Web Trackers Research Articles

Combating Web Tracking: Analyzing Web Tracking Technologies for User Privacy

Behind everyday websites, a hidden shadow world tracks the behavior of Internet users. Web tracking analyzes online activity based on collected data and delivers content tailored to users’ interests. It gathers vast amounts of information for various purposes, ranging from sensitive personal data to seemingly minor details such as IP addresses, devices, browsing histories, settings, and preferences. While Web tracking is largely a legitimate technology, the increase in illegal user tracking, data breaches, and the unlawful sale of data has become a growing concern. As a result, the demand for technologies that can detect and prevent Web trackers is more important than ever. This paper provides an overview of Web tracking technologies, relevant research, and website measurement tools designed to identify web-based tracking. It also explores technologies for preventing Web tracking and discusses potential directions for future research.

Disposable identities: Solving web tracking

Interrupting the web tracking kill chain is enough to disrupt the tracker’s ability to leverage the collected information; however, this may disrupt the personalized services enjoyed by many. Empowering the user to select which domains can be co-tracked gives him/her the upper hand over web trackers. This allows the user to enjoy the personalized services without fearing full inter-domain tracking. To achieve this, we propose a solution that attempts to introduce layers of anonymization serving as temporary identities to be used by the user while browsing. Those identities will be used for limited time (to sustain the customization and user experience resulting from tracking), and then discarded for a new identity. This approach allows the user to divide the activity into profiles which eliminates browsing history spilling over to other sessions. We proved the security of this approach mathematically and we demonstrated its usability using an open-source Proof-of-Concept built on top of blockchain.

An Empirical Analysis of Web Storage and Its Applications to Web Tracking

In this article, we present a large-scale empirical analysis of the use of web storage in the wild.By using dynamic taint tracking at the level of JavaScript and by performing an automated classification of the detected information flows, we shed light on the key characteristics of web storage uses in the Tranco Top 10k. Our analysis shows that web storage is routinely accessed by third parties, including known web trackers, who are particularly eager to have both read and write access to persistent web storage information. We then deep dive in web tracking as a prominent case study: our analysis shows that web storage is not yet as popular as cookies for tracking purposes; however, taint tracking is useful to detect potential new trackers not included in standard filter lists. Moreover, we observe that many websites do not comply with the General Data Protection Regulation directives when it comes to their use of web storage.

COMBINED METHOD FOR PROTECTING USER PRIVACY WHEN USING A WEB BROWSER

The article examines the issue of digital tracking, which allows users to be identified using cookies and digital fingerprints. A comparative analysis of current web tracking methods shows that approaches based on detecting and blocking web trackers are less effective than methods using value substitution. These approaches do not protect against passive fingerprinting techniques and are easily detected, making them vulnerable to user identification. To solve this problem, a hybrid method of forging transmitted data is proposed, including random generation and data fusion, as well as detecting trackers for immediate protection. Attributes with a wide range of possible values and complex compatibility are proposed to be replaced by real values with minor distortions.

ГИБРИДНЫЙ СПОСОБ ОБЕСПЕЧЕНИЯ КОНФИДЕНЦИАЛЬНОСТИ ПОЛЬЗОВАТЕЛЯ ПРИ РАБОТЕ С ВЕБ-БРАУЗЕРОМ

Introduction: One of the most common privacy vulnerabilities on the Internet is digital tracking that identifies users, which includes cookies and digital fingerprinting mechanisms. A comparative analysis of existing modern web tracking methods shows that approaches that rely on detecting and blocking web trackers are less effective than ones using value spoofing, since they do not provide passive fingerprinting methods protection, and are also easily detectable and, as a consequence, are susceptible to being used user identification. To eliminate these shortcomings, new, generally combined, methods should be developed. Purpose is to analyze the main mechanisms and varieties of digital tracking, describe the principles of their operation and develop an effective hybrid method to counteract the digital fingerprinting of the user's device. Results: It is shown that fingerprint tracking is extremely dangerous, as it cannot be effectively blocked by the browser. To solve the problem, a hybrid method of spoofing transmitted data, including both randomization and unification, is proposed. This method is chosen due to the fact that it provides protection against known digital fingerprinting methods. In addition, the method lacks the tracker detection stage, that provides instant protection. Characteristics with a wider range of possible values, that are also difficult to unify (Canvas, WebGL, Audio) are proposed to be replaced with the real ones with the addition of minor distortions. Attributes that must comply with the value adequacy property and changing of which may disrupt the website will be unified. Consequently, it is proposed to unify HTTP headers and global JavaScript browser parameters. The software implementation of the described algorithm is made in the JavaScript programming language in the ECMAScript 6 specification using the standard of the Web-Extensions API cross-browser add-on development system.

