FP-Block usable web privacy by controlling browser fingerprinting - - PowerPoint PPT Presentation

▶
fp block
SMART_READER_LITE
LIVE PREVIEW

FP-Block usable web privacy by controlling browser fingerprinting - - PowerPoint PPT Presentation

Aug 23, 2022 378 likes •1.52k views

FP-Block usable web privacy by controlling browser fingerprinting Joint work with Sjouke Mauw (UL), Christof Ferreira Torres (UL) OUtline Part 1: introduction Part 2: thwarting 3 rd party fingerprint-based web-tracking Introducing

slide-1
SLIDE 1

FP-Block

usable web privacy by controlling browser fingerprinting

Joint work with Sjouke Mauw (UL), Christof Ferreira Torres (UL)

slide-2
SLIDE 2

OUtline

  • Part 1:

introduction

  • Part 2:

thwarting 3rd party fingerprint-based web-tracking

slide-3
SLIDE 3

Introducing myself

  • PhD thesis on Fair Sharing and Vote Privacy (UL & TU/e)
  • Voting @ University of Surrey
  • Privacy in mobile/web @ University of Luxembourg
  • Hybrid mixnet @ TU Darmstadt
  • Interests:

– vote privacy – healthcare privacy, e-health – auction verifiability & privacy – formalising privacy – practical security

slide-4
SLIDE 4

Introducing myself

  • PhD thesis on Fair Sharing and Vote Privacy (UL & TU/e)
  • Voting @ University of Surrey
  • Privacy in mobile/web @ University of Luxembourg
  • Hybrid mixnet @ TU Darmstadt
  • Interests:

– vote privacy – healthcare privacy, e-health – auction verifiability & privacy – formalising privacy – practical security

slide-5
SLIDE 5

5 / 112

We are terrible at privacy

slide-6
SLIDE 6

6 / 112

We are terrible at privacy

slide-7
SLIDE 7

7 / 112

We are terrible at privacy

slide-8
SLIDE 8

8 / 112

We are terrible at privacy

slide-9
SLIDE 9

9 / 112

We really don't get privacy

slide-10
SLIDE 10

10 / 112

We really don't get privacy

Note: account number can suffice for withdrawal

slide-11
SLIDE 11

11 / 112

In our defence: privacy is hard...

slide-12
SLIDE 12

12 / 112

In our defence: privacy is hard...

slide-13
SLIDE 13

13 / 112

… really hard...

slide-14
SLIDE 14

14 / 112

… really, really hard. “Another thing which is just an observation, when I was working on the blocking of the social plugins, I always used the website to test my implementation. Today Facebook suggested me on my phone the group of .” – anonymous UL Bachelor student / coauthor

slide-15
SLIDE 15

15 / 112

Reasoning about privacy

slide-16
SLIDE 16

16 / 112

Reasoning about privacy

  • Privacy is wrt. someone
slide-17
SLIDE 17

17 / 112

Reasoning about privacy

  • Privacy is wrt. someone
  • Two sides:

– (in)distinguishability

slide-18
SLIDE 18

18 / 112

Reasoning about privacy

  • Privacy is wrt. someone
  • Two sides:

– (in)distinguishability – (un)certainty

slide-19
SLIDE 19

19 / 112

Did privacy become harder?

slide-20
SLIDE 20

20 / 112

Did privacy become harder?

slide-21
SLIDE 21

21 / 112

Did privacy become harder?

slide-22
SLIDE 22

22 / 112

Did privacy become harder?

slide-23
SLIDE 23

23 / 112

My research interests in a nutshell

slide-24
SLIDE 24

24 / 112

My research interests in a nutshell

slide-25
SLIDE 25

25 / 112

My research interests in a nutshell

slide-26
SLIDE 26

26 / 112

My research interests in a nutshell

≈

slide-27
SLIDE 27

FP-Block

usable web privacy by controlling browser fingerprinting

slide-28
SLIDE 28

28 / 112

OUtline

  • What is tracking
  • What is FP-based tracking
  • Literature + countermeasures
  • Web identities
  • Fingerprint surface / Fingerprint vectors
  • FP-Block
slide-29
SLIDE 29

29 / 112

Reasons to track

  • Find site errors / problems
  • Count visitors, not pageviews
  • Detect suspicious logins
  • Targeted advertising
  • Goal: track a user
slide-30
SLIDE 30

30 / 112

Web tracking

Tracking is good!

