October 23, 2017

Conference Paper: “Cookies That Give You Away: The Surveillance Implications of Web Tracking”

The following paper by Princeton University and Stanford University researchers was presented on May 20th at the 24th International World Wide Web Conference in Florence, Italy.


Cookies That Give You Away: The Surveillance Implications of Web Tracking

Steven Englehardt
Princeton University
Dillon Reisman
Princeton University
Christian Eubank
Princeton University
Peter Zimmerman
Princeton University
Jonathan Mayer
Stanford University
Arvind Narayanan
Princeton University
Edward W. Felten
Princeton University
Proceedings of the 24th International World Wide Web Conference
May 2015
We study the ability of a passive eavesdropper to leverage “third-party” HTTP tracking cookies for mass surveillance.
If two web pages embed the same tracker which tags the browser with a unique cookie, then the adversary can link visits to those pages from the same user (i.e., browser instance) even if the user’s IP address varies. Further, many popular websites leak a logged-in user’s identity to an eavesdropper in unencrypted traffic.
To evaluate the e ffectiveness of our attack, we introduce a methodology that combines web measurement and network measurement. Using OpenWPM, our web privacy measurement platform, we simulate users browsing the web and find that the adversary can reconstruct 62-73% of a typical user’s browsing history.
We then analyze the e ffect of the physical location of the wiretap as well as legal restrictions such as the NSA’s “one-end foreign” rule. Using measurement units in various locations—Asia, Europe, and the United States—we show that foreign users are highly vulnerable to the NSA’s dragnet surveillance due to the concentration of third-party trackers in the U.S.
Finally, we find that some browser-based privacy tools mitigate the attack while others are largely ineffective.
Gary Price About Gary Price

Gary Price (gprice@mediasourceinc.com) is a librarian, writer, consultant, and frequent conference speaker based in the Washington D.C. metro area. Before launching INFOdocket, Price and Shirl Kennedy were the founders and senior editors at ResourceShelf and DocuTicker for 10 years. From 2006-2009 he was Director of Online Information Services at Ask.com, and is currently a contributing editor at Search Engine Land.