Broadband Tech > Security > Security > Something I don't understand about WebWasher

Something I don't understand about WebWasher

Please read my notes in this thread. It will clear this up for you.

Hi Zhen - I read that thread, and thanks for pointing to it, but I think this problem is different.

I am not talking about cookies remaining on the hard drive after they have expired, I am talking about cookies that seem to be able to get through or past the filter altogether, while others aren't.

How are those cookies able to do that? The aren't even given the right expiration date, but have the original expiration date set by the cookie itself, and in the one instance, NO COOKIE should have been set AT ALL!!

I am stumped because WW is filtering other cookies fine!

Do you see the difference?

How can you gauge WW is not doing it's job? Not that I can say it is. The only thing I can go by really are the statistics and the word of the authors (via support).

BTW, I use finish when browsing done. Those neutral cookies never get set.

Is this what you mean? I am confused. Sorry.

Ok sorry - I probably wasn't clear enough . . .

I am looking at the cookies through "CookieSpy" which tells me when they were set, and when they expire.

Now, those three cookies I mentioned in my initial post, are in my filter list with WW. 2 are set as neutrals, and one is set as bad in the filter.

The neutrals should expire in 24hours.

The Bad should never be set.

Now, I have several sites listed in the WW filter, - for instance, I visited sears.com a few days ago, it set a cookie. I put sears.com in my filter list as "BAD", deleted the cookie through CookieSpy, and when I went back NO new cookies were set. The same thing with Google.

BUT not so with www.paypal.com! I have it in my filter list as "BAD" - - BUT the cookie still gets set, and it gets set for it's original length of time - 30 years - confirmed through CookieSpy after I deleted the cookie from www.paypal.com several times. Every time I visit their site, it is set afresh if I have deleted it.

How is that happening when WW is correctly filtering out other "BAD" cookies from my machine?

And what is happening with the neutrals, is - as I said, I have neutral cookies set to expire in 24 hours. And all my sites in the WW filter list are being set correctly EXCEPT the two I mentioned above - paypal.com and ebay.com - those two have their original expiration dates of 20 years and 5 years respectively when viewed through CookieSpy - BUT all the other neutral cookies (including dslr) are set for 24 hours and confirmed through CookieSpy as expiring in 24 hours.

How are those 2 cookies slipping by the filter?

From what I have seen through CookieSpy, WW sets a 24 hour expiration on the neutral cookies and that is what CookieSpy confirms and reads, except for the exceptions I am puzzled about.

Now is that clear as mud?

I understand. I don't have the answer, but I did send the same question to their support team yesterday morning. As of last night, I haven't received a response to that question.

I'm hoping to get one today. In the meantime, you should use the finished when done browsing option. Works for me.

And just so that I understand, the question is why aren't the neutral cookies that are set to expire after a user defined time not expired in the actual cookie?

reply to Anon
Here is the post which holds my WW configuration.

reply to Zhen-Xjell
2 questions actually:

1)
Why aren't certain NEUTRAL cookies (not all, just certain ones) being set with my WW user defined expiration time when all other ones are being filtered appropriately and have their expiration times set correctly through the WW Filter? (in other words, why are they being set with the site's defined expiration time instead of what I have set in WW)

2) why aren't certain BAD cookies being filtered at all, when all the other BAD cookies are? (In other words, why am I finding certain BAD cookies on my system at all? How are they slipping by WW filter?)

Example:

paypal.com - neutral -
designated to expire in 24hours in WW filter -
CookieSpy shows it will expire in 20 years.

ebay.com - neutral -
designated to expire in 24 hours in WW filter -
CookieSpy shows it will expire in 5 years

www.paypal.com - BAD -
designated as BAD - should never be allowed to be set -
Cookie Spy shows it is set and will expire in 30 years.

All other cookies are being set, or not set at all, appropriately with correct expiration times, depending on their designation in the WW filter.

Zhen, what I am thinking is that these particular cookies are fooling the system (WW) somehow - how I would like to know!!

