Abusing the Cache: Tracking Users without Cookies (joshduck.com)

Wow. No javascript required, cookies turned off, just the browser cache and he will find you and hunt you down.

This could be defeated easily by a good, old-fashioned web proxy. Other than that, or blacklisting, there's no efficient way around it. Wow.

Perhaps a simple fix at browser level would be to treat cached files with future etags like cookies, clearing or ignoring them with the same policy.

Its a genius trick though.

Chrome's incognito window shields you from this attack - it starts you off with a fresh set of history/cache/cookies every time you start it up.

And for users who disable caching?

That's a pretty ingenius hack. More limited in use than a real cookie (real cookies are sent along with every request; even for images etc), but still pretty cool.

Very clever. Props for creativity and originality.

It's neat, but it's not a new idea. http://sourcefrog.net/projects/meantime/

one purpose is webtracking, especially in the affiliatemarketing niche, which "suffers" from cookie deletion because the cookiebased-tracking then does not recognize visitors and thus affiliates don't get paid... fingerprint methods are another alternative, although less precise and more difficult to implement.