay for sites, like ars, whose content I really like and consume) so it's all good.  I was just curious.

[coromonadalix]

you have some reading on how websites know you use adblockers ....

[golden_labels]

You'd better get used to it, in the future it will be like this

What seems worse that this kind of a future is people, who see no problem.

If you do not understand, what is the problem, it may be hard to explain. Values system impedance mismatch may be preventing this. But one thing matters to most people, and that is wealth. So perhaps in this we may find a common ground.

In that system you are not a customer. You are a product. Not a person, but an object that is being sold. And, in the end, after a long chain of transactions, that item is actually paid for by… you yourself. Forgive me being frank, but in my dictionary there is a word describing such a person accurately: sucker.

While I do not care much about your personal life choices and — if that was your consciously taken decision — to me you may as well look down a barrel to see if a bullet is inside, this is not affecting you only. Like many choices this affects everybody, including me. And I do not like being forced to be a sucker.

This is of course not the only reason for my opposition and likely not even the most important one. But I hope this is one, which you can understand.

[SiliconWizard]

I don't understand why we should be alarmed if a site keeps track of its visitors.
In every modern shopping center we have at least 2 rolling camera views per 10m^2 to ensure that you do not commit acts of vandalism, break windows, steal goods, etc.

Yes, but in a "normal" world - the one that used to be, a bit - the recordings of surveillance cameras are never stored for more than a couple days or so, it's a rolling thing. They are not stored long-term. Normally...
Of course, this is all changing now. Put your surveillance systems on the "cloud", and now you can have virtually unlimited backups of everything that ever happens, whether you even actually mean to or not.

[DiTBho]

I don't understand why we should be alarmed if a site keeps track of its visitors.
In every modern shopping center we have at least 2 rolling camera views per 10m^2 to ensure that you do not commit acts of vandalism, break windows, steal goods, etc.

Yes, but in a "normal" world - the one that used to be, a bit - the recordings of surveillance cameras are never stored for more than a couple days or so, it's a rolling thing. They are not stored long-term. Normally...
Of course, this is all changing now. Put your surveillance systems on the "cloud", and now you can have virtually unlimited backups of everything that ever happens, whether you even actually mean to or not.

I took care of the airport perimeter security and fire prevention system: 48 hours, then the tapes are rewound and reused.

If something happens, the police have 48 hours to request the tapes, or they can see what happened in the last 48 hours; this is how it has to work, and this is how it also works on the streets and in shopping centres.

Nobody needs to store anything in the long run, and that goes for servers too when you visit a web-site! Also because you can't do anything about it. At most, behaviors and statistical characteristics can be extracted.

This applies to the voice samples that Google and Amazon extract from home microphones to improve AI's speech understanding algorithms.