检索结果-内蒙古大学图书馆

ACM on Internet measurement Conference (IMC)

作者： Ardi, Calvin Calder, Matt USC ISI Los Angeles CA 90007 USA Columbia Univ Meta New York NY USA

ISBN: (纸本)9798400703829

Much of the content and structure of the web remains inaccessible to evaluate at scale because it is gated by user authentication. This limitation restricts researchers to examining only a superficial layer of a website: the landing page or public, search-indexable pages. Since it is infeasible to create individual accounts across thousands of webpages, we examine the prevalence of Single Sign-On (SSO) on the web to explore the feasibility of using a few accounts to authenticate to many sites. We find that 58% of the top 10K websites with logins are accessible with popular 3rd-party SSO providers, such as Google, Facebook, and Apple, indicating that leveraging SSO offers a scalable solution to access a large volume of user-gated content.

关键词： Single Sign-On web authentication Top lists web measurement

来源：评论

学校读者我要写书评

暂无评论

webMea: A Google Chrome Extension for web Security and Privacy measurement Studies 5th

WebMea: A Google Chrome Extension for Web Security and Priva...

引用

5th International Conference on Science of Cyber Security (SciSec)

作者： Ren, Mengxia Josey, Joshua Yue, Chuan Colorado Sch Mines Golden CO 80401 USA

ISBN: (纸本)9783031459320;9783031459337

web measurement is an integral part of web security and privacy analysis. A large-scale web measurement usually relies on a crawler. Browser-based crawlers are often preferred and they are typically implemented through one of two approaches: the DevTools approach or the browser extension approach. It is often not clear to researchers which approach should be taken to implement a crawler since the analysis of these two approaches is limited. In this paper, we analyze and compare the web measurement capability of the Google Chrome DevTools approach and the Google Chrome extension approach to help researchers make decisions. We find that both approaches have the capability to satisfy primary web measurement requirements, although their APIs and the complexity of using their APIs are different. We point out such differences to help researchers more easily choose or take the appropriate approach. Taking the former approach, Puppeteer is a crawler that can be readily used by researchers. However, it is difficult for researchers to find a good baseline Google Chrome extension to start with their extension-based crawler construction. Therefore, we further build webMea as a baseline Google Chrome extension that can measure multiple types of web data. Researchers can use or customize webMea according to their web measurement requirements. webMea is applicable to different web measurement studies, and it can help make web measurement studies more reproducible and replicable.

关键词： web measurement Tool Security Privacy Browser Extension

来源：评论

学校读者我要写书评

暂无评论

Information flow control for comparative privacy analyses

引用

INTERNATIONAL JOURNAL OF INFORMATION SECURITY 2024年第5期23卷 3199-3216页

作者： Ahmad, Zubair Calzavara, Stefano Casarin, Samuele Stock, Ben Univ CaFoscari Venezia Venice Italy CISPA Helmholtz Ctr Informat Secur Saarbrucken Germany

The prevalence of web tracking and its key characteristics have been extensively investigated by the research community by means of large-scale web measurements. Most such measurements however are limited to the choice of a specific client used for data collection, which is insufficient to characterize the relative privacy guarantees offered by the adoption of different clients to access the web. Recent work on comparative privacy analyses involving multiple clients is still preliminary and relies on relatively simple heuristics to detect web tracking based on the inspection of HTTP requests, cookies and API usage. In this paper, we propose a more sophisticated methodology based on information flow tracking, which is better suited for the complexity of comparing tracking behavior observed in different clients. After clarifying the key challenges of comparative privacy analyses, we apply our methodology to investigate web tracking practices on the top 10k websites from Tranco as observed by different clients, i.e., Firefox and Brave, under different configuration settings. Our analysis estimates information flow reduction to quantify the privacy benefits offered by the filter lists implemented in Firefox and Brave, as well as the effectiveness of their partitioned storage mechanism against cross-site tracking.

关键词： web tracking Privacy protection Information flow control web measurement

来源：评论

学校读者我要写书评

暂无评论

Browsing without Third-Party Cookies: What Do You See? 24

Browsing without Third-Party Cookies: What Do You See?