  • Fraud prevention
  • Improving web site usability

– Finding common browsing “errors” – Related items of interest – ...

slide-31
SLIDE 31

31 / 112

Embedded tracking, however...

slide-32
SLIDE 32

32 / 112

Embedded tracking, however...

  • Buttons everywhere
slide-33
SLIDE 33

33 / 112

Embedded tracking, however...

  • Buttons everywhere
  • JS code loaded from social network

– Request will send cookie – Response can set / update cookie

slide-34
SLIDE 34

34 / 112

Embedded tracking, however...

  • Buttons everywhere
  • JS code loaded from social network

– Request will send cookie – Response can set / update cookie

  • Facebook can track people not on FB [Roos11]
slide-35
SLIDE 35

35 / 112

Embedded tracking, however...

  • Buttons everywhere
  • JS code loaded from social network

– Request will send cookie – Response can set / update cookie

  • Facebook can track people not on FB [Roos11]
  • Google is worse (AdSense, Analytics)
slide-36
SLIDE 36

36 / 112

Embedded content

  • 1. Content delivery networks
  • 2. Advertising
  • 3. Analytics and tracking
  • 4. Embedded media
  • 5. Social plugins
  • 6. Payment
  • 7. Libraries
  • 8. ….
slide-37
SLIDE 37

37 / 112

Embedded content

  • 1. Content delivery networks
  • 2. Advertising
  • 3. Analytics and tracking
  • 4. Embedded media
  • 5. Social plugins
  • 6. Payment
  • 7. Libraries
  • 8. ….

Top 10k Top 1mil

  • 1. Akamai

17% 11%

  • 2. Doubleclick

10% 20%

  • 3. Google Analytics

19% 44%

  • 4. YouTube

26% 47%

  • 5. Facebook Like*

20% 16%

  • 6. PayPal button

33% 44%

  • 7. JQuery

18% 20%

slide-38
SLIDE 38

38 / 112

Embedded content

  • 1. Content delivery networks
  • 2. Advertising
  • 3. Analytics and tracking
  • 4. Embedded media
  • 5. Social plugins
  • 6. Payment
  • 7. Libraries
  • 8. ….

Top 10k Top 1mil

  • 1. Akamai

17% 11%

  • 2. Doubleclick

10% 20%

  • 3. Google Analytics

19% 44%

  • 4. YouTube

26% 47%

  • 5. Facebook Like*

20% 16%

  • 6. PayPal button

33% 44%

  • 7. JQuery

18% 20% * aggregated numbers from builtwith.com. numbers by similartech.com are higher.

slide-39
SLIDE 39

39 / 112

Browser Browser

Tracking via embedded content

ID

slide-40
SLIDE 40

40 / 112

Browser Browser

Tracking via embedded content

Website A Website A

A,ID ID

slide-41
SLIDE 41

41 / 112

Browser Browser

Tracking via embedded content

Website A Website A

A,ID B ID

slide-42
SLIDE 42

42 / 112

Browser Browser

Tracking via embedded content

Website A Website A Website B Website B

A,ID B ID A,ID

slide-43
SLIDE 43

43 / 112

Browser Browser

Tracking via embedded content

Website A Website A Website B Website B

A,ID B ID A,ID

ID: A

slide-44
SLIDE 44

44 / 112

Browser Browser

Tracking via embedded content

Website A Website A Website B Website B Website C Website C

A,ID C,ID B ID A,ID

ID: A

slide-45
SLIDE 45

45 / 112

Browser Browser

Tracking via embedded content

Website A Website A Website B Website B Website C Website C

A,ID C,ID B ID B A,ID

ID: A

slide-46
SLIDE 46

46 / 112

Browser Browser

Tracking via embedded content

Website A Website A Website B Website B Website C Website C

A,ID C,ID B ID B C,ID A,ID

ID: A

slide-47
SLIDE 47

47 / 112

Browser Browser

Tracking via embedded content

Website A Website A Website B Website B Website C Website C

A,ID C,ID B ID B C,ID A,ID

ID: A

ID: B

slide-48
SLIDE 48

48 / 112

How to track

  • Client-side

– Cookies / evercookies / zombiecookies / ... – History exploit / CSS tricks / ... – Active fingerprinting

