To Extend or not to Extend: On the Uniqueness of Browser Extensions and Web Logins
To Extend or not to Extend: On the Uniqueness of Browser Extensions and Web Logins
复制标题
扩展还是不扩展：论浏览器扩展和Web登录的独特性
DOI：
10.1145/3267323.3268959
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
C. Castelluccia
中科院分区：
文献类型：
--
作者：
G. Gulyás;Doliére Francis Somé;Nataliia Bielova;C. Castelluccia
最近的工作表明，网站可以检测用户安装的浏览器扩展和他们登录的网站。这会带来很大的隐私风险，因为反映用户行为的扩展名和Web登录名可用于在Web上唯一标识用户。本文报告了第一项大规模行为独特性研究，该研究基于访问我们网站的16，393名用户。我们测试并检测了16，743个Chrome扩展程序，覆盖了所有免费Chrome扩展程序的28%。我们还检测用户是否连接到60个不同的网站。我们根据用户的行为分析了用户的独特性，并发现54.86%安装了至少一个可检测扩展的用户是独特的; 19.53%的用户在登录到一个或多个可检测网站的用户中是独特的; 89.23%的用户至少有一个扩展和一个登录。我们使用先进的指纹识别算法，并表明，它是可能的，以确定用户在不到625毫秒的选择最独特的组合扩展。由于隐私扩展有助于用户的独特性，我们研究了这些扩展所阻止的跟踪器的数量和这些扩展的用户的独特性之间的权衡。我们发现隐私扩展应该被认为是有益的而不是有害的。文章最后提出了可能的对策。
Recent works showed that websites can detect browser extensions that users install and websites they are logged into. This poses significant privacy risks, since extensions and Web logins that reflect user's behavior, can be used to uniquely identify users on the Web. This paper reports on the first large-scale behavioral uniqueness study based on 16,393 users who visited our website. We test and detect the presence of 16,743 Chrome extensions, covering 28% of all free Chrome extensions. We also detect whether the user is connected to 60 different websites. We analyze how unique users are based on their behavior, and find out that 54.86% of users that have installed at least one detectable extension are unique; 19.53% of users are unique among those who have logged into one or more detectable websites; and 89.23% are unique among users with at least one extension and one login. We use an advanced fingerprinting algorithm and show that it is possible to identify a user in less than 625 milliseconds by selecting the most unique combinations of extensions. Because privacy extensions contribute to the uniqueness of users, we study the trade-off between the amount of trackers blocked by such extensions and how unique the users of these extensions are. We have found that privacy extensions should be considered more useful than harmful. The paper concludes with possible countermeasures.