Abstract
Over the past few months we are seeing a large and ever increasing number of Web sites encouraging users to log in with their Facebook, Twitter, or Gmail identity, or personalize their browsing experience through a set of plug-ins that interact with the users’ social profile. Research results suggest that more than two million Web sites have already adopted Facebook’s social plug-ins, and the number is increasing sharply. Although one might theoretically refrain from such single sign-on platforms and cross-site interactions, usage statistics show that more than 250 million people might not fully realize the privacy implications of opting-in. To make matters worse, certain Web sites do not offer even the minimum of their functionality unless the users meet their demands for information and social interaction. At the same time, in a large number of cases, it is unclear why these sites require all that personal information for their purposes.
In this paper we mitigate this problem by designing and developing a framework for minimum information disclosure across third-party sites with single sign-on interactions. Our example case is Facebook, which combines a very popular single sign-on platform with information-rich social networking profiles. When a user wants to browse a Web site that requires authentication or social interaction with his Facebook identity, our system employs, by default, a Facebook session that reveals the minimum amount of information necessary. The user has the option to explicitly elevate that Facebook session in a manner that reveals more or all of the information tied to his social identity. This enables users to disclose the minimum possible amount of personal information during their browsing experience on third-party Web sites.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
BuiltWith - Facebook for Websites Usage Trends, http://trends.builtwith.com/javascript/Facebook-for-Websites
Facebook for Websites, https://developers.facebook.com/docs/guides/web/
Facebook Statistics, https://www.facebook.com/press/info.php?statistics
OAuth, http://oauth.net/
OpenID Foundation - OpenID Authentication 2.0 Specifications, http://openid.net/specs/openid-authentication-2_0.html
Sign in with Twitter, http://dev.twitter.com/pages/sign_in_with_twitter
Symantec Official Blog - Facebook Applications Accidentally Leaking Access to Third Parties, http://www.symantec.com/connect/blogs/facebook-applications-accidentally-leaking-access-third-parties
The Chromium Projects - Multiple Profiles, http://www.chromium.org/user-experience/multi-profiles
WebProNews - Million Sites Have Added Facebook’s Social Plugins Since f8, http://www.webpronews.com/2-million-sites-have-added-facebooks-social-plugins-since-f8-2010-09
Ardagna, C.A., De Capitani di Vimercati, S., Foresti, S., Paraboschi, S., Samarati, P.: Supporting privacy preferences in credential-based interactions. In: Proceedings of the 9th Annual ACM Workshop on Privacy in the Electronic Society (2010)
Barth, A., Jackson, C., Mitchell, J.C.: Robust defenses for cross-site request forgery. In: Proceedings of the 15th ACM Conference on Computer and Communications Security (2008)
Dey, A., Weis, S.: PseudoID: Enhancing privacy in federated login. In: Hot Topics in Privacy Enhancing Technologies (2010)
Felt, A., Evans, D.: Privacy protection for social networking platforms. In: Proceedings of the Workshop on Web 2.0 Security and Privacy (2008)
Luo, W., Xie, Q., Hengartner, U.: Facecloak: An architecture for user privacy on social networking sites. In: Proceedings of the International Conference on Computational Science and Engineering (2009)
Meiss, M., Duncan, J., Gonçalves, B., Ramasco, J.J., Menczer, F.: What’s in a session: tracking individual behavior on the web. In: Proceedings of the 20th ACM Conference on Hypertext and Hypermedia (2009)
Singh, K., Bhola, S., Lee, W.: xbook: redesigning privacy control in social networking platforms. In: Proceedings of the 18th Conference on USENIX Security Symposium (2009)
Stone, B.: Facebook aims to extend its reach across the web. New York Times (2008)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Kontaxis, G., Polychronakis, M., Markatos, E.P. (2011). SudoWeb: Minimizing Information Disclosure to Third Parties in Single Sign-on Platforms. In: Lai, X., Zhou, J., Li, H. (eds) Information Security. ISC 2011. Lecture Notes in Computer Science, vol 7001. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-24861-0_14
Download citation
DOI: https://doi.org/10.1007/978-3-642-24861-0_14
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-24860-3
Online ISBN: 978-3-642-24861-0
eBook Packages: Computer ScienceComputer Science (R0)