Hm, I looked into this, and as of recently you could get around it just by changing the QueryString: http://twitchy.com/2013/02/12/paywalls-are-hard-new-york-tim...

The cookies are for the number of times viewed, yes.

The HTTP Referer header is used to tell if you came from google or twitter: http://www.labspaces.net/blog/1258/Thwart_the_NYtimes_paywal...

They definitely look at IP address for geographic reasons: http://blogs.hbr.org/samuel/2011/03/on-the-new-york-times-pa... but you are correct, they don't appear to use it for the paywall.

Thanks!

Nytimes paywall depends on inducing different feelings. They just use it to remind you that "Hey we are doing great work here, show us some support" ... so they don't mind it being porous.