Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask
Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask
复制标题
Cookie 同步：您一直想知道但又不敢问的一切
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
E. Markatos
中科院分区：
文献类型：
--
作者：
P. Papadopoulos;N. Kourtellis;E. Markatos
用户数据是数字广告的主要输入，为我们所知的免费互联网提供了动力。因此，网络公司在精心设计的跟踪机制上投入了大量资金，以获取可以出售给数据市场和广告商的用户数据。然而，由于同源策略和Cookie作为网络上的主要识别机制，每个跟踪器都知道具有不同ID的同一用户。为了缓解这一问题，Cookie同步（CSync）来了救援，促进第三方之间的信息共享渠道，这些第三方可能直接访问用户访问的网站。在后台，通过CSync，他们合并了他们拥有的用户数据，但也重建了用户的浏览历史，绕过了同源策略。在本文中，我们进行了第一次到我们所知的CSync在野外的深入研究，使用长达一年的博客从850个真实的移动的用户。通过我们的研究，我们的目的是了解CSync协议的特点和它对Web用户的隐私的影响。为此，我们设计并实现了CONRAD，一个整体的机制来检测CSync事件在真实的时间，和隐私的损失，在用户端，即使同步的ID被混淆。使用CONRAD，我们发现97%的普通网络用户接触到CSync：他们中的大多数在浏览的第一周内，平均用户ID泄露到3.5个不同的域名。最后，我们看到CSync将跟踪用户的域数量增加了6.75倍。
User data is the primary input of digital advertising, fueling the free Internet as we know it. As a result, web companies invest a lot in elaborate tracking mechanisms to acquire user data that can sell to data markets and advertisers. However, with same-origin policy and cookies as a primary identification mechanism on the web, each tracker knows the same user with a different ID. To mitigate this, Cookie Synchronization (CSync) came to the rescue, facilitating an information sharing channel between 3rd-parties that may or not have direct access to the website the user visits. In the background, with CSync, they merge user data they own, but also reconstruct a user's browsing history, bypassing the same origin policy. In this paper, we perform a first to our knowledge in-depth study of CSync in the wild, using a year-long weblog from 850 real mobile users. Through our study, we aim to understand the characteristics of the CSync protocol and the impact it has on web users' privacy. For this, we design and implement CONRAD, a holistic mechanism to detect CSync events at real time, and the privacy loss on the user side, even when the synced IDs are obfuscated. Using CONRAD, we find that 97% of the regular web users are exposed to CSync: most of them within the first week of their browsing, and the median userID gets leaked, on average, to 3.5 different domains. Finally, we see that CSync increases the number of domains that track the user by a factor of 6.75.
影响因子：
--
作者：
M. Mughees;Zhiyun Qian;Zubair Shafiq
通讯作者：
M. Mughees;Zhiyun Qian;Zubair Shafiq