  • Server-side only

– Web bugs – Passive fingerprinting

slide-49
SLIDE 49

49 / 112

Why fingerprinting?

  • Cookies: client-side storage.
  • Fingerprinting:

– Passive: infer info from server side. – Active: gather info from client side on-the-fly.

  • Actually in use?

– [S&P13, CCS13]: some, but not much... yet.

slide-50
SLIDE 50

Related work

slide-51
SLIDE 51

51 / 112

Panopticlick [PETS10]

slide-52
SLIDE 52

52 / 112

Panopticlick [PETS10]

  • Effectiveness of fingerprinting
slide-53
SLIDE 53

53 / 112

Panopticlick [PETS10]

  • Effectiveness of fingerprinting
  • Results:

– 90% of desktop browsers unique – No JS better results

– Mobile less plugins better results

slide-54
SLIDE 54

54 / 112

Panopticlick [PETS10]

  • Effectiveness of fingerprinting
  • Results:

– 90% of desktop browsers unique – No JS better results

– Mobile less plugins better results

  • Fingerprints change...
slide-55
SLIDE 55

55 / 112

Panopticlick [PETS10]

  • Effectiveness of fingerprinting
  • Results:

– 90% of desktop browsers unique – No JS better results

– Mobile less plugins better results

  • Fingerprints change...
  • ...predecessor found in 65% (99.1% correct)
slide-56
SLIDE 56

56 / 112

Panopticlick [PETS10]

  • Effectiveness of fingerprinting
  • Results:

– 90% of desktop browsers unique – No JS better results

– Mobile less plugins better results

  • Fingerprints change...
  • ...predecessor found in 65% (99.1% correct)
  • Revealing: order of fonts, order of plugins
slide-57
SLIDE 57

57 / 112

Panopticlick [PETS10]

  • Effectiveness of fingerprinting
  • Results:

– 90% of desktop browsers unique – No JS better results

– Mobile less plugins better results

  • Fingerprints change...
  • ...predecessor found in 65% (99.1% correct)
  • Revealing: order of fonts, order of plugins
  • Defensive paradox
slide-58
SLIDE 58

58 / 112

Panopticlick (2)

Test Entropy (bits) user-agent header 10.00 plugins 15.40 fontlist 13.90 screen resolution 4.83 supercookie test 2.12 http accept headers 6.09 timezone 3.04 cookies enabled? 0.35

slide-59
SLIDE 59

59 / 112

Panopticlick (2)

Test Entropy (bits) user-agent header 10.00 plugins 15.40 fontlist 13.90 screen resolution 4.83 supercookie test 2.12 http accept headers 6.09 timezone 3.04 cookies enabled? 0.35

slide-60
SLIDE 60

60 / 112

Panopticlick (2)

Test Entropy (bits) user-agent header 10.00 plugins 15.40 fontlist 13.90 screen resolution 4.83 supercookie test 2.12 http accept headers 6.09 timezone 3.04 cookies enabled? 0.35

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)

slide-61
SLIDE 61

61 / 112

More ways to fingerprint

slide-62
SLIDE 62

62 / 112

More ways to fingerprint

[W2SP11] – fingerprinting JavaScript implementations Hooray for the speedwars!

slide-63
SLIDE 63

63 / 112

More ways to fingerprint

[W2SP11] – fingerprinting JavaScript implementations Hooray for the speedwars! [W2SP12] – fingerprinting HTML5 font rendering All Arials are equal... except most aren't.

