How We Saved Cookie Sleuth From False Positive Hell - Building an Information-Theoretic Engine
If you've ever built a privacy tool or security extension, you know the exact moment the dream hits reality: you test your shiny new code on a real-world website, and it immediately blows up.
That was our exact experience with Cookie Sleuth recently. Checkout the Repo here: https://github.com/huement/cookie_sleuth/
We had built an extension designed to catch cookie stuffing—the fraudulent practice where malicious sites covertly drop affiliate tracking cookies onto your browser without your consent so they can steal attribution credit when you buy something later.
The original logic was straightforward: match affiliate URL parameters, check cookie names, add up some penalty points, and flag a threat if the score hit a threshold.
Then we opened YouTube. And Gmail. And a few news sites.
Within seconds, the alert badge turned bright pink with hundreds of false positives. Modern single-page web apps render at lightning speed, make dozens of background API calls, and load programmatic display ads. To our naive scoring engine, YouTube looked like a giant cookie stuffing ring.
We needed to fix this fast. We couldn't just throw together a giant, fragile whitelist. Instead, we re-architected the entire detection engine from the ground up, grounding it in information theory, human physiological reaction limits, and a 3-stage normalized scoring pipeline.
Here is a look behind the scenes at how the new Cookie Sleuth detection engine works.
1. The Core Fix: Moving to a 3-Stage Pipeline
The biggest flaw in our early model was treating affiliate tracking as an automatic threat. Seeing a utm_source= or affid= parameter doesn't mean you're being scammed—it just means affiliate attribution exists.
We completely separated Affiliate Identification from Unsolicited Suspicion. Now, every cookie passes through three distinct stages:
Stage 1: Is this actually an affiliate cookie?
Before running any heavy analysis, Stage 1 performs a quick binary check. Does the cookie name match known affiliate markers? Does the...