引用

ACM Internet measurement Conference (IMC)

作者： Lin, Maxwell Lin, Shihan Wu, Helen Wang, Karen Yang, Xiaowei Duke Univ Comp Sci Durham NC 27708 USA Vanderbilt Univ Comp Sci 221 Kirkland Hall Nashville TN 37235 USA Duke Kunshan Univ Appl Math & Computat Sci Suzhou Peoples R China

ISBN: (纸本)9798400705922

Third-party web cookies are often used for privacy-invasive behavior tracking. Partly due to privacy concerns, browser vendors have started to block all third-party cookies in recent years. To understand the effects of such third-party cookieless browsing, we crawled and measured the top 10,000 Tranco websites. We developed a framework to remove third-party cookies and analyze the differences between the appearance of web pages with and without these cookies. We find that disabling third-party cookies has no substantial effect on website appearance including layouts, text, and images. This validates the industry-wide shift towards cookieless browsing as a way to protect user privacy without compromising on the user experience.

关键词： cookieless browsing third-party cookies web measurement

来源：评论

学校读者我要写书评

暂无评论

From User Insights to Actionable Metrics: A User-Focused Evaluation of Privacy-Preserving Browser Extensions 19

From User Insights to Actionable Metrics: A User-Focused Eva...

引用

19th ACM Asia Conference on Computer and Communications Security (ACM AsiaCCS)

作者： Roongta, Ritik Greenstadt, Rachel NYU Brooklyn NY 11220 USA

ISBN: (纸本)9798400704826

an increased adoption of privacy-preserving browser extensions. These extensions are crucial for blocking trackers and enhancing the overall web browsing experience. The advertising industry is constantly changing, leading to ongoing development and improvements in both new and existing ad-blocking and anti-tracking extensions. Despite this, there is a lack of comprehensive studies exploring the set of user concerns associated with these extensions. Our research addresses this gap by identifying five user concerns and establishing a privacy and usability topics framework, specific to privacy-preserving extensions. Also, many of these user concerns have not been extensively studied in the prior works. Therefore, we conducted an extensive literature reviewto identify shortcomings in the current benchmarking methodology. This led to the development of new techniques, including experiments to measure newly identified metrics. Our study reveals eight new metrics for privacy-preserving extensions that have not been previously measured. Additionally, our study enhances the measurement methodology for two metrics, ensuring precise results. We focus particularly on metrics that users commonly encounter on the web and report in Chrome web store reviews. Our goal is to serve as a foundational reference for future research in this field.

关键词： web measurement Privacy AdBlockers User Concerns Metrics Filterlists

来源：评论

学校读者我要写书评

暂无评论

A First View of Topics API Usage in the Wild 24

A First View of Topics API Usage in the Wild

引用

20th International Conference on Emerging Networking Experiments and Technologies

作者： Verna, Alberto Jha, Nikhil Trevisan, Martino Mellia, Marco Politecn Torino Turin Italy Univ Trieste Trieste Italy

ISBN: (纸本)9798400711084

Among several proposals for a privacy-preserving replacement of third-party cookies, Google's new Topics API is widely discussed as a possible solution. Some scepticism still lingers on the new paradigm from researchers and control bodies;however, the industry has started deploying and testing it. This paper measures the current usage of the Topics API in the wild, discovering third parties that started enabling it, the practices they adopt and their interplay with privacy policies and consent acquisition mechanisms. To do so, we deploy a crawler to record the usage of Topics API on the most popular 50,000 websites worldwide. We observe that this technology starts to get a foothold - with 47 popular ad-related third parties that are testing it to understand the opportunities it offers. We notably observe typical problems of early deployments: privacy regulation violations, unexpected solutions that allow one to circumvent abuse protection, and deployment errors.

关键词： Topics API web Privacy web measurement

来源：评论

学校读者我要写书评

暂无评论

To Auth or Not To Auth? A Comparative Analysis of the Pre- and Post-Login Security Landscape 45

To Auth or Not To Auth? A Comparative Analysis of the Pre- a...

引用

45th IEEE Symposium on Security and Privacy (SP)

作者： Rautenstrauch, Jannis Mitkov, Metodi Helbrecht, Thomas Hetterich, Lorenz Stock, Ben CISPA Helmholtz Ctr Informat Secur Munich Germany

ISBN: (纸本)9798350331318;9798350331301

The web has evolved from a way to serve static content into a full-fledged application platform. Given its pervasive presence in our daily lives, it is therefore imperative to conduct studies that accurately reflect the state of security on the web. Many research works have focussed on detecting vulnerabilities, measuring security header deployment, or identifying roadblocks to a more secure web. To conduct these studies at a large scale, they all have a common denominator: they operate in automated fashions without human interaction, i.e., visit applications in an unauthenticated manner. To understand whether this unauthenticated view of the web accurately reflects its security as observed by regular users, we conduct a comparative analysis of 200 websites. By relying on a semi-automated framework to log into applications and crawl them, we analyze the differences between unauthenticated and authenticated states w.r.t. client-side XSS flaws, usage of security headers, postMessage handlers, and JavaScript inclusions. In doing so, we discover that the unauthenticated web could provide a significantly skewed picture of security depending on the type of research question.

