research-article

Public Access

Measuring the Privacy vs. Compatibility Trade-off in Preventing Third-Party Stateful Tracking

Authors:

Jordan Jueckstock,

Alexandros Kapravelos,

Benjamin LivshitsAuthors Info & Claims

WWW '22: Proceedings of the ACM Web Conference 2022

Pages 710 - 720

https://doi.org/10.1145/3485447.3512231

Published: 25 April 2022 Publication History

All formats PDF

Abstract

Despite active privacy research on sophisticated web tracking techniques (e.g., fingerprinting, cache collusion, bounce tracking, CNAME cloaking), most tracking on the web is basic “stateful” tracking enabled by classical browser storage policies sharing per-site storage across all HTTP contexts. Alternative, privacy-preserving storage policies, especially for third-party contexts, have been proposed and even deployed, but these can break websites that presume traditional, non-partitioned storage. Such breakage discourages privacy-preserving experimentation, cementing the dismal status quo. Our work measures the privacy vs. compatibility trade-offs of representative third-party storage policies to enable design of browsers that are both compatible and privacy respecting. Our contributions include web-scale measurements of page behaviors under multiple third-party storage policies inspired by production browsers. We define metrics for measuring aggregate effects on web privacy and compatibility, including a novel system for quantitatively estimating aggregate website breakage under different policies. We find that making third-party storage partitioned by first-party, and lifetimes by site-session achieves the best privacy and compatibility trade-off. We provide complete measurement datasets and storage policy implementations.

References

[1]

2020. Chromium Blog: Building a more private web: A path towards making third party cookies obsolete. https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html. Accessed: 2020-10-12.

[2]

2020. EasyList. https://easylist.to/easylist/easylist.txt. Accessed: 2020-09-17.

[3]

2020. GitHub - disconnectme/disconnect-tracking-protection. https://github.com/disconnectme/disconnect-tracking-protection. Accessed: 2020-10-12.

[4]

2020. HTML Standard: 7.5 Origin. https://html.spec.whatwg.org/multipage/origin.html#origin. Accessed: 2020-10-12.

[5]

2020. HTML Standard §12.2.3: The localStorage getter. https://html.spec.whatwg.org/multipage/webstorage.html#the-localstorage-attribute. Accessed: 2022-02-05.

[6]

2020. Indexed Database API 2.0. https://www.w3.org/TR/IndexedDB-2/. Accessed: 2022-02-05.

[7]

2020. Open-source, prototype implementation of page-length storage and public dataset. https://github.com/wspr-ncsu/ephemeral-storage-patches. Accessed: 2020-10-15.

[8]

2020. Public Suffix List. https://publicsuffix.org/list/public_suffix_list.dat. Accessed: 2020-09-19.

[9]

Gunes Acar, Christian Eubank, Steven Englehardt, Marc Juarez, Arvind Narayanan, and Claudia Diaz. 2014. The Web Never Forgets: Persistent Tracking Mechanisms in the Wild. In Proceedings of the ACM Conference on Computer and Communications Security (CCS).

Digital Library

[10]

Gunes Acar, Marc Juarez, Nick Nikiforakis, Claudia Diaz, Seda Gürses, Frank Piessens, and Bart Preneel. 2013. FPDetective: Dusting the Web for Fingerprinters. In Proceedings of the ACM Conference on Computer and Communications Security (CCS). 1129–1140.

Digital Library

[11]

Assel Aliyeva and Manuel Egele. 2021. Oversharing Is Not Caring: How CNAME Cloaking Can Expose Your Session Cookies. In Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security.

Digital Library

[12]

Lujo Bauer, Shaoying Cai, Limin Jia, Timothy Passaro, Michael Stroucken, and Yuan Tian. 2015. Run-time Monitoring and Formal Analysis of Information Flows in Chromium. In Proceedings of the Symposium on Network and Distributed System Security (NDSS).

[13]

Quan Chen, Panagiotis Ilia, Michalis Polychronakis, and Alexandros Kapravelos. 2021. Cookie Swap Party: Abusing First-Party Cookies for Web Tracking. In Proceedings of the The Web Conference (WWW).

Digital Library

[14]

Quan Chen, Peter Snyder, Ben Livshits, and Alexandros Kapravelos. 2021. Detecting Filter List Evasion With Event-Loop-Turn Granularity JavaScript Signatures. In Proceedings of the IEEE Symposium on Security and Privacy.

[15]

Yana Dimova, Gunes Acar, Lukasz Olejnik, Wouter Joosen, and Tom Van Goethem. 2021. The CNAME of the Game: Large-scale Analysis of DNS-based Tracking Evasion. In Proceedings on Privacy Enhancing Technologies.

