Hm, I looked into this, and as of recently you could get around it just by changing the QueryString: http://twitchy.com/2013/02/12/paywalls-are-hard-new-york-tim...

The cookies are for the number of times viewed, yes.

The HTTP Referer header is used to tell if you came from google or twitter: http://www.labspaces.net/blog/1258/Thwart_the_NYtimes_paywal...

They definitely look at IP address for geographic reasons: http://blogs.hbr.org/samuel/2011/03/on-the-new-york-times-pa... but you are correct, they don't appear to use it for the paywall.

Thanks!