You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

purplecat Author

Level 1

2 points

Removing the dreaded evercookie

Can anyone advise how to permanently remove an evercookie? I found Dominic White's blog about removing an evercookie in Safari. He provides a script, but I have little to no experience with running scripts on my Mac. I opened Terminal, pasted the script, and followed the instructions, but it didn't clear the evercookie. In all likelihood, I didn't run the script correctly.

If someone could provide step-by-step instructions for running a script, I would be very grateful. Here is the link to Dominic's blog with the script: http://singe.za.net/blog/archives/1014-Killing-the-Evercookie.html#extended

Thank you!

iMac, Mac OS X (10.5.8), Safari

Posted on Jan 29, 2011 5:10 AM

29 replies

purplecat Author

Level 1

2 points

Jan 29, 2011 1:58 PM in response to purplecat

You might be onto something with this being tied to either RSS or Apple Mail. I closed down Apple Mail fully expecting the cookie to propagate again within 10 minutes. So far, no cookie, and it's been longer than 10 minutes I'd say. Will keep watching...

purplecat Author

Level 1

2 points

Jan 29, 2011 3:15 PM in response to purplecat

That didn't work either. It's back.

andyBall_uk

Level 7

20,516 points

Jan 29, 2011 3:56 PM in response to purplecat

Did you lose the pubsub folder?

checked to see if cookies.plist is being written to with that unwanted cookie? If so, http://www.apple.com/downloads/macosx/systemdiskutilities/fseventer.html may be able to tell you what is doing so. Either confirming it's safari, or...

just enter the path for the cookies folder in the filter box.

purplecat Author

Level 1

2 points

Jan 29, 2011 4:02 PM in response to andyBall_uk

Ummm, where's the pubsub folder? I'm not finding that.

andyBall_uk

Level 7

20,516 points

Jan 29, 2011 4:12 PM in response to purplecat

~/Library/PubSub/

into safari's address bar, should take you right there.

purplecat Author

Level 1

2 points

Jan 29, 2011 4:14 PM in response to andyBall_uk

Found it. Go through the process again, reset Safari, quit Safari, delete that folder, and restart?

andyBall_uk

Level 7

20,516 points

Jan 29, 2011 4:37 PM in response to purplecat

sure - or set fseventer on the cookies,

or Easyfind in a file-content search for girls, restricted to your home folder, may swiftly find out where else that info is stored. http://www.devon-technologies.com/products/freeware/

purplecat Author

Level 1

2 points

Jan 29, 2011 4:46 PM in response to andyBall_uk

Thanks. I'll try that. I made the mistake of going to Samy Kamkar's website hoping for a fix. The site just wanted to access my hard drive over and over again until it crashed Safari. There's no denying it and just to read his site.

According to what I could capture before the crash, here's what it said:

Specifically, when creating a new cookie, it uses the following storage mechanisms when available:
- Standard HTTP Cookies
- Local Shared Objects (Flash Cookies)
- Silverlight Isolated Storage
- Storing cookies in RGB values of auto-generated, forced-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out
- Storing cookies in Web History
- Storing cookies in HTTP ETags
- Storing cookies in Web cache
- window.name caching
-Internet Explorer userData storage
- HTML5 Session Storage
- HTML5 Local Storage
- HTML5 Global Storage
- HTML5 Database Storage via SQLite

TODO: adding support for:
- Caching in HTTP Authentication
- Using Java to produce a unique key based off of NIC info

andyBall_uk

Level 7

20,516 points

Jan 29, 2011 5:05 PM in response to purplecat

yep, the site used to be less insistent, as I recall.

Any road, none of those explain how a cookie gets recreated. Sure, there are ways to id a user & even from that to say ooh, same computer that visited xyz.com, but while safari prefs are set to only from sites I visit, there's no way for a site to write another's cookie, that I know of; even supposing you were somehow repeatedly visiting sites that did that kind of thing.

purplecat Author

Level 1

2 points

Jan 29, 2011 5:13 PM in response to andyBall_uk

Well, it's definitely not a site recreating the cookie, because even if I leave Safari open and never visit any sites, I think that that cookie reappears. So it must be some script that runs while Safari is open to bring that cookie back. The only way for the cookie not to appear, is if I have the setting to "never accept cookies."

purplecat Author

Level 1

2 points

Jan 30, 2011 8:43 AM in response to purplecat

I think it may be gone! I've been surfing around all morning, and it hasn't returned which is very unusual given its persistency. Maybe it cleared out after all the things I did yesterday coupled with turning off the computer for the night. For the record, I did not delete the PubSub folder as yet.

Will post again if it returns. If it does not, I will mark this question answered after a day or two.

Thanks Andy for all your help!

andyBall_uk

Level 7

20,516 points

Jan 30, 2011 8:46 AM in response to purplecat

fingers crossed eh - I wish I knew how it happens.

purplecat Author

Level 1

2 points

Jan 31, 2011 1:29 PM in response to purplecat

Ding Dong the Cookie's Gone! Not sure which step actually took care of the evercookie, and maybe it was a combination of the suggestions by Andy, but the dreaded evercookie is gone.

Also, this came from Dominic White, his instructions for deleting an evercookie:

The step-by-step would be to:

1) Reset Safari.
2) Run the script in terminal

If (2) isn't working for you, then try the following:

a) Delete all files in the following folders:
/Users/<your username>/Library/Cookies/
/Users/<your username>/Library/Safari/Databases/
/Users/<your username>/Library/Safari/LocalStorage/
/Users/<your username>/Library/Preferences/Macromedia/Flash Player/#SharedObjects/
/Users/<your username>/Library/Preferences/Macromedia/Flash Player/macromedia.com/support/flashplayer/sys/
Users/<your username>/Library/Application Support/Microsoft/Silverlight/is/

Mar 5, 2012 10:11 AM in response to purplecat

Hi PurpleCat! I don't know if I'am too late with my idea but this is the remedy I have found, although a bit delicate:

1- Go to applications

2- open disk utilitity

3- Make sure the FIRST AID is selected (because this is the delicate part) you could wipe your computer of everything you have in it.

4- Select the disk on left side and there will be 2 options at the bottom:

VERIFY DISK PERMISSION and REPAIR DISK PERMISSION

5- Click repair disk permission, and reparation will start inmediately

6- After everything is repaired, Restart your computer Almost sure, evercookie will be gone.

I'am still trying to find out if there's a way the computer can reject this kind of invasion of privacy.

Removing the dreaded evercookie