slide-64
SLIDE 64

64 / 112

More ways to fingerprint

[W2SP11] – fingerprinting JavaScript implementations Hooray for the speedwars! [W2SP12] – fingerprinting HTML5 font rendering All Arials are equal... except most aren't. [W2SP13] – fingerprinting JS engine errors. “Foutje, bedankt.”

slide-65
SLIDE 65

65 / 112

More ways to fingerprint

[W2SP11] – fingerprinting JavaScript implementations Hooray for the speedwars! [W2SP12] – fingerprinting HTML5 font rendering All Arials are equal... except most aren't. [W2SP13] – fingerprinting JS engine errors. “Foutje, bedankt.” Clock skew can be passively detected, proxies don't help.

slide-66
SLIDE 66

66 / 112

Fighting fingerprinting

slide-67
SLIDE 67

67 / 112

Fighting fingerprinting

  • Do Not Track header?

[NSDI12]: X

slide-68
SLIDE 68

68 / 112

Fighting fingerprinting

  • Do Not Track header?

[NSDI12]: X

  • Blacklisting fingerprinters?

[W2SP11]: X

slide-69
SLIDE 69

69 / 112

Fighting fingerprinting

  • Do Not Track header?

[NSDI12]: X

  • Blacklisting fingerprinters?

[W2SP11]: X

  • FireGloves [NordSec11]?

[CCS13]: X

  • Tor Browser?

[CCS13]: X

slide-70
SLIDE 70

70 / 112

Fighting fingerprinting

  • Do Not Track header?

[NSDI12]: X

  • Blacklisting fingerprinters?

[W2SP11]: X

  • FireGloves [NordSec11]?

[CCS13]: X

  • Tor Browser?

[CCS13]: X

  • Again: defensive paradox.
slide-71
SLIDE 71

71 / 112

Privacy plugins

...

slide-72
SLIDE 72

72 / 112

Typical countermeasures

Browser Browser

ID ID'

slide-73
SLIDE 73

73 / 112

Typical countermeasures

Website A Website A

A,ID'

Browser Browser

ID ID'

slide-74
SLIDE 74

74 / 112

Typical countermeasures

Website A Website A

A,ID' B

Browser Browser

ID ID'

slide-75
SLIDE 75

75 / 112

Typical countermeasures

Website A Website A Website B Website B

A,ID' B

Browser Browser

A,ID' ID ID'

slide-76
SLIDE 76

76 / 112

Typical countermeasures

Website A Website A Website B Website B Website C Website C

A,ID' C,ID' B

Browser Browser

A,ID' ID ID'

slide-77
SLIDE 77

77 / 112

Typical countermeasures

Website A Website A Website B Website B Website C Website C

A,ID' C,ID' B

Browser Browser

B A,ID' ID ID'

slide-78
SLIDE 78

78 / 112

Typical countermeasures

Website A Website A Website B Website B Website C Website C

A,ID' C,ID' B

Browser Browser

B C,ID' A,ID' ID ID'

slide-79
SLIDE 79

79 / 112

Overcoming the defensive paradox

The defense can be detected … ... which makes you more unique.

slide-80
SLIDE 80

80 / 112

Overcoming the defensive paradox

The defense can be detected … ... which makes you more unique. How to overcome?

