NWA-PCUG Newsletter Article
Internet Cookies - September 2001 Meeting Recap
by Dale Oliver, President, October 2001
d_oliver@swbell.net
(click to email author)


What is a cookie? A cookie is a small text file that allows a Web site to remember some things about you.

There are two types of cookies:

Session cookies are stored temporarily in your computer's
memory (RAM).
Persistent cookies are stored in a file on your hard drive.

Where are the persistent cookies stored on my hard drive? Microsoft's default location for storage of persistent cookies is in the C:\Windows\Cookies\ folder. It stores each Web site's cookies in a separate file. Netscape, to the best of my knowledge, stores cookie information in the Netscape folder in a single file named Cookies.txt.

Where did the name "cookie" come from? This is a fairly common term in computer science, and one that is often associated with the Unix operating system. The term is a generic one that indicates a small bit of information that is stored in order to temporarily remember something. The data being stored in a cookie is typically referred to as a "string" or "token."

Why are cookies needed? Internet pages are generally created using HTML, or HyperText Markup Language, meaning that basic Web sites consist of text files with embedded formatting information that describes how to display the information (font, color, alignment, placeholders for embedded photos and graphics, etc.) These glorified text files have no way of storing information about you. They simply send the contents of the HTML file to you when you request it by visiting the site. Cookies give Web sites a mechanism to store information for later retrieval.

What are cookies used for? What is stored in them? Cookies were initially intended to keep up with simple information for the end-user's convenience, such as the items you have placed in an online shopping cart, or whether you are a returning Web site visitor so you won't have to reenter your login ID and password, etc.

The use of cookies has evolved to allow more novel uses for them. For example, a site can remember certain personal preferences based on prior purchases you have made while visiting their site. Some sites even let you configure the content and layout you see to create a custom home page when you visit that site. Your preferences are stored in a cookie. Some examples of legitimate cookie usage follow:

  • An investment site allows you to select the specific stocks you want to display in a ticker when you visit that site. The site will keep track of the ticker symbols on their local server and link the data to a unique ID, which is then stored on your computer in the form of a persistent cookie. The next time you visit the site, the server reads the unique ID number from your cookie and then customizes the content of the stock ticker to suit your preferences.

  • This hypothetical investment site may also use a temporary session cookie to remember if you have logged into a secure area of the site that is only available to registered users, so that when you move from areas of exclusive content to areas of regular content and back again during your visit, you won't have to keep logging in.

  • For a more personalized feel, a site remembers your name after you have typed it in. When you visit the site again, it greets you by name.

  • A site includes the ability for you to enter a drawing, but through the use of cookies, remembers that you've already entered and therefore enforces the rules that you can only enter the drawing once.

  • A news-related site allows you to customize the kind of news you are interested in. If you select sports and business news, the next time you visit the site, you will only be shown the topics of interest and not a lot of other news items you're not interested in.

  • A weather-related site allows you to enter your city or zip code, so that when you return to the site, you can get local weather instantly.

Who can read and modify the contents of cookies? Cookies are managed through your Web browser via requests from the Web server of the site you are visiting. Only pages on the Web server that created a cookie can read and write to it-this is enforced by the Web browser based on the site's URL. In other words, a Web site can't snoop through cookies placed there by other sites. But read on...there are clever ways around this seemingly safe mechanism.

What can Web servers find out about me, and potentially save in a cookie?
The type of browser you are using.
Your IP address.
How you got to their site (for example, by clicking a link on another site).
Recent Web sites you have visited.
Information you have specifically given that Web site by filling out an online form, etc.

Can cookies contain viruses, worms, Trojans or other things that can damage my computer? No. Cookies are not programs. They are simple text files.

Can I control whether to accept cookies or not? Yes. All modern Web browsers give you several levels of control, including the ability to accept all cookies, notify you when a site wants to access cookies and let you decide if it is okay, or reject all cookies. Aftermarket software products allow even more flexibility, such as configuring cookie preferences for each site you visit. This is discussed in more depth later in the article.

To cookie, or not to cookie: that is the question.

Some sites, such as the hypothetical investment site we have been discussing actually require you to accept cookies so that they can give you access to secure areas, display custom information you request, remember you as a registered visitor, etc. This is perfectly legitimate and should not be cause for alarm. In fact, it can be a great convenience so that the site will "remember you" and not ask you to type a login ID and password every time you visit the site.

Another way to think about cookies is to think about valet parking. When the valet takes your car, he gives you a receipt with a unique number on it. When you return, you give the valet your receipt, and he will know exactly which car to retrieve for you and where it is parked.

