Track: Web Privacy
Use the red “Join on YouTube” button above to join the livestream. If you cannot see this button, make sure you are logged in (see the upper-right corner of your screen).
Session Chair: Nataliia Bielova
- Long-Term Observation on Browser Fingerprinting: Users’ Trackability and Perspective
- No boundaries: data exfiltration by third parties embedded on web pages
- A Comparative Measurement Study of Web Tracking on Mobile and Desktop Environments
- In Depth Evaluation of Redirect Tracking and Link Usage
Gaston Pugliese (Friedrich-Alexander University Erlangen-Nürnberg (FAU)), Christian Riess (Friedrich-Alexander University Erlangen-Nürnberg (FAU)), Freya Gassmann (Saarland University), and Zinaida Benenson (Friedrich-Alexander University Erlangen-Nürnberg (FAU))
Summary: Browser fingerprinting, as a stateless tracking technique, can be used to recognize users based on the characteristics and behavior of their browser. In this talk, we present technical and user-centred findings from a 3-year online study.
Gunes Acar (KU Leuven), Steve Englehardt (Mozilla), and Arvind Narayanan (Princeton University)
Summary: We investigate data exfiltration by third-party scripts directly embedded on web pages. Specifically, we study three attacks: misuse of browsers’ internal login managers, social data exfiltration, and whole-DOM exfiltration. Although the possibility of these attacks was well known, we provide the first empirical evidence based on measurements of 300,000 distinct web pages from 50,000 sites. We extend OpenWPM’s instrumentation to detect and precisely attribute these attacks to specific third-party scripts. Our analysis reveals invasive practices such as inserting invisible login forms to trigger autofilling of the saved user credentials, and reading and exfiltrating social network data when the user logs in via Facebook login. Further, we uncovered password, credit card, and health data leaks to third parties due to wholesale collection of the DOM. We discuss the lessons learned from the responses to the initial disclosure of our findings and fixes that were deployed by the websites, browser vendors, third-party libraries and privacy protection tools.
Zhiju Yang (Colorado School of Mines) and Chuan Yue (Colorado School of Mines)
Martin Koop (None), Erik Tews (University of Twente), and Stefan Katzenbeisser (Universität Passau)
Summary: In this work we present the first large scale study on the threat of redirect link tracking. By crawling the Alexa top 50k websites and following up to 34 page links, we recorded traces of HTTP requests from 1.2 million individual visits of websites as well as analyzed 108,435 redirect chains originating from links clicked on those websites. We evaluate the derived redirect network on its tracking ability and demonstrate that top trackers are able to identify the user on the most visited websites. We also show that 11.6% of the scanned websites use one of the top 100 redirectors which are able to store non-blocked first-party tracking cookies on users' machines even when third-party cookies are disabled. Moreover, we present the effect of various browser cookie settings, resulting in a privacy loss even when using third-party blocking tools.