  • Leverage this uniqueness;
  • Allow local tracking.
slide-81
SLIDE 81

81 / 112

Option 1: constant fingerprint / site

Browser Browser

ID ID*

slide-82
SLIDE 82

82 / 112

Option 1: constant fingerprint / site

Website A Website A

Browser Browser

ID ID* A,IDa

slide-83
SLIDE 83

83 / 112

Option 1: constant fingerprint / site

Website A Website A

B

Browser Browser

ID ID* A,IDa

slide-84
SLIDE 84

84 / 112

Option 1: constant fingerprint / site

Website A Website A Website B Website B

B

Browser Browser

A,IDb ID ID* A,IDa

slide-85
SLIDE 85

85 / 112

Option 1: constant fingerprint / site

Website A Website A Website B Website B Website C Website C

C,IDc B

Browser Browser

A,IDb ID ID* A,IDa

slide-86
SLIDE 86

86 / 112

Option 1: constant fingerprint / site

Website A Website A Website B Website B Website C Website C

C,IDc B

Browser Browser

B A,IDb ID ID* A,IDa

slide-87
SLIDE 87

87 / 112

Option 1: constant fingerprint / site

Website A Website A Website B Website B Website C Website C

C,IDc B

Browser Browser

B C,IDb A,IDb ID ID* A,IDa

slide-88
SLIDE 88

88 / 112

Option 1: constant fingerprint / site

Website A Website A Website B Website B Website C Website C

C,IDc B

Browser Browser

B C,IDb A,IDb ID ID* A,IDa

slide-89
SLIDE 89

89 / 112

Option 1: constant fingerprint / site

Website A Website A Website B Website B Website C Website C

Browser Browser

ID ID* A,IDa

slide-90
SLIDE 90

90 / 112

Option 1: constant fingerprint / site

Website A Website A Website B Website B Website C Website C

Browser Browser

ID ID* A,IDa A,IDa

slide-91
SLIDE 91

91 / 112

Option 2: separate web identities

Browser Browser

ID ID*

slide-92
SLIDE 92

92 / 112

Option 2: separate web identities

Website A Website A

Browser Browser

ID ID* A,IDa

slide-93
SLIDE 93

93 / 112

Option 2: separate web identities

Website A Website A

B

Browser Browser

ID ID* A,IDa

slide-94
SLIDE 94

94 / 112

Option 2: separate web identities

Website A Website A Website B Website B

B

Browser Browser

A,IDa ID ID* A,IDa

slide-95
SLIDE 95

95 / 112

Option 2: separate web identities

Website A Website A Website B Website B Website C Website C

C,IDc B

Browser Browser

A,IDa ID ID* A,IDa

slide-96
SLIDE 96

96 / 112

Option 2: separate web identities

Website A Website A Website B Website B Website C Website C

C,IDc B

Browser Browser

B A,IDa ID ID* A,IDa

slide-97
SLIDE 97

97 / 112

Option 2: separate web identities

Website A Website A Website B Website B Website C Website C

C,IDc B

Browser Browser

B C,IDc A,IDa ID ID* A,IDa

slide-98
SLIDE 98

98 / 112

Option 2: separate web identities

Website A Website A Website B Website B Website C Website C

C,IDc B

Browser Browser

B C,IDc A,IDa ID ID* A,IDa

IDa ≠ IDc

slide-99
SLIDE 99

99 / 112

Option 2: separate web identities

Website A Website A Website B Website B Website C Website C

Browser Browser

ID ID* A,IDa

slide-100
SLIDE 100

100 / 112

Option 2: separate web identities

Website A Website A Website B Website B Website C Website C

Browser Browser

ID ID* A,IDa A,IDa

slide-101
SLIDE 101

101 / 112

Option 2: separate web identities

Website A Website A Website B Website B Website C Website C

B

Browser Browser

A,IDa ID ID* A,IDa A,IDa

slide-102
SLIDE 102

102 / 112

Determining the fingerprint surface

Theoretical argument: If there is one computer used directly by everyone at the same time, then fingerprints might be indistinguishable. Practice

  • Different physical locations
  • Different hardware
  • Different software

complete coverage infeasible → determine fingerprint vectors

slide-103
SLIDE 103

103 / 112

Fingerprinters

Non-profit:

  • Panopticlick
  • academic study
  • FingerPrintJS
  • open source

Commercial:

  • AddThis
  • social media buttons
  • BlueCava
  • advertisements
  • Iovation
  • fraud prevention
  • ThreatMetrix
  • fraud prevention
slide-104
SLIDE 104

104 / 112

Fingerprint vectors

  • √: this work
  • √: [S&P13]
  • –: [S&P13], but dropped
slide-105
SLIDE 105

105 / 112

Proof-of-concept: FP-Block plugin

  • Generates consistent fingerprint
  • One fingerprint used per domain
  • 23 attributes covered (Tor: 14, FireGloves: 8)
  • Covers

– HTTP (passive fingerprinting) – JavaScript (active fingerprinting)

  • Additional coverage to ensure functionality
  • Canvas fingerprint

– detection [CCS14] – prevention (new)

slide-106
SLIDE 106

106 / 112

Fingerprint coverage

Footnotes:

  • Property can be checked passively, i.e., no client-side

technology required.

