Cookies That Give You Away

Englehardt, Steven; Reisman, Dillon; Eubank, Christian; Zimmerman, Peter D.; Mayer, Jonathan; Narayanan, Arvind; Felten, Edward W.

doi:10.1145/2736277.2741679

Cited by 129 publications

(29 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As most research involving GDPR does not consider banner interactions (i.e., clicking accept/reject buttons) [1,18,45,74], we develop BannerClick to automatically interact with banners. We run BannerClick on the Tranco top-10k websites [42] to analyze the effect of cookie banners.…”

Section: Effect Of Cookie Bannersmentioning

confidence: 99%

“…Web cookies serve various purposes, like keeping the user logged in or storing a user's website settings. However, other than their originally intended use, cookies have been exploited for commercial activities like user tracking and advertisement targeting [1,4,17,18,59]. As a consequence, various data protection laws have been enacted in the past few years, e.g., the General Data Protection Regulation (GDPR) [19] in the EU and the California Consumer Privacy Act (CCPA) [8] to regulate the use of cookies.…”

Section: Introductionmentioning

confidence: 99%

“…Interaction with cookie banners: Most research involving GDPR does not consider interaction with cookie banners (e.g., clicking accept/reject buttons) [1,18,45,74]. Thus, we develop the automated tool BannerClick to automatically detect, accept and reject cookie banners with an accuracy of 99%, 97%, and 87%, respectively (see Section 3).…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Exploring the Cookieverse: A Multi-Perspective Analysis of Web Cookies

Rasaii

Singh

Gosain

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Web cookies have been the subject of many research studies over the last few years. However, most existing research does not consider multiple crucial perspectives that can influence the cookie landscape, such as the client's location, the impact of cookie banner interaction, and from which operating system a website is being visited. In this paper, we conduct a comprehensive measurement study to analyze the cookie landscape for Tranco top-10k websites from different geographic locations and analyze multiple different perspectives. One important factor which influences cookies is the use of cookie banners. We develop a tool, BannerClick , to automatically detect, accept, and reject cookie banners with an accuracy of 99%, 97%, and 87%, respectively. We find banners to be 56% more prevalent when visiting websites from within the EU region. Moreover, we analyze the effect of banner interaction on different types of cookies (i.e., first-party, third-party, and tracking). For instance, we observe that websites send, on average, 5.5× more third-party cookies after clicking "accept", underlining that it is critical to interact with banners when performing Web measurements. Additionally, we analyze statistical consistency, evaluate the widespread deployment of consent management platforms, compare landing to inner pages, and assess the impact of visiting a website on a desktop compared to a mobile phone. Our study highlights that all of these factors substantially impact the cookie landscape, and thus a multi-perspective approach should be taken when performing Web measurement studies.

show abstract

Section: Effect Of Cookie Bannersmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Exploring the Cookieverse: A Multi-Perspective Analysis of Web Cookies

Rasaii

Singh

Gosain

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…HTML5 technologies such as WebGL and WebSockets contributed to achieve something that was attempted but not successful so far: in-browser crypto-currency mining [1]. On the one hand, cryptomining could be a business model where visitors use energy and computational resources in exchange for the content they get, instead of coping with advertisements and their privacy implications [14,16,29,47]. However, system administrators, developers, and attackers have started embedding crypto-mining scripts through their own and third-party sites without the users' consent.…”

Section: Motivationmentioning

confidence: 99%

Rapid

Rodriguez

Posegga

2018

Proceedings of the 34th Annual Computer Security Applications Conference

View full text Add to dashboard Cite

Direct access to the system's resources such as the GPU, persistent storage and networking has enabled in-browser crypto-mining. Thus, there has been a massive response by rogue actors who abuse browsers for mining without the user's consent. This trend has grown steadily for the last months until this practice, i.e., Crypto-Jacking, has been acknowledged as the number one security threat by several antivirus companies. Considering this, and the fact that these attacks do not behave as JavaScript malware or other Web attacks, we propose and evaluate several approaches to detect in-browser mining. To this end, we collect information from the top 330.500 Alexa sites. Mainly, we used real-life browsers to visit sites while monitoring resourcerelated API calls and the browser's resource consumption, e.g., CPU. Our detection mechanisms are based on dynamic monitoring, so they are resistant to JavaScript obfuscation. Furthermore, our detection techniques can generalize well and classify previously unseen samples with up to 99.99% precision and recall for the benign class and up to 96% precision and recall for the mining class. These results demonstrate the applicability of detection mechanisms as a server-side approach, e.g., to support the enhancement of existing blacklists. Last but not least, we evaluated the feasibility of deploying prototypical implementations of some detection mechanisms directly on the browser. Specically, we measured the impact of in-browser API monitoring on page-loading time and performed micro-benchmarks for the execution of some classiers directly within the browser. In this regard, we ascertain that, even though there are engineering challenges to overcome, it is feasible and benecial for users to bring the mining detection to the browser.

show abstract

“…Websites commonly track their users and share their data with third parties, 1 significantly elevating their users’ privacy risks. 2 The increase in online traffic and the subsequent potential for privacy risks exacerbate the current privacy concerns about the digital surveillance practices put in place to combat the COVID-19 pandemic. 3 , 4 McCoy et al 5 recently discovered that third-party tracking was prevalent among COVID-19-related websites.…”

Section: Introductionmentioning

confidence: 99%

Dark clouds and silver linings: impact of COVID-19 on internet users’ privacy

et al. 2021

View full text Add to dashboard Cite

Objectives To examine the impact of COVID-19 pandemic on the extent of potential violations of Internet users’ privacy. Materials and Methods We conducted a longitudinal study of the data sharing practices of the top 1,000 websites in the US between April 9th and August 27th, 2020. We fitted a conditional latent growth curve model on the data to examine the longitudinal trajectory of the third-party data sharing over the 21 weeks period of the study and examine how website characteristics affect this trajectory. We denote websites that asked for permission before placing cookies on users’ browsers as "privacy-respecting". Results As the weekly number of COVID-19 deaths increased by 1,000, the average number of third parties increased by 0.26 [95%CI, 0.15 to 0.37] P<.001 units in the next week. This effect was more pronounced for websites with higher traffic as they increased their third parties by an additional 0.41 [95% CI, 0.18 to 0.64]; P<.001 units per week. However, privacy respecting websites that experienced a surge in traffic reduced their third parties by 1.01 [95% CI, -2.01 to 0]; P = 0.05 units per week in response to every 1,000 COVID-19 deaths in the preceding week. Discussion While in general websites shared their users’ data with more third parties as COVID-19 progressed in the US, websites’ expected traffic and respect for users’ privacy significantly affect such trajectory. Conclusions Attention should also be paid to the impact of the pandemic on elevating online privacy threats, and the variation in third-party tracking among different types of websites. Lay Summary As the COVID-19 pandemic progressed in the country, the demand for online services surged. As the level of Internet use increased, websites’ opportunity to track and monetize users’ data increased with it. In this research, we examine the extent to which websites increased the number of third-parties with which they share their user’ data and how such practices were moderated by a website’s level of respect for users’ privacy and traffic surge. We find that while the number of third parties increased over time, the websites with higher respect for privacy tend to decrease the number of their parties only if they also experience a significant increase in their traffic.

show abstract

Cookies That Give You Away

Cited by 129 publications

References 17 publications

Exploring the Cookieverse: A Multi-Perspective Analysis of Web Cookies

Exploring the Cookieverse: A Multi-Perspective Analysis of Web Cookies

Rapid

Dark clouds and silver linings: impact of COVID-19 on internet users’ privacy

Contact Info

Product

Resources

About