Physical-Equivalent Privacy

ABSTRACT This article introduces and applies the concept of “physical-equivalent privacy” to evaluate the appropriateness of data collection about library patrons’ use of library-provided e-resources. It posits that as a matter of service equity, any data collection practice that causes e-resource users to enjoy less information privacy than users of an information-equivalent print resource is to be avoided. Analysis is grounded in real-world e-resource-related phenomena: secure (HTTPS) library websites and catalogs, the Adobe Digital Editions data-leak incident of 2014, and use of web trackers on e-resource websites. Implications of physical-equivalent privacy for the SeamlessAccess single-sign-on proposal will be discussed.

Data Security as the Basis for the Operation of Online Travel Platforms on the Example of Platforms Dedicated to Nautical Tourism: Cyber Analysis and Geographical Impacts

Trust has emerged as a key factor in any virtual transaction. Therefore, the protection of trustworthiness should be a central matter of concern in the online tourism sector, especially in emerging and, hence, more fragile markets such as nautical tourism. In this study, an exploratory investigation was conducted of four online sailing platforms using an inductive content analysis of the data collected. The goal was to examine cybersecurity-related indicators that may affect trustworthiness of the platforms. To this end, the study focused on two freely accessible types of information: the level of transaction security and the level of concern for personal privacy. Given that it may be unclear to many users how a small text file (a cookie) created by a website and stored in the user's computer can affect the user’s privacy, an interdisciplinary disclosive computer ethics approach was used for unveiling the risk related to cookies, especially third-party cookies, or web trackers. Interestingly, geopolitical and geoeconomic correlations were noted when interpreting the findings from a geographical point of view, although it was concluded that more research is needed to better understand the phenomenon. However, notwithstanding the relatively limited sample, this work offers valuable insights into a systematic understanding of how cybersecurity contributes to increased trust and, hence, improved competitiveness.

Using Deep Learning to Block Web Tracking

Most websites that users browse every day utilize trackers that can identify who users are and what activities they conduct online. Although there are benefits to these trackers, they also raise considerable privacy concerns. This research study examines the issue of how to identify web trackers and how to protect users from being tracked. Specifically, this study investigates how AI Deep Learning technologies can be leveraged to identify and stop trackers. The main idea of AI Tracker Blocking is that AI can detect the small differences between tracker server domains and non-tracker server domains. For instance, a tracker domain may appear like this: analytics.xxx.bid, whereas a non-tracker domain may be like this: mail.xxx.com. Although it is likely impossible to block all trackers, results from this study indicate that there are new ways to identify them using Deep Learning.

Web Tracking Under the New Data Protection Law: Design Potentials at the Intersection of Jurisprudence and HCI

Abstract The GDPR regulates at present the handling with personal data fundamentally new and thereby opens new leeway. At the same time, it creates great uncertainty among those affected. One example of this is web tracking: It helps designers to improve the utility and usability of their websites based on, in part, extensive (personal) data collection, or enable operators to finance them. Against this background, in this article we first show the practical relevance of web tracking by collecting the web trackers of the 100 most popular pages of each of the 28 EU member states. Building on this, we show which data these trackers collect and analyze their legal bases. Finally, we discuss possible consequences in design and architecture for fulfilling the legally outlined requirements, taking into account a user’s perspective.

When the cookie meets the blockchain: Privacy risks of web payments via cryptocurrencies

Abstract We show how third-party web trackers can deanonymize users of cryptocurrencies. We present two distinct but complementary attacks. On most shopping websites, third party trackers receive information about user purchases for purposes of advertising and analytics. We show that, if the user pays using a cryptocurrency, trackers typically possess enough information about the purchase to uniquely identify the transaction on the blockchain, link it to the user’s cookie, and further to the user’s real identity. Our second attack shows that if the tracker is able to link two purchases of the same user to the blockchain in this manner, it can identify the user’s cluster of addresses and transactions on the blockchain, even if the user employs blockchain anonymity techniques such as CoinJoin. The attacks are passive and hence can be retroactively applied to past purchases. We discuss several mitigations, but none are perfect.