Does using a secure website - https - have anything to do with it? So - if the site has both and http and https within it, does WW work on both, or just the http unless you tell it to work on the https pages as well??

reply to Zhen-Xjell
Zhen, I think I may have figured it out, and if this is right, then there is a bug in WW!

I went to eBay, which will try to set cookies just on visiting their home page. Nothing on my machine.

I went to the sign in page - and chose the SSL sign in which brought me to a https web page, and what do you know! There is the cookie!

It seems to me that WW can't filter out cookies from an https page and there is no way to tell it to do so!

I have to shut down and restart to get eBay to not recognize that I am signed in to try this again.

reply to Anon
Interesting... if you are setting the paypal cookie to bad, then you shouldn't be able to log into the system at all since it wants to leave a cookie on your hard drive. Hmm... I have to test this when I get home.

AFAIK, any bad cookies I have set, are not coming down.

Well Zhen I may have spoken too soon, as I went back to eBay, and signed in under the http (instead of hhtps) and I still got a cookie set to expire in 5 years, not 24 hours, so the https may have nothing to do with it.

I am stumped. (Not that I know enough not to be stumped, it just shows how little I know about how these things work).

And also - I have my WW configured like yours except neutral cookies expire in 24 hours. Also I have disabled scripts from accessing cookies.
[text was edited by author 2001-05-22 16:18:12]

Switch the neutral setting and conduct the same test. What are your results?

Ok - I set my neutral to expire after finishing the browser session, and when I checked cookies for ebay.com at every page I went to (through CookieSpy, and I refresh the view of that folder each time by going to a different folder than coming back to the folder these cookies go into).

What I found was this:

As long as I stayed in the http portion of the site, NO COOKIE was set on my machine.

I signed out and resigned in (checking at each step along the way for a cookie from ebay.com) via https and low and behold the cookie with a 5 year expiration date appears on my system!!! So, with neutrals set to expire with the browser session, WW didn't keep out cookie from the https page !! ?? !!

I went to »www.paypal.com - did nothing, no cookie

went to »www.paypal.com - did nothing, cookie set and expires in 30 years. (I deleted it)

When I tried to repeat it with the https and paypal, it didn't set a cookie. (But it did that first time - which I promptly deleted.)

When I signed into PayPal, which is through the https, and is www.paypal.com, I get a cookie now which expires in 6 months.

more confused . . . .

reply to Zhen-Xjell
Ok Zhen,

Think I am narrowing this down a little - I went to costco.com - on my BAD list. No cookie set at the usual

http ://costco.com (had to put a space in there for the url to show up correctly?)

BUT when I went to

»costco.com

I got a cookie set that expires in 34 years!!

hmmmm

reply to Zhen-Xjell
Zhen same thing happened with sears.com

go to http and no cookie.

go to https and you get a cookie - this one for 24 years.

Not good . . . . .

reply to Anon
I just tried, first setting the url filter to »www.paypal.com. Two cookies were set. I deleted them, then tried again with the filter set to *.paypal.com, went to htts://www.paypal.com, and this time, no cookies were set at all.
--
we were just souless, bloodsucking demons-they're lawyers...

I am still learning how to use WW - so I should do a "*" in front of it?? hmmmm I'll go try that now!

Well - I still get the 6mth cookie when I log in at the https www.paypal.com and the cookie is from paypal.com, not www.paypal.com

I put a "*" in front of both too in their respective entries in the WW filter list.
[text was edited by author 2001-05-22 18:08:03]

Here is a site to help you Setup and use WW. »www.pacificnet.net/%7Ebbruce/workshop.htm

thanks for the link.
Do you guys have trouble with opening pop up windows when WW is not set to block them?»www.bhmotorsports.com/
That site uses pop ups for everything and with WW on I can't get any pop up at all.

Update never mind when I open WW first all is OK:)
[text was edited by author 2001-05-22 19:08:30]

reply to Vampirefo
Thank you vampirefo for the link - I had meant to get back there for a while now.

I didn't find anything to help me with this except that they have found that cookies from about.com can't be blocked by WW.