WEBVTT

NOTE
Subtitles for the Cookies and fingerprints walkthrough. They match the captions drawn on the video,
and there is no spoken narration. The music is an original score. Cue times follow
the film timeline in seconds.

1
00:00:00.400 --> 00:00:04.530
How does a website know it is you, even after you leave and come back?

2
00:00:04.730 --> 00:00:09.630
The promise: you will see a real cookie, your own user agent and your own fingerprint.

3
00:00:09.830 --> 00:00:13.910
Our job: learn what each one reveals, and which controls really help.

4
00:00:15.400 --> 00:00:18.910
A cookie starts when your browser asks a site for a page.

5
00:00:19.110 --> 00:00:24.060
The server replies with Set-Cookie: an ID, how long it lasts, and flags such as Secure.

6
00:00:24.260 --> 00:00:28.100
Your browser stores it, and every later request carries it back.

7
00:00:28.300 --> 00:00:33.770
A cookie is only text. It cannot run code, and many are useful: sign-in, your cart, your language.

8
00:00:33.970 --> 00:00:37.770
The harm is not the cookie. It is a unique ID that follows you.

9
00:00:38.900 --> 00:00:44.180
Now watch how cookies become tracking. Three made-up sites each load code from one ad company.

10
00:00:44.380 --> 00:00:47.940
The ad company’s cookie carries the same ID on every site.

11
00:00:48.140 --> 00:00:52.800
So the ad company sees one visitor who read recipes, local news and hiking boots.

12
00:00:53.000 --> 00:00:57.320
Companies also swap IDs to match profiles, which is called cookie syncing.

13
00:00:57.520 --> 00:01:02.030
Deleting cookies resets the ID. Does that stop a tracker from recognizing you?

14
00:01:03.400 --> 00:01:08.200
In the lab you will set a real cookie, and see exactly what your browser sends back.

15
00:01:08.400 --> 00:01:11.870
You will watch a tracker follow one cookie across sites.

16
00:01:12.070 --> 00:01:15.440
Then you will see your own user agent and fingerprint.

17
00:01:15.640 --> 00:01:20.440
Predict: if you delete all your cookies, can a website still recognize your browser?

18
00:01:21.900 --> 00:01:26.940
In the lab, you set a real cookie and see what your browser sends back with each request.

19
00:01:27.140 --> 00:01:31.130
A made-up ad company follows one cookie across three made-up sites.

20
00:01:31.330 --> 00:01:36.180
Then your own user agent and your own fingerprint appear, worked out in your browser.

21
00:01:36.380 --> 00:01:41.030
Delete the cookies, and the cookie ID resets. The fingerprint comes out the same.

22
00:01:42.400 --> 00:01:46.870
So, can a site still recognize you after you delete your cookies? Often, yes.

23
00:01:47.070 --> 00:01:51.580
The cookie ID resets, but a fingerprint needs no cookie, so it stays the same.

24
00:01:52.900 --> 00:01:55.900
Cookie controls come with trade-offs.

25
00:01:56.100 --> 00:02:02.140
Blocking third-party cookies stops outside companies reading across sites, but some embedded logins may break.

26
00:02:02.340 --> 00:02:07.000
Separate cookies per site gives the same company a different cookie on each site.

27
00:02:07.200 --> 00:02:12.800
Clearing cookies resets IDs and signs you out. Choosing Reject on banners turns off optional cookies.

28
00:02:13.000 --> 00:02:19.760
Global Privacy Control asks sites not to sell or share your data, and separate profiles keep school, work and shopping apart.

29
00:02:19.960 --> 00:02:24.280
Defaults change between browsers and versions, so check your own settings.

30
00:02:25.400 --> 00:02:29.910
Your browser sends a user agent string with every request, without asking you.

31
00:02:30.110 --> 00:02:34.100
Mozilla slash 5.0 is a historical token almost every browser sends.

32
00:02:34.300 --> 00:02:38.910
The rest names your operating system, your engine, your browser and its version.

33
00:02:39.110 --> 00:02:43.680
It is a label, not a secret. Changing it can make you stand out more, not less.

34
00:02:44.900 --> 00:02:50.700
A fingerprint combines many small details: user agent, language, time zone, screen size, fonts, and more.

35
00:02:50.900 --> 00:02:55.800
Together they make an ID that needs no cookie, so deleting cookies does not remove it.

36
00:02:56.000 --> 00:03:00.940
Help comes from common settings, a browser with built-in protection, and fewer add-ons.

37
00:03:01.140 --> 00:03:05.320
Blend in. Random spoofing and unusual add-ons can make you more unique.

38
00:03:06.400 --> 00:03:09.400
Here is your cookie plan. Eight steps.

39
00:03:09.600 --> 00:03:16.210
Look at the cookies on a site you use, check your browser’s third-party cookie setting, and clear cookies you do not need.

40
00:03:16.410 --> 00:03:21.780
Choose Reject on cookie banners when you can, and turn on the Global Privacy Control if offered.

41
00:03:21.980 --> 00:03:26.970
Test your browser’s fingerprint, and keep your browser updated with few unusual add-ons.

42
00:03:27.170 --> 00:03:30.450
And use separate profiles for school, work and home.

43
00:03:31.900 --> 00:03:34.900
Two questions for the room.

44
00:03:35.100 --> 00:03:40.330
Cookie banners are meant to give you a choice. Do they? What would a better design look like?

45
00:03:40.530 --> 00:03:46.850
A fingerprint works without cookies and is hard to stop. Who else should act: browser makers, websites or lawmakers?

46
00:03:47.900 --> 00:03:53.220
That is the lesson: cookies, user agents and fingerprints each tell a site something about you.

47
00:03:53.420 --> 00:03:57.410
Learn what each one reveals, and use the controls that really help.

48
00:03:57.610 --> 00:04:00.610
Blend in. Do not stand out.