and Interaction-based Third-party Cookie Policy Istemi Ekin Akkus 1 - - PowerPoint PPT Presentation
The Case for a General and Interaction-based Third-party Cookie Policy Istemi Ekin Akkus 1 , Nicholas Weaver 2 1 Max Planck Institute for Software Systems (MPI-SWS) 2 ICSI & UC Berkeley Sample Web Page Content Optimized with Ad web
1 Max Planck Institute for Software Systems (MPI-SWS) 2 ICSI & UC Berkeley
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 2
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 3
Publisher Client Ad Network Data Aggregator Online Social Network
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 4
Mostly aggregators/ad networks
aggregators
block tracking
Status quo! Users unhappy Suffering web analytics & social engagement Publishers unhappy
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 5
– Cookie policies – Blacklist-based client tools
– Two-click control – Generalization
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 6
– No ‘stateless’ tracking (i.e., fingerprinting) – No ‘behind-the-scenes’ cookie synching
– (e.g., Doubleclick vs. Safari)
– No passive mashups requiring user cookies
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 7
– Default policy; allows tracking
– Prevents tracking – Breaks functionality of social widgets
– Aimed to prevent tracking by data aggregators, but enable social widgets – Allows OSNs to track
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 8
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 9
– Update and distribute the blacklist
– Require fine-tuning
– Cannot handle third-party server tricks
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 10
– Allow whitelisting desired third-party content
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 11
<FB Like/>
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 12
“Sign up to see …” Sign up to see … “Alice likes this.” Alice likes this.
Bob
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 13
13
Alice likes this. “I like this.” “You and Alice like this.”
Bob
“You and Alice like this.”
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 14
14
Bob
3rd 3rd
– Ghostery, Disconnect, ShareMeNot
– Priv3
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 15
– Loaded in a single iframe; reload it
– Loaded in nested iframes; pass the click
– Small gif images, invisible iframes, …
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 16
– Our policy will trigger a reload of the ad with potentially adverse side effects
– Crawl the web and see how many ads are loaded in a single iframe
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 17
– Advertisement clicks – Lessons learned
– Priv3+
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 18
– Reload parent iframe? – Reload child iframe? – What if there is no source URL for the iframe?
– “The user wanted to click that advertisement, not another.”
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 19
user’s browser
first party Original Priv3 implementation prevents as does Priv3+
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 20
– Unlike Ghostery, Disconnect, ShareMeNot, …
– On-demand social widgets requiring a little more user action (i.e., two-click control) – Whitelisting desired third parties
– No interference with non-tracking analytics and advertisement services – No tracking analytics and advertisement services
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 21
– Emulates our general cookie policy in the browser – Two-click control for third-party content – Utilizes selective reload of interacted elements – Highlights various types of third-party content – Allows user to whitelist desired third-party content
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 22
– 7.3K pages
– Priv3+: ~4% – Never accept 3rd party cookies: ~1.7% – Accept 3rd party cookies from visited: ~1.3
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 23
– More sites, more pages
– Tracking expectations & treating of various 3rd party content
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 24
– Low overhead
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 25
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 26
– Flash cookies not deleted when clearing browser cookies – Revive cookie values by accessing flash cookies
– Previous cookie values or first party cookies as GET parameters
Previously set cookies will not be sent as to third parties and third party scripts cannot access cookies
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 27
Akkus and Weaver (W2SP2015) The Case for a General and Interaction- based Third-party Cookie Policy 28