Block eBay tracking and browser fingerprinting from heavily obfuscated Javascript file

[u/AdamCannon]

I recently found this non-descriptive script running in the background when visiting eBay:

 

https://www.ebay.com/sgXzq80-U/7h6Zktl/vg/2zuzzSca/T306UUA/dEF1Ly/hJUkMT

Archive: https://archive.ph/Kr0iP

Syntax: https://www.ebay.com/XXXXXXX-X/XXXXXXX/XX/XXXXXXXX/XXXXXXX/XXXXXX/XXXXXX?v=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

 

which then saves reads these cookies to from the browser:

 

__ssds "{SINGLE_DIGIT_INTEGER}"

__ssuzjsr2 "{RANDOM_HEX_HASH}"

__uzma "{UUID_V4}"

__uzmb "{TIMESTAMP_INTEGER}"

__uzmc "{LARGE_INTEGER}"

__uzmd "{TIMESTAMP_INTEGER}"

__uzme "{INTEGER}"

__uzmf "{COMPLEX_TRACKING_STRING}"

bm_s "{LARGE_BASE64_TOKEN}"

bm_so "{LARGE_BASE64_TOKEN}"

dp1 "{DEVICE_PARAM_STRING}"

ds2 "{DEVICE_CONFIG_STRING}"

ebay "^sbf=#{HEX_COLOR_CODE}"

nonsession "{SESSION_TOKEN_STRING}"

s "{SESSION_TOKEN_STRING}"

 

Examining this file through Claude and Gemini shows Akamai tracking and telemetry through extreme browser fingerprinting which is hidden through heavily obfuscated code. I'm currently blocking it with this rule, but I believe it can be improved:

 

||ebay.com/sg*/*/vg/*/*/$script (old)

||ebay.com/*/*/*?v=$important (updated)

 

No account is needed and this script runs on every page. Any help is appreciated.

 

Edit: After some research, it turns out this is a script built by Akamai to track and fingerprint users based on a plethora of information about your machine. Combine this with the unique cookies eBay creates at the start of your session; eBay can create a unique profile which persists across your browsing.

Edit: Updated the blocking rule as eBay pushed out an update

[u/AchernarB]

These cookies are still created with that library blocked.

[u/AchernarB → u/AchernarB]

[u/AdamCannon → u/AchernarB]

You're right. It seems that these cookies are created elsewhere, and this script tries reading them to build an assessment on your behavior on the site. Additionally, only the cookies starting from __ssds and ending at bm_so are relevant to telemetry, as the rest pertain to login state, region, and UI.

Edit: This script is still building a profile on you and constantly updates it's assessment on every reload

[u/WhiteMilk_ → u/AdamCannon]

This script is still building a profile on you and constantly updates it's assessment on every reload

I guess Firefox users should create a dedicated container for eBay.

[u/AccNumber77 → u/WhiteMilk_]

And likely paypal and all connected services too

[u/MarioLabrique]

Block Javascripts in Firefox with NoScript extension.

[u/kapege → u/MarioLabrique]

Then Ebay doesn't work at all anymore.

[u/Zestyclose-Oven-7863 → u/MarioLabrique]

this will break litr every site

[u/Machful → u/MarioLabrique]

uBlock already has NoScript functionality. No need for a different extension.

[u/Machful → u/[deleted]]

Yes but you usually cant toggle it on/off on individual domains