6:49 PM
postin
Last month yahoo introduced "Yahoo Sign In SEAL" aimed at preventing the phishing attacks. I have always been extra curious when it comes to security of software and web applications and decided to see how this works. Here is what testing has revealed about the tracking.
Yahoo uses multiple methodologies to achieve the tagging of user system.
- Simple browser cookie
- Flash Shared Objects (.sol) Aka. Flash Cookie
- XML file in Userdata folder.
Interesting part of the findings is how persistent the tagging has been. If you delete one source other one will help yahoo identify the system and recreate the deleted data.
How to delete Yahoo Sign In SEAL tracking completely ?
- Close Browsers
- Delete the Cookies from browser (IE : Tools >Internet Options> Delete Cookies , Firefox Ctrl+Shift+Del )
- Delete Flash Shared Objects from C:\Documents and Settings\{user name}\Application Data\Macromedia\Flash Player\#SharedObjects
- Delete YL[1].xml. On windows XP you can have it here "C:\Documents and Settings\{user name}\UserData\{random folder like ODFXSDVY} \YL[1].xml
More questions then Answers:
How can a web page store something outside temp folder of browser?
And how is yahoo able to write the XML file to UserData folder?
To best of my knowledge this folder is exclusively used by Window and IE to store system info.
Posted in: 
45 comments:
Welcome to the blogosphere genius! Now we the web world will become more knowledgeable!!
Ok, a fellow blogger has pointed that Yahoo was able to store the persistent data as implemented by Dynamic HTML (DHTML) behaviors.
More Interesting stuff here : http://msdn.microsoft.com/library/default.asp?url=/workshop/author/persistence/persistence_ovw_entry.asp
To disable the Userdata Persistence in IE follow steps given here
1. Tools > Internet Options > Security
2. Edit the Level security settings
3. Find Miscellaneous
4. scroll down and go to Userdata Persistence
5. Select Disable and save.
Really, this is a neat way to uniquely identify computers all over the world.
And the general public most likely won't know how to undo it. (do they bother anyway?)
Post a Comment