[16]

Peter Eckersley. 2010. How Unique Is Your Web Browser?. In International Symposium on Privacy Enhancing Technologies Symposium.

[17]

Steven Englehardt and Arvind Narayanan. 2016. Online Tracking: A 1-million-site Measurement and Analysis. In Proceedings of the ACM Conference on Computer and Communications Security (CCS).

Digital Library

[18]

Marjan Falahrastegar, Hamed Haddadi, Steve Uhlig, and Richard Mortier. 2016. Tracking personal identifiers across the web. In International Conference on Passive and Active Network Measurement. Springer, 30–41.

[19]

Imane Fouad, Nataliia Bielova, Arnaud Legout, and Natasa Sarafijanovic-Djukic. 2020. Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels. In PETS 2020-20th Privacy Enhancing Technologies Symposium.

[20]

Alejandro Gómez-Boix, Pierre Laperdrix, and Benoit Baudry. 2018. Hiding in the Crowd: an Analysis of the Effectiveness of Browser Fingerprinting at Large Scale. In Proceedings of the International World Wide Web Conference (WWW).

Digital Library

[21]

David Gugelmann, Markus Happe, Bernhard Ager, and Vincent Lenders. 2015. An automated approach for complementing ad blockers’ blacklists. Proceedings on Privacy Enhancing Technologies 2015, 2(2015), 282–298.

[22]

Kevin A Hallgren. 2012. Computing inter-rater reliability for observational data: an overview and tutorial. Tutorials in quantitative methods for psychology 8, 1 (2012), 23.

[23]

Xuehui Hu and Nishanth Sastry. 2020. What a Tangled Web We Weave: Understanding the Interconnectedness of the Third Party Cookie Ecosystem. In Proceedings of the 12th ACM Conference on Web Science. ACM, Southampton, UK.

Digital Library

[24]

Umar Iqbal, Peter Snyder, Shitong Zhu, Benjamin Livshits, Zhiyun Qian, and Zubair Shafiq. 2020. AdGraph: A Graph-Based Approach to Ad and Tracker Blocking. In Proceedings of the IEEE Symposium on Security and Privacy.

[25]

Collin Jackson, Andrew Bortz, Dan Boneh, and John C Mitchell. 2006. Protecting Browser State from Web Privacy Attacks. In Proceedings of the International World Wide Web Conference (WWW).

Digital Library

[26]

Pierre Laperdrix, Benoit Baudry, and Vikas Mishra. 2017. FPRandom: Randomizing core browser objects to break advanced device fingerprinting techniques. In International Symposium on Engineering Secure Software and Systems. Springer, 97–114.

[27]

Pierre Laperdrix, Walter Rudametkin, and Benoit Baudry. 2016. Beauty and the beast: Diverting modern web browsers to build unique browser fingerprints. In Proceedings of the IEEE Symposium on Security and Privacy.

[28]

Tai-Ching Li, Huy Hang, Michalis Faloutsos, and Petros Efstathopoulos. 2015. Trackadvisor: Taking back browsing privacy from third-party trackers. In International Conference on Passive and Active Network Measurement. Springer, 277–289.

[29]

Chao Liu, Ryen W White, and Susan Dumais. 2010. Understanding web browsing behaviors through Weibull analysis of dwell time. In Proceedings of the 33rd international ACM SIGIR conference on Research and development in information retrieval. 379–386.

Digital Library

[30]

J. R. Mayer and J. C. Mitchell. 2012. Third-Party Web Tracking: Policy and Technology. In Proceedings of the IEEE Symposium on Security and Privacy.

Digital Library

[31]

Mary L McHugh. 2012. Interrater reliability: the kappa statistic. Biochemia medica: Biochemia medica 22, 3 (2012), 276–282.

[32]

Nick Nikiforakis, Wouter Joosen, and Benjamin Livshits. 2015. Privaricator: Deceiving fingerprinters with little white lies. In Proceedings of the 24th International Conference on World Wide Web. 820–830.

Digital Library

[33]

Łukasz Olejnik, Gunes Acar, Claude Castelluccia, and Claudia Diaz. 2016. The Leaking Battery. In Data Privacy Management, and Security Assurance. Springer International Publishing.

[34]

Lukasz Olejnik, Tran Minh-Dung, and Claude Castelluccia. 2014. Selling Off Privacy at Auction. In Proceedings of the Symposium on Network and Distributed System Security (NDSS).

[35]

Xiang Pan, Yinzhi Cao, and Yan Chen. 2015. I Do Not Know What You Visited Last Summer: Protecting Users from Third-party Web Tracking with TrackingFree Browser. In Proceedings of the Symposium on Network and Distributed System Security (NDSS).

[36]

Panagiotis Papadopoulos, Nicolas Kourtellis, and Evangelos Markatos. 2019. Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask. In Proceedings of the International World Wide Web Conference (WWW).

