Hacker News Reader

ETag (paired with If-None-Match header sent by the browsers) is another caching header to be aware of.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ET...

Ooh that's kinda evil. A server could give a client a uniquely identifying ETag for a given URL. So whenever the client comes back on the same browser, they're identified.

Fortunately this is probably just as detectable as the Last-Modified abuse in the post.

There are a lot of things like that. Although browsers changed it recently, you also used to be able to use TLS session tickets.

Another one was the favicon cache.

Pretty much any state on the browser can be used to track people.

Reply on news.ycombinator.com