The Web Never Forgets

Abstract

We present the first large-scale studies of three advanced web tracking mechanisms -canvas fingerprinting, evercookies and use of "cookie syncing" in conjunction with evercookies. Canvas fingerprinting, a recently developed form of browser fingerprinting, has not previously been reported in the wild; our results show that over 5% of the top 100,000 websites employ it. We then present the first automated study of evercookies and respawning and the discovery of a new evercookie vector, IndexedDB. Turning to cookie syncing, we present novel techniques for detection and analysing ID flows and we quantify the amplification of privacy-intrusive tracking practices due to cookie syncing.Our evaluation of the defensive techniques used by privacy-aware users finds that there exist subtle pitfallssuch as failing to clear state on multiple browsers at once -in which a single lapse in judgement can shatter privacy defenses. This suggests that even sophisticated users face great difficulties in evading tracking techniques.

Dark Patterns at Scale

“…First, while prior work has largely focused on creating taxonomies of the types of dark patterns either based on anecdotal data [31,32] or data collected from users' submissions [38,48], we provide large-scale evidence documenting the presence and prevalence of dark patterns in the wild. Automated measurements of this kind have proven useful in discovering various privacy and security issues on the web-including third-party tracking [25,40] and detecting vulnerabilities of remote third-party JavaScript libraries [68]-by documenting how and on which websites these issues manifest, thus enabling practical solutions to counter them. Second, we expand on the insight offered by prior work about how dark patterns affect users.…”

“…In this paper, we present an automated approach that enables experts to identify dark patterns at scale on the web. Our approach relies on (1) a web crawler, built on top of OpenWPM [25,40]-a web privacy measurement platform-to simulate a user browsing experience and identify user interface elements; (2) text clustering to extract all user interface designs from the resulting data; and (3) inspecting the resulting clusters for instances of dark patterns. We also develop a taxonomy so that researchers can share descriptive and comparative terminology to explain how dark patterns subvert user decision-making and lead to harm.…”

Browser Fingerprinting

“…Later, Acar et al performed a large-scale study of canvas fingerprinting in "The Web Never Forgets" [68]. They found that scripts utilize the techniques outlined by Mowery and Shacham and notably, they take advantage of the fallback font mechanism of modern browsers to generate even more differences between devices.…”

“…In 2014, Acar et al performed the "The Web Never Forgets" study [68], where they measured adoption of canvas fingerprinting on homepages of 100,000 Alexa websites. They instrumented the browser to intercept calls and returns to Canvas related methods, and tried to remove false positives by a set of rules (more details in Section 3.1 of [68]). They found 5542 sites out of 100,000 performing Canvas fingerprinting.…”

“…Can the collected information be used to identify a single device? Studies like [68,78] have looked specifically at APIs like Canvas, WebRTC or AudioContext. They did not consider the full list of attributes that could be collected to assess if a script is performing fingerprinting or not.…”