Digital Library

[37]

Panagiotis Papadopoulos, Nicolas Kourtellis, and Evangelos P Markatos. 2018. The cost of digital advertisement: Comparing user and advertiser views. In Proceedings of the 2018 World Wide Web Conference. 1479–1489.

Digital Library

[38]

Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maciej Korczyński, and Wouter Joosen. 2019. Tranco: A research-oriented top sites ranking hardened against manipulation. In Proceedings of the Symposium on Network and Distributed System Security (NDSS).

[39]

Gaston Pugliese, Christian Riess, Freya Gassmann, and Zinaida Benenson. 2020. Long-Term Observation on Browser Fingerprinting: Users’ Trackability and Perspective. Proceedings on Privacy Enhancing Technologies 2020, 2(2020), 558–577.

[40]

Franziska Roesner, Tadayoshi Kohno, and David Wetherall. 2012. Detecting and Defending Against Third-Party Tracking on the Web. In Proceedings of the USENIX Symposium on Networked Systems Design & Implementation.

[41]

Iskander Sanchez-Rola, Davide Balzarotti, and Igor Santos. 2019. BakingTimer: Privacy Analysis of Server-Side Request Processing Time. In Proceedings of the Annual Computer Security Applications Conference (ACSAC).

Digital Library

[42]

Iskander Sanchez-Rola, Matteo Dell’Amico, Davide Balzarotti, Pierre-Antoine Vervier, and Leyla Bilge. 2021. Journey to the Center of the Cookie Ecosystem: Unraveling Actors’ Roles and Relationships. In Proceedings of the IEEE Symposium on Security and Privacy.

[43]

Jörg Schwenk, Marcus Niemietz, and Christian Mainka. 2017. Same-Origin Policy: Evaluation in Modern Browsers. In Proceedings of the USENIX Security Symposium.

[44]

Alexander Sjösten, Peter Snyder, Antonio Pastor, Panagiotis Papadopoulos, and Benjamin Livshits. 2020. Filter List Generation for Underserved Regions. In Proceedings of The Web Conference 2020.

Digital Library

[45]

Peter Snyder, Cynthia Taylor, and Chris Kanich. 2017. Most Websites Don’t Need to Vibrate: A Cost-Benefit Approach to Improving Browser Security. In Proceedings of the ACM Conference on Computer and Communications Security (CCS).

Digital Library

[46]

Martin Stopczynski, Erik Tews, and Stefan Katzenbeisser. 2020. In Depth Evaluation of Redirect Tracking and Link Usage. In PETS 2020-20th Privacy Enhancing Technologies Symposium.

[47]

Tom Van Goethem, Christina Pöpper, Wouter Joosen, and Mathy Vanhoef. 2020. Timeless Timing Attacks: Exploiting Concurrency to Leak Secrets over Remote Connections. In Proceedings of the USENIX Security Symposium.

[48]

Zhiju Yang and Chuan Yue. 2020. A Comparative Measurement Study of Web Tracking on Mobile and Desktop Environments. Proceedings on Privacy Enhancing Technologies 2020, 2(2020), 24–44.

[49]

Zhonghao Yu, Sam Macbeth, Konark Modi, and Josep M Pujol. 2016. Tracking the trackers. In Proceedings of the 25th International Conference on World Wide Web. 121–132.

Digital Library

[50]

Sebastian Zimmeck, Jie S Li, Hyungtae Kim, Steven M Bellovin, and Tony Jebara. 2017. A Privacy Analysis of Cross-device Tracking. In Proceedings of the USENIX Security Symposium. 1391–1408.

Cited By

Yang WWang EGui ZZhou YWang BXie W(2025)An MLLM-Assisted Web Crawler Approach for Web Application FuzzingApplied Sciences10.3390/app1502096215:2(962)Online publication date: 19-Jan-2025
https://doi.org/10.3390/app15020962
Stafeev APellegrino GBalzarotti DXu W(2024)SoKProceedings of the 33rd USENIX Conference on Security Symposium10.5555/3698900.3698941(719-737)Online publication date: 14-Aug-2024
https://dl.acm.org/doi/10.5555/3698900.3698941
McQuistin SSnyder PHaddadi HTyson GVallina-Rodríguez NSuarez-Tángil GLevin DPelsser C(2024)A First Look at Related Website SetsProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3689026(107-113)Online publication date: 4-Nov-2024
https://dl.acm.org/doi/10.1145/3646547.3689026
Show More Cited By

Index Terms

Measuring the Privacy vs. Compatibility Trade-off in Preventing Third-Party Stateful Tracking

Index terms have been assigned to the content through auto-classification.