关键词： Cross-Site Scripting Login Automation web measurement web Security

来源：评论

学校读者我要写书评

暂无评论

Permission Rationales in the web Ecosystem: An Exploration of Rationale Text and Design Patterns 25

Permission Rationales in the Web Ecosystem: An Exploration o...

引用

2025 CHI Conference on Human Factors in Computing Systems, CHI 2025

作者： Elbitar, Yusra Khodayari, Soheil Harbach, Marian De Stefano, Gianluca Engedy, Balazs Csaba Pellegrino, Giancarlo Bugiel, Sven Cispa Helmholtz Center for Information Security Saarbruecken Germany Saarland University Saarbruecken Germany Google Munich Germany

ISBN: (纸本)9798400713941

Modern web applications use features like camera and geolocation for personalized experiences, requiring user permission via browser prompts. To explain these requests, applications provide rationales - contextual information on why permissions are needed. Despite their importance, little is known about how often rationales appear on the web or their influence on user *** paper presents the first large-scale study of how the web ecosystem handles permission rationales, covering three areas: (i) identifying webpages that use permissions, (ii) detecting and classifying permission rationales, and (iii) analyzing their attributes to understand their impact on user decisions. We examined over 770K webpages from Chrome telemetry, finding 3.6K unique rationale texts and 749 rationale UIs across 85K pages. We extracted key rationale attributes and assessed their effect on user behavior by cross-referencing them with Chrome telemetry data. Our findings reveal nine key insights, providing the first evidence of how different rationales affect user decisions. © 2025 Copyright held by the owner/author(s).

关键词： web measurement

来源：评论

学校读者我要写书评

暂无评论

A Privacy Measure Turned Upside Down? Investigating the Use of HTTP Client Hints on the web 24

A Privacy Measure Turned Upside Down? Investigating the Use ...

引用

19th International Conference on Availability, Reliability, and Security (ARES)

作者： Wiefling, Stephan Hoenscheid, Marian Lo Iacono, Luigi H BRS Univ Appl Sci St Augustin Germany

ISBN: (纸本)9798400717185

HTTP client hints are a set of standardized HTTP request headers designed to modernize and potentially replace the traditional user agent string. While the user agent string exposes a wide range of information about the client's browser and device, client hints provide a controlled and structured approach for clients to selectively disclose their capabilities and preferences to servers. Essentially, client hints aim at more effective and privacy-friendly disclosure of browser or client properties than the user agent string. We present a first long-term study of the use of HTTP client hints in the wild. We found that despite being implemented in almost all web browsers, server-side usage of client hints remains generally low. However, in the context of third-party websites, which are often linked to trackers, the adoption rate is significantly higher. This is concerning because client hints allow the retrieval of more data from the client than the user agent string provides, and there are currently no mechanisms for users to detect or control this potential data leakage. Our work provides valuable insights for web users, browser vendors, and researchers by exposing potential privacy violations via client hints and providing help in developing remediation strategies as well as further research.

关键词： HTTP client hints web measurement privacy tracking security risk-based authentication

来源：评论

学校读者我要写书评

暂无评论

Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the web 23

Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banner...

引用

ACM on Internet measurement Conference (IMC)

作者： Rasaii, Ali Gosain, Devashish Gasser, Oliver Max Planck Inst Informat Saarbrucken Germany BITS Pilani Goa Sancoale Germany

ISBN: (纸本)9798400703829

Privacy regulations have led to many websites showing cookie banners to their users. Usually, cookie banners present the user with the option to "accept" or "reject" cookies. Recently, a new form of paywall-like cookie banner has taken hold on the web, giving users the option to either accept cookies (and consequently user tracking) or buy a paid subscription for a tracking-free website experience. In this paper, we perform the first completely automated analysis of cookiewalls, i.e., cookie banners acting as a paywall. We find cookiewalls on 0.6% of all queried 45k websites. Moreover, cookiewalls are deployed to a large degree on European websites, e.g., for Germany we see cookiewalls on 8.5% of top 1k websites. Additionally, websites using cookiewalls send 6.4 times more third-party cookies and 42 times more tracking cookies to visitors, compared to regular cookie banner websites. We also uncover two large Subscription Management Platforms used on hundreds of websites, which provide website operators with easy-to-setup cookiewall solutions. Finally, we publish tools, data, and code to foster reproducibility and further studies.

关键词： Cookie banner cookiewall subscription management platform web measurement

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：