  • Property specific to Internet Explorer.
  • Property is determined using a Windows DLL created

by the fingerprinting company.

  • Out of scope – FP-Block only targets HTTP and

Javascript layers.

  • Blocking or spoofing this attribute would break or limit

important functionality.

slide-107
SLIDE 107

107 / 112

Validation

  • Controlled test setup

– 2 domains – On each: page embedding file from other domain – Generate fingerprint with fingerprintJS

  • Real-life test setup

– BC, IO, TM, fingerprintJS, Panopticlick, AddThis

  • Additional test: BlueCava ID request
slide-108
SLIDE 108

108 / 112

Monitoring evolution of fingerprinters

Updates since September 2014:

  • Panopticlick

–

  • BlueCava

–

  • AddThis

–

  • Iovation

complex

  • FingerPrintJS

added screen orientation

  • ThreatMetrix

major changes since 27 oct '14

slide-109
SLIDE 109

109 / 112

Conclusions

  • Ubiquitous tracking is a reality
  • Countermeasures fall short
  • Local tracking is acceptable

→ overcomes defensive paradox Results:

  • Propose separation of web identities
  • Determine fingerprint vectors
  • Proof-of-concept implementation
  • Validation against commercial fingerprinters
slide-110
SLIDE 110

110 / 112

Thank you for your attention!

slide-111
SLIDE 111

111 / 112

References (1)

[PETS10]

  • P. Eckersley. How unique is your web browser? In Proc. 10Th Privacy

Enhancing Technologies Symposium (PETS'10), LNCS 6205, pp. 1-18. Springer, 2010. [CCS13]

  • G. Acar, M. Juarez, N. Nikiforakis, C. Diaz, S. Gürses, F. Piessens, B.
  • Preneel. FPDetective: dusting the web for fingerprinters. In Proc. 20Th

Conference on Computer & Communications Security (CCS'13), pp. 1129-

  • 1140. ACM.

[W2SP11]

  • K. Mowery, D. Bogenreif, S. Yilek, H. Shacham. Fingerprinting

information in JavaScript implementations. In Proc. 2nd Web 2.0 Security and Privacy (W2SP'11). [W2SP12]

  • K. Mowery, H. Shacham. Pixel Perfect: Fingerprinting Canvas in
  • HTML5. In Proc. 3rd Web 2.0 Security and Privacy (W2SP'12).

[W2SP13]

  • M. Mulazzani, P. Reschl, M. Huber, M. Leithner, S. Schrittwieser, E.
  • Weippl. Fast and reliable browser identification with Javascript

engine fingerprinting. In Proc. 3rd Web 2.0 Security and Privacy (W2SP'13).

slide-112
SLIDE 112

112 / 112

References (2)

[Roos11]

  • A. Roosendaal. Facebook Tracks and Traces Everyone: Like

This!. Tilburg Law School Research Paper No. 03/2011.

[S&P13] [NordSec11]

  • N. Nikiforakis, A. Kapravelos, W. Joosen, C. Kruegel, F. Piessens,G.
  • Vigna. Cookieless monster: Exploring the ecosystem of web-based

device fingerprinting. In Proc. 34th Symposium on Security and Privacy (SP'13), pp. 541-555. IEEE, 2013.

  • K. Boda, Á.M. Földes, G.Gy. Gulyás, S. Imre. User Tracking on the Web

via Cross-Browser Fingerprinting. In Proc. 16th Nordic Conference in Secure IT Systems (Nordsec 2011), Springer-Verlag, LNCS 7161, pp. 31- 46, 2012.

[NSDI12]

  • F. Roesner, T. Kohno, D. Wetherall. Detecting and defending

against third-party tracking on the web. In Proc. 9th USENIX Symposium on Networked Systems Design and Implementation (NSDI’12), pages 155–168. USENIX, 2012.