Removing the dreaded evercookie

Question

Level 1

2 points

Removing the dreaded evercookie

Can anyone advise how to permanently remove an evercookie? I found Dominic White's blog about removing an evercookie in Safari. He provides a script, but I have little to no experience with running scripts on my Mac. I opened Terminal, pasted the script, and followed the instructions, but it didn't clear the evercookie. In all likelihood, I didn't run the script correctly.

If someone could provide step-by-step instructions for running a script, I would be very grateful. Here is the link to Dominic's blog with the script: http://singe.za.net/blog/archives/1014-Killing-the-Evercookie.html#extended

Thank you!

iMac, Mac OS X (10.5.8), Safari

Posted on Jan 29, 2011 5:10 AM

Reply

Answer 1

DeSol86

Level 1

4 points

Nov 1, 2017 9:04 AM in response to purplecat

The script worked for me. I had multiple evercookies from Expedia, UPS. loc.gov, hotels.com and some from German websites. Thank you so much.

I think it is really disturbing that this issue has been going on for so long and Apple seems to not care at all, not even issuing support in the threads of this forum.

Reply

Answer 2

andyBall_uk

Level 7

20,516 points

Jan 29, 2011 8:44 AM in response to purplecat

Hi 🙂

the script detailed there is fairly limited, intended to clean up what a full Safari reset leaves behind, ... even then it seems limited, but presumably it does the trick.

anyway, you surely don;t need a script to do that, since all the files removed are in the user's home library folder.


#!/bin/bash
echo "Deleting evercookie locations Safari missed (see samy.pl/evercookie)"
rm -r ~/Library/Safari/Databases/*
rm -r ~/Library/Safari/LocalStorage/*
rm -r ~/Library/Preferences/Macromedia/Flash Player/#SharedObjects/*

echo - just writes to the screen

rm - removes (deletes) files or folders
so there's just three useful lines which remove all the files in these folders

~/Library/Safari/Databases/
~/Library/Safari/LocalStorage/
~/Library/Preferences/Macromedia/Flash Player/#SharedObjects/

You can use Finder to see those yourself & trash them, paste the lines into Safari's address bar if you've any trouble locating them. Trash the whole folder, Safari will create new ones next time it runs.

Like they say, quit Safari before trashing them ( & consider dumping the entire Macromedia folder )

Reply

Answer 3

purplecat Author

Level 1

2 points

Jan 29, 2011 10:19 AM in response to andyBall_uk

I was hopeful, but that didn't solve the problem. There has to be another place that the information gets stored. I have read that it could be up to 13 places that these cookies store information. This is driving me crazy!

Reply

Answer 4

andyBall_uk

Level 7

20,516 points

Jan 29, 2011 10:28 AM in response to purplecat

There has to be another place that the information gets stored...

Naturally - that list seemed kinda short.

Isn't there an account some place of what/where evercookie does ?
try the entire safari folder, say - but don't trash it until you've moved your bookmarks out of there, or they'll be gone for good.

Reply

Answer 5

purplecat Author

Level 1

2 points

Jan 29, 2011 10:46 AM in response to andyBall_uk

andyBall_uk wrote:
Isn't there an account some place of what/where evercookie does ?

I'm not aware of an account that tells what an evercookie does. I trashed the Safari folder so we'll see what happens. I made sure to reset Safari prior to deleting the entire folder (and exported my bookmarks.) I'll let you know.

Reply

Answer 6

andyBall_uk

Level 7

20,516 points

Jan 29, 2011 10:55 AM in response to purplecat

Hi

I meant didn't the evercookie guy document & explain what he did? (I'm sure I read it all before)
find a list & we'll know what you're missing, most probably.

Reply

Answer 7

purplecat Author

Level 1

2 points

Jan 29, 2011 11:00 AM in response to andyBall_uk

The only list I saw was from Dominic White and that's the list with just the three files to delete. I have not sought out Samy Kamar's site - he's the one who created the evercookie - to see what he recommends, +if anything,+ for removal.

Reply

Answer 8

andyBall_uk

Level 7

20,516 points

Jan 29, 2011 11:16 AM in response to purplecat

I see - the site does go into some detail on how it works.

