cookielesscookies

Demo of tracking using etags instead of cookies (or localstorage or anything else)

Explore on GitHub Read Hacker News discussions

2Distinct people

2Mentions

0Explicit recommenders

1.2KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Demo of tracking using etags instead of cookies (or localstorage or anything else)

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year2 dated mentions

Observed mentions: 2013-08-18 12:56:46 UTC to 2016-11-18 04:22:59 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Comments
2013	2013-01-01 00:00:00 UTC	2014-01-01 00:00:00 UTC	1	1
2014	2014-01-01 00:00:00 UTC	2015-01-01 00:00:00 UTC	0	0
2015	2015-01-01 00:00:00 UTC	2016-01-01 00:00:00 UTC	0	0
2016	2016-01-01 00:00:00 UTC	2017-01-01 00:00:00 UTC	1	1

What Hacker News says

2 sources

niftich·Nov 18, 2016

You can exploit the fact that HTTP caching sends the ETag back and forth. A server can set a crafted ETag and basically use it as a session ID. See [1][2] [1] http://security.stackexchange.com/questions/12679/how-can-i-... [2] https://github.com/lucb1e/cookielesscookies/blob/master/inde...

In Ask HN: How does Quora auto login work?

miken123·Aug 18, 2013

As it turns out, he simply uses your IP and User Agent string. See https://github.com/lucb1e/cookielesscookies/blob/master/inde... No E-Tag tracking is taking place, since the E-Tag is never send to the server for the index.php request (only for the image request). In theory he could update the session after your IP changed, but he does not seem to do that (the image requests hold on to the old E-Tag). So, basically, to me it seems like the whole point/post is invalid. Please correct me if I'm wrong.

In Cookieless cookies