Protecting Browser State from Web Privacy Attacks
Authors: C. Jackson, A. Bortz, D. Boneh, and J. Mitchell
Abstract:
Through a variety of means, including a range of browser
cache methods and inspecting the color of a visited hyper-link, client-side
browser state can be exploited to track users
against their wishes. This tracking is possible because per-
sistent, client-side browser state is not properly partitioned
on per-site basis in current browsers. We address this problem by
refining the general notion of a same-origin policy
and implementing two browser extensions that enforce this
policy on the browser cache and visited links.
We also analyze various degrees of cooperation between sites to track users, and show that even if long-term browser state is properly partitioned, it is still possible for sites to use modern web features to bounce users between sites and invisibly engage in cross-domain tracking of their visitors. Cooperative privacy attacks are an unavoidable consequence of all persistent browser state that affects the behavior of the browser, and disabling or frequently expiring this state is the only way to achieve true privacy against colluding parties.
Reference:
In Proceedings of the 15th International Conference on World Wide Web, WWW '06, ACM Press, pp. 737-744
Full paper: pdf [first posted 3/2006 ]