Can a website know about my browsing history?

Question

When I visit a website it sometimes puts cookies on my browser. Usually cookies keep track of browsing info from that particular site. If I don't delete those cookies and browse other websites, will the cookies be able to know which site I am browsing? Also, can any website read browsing history which is saved by browsers? Can any website know about my browsing history by help of cookies, browsing histories saved by browsers, or by any scripting language e.g. javascript?

Solution 1

The short answer is yes, though it is not as easy as you might think.

The browser stores cookies independently for each domain. That means that www.foo.com cannot access the cookies made by www.bar.com and vice versa.

The vulnerability (or loophole) is in included pages. Most advertisements come from a different domain than the page itself, so they create their own sets of cookies. When another site includes an ad from the same ad provider, they can read their own cookies created earlier and they know you visited that page earlier. This way they can only track you on sites that host their ads. This is the strategy Google uses to serve relevant ads.

Also Facebook and other social networks can do this because of their ubiquitous like, tweeet, pin etc. buttons, which are also included content. This is not avoidable without disabling cookies altogether or using private browsing, but that could be a major burden (Cookies do make the Internet convenient). I personally choose not to be paranoid of these things.

Solution 2

A third-party cookie placed on your machine at one site can be detected at a later time by the third party, so your browsing history is to some extent public. There are both HTML and Flash cookies, so if you wish to remove them delete both types.

Browsers such as Firefox can be set to a "private" mode in which cookies are deleted at shutdown. Cookies can also be deleted by the browser or by free tool such as CCleaner. Deleting cookies may require you to log into sites which had opened automatically before.

Comments

[Matias Ficarrotti]

Any site can find out if you are logged into social web sites - hacks.mozilla.org/2011/02/… mvark.blogspot.in/2012/04/…

[matega]

A third party is not able to detect nor read cookies not created by their domain.

[Patrick Seymour]

I think the Dr is saying the same thing you did. "A third-party cookie" can later be read by "the third party," that is, the same third party that dropped the cookie in the first place.

[Ramhound]

But that ability doesn't provide them any information about the websites you viewed.

[Ramhound]

This is only true if the user allows this to happen

[matega]

I've touched disabling cookies in my answer; what other thing do you mean by the user allowing this to happen? The Do not track header only requests servers to disable tracking, but it's up to them if they honor it or not. If they are malicious, why would they care? If they're not, why would you?

[J Slick]

You can install Disconnect in your browser to block this data from being sent.

[Ramhound]

@matega You can allow a website to create its own cookie. You can also not allow Facebook to create a cookie, when you visit a website that implements Facebook Like voting, by not allowing third-party cookies to be created.

[matega]

Oh. +1. I did not know about that, thanks for the info. But still, that breaks some functionality and I am not paranoid enough (i.e. at all) to give up on that functionality. There are far worse things out there than targeted advertising (heck, I'd say it's even good sometimes).

[matega]

Not if they don't litter most of the websites you visit with their content. Which is what Facebook, Google and other are doing. Also, after the edit, this does make sense - if not immediately obvious how.