Why does CNAME Cloaking enable cross domain tracking?

Question

Recently, as browsers start blocking 3rd party cookies, a risky technique known as CNAME Cloaking emerged. It is said that this technique enables trackers, especially those in the online advertising industry, to continue to track users across domains and across the web.

From https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a:

Let’s assume you visited website1.com that includes a third-party tracker from Tracking Company, then website2.com that also includes that tracker. Tracking Company would know that you visited both sites...

As I understand, in CNAME Cloaking, the browser doesn't know a given external resource (such as image, iframe, or JS) is an alias to a 3rd party site. So if a user is on website1.com, the browser will still store and send first-party cookies to img1.website.com, which is an alias to trackingcompany.com.

My question is on how CNAME Cloaking establishes linkage for the same user across domains. As a specific example, say website1.com stores/sends its first-party cookie containing w1_id to Tracking Company, while website2.com sends/stores w2_id. How does Tracking Company link w1_id and w2_id it gets?

Answer 1

CNAME cloaking allows the tracker to bypass outright blocking of the tracking script. It does not allow cookies to be set across multiple domains.

To link cookies w1_id and w2_id set on different sites, browser fingerprinting would usually be used. 99.5% of users can be uniquely identified based on unique characteristics of the user's settings, browser, hardware, and behavior. Details that typically go into the fingerprint are:

• Operating system
• Browser version
• Time zone
• Language
• Font list
• How a browser draws on a canvas
• Screen dimensions

If you want to see if you are fingerprintable, go to https://amiunique.org/ to generate your fingerprint and see the whole list of items they check.

Browsers are starting to make changes to make fingerprinting harder. Browsers have implemented several changes that prevent JavaScript from getting so much unique info:

• Hiding minor version numbers in user agent strings and lying about other details such as operating system version.
• Preventing JavaScript access to lists of plugins installed.
• Removing Flash

However, this has only helped the situation to a small degree. There is still a ton of data exposed by browsers that can be used in fingerprinting.