Surviving the Web

What Storage? An Empirical Analysis of Web Storage in the Wild

“…Their work, in turn, uses a lightweight static analysis which only detects API calls, hence cannot discriminate between actual information leaks and simple "feature detection" libraries like Modernizr. 5 Chen and Kapravelos presented a taint tracking engine called Mystique and used it to track information leakage from browser extensions [7]. Mystique was applied to a total of 181,683 browser extensions, detecting 3,686 extensions leaking private information.…”

“…Remarkably, contrary to cookies, web storage also received only limited attention by the security and privacy community so far. This is concerning, because the web storage functionality is reminiscent of traditional first-party cookies, hence it can be employed to implement web authentication [5] or to track users across third parties [6], all uses that deserve careful scrutiny. In the present paper, we take a first step to improve our understanding of the usage of web storage in the wild.…”