I'd also remove the whole of that Macromedia folder, if you find it still shows up.

Reply

Answer 9

purplecat Author

Level 1

2 points

Jan 29, 2011 11:17 AM in response to purplecat

Removing the entire Safari folder from the Library file didn't kill the evercookie. As I'm working in Safari, over time, the cookie just pops back up in my list of cookies. It's not related to any particular website, or number of site visits. It recreates itself over time that my browser is open. About every 5-10 minutes or less.

Reply

Answer 10

andyBall_uk

Level 7

20,516 points

Jan 29, 2011 11:32 AM in response to purplecat

the cookie just pops back up in my list of cookies...

which cookie ?
one for samy.pl ? something else named evercookie ?
the list you see in Safari-Preferences-Security-Show cookies ?

you've tried trashing ~/Library/Cookies/Cookies.plist (again, with Safari quit)

Reply

Answer 11

purplecat Author

Level 1

2 points

Jan 29, 2011 11:47 AM in response to andyBall_uk

The cookie is called .want-girls.com. It was a dating forum that posted info about a book I wrote. I navigated to it several months ago, and bookmarked the website. I would probably not even notice the cookie if it weren't for the name. I have since deleted the bookmark, and, as I said, the website is no longer there.

Yes, I can see it in Safari-Preference-Security-Show Cookies. I delete it and keep the window open to watch what happens as I work in Safari. It doesn't matter whether I'm on one site or many, eventually it pops up again in the cookie window. The only way it won't pop up again is if I block all cookies. That just gets tiresome as some sites routinely require cookies, and once I click back to "accept cookies only from sites I navigate," it's back again.

I just tried trashing ~/Library/Cookies/Cookies.plist with Safari quit and also after yet another reset. I have a feeling it's going to take more than that, but I'll keep you posted.

Thank you for your patience and persistence with this problem. You're a good evercookie!

And just as I was typing this post, it came back again! It is driving me absolutely crazy!

Reply

Answer 12

andyBall_uk

Level 7

20,516 points

Jan 29, 2011 12:38 PM in response to purplecat

ok, maybe not evercookie anyway - if you have cookie prefs set to 'sites I visit' then Safari shouldn't allow the creation of a xyz.com one unless you go there... of course. I've seen nothing yet to suggest that evercookie can get round that.

There have been a few threads here before with seemingly persistent cookies, even after trashing the plist... I've never been able to recreate that, so presume it's been some extra software on those macs. Either some syncing usefulness, or (less likely) potentially some deliberately designed app/addon. I say that only since I've not read of any current way to write cookies through safari, w/o Safari applying its usual rules.

So, you've no extra software always running? Safari extensions (shouldn't be possible, but hey), Home/Library/InputManagers, HD/Library/InputManagers, Home/Library/LaunchAgents/, Home/Library/Internet Plug-Ins/ etc or showing in System Preferences-Accounts-Login Items ?

there's no mobileme or similar?

Reply

Answer 13

purplecat Author

Level 1

2 points

Jan 29, 2011 12:46 PM in response to andyBall_uk

No, no syncing with Safari. I don't even have any apps or add-ons for Safari. The cookie pref allowed the cookie to be planted when I originally visited the site. Now it seems here to stay. The only other thing that's always running is my email program – nothing to do with Safari. I trashed the original Safari folder in Library so wouldn't that have cleared out everything like that??

Reply

Answer 14

andyBall_uk

Level 7

20,516 points

Jan 29, 2011 1:19 PM in response to purplecat

try w/o Mail running, also consider widgets and/or rss/feeds that might be accessing the site now, either in safari or mail.

Home/Library/PubSub/ being removed ought to reset most of the latter, keep hold of it if you've a bunch of feeds subscribed.

Reply

Answer 15

purplecat Author

Level 1

2 points

Jan 29, 2011 1:27 PM in response to andyBall_uk

I do have a couple RSS feeds in Apple Mail. I closed out Apple Mail, and turned on "accept cookies only from sites I visit." I'll bet in 10 minutes or less that cookie will pop up again in the cookie window.

Reply