Other sites, such as DoubleClick, LinkExchange, AdExchange, AdMonitor, Boomerang, MediaMatch, Focalink, ADSmart, etc. use cookies that can track where you go and what you do on the Internet. This can be innocuous enough if done conscientiously. For example, if you have just visited three sites looking for Rolex watches, banner ad contents can be tailored to your specific interest...lo and behold...a Rolex banner ad pops up! It's not ESP. It's also not blatant mind control-whether or not you decide to click on the link is your business.

Some sites even track referring links and banner ads as a way to charge businesses on a per-click basis for potential customers they have referred.

It is possible for cookies to be used a bit like radio collars are used to track wild animals as they move around. Or, you can think of cookies as being similar to a Caller ID system to automatically identify you. This can be a bit disconcerting for some users who may not exactly want their Web surfing habits monitored. If this is the case with you, you should be selective about the cookies you accept. Read on.

Can bad cookies be put in my "cookie jar" without my knowledge? Yes. Possibly the most notorious privacy invader is DoubleClick (http://www.doubleclick.com). Through some technological slight of hand and plenty of cleverness, they have gotten around the implied limitation that only the Web site that writes a cookie can see information stored in it. Without your knowledge or consent, DoubleClick participates in a two-way sharing of information about you with many companies and Web sites. And they do it for a handsome profit. This all seems rather unusual in light of the recent regulations regarding consumer privacy at financial institutions and the like. It is apparent that our lawmakers don't know any more about what is going on with Internet cookies than the average user, so they are incapable of creating laws to protect our online privacy. Information collected about you online is a free-for-all at this point in time, and it is up to each individual user to protect themselves.

Chances are good that there is a DoubleClick cookie on your computer, even if you've never visited that site. Hmmmm...kinda' makes you wonder, doesn't it? If you want to learn more about how DoubleClick is making a lot of money tracking your Web surfing habits, simply log onto their website (http://www.doubleclick.net) and read. Selling information about the personal surfing habits of millions of users is big business, and online merchants are apparently willing to pay handsomely for that data. Notice that a lot of "real" content on DoubleClick requires you to fill out a registration from. Guess what happens when you register? Bingo! Cookie time. Now they can relate your surfing data to your name, telephone number, e-mail address, home address, etc. Even if they don't specifically collect all of this information from their own online forms, they have enough information to uniquely identify you and easily figure out who you are, where you live, what your e-mail address is, your phone number, etc. You are now a target for not only customized banner ads, links and pop-up ads as you surf the Internet, but you are also a target for e-mail, telephone, and direct mail solicitation.

They have honed this to such a science, they can easily find out your precise geographical location and demographics, approximately what your income is, what type of business you work for (SIC code) and the size of the business, what browser and operating system you are using, who your ISP is, what specific words or phrases you are likely to respond to, and even what day of the week and time of day you are most likely to be reached. Ingenious! This is truly capitalism at its finest.

What? You're not impressed? You don't want to join the magic cookie party with eighty million other revelers? Maybe some cookie management is in order.

Check out the companies that are closely affiliated with DoubleClick. You may be surprised and shocked at the organizations that are supporting this breach of consumer confidentiality.

DoubleClick's site claims that it has data on 80,000,000 (eighty million) online computer users through more than 1,100 sites. It also claims to have data on over 3.5 billion online transactions that originate from more than 90,000,000 (ninety million) U.S. households.

Can I circumvent specific cookies without installing special software? Yes. A neat trick that has been suggested for more advanced users is to take a cookie file, delete its contents, and then change the file properties so that the file becomes read-only. This can trick a Web server into thinking you already have a cookie file from them (so it won't try to install another one) but when it tries to update the cookie, it is not able to. Many sites have a work-around for this, though, so it's not a bulletproof strategy.

I'm not that technically advanced. What can I do that is quick, easy and cheap? Go to your favorite download site (such as CNET's http://www.download.com) and download a small, simple cookie management software product. I have downloaded one of the simplest and least expensive solutions that I am aware of: CookiePal from Kukaburra Software (http://www.kburra.com). Using a simple graphical user interface, it allows you to indicate which sites you are willing to accept cookies from. You can use it for a month without cost, then if you like it, you can register the software for $15. Another very popular cookie management software product with similar features is Cookie Crusher from The Limit Software (http://www.thelimitsoft.com). It, too, allows you to evaluate the software for a month before deciding to buy it for $15.

What is currently being done about this privacy issue? The ITEF, or Internet Engineering Task Force, is currently proposing changes in the standards that affect the way persistent cookies work. They are also trying to get Microsoft and Netscape to set default browser settings to warn you before accepting cookies. Another more sweeping proposed change is to stop requests from third party servers, so that blatant advertising campaigns such as DoubleClick uses will be thwarted.

How can I learn more? Search for the phrase "persistent cookie" using your favorite search engine, or visit an informative Web site such as http://www.cookiecentral.com.

Click here to return to top



==================================================================