Storing information without Cookies, Sessions and ViewState

I thought the only place a developer could store important web application information that is to be used a later time was either Cookies, Sessions or ViewState (using .NET) . But the following case proves there are other places, which I want to know about:

Open IE and make sure Delete Browsing History on Exit is checked in Internet Options (and all checkboxes are checked under the Delete... button on that dialog box)
Restart browser if you made any change
Go to bing.com, click on Search History, and make sure your history is ON (left side menu link)
Now search for something, and now close the browser - which supposedly should delete my browsing history according to Step 1.
Now open same browser again, and see if your browsing history is there. Mine is. Always. Unless I turn my history Off.

How does bing remember my preference, even after the browser clears cookies, cache, session values etc. after the restart?

Re: Storing information without Cookies, Sessions and ViewState

Check whether Bing stores your information in its server as well. This is quite possible in contextual search days when search engine store up user preferences and deliver it back to you. Let me know if it works in some other way. I am equally curious.

Re: Storing information without Cookies, Sessions and ViewState

Cookies aren't the only way to track a user.

Re: Storing information without Cookies, Sessions and ViewState

Shankar_ss

Check whether Bing stores your information in its server as well. This is quite possible in contextual search days when search engine store up user preferences and deliver it back to you. Let me know if it works in some other way. I am equally curious.

Server side storage happens only when a user is signed in. I'm not signed in and sitting behind a NATted address, so that would be remote possibility. Right now I am only thinking in terms of client side storage. What are the possible ways other than cookies, session and viewstate.

Re: Storing information without Cookies, Sessions and ViewState

BrockAllen

Cookies aren't the only way to track a user.

The red Test Me button on that link gave a never seen before error :

Browser address bar says : res://ieframe.dll/acr_error.htm#eff.org,https://panopticlick.eff.org/index.php?action=log&js=yes

Error message says: We were unable to return you to eff.org. Internet Explorer has stopped trying to restore this website. It appears that the website continues to have a problem.

BTW, I'm using Win7 Pro 64 bit, IE 9 32 bit

Re: Storing information without Cookies, Sessions and ViewState

It is not essential you need to sign in. All bing requires is your IP and machine number which can be used to retrieve favourites if it saves your information on its server. So we cannot rule out this possibility.

So server side storage is still an option. But, as you said, there may be someother way used in client side storage.

Re: Storing information without Cookies, Sessions and ViewState

Shankar_ss, I am behind a NATed address, which means my internal IP is not visible to bing. There are hundreds of computers which will appear same to bing if IP address was the only criteria.

So what exactly do these sites use to store this super persistent data that does not get deleted after deleting cookies, session etc. ?

Re: Storing information without Cookies, Sessions and ViewState

Not sure that it applies to how bing stores data but there is also LocalStorage in HTML5 as well as userData which is an IE feature added in v5. This data can persist through browser restarts. Some interesting facts about LocalStoreage can be found here.

http://htmlui.com/blog/2011-08-23-5-obscure-facts-about-html5-localstorage.html

Re: Storing information without Cookies, Sessions and ViewState

Kind of intrested me how they were doing this so digging a bit I came accross this.

http://onlinehelp.microsoft.com/en-us/bing/ff808459.aspx

Seems they maybe use data stored in the form data saved in your browser as well as your browsers history? This data will only be available on the machine in question. This page was linked from this page http://onlinehelp.microsoft.com/en-us/bing/ff808483.aspx which tells how to clear your Bing search history if this is where they get this from I am not sure...

From http://onlinehelp.microsoft.com/en-us/bing/ff808483.aspx:

"Search history comes from the searches and related information that you send to Bing when you do a search. You can remove your search history from appearing on the site by following the steps above for removing and clearing your search history. Removing your history removes it from the Search History service and prevents that history from being displayed on the site, but it does not delete information from our standard search logs, which are used to operate and improve our products and services, and are retained and anonymized as described in the Bing Supplement to the Microsoft Online Privacy Statement. We store the searches you make separately from any information that directly identifies you, such as your email address or phone number. Even when you are signed in with your Windows Live ID or Facebook account, your searches are stored using a one-way anonymized identifier that does not directly identify you. For more information, see "

One of the "steps above" was clearing form and search history from the browser.

If you sign in with Live then your search data is stored on their servers to be used on any machine you are logged into using your Live account.

Re: Storing information without Cookies, Sessions and ViewState

I dont know the specifics of web browser architectures themselves but they do employ client side caching of pages (or snapshots, can't remember which).

As for cookies, there is another form of cookie that doesn't get removed by simply clearing your browser cookies and history, etc.

read up about "EverCookies". I don't recall the details of evercookies because it was quite awhile ago that I read about them but they are stored in a completely different area than standard cookies. May even be outside of the browser's filesystem, but again, I dont remember. It's a very persistance (and kind of invasive if you ask me) form of client side storage.

As for the question about bing, they probably use a combination of methods for continuing user sessions. They definitely store your ip server-side but they obviously arent relying entirely on that for returning users (because proxies pretty much wreck that idea lol).

Re: Storing information without Cookies, Sessions and ViewState

magicmike2011, evercookie was eye opener. thanks!