Recommendations

Alternative to third-party cookies: investigating persistent PII leakage-based web tracking
CoNEXT '21: Proceedings of the 17th International Conference on emerging Networking EXperiments and Technologies

Many popular websites give users the ability to sign up for their services, which requires personally identifiable information (PII). However, these websites embed third-party tracking and advertising resources, and as a consequence, the authentication ...
Measuring privacy loss and the impact of privacy protection in web browsing
SOUPS '07: Proceedings of the 3rd symposium on Usable privacy and security

Various bits of information about users accessing Web sites. some of which are private, have been gathered since the inception of the Web. Increasingly the gathering, aggregation, and processing has been outsourced to third parties. The goal of this ...
Review: A survey on solutions and main free tools for privacy enhancing Web communications

Concern for privacy when users are surfing on the Web has increased recently. Nowadays, many users are aware that when they are accessing Web sites, these Web sites can track them and create profiles on the elements they access, the advertisements they ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

WWW '22: Proceedings of the ACM Web Conference 2022

April 2022

3764 pages

ISBN:9781450390965

DOI:10.1145/3485447

Editors:
Frédérique Laforest
INSA Lyon, France
,
Raphaël Troncy
EURECOM, France
,
Elena Simperl
King’s College London, UK
,
Deepak Agarwal
Pinterest, USA
,
Aristides Gionis
KTH Royal Institute of Technology, Sweden
,
Ivan Herman
W3C / retired
,
Lionel Médini
Université Lyon 1, France

Copyright © 2022 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGWEB: ACM Special Interest Group on Hypertext, Hypermedia, and Web

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 25 April 2022

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article
Research
Refereed limited

Funding Sources

Conference

WWW '22

Sponsor:

SIGWEB

WWW '22: The ACM Web Conference 2022

April 25 - 29, 2022

Virtual Event, Lyon, France

Acceptance Rates

Overall Acceptance Rate 1,899 of 8,196 submissions, 23%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

8
Total Citations
View Citations
602
Total Downloads

Downloads (Last 12 months)195
Downloads (Last 6 weeks)37

Reflects downloads up to 08 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Yang WWang EGui ZZhou YWang BXie W(2025)An MLLM-Assisted Web Crawler Approach for Web Application FuzzingApplied Sciences10.3390/app1502096215:2(962)Online publication date: 19-Jan-2025
https://doi.org/10.3390/app15020962
Stafeev APellegrino GBalzarotti DXu W(2024)SoKProceedings of the 33rd USENIX Conference on Security Symposium10.5555/3698900.3698941(719-737)Online publication date: 14-Aug-2024
https://dl.acm.org/doi/10.5555/3698900.3698941
McQuistin SSnyder PHaddadi HTyson GVallina-Rodríguez NSuarez-Tángil GLevin DPelsser C(2024)A First Look at Related Website SetsProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3689026(107-113)Online publication date: 4-Nov-2024
https://dl.acm.org/doi/10.1145/3646547.3689026
Kancherla GHong JPark JPrzybyłek A(2024)Student Research Abstract: Least Privilege Persistent-Storage Access in Web BrowsersProceedings of the 39th ACM/SIGAPP Symposium on Applied Computing10.1145/3605098.3635173(1797-1799)Online publication date: 8-Apr-2024
https://dl.acm.org/doi/10.1145/3605098.3635173
Smith MTorres-Agüero AGrossman RSen PChen YBorcea CChua TNgo CKa-Wei Lee RKumar RLauw H(2024)A Study of GDPR Compliance under the Transparency and Consent FrameworkProceedings of the ACM Web Conference 202410.1145/3589334.3645618(1227-1236)Online publication date: 13-May-2024
https://dl.acm.org/doi/10.1145/3589334.3645618
Hajj Chehade SSiby STroncoso C(2024)SINBAD: Saliency-informed detection of breakage caused by ad blocking2024 IEEE Symposium on Security and Privacy (SP)10.1109/SP54263.2024.00199(258-276)Online publication date: 19-May-2024
https://doi.org/10.1109/SP54263.2024.00199
Nisenoff ABorem APickering MNakanishi GThumpasery MUr BCalandrino JTroncoso C(2023)Defining "broken"Proceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620440(3619-3636)Online publication date: 9-Aug-2023
https://dl.acm.org/doi/10.5555/3620237.3620440
Fouquet RLaperdrix PRouvoy R(2023)Breaking Bad: Quantifying the Addiction of Web Elements to JavaScriptACM Transactions on Internet Technology10.1145/357984623:1(1-28)Online publication date: 23-Feb-2023
https://dl.acm.org/doi/10.1145/3579846

View Options

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

HTML Format

View this article in HTML Format.

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

Figures

Tables

Media

View Table of Conten