Understanding the Performance Costs and Benefits of Privacy-Focused
Total Page：16
File Type：pdf, Size：1020Kb
Understanding the Performance Costs and Benefits of Privacy-focused Browser Extensions Kevin Borgolte Nick Feamster [email protected] [email protected] Princeton University University of Chicago ABSTRACT 1 INTRODUCTION Advertisements and behavioral tracking have become an invasive The online advertisement (ad) industry has been one of the fastest nuisance on the Internet in recent years. Indeed, privacy advocates growing industries in the recent years, growing from over 108 and expert users consider the invasion signifcant enough to war- billion US dollars in 2018 to an estimated 129 billion US dollars rant the use of ad blockers and anti-tracking browser extensions. in 2019 in the United States [34], and to estimated 333 billion US At the same time, one of the largest advertisement companies in dollars in 2019 globally [12]. This growth has sparked numerous the world, Google, is developing the most popular browser, Google academic studies of various angles of online ads, from understand- Chrome. This confict of interest, that is developing a browser (a ing the underlying economics, the overall scale of it, mechanisms user agent) and being fnancially motivated to track users’ online and techniques used, as well as how miscreants are abusing it to behavior, possibly violating their privacy expectations, while claim- proft. ing to be a "user agent," did not remain unnoticed. As a matter of Academic and industry studies on the techniques that online fact, Google recently sparked an outrage when proposing changes ads are relying on have led to privacy advocates and expert users to Chrome how extensions can inspect and modify requests to "im- arguing that the ad companies’ tracking and data collection, which prove extension performance and privacy," which would render provides the foundation for the most prevalent online ads today, existing privacy-focused extensions inoperable. that is, behavioral tracking and targeting, is excessive and invasive In this paper, we analyze how eight popular privacy-focused to users’ privacy [42]. Indeed, in 2012 already, the retailer Target browser extensions for Google Chrome and Mozilla Firefox, the could predict customers’ pregnancies’ due dates with high accuracy, two desktop browsers with the highest market share, afect browser based on browsing and online shopping patterns, and used the performance. We measure browser performance through several information for targeted ads by physical mail (and inadvertently metrics focused on user experience, such as page-load times, num- disclosed a daughter’s pregnancy to her father) [17]. ber of fetched resources, as well as response sizes. To address po- Concerns about excessive data collection as well as data breaches tential regional diferences in advertisements or tracking, such as have since led to new regulation, such as the European General infuenced by the European General Data Protection Regulation Data Protection Regulation (GDPR) [13], which went into efect (GDPR), we perform our study from two vantage points, the United in May 2018 in the European Union, and the California Consumer States of America and Germany. Moreover, we also analyze how Privacy Act (CCPA), which will go into full efect January 2020 [40]. these extensions afect system performance, in particular CPU time, Such regulation is an important frst step to ensuring users’ privacy, which serves as a proxy indicator for battery runtime of mobile and, considering the large fnes and penalties that GDPR allows devices. Contrary to Google’s claims that extensions which inspect to impose for violations (up 20 million Euro or 4% of the world- and block requests negatively afect browser performance, we fnd wide annual revenue, whichever is greater), it has already forced that a browser with privacy-focused request-modifying extensions companies to rethink their approach to data handling, even though performs similar or better on our metrics compared to a browser the exact interpretation of GDPR’s requirements and enforcement without extensions. In fact, even a combination of such extensions remain largely uncharted territory. After introduction of GDPR, the performs no worse than a browser without any extensions. Our New York Times switched from ads based on behavioral tracking to results highlight that privacy-focused extensions not only improve context-based ads, and it did not experience a loss in ad revenue [7]. users’ privacy, but can also increase users’ browsing experience. This brings into question whether behavioral tracking is even nec- essary from an economical point of view for content and service ACM Reference Format: providers to allow free access to their content and services. Kevin Borgolte and Nick Feamster. 2020. Understanding the Performance Regulation is however, by its nature, a local matter. Online track- Costs and Benefts of Privacy-focused Browser Extensions. In Proceedings of ing, on the other hand, is a global phenomena and online tracking ACM, The Web Conference 2020 (WWW ’20), April 20–24, 2020, Taipei, Taiwan. remains pervasive on a global level. There may less or no tracking New York, NY, USA, 12 pages. https://doi.org/10.1145/3366423.3380292 in the European Union due to GDPR, but there is still substantial behavioral tracking and targeting in the United States of Amer- This paper is published under the Creative Commons Attribution 4.0 International ica, China, India, and most other countries. Therefore, users who (CC-BY 4.0) license. Authors reserve their rights to disseminate the work on their want to protect their privacy and not be subject to tracking need personal and corporate Web sites with the appropriate attribution. to rely on other means, with anti-tracking or ad-blocking browser WWW ’20, April 20–24, 2020, Taipei, Taiwan © 2020 IW3C2 (International World Wide Web Conference Committee), published extensions [8, 14, 15, 18] being the most popular solution. under Creative Commons CC-BY 4.0 License. Browser extensions, however, had their own fair share of security ACM ISBN 978-1-4503-7023-3/20/04. and privacy issues, because of their powerful capabilities, which https://doi.org/10.1145/3366423.3380292 2275 WWW ’20, April 20–24, 2020, Taipei, Taiwan Kevin Borgolte and Nick Feamster can allow them to inspect and modify all of a user’s browsing ac- our measurements for diferent privacy-focused extensions, tivity. For example, extensions designed with malicious intent have across browsers, and from multiple vantage points, providing been observed stealing user credentials, cookie stufng to generate additional insight on how performance of the same exten- afliate revenue, and ad injection. Using a browser extension has sions difers across these variables. proven to be so proftable for miscreants that they even approached • We show that privacy-focused extensions can improve browser extension developers to buy extensions from them, with the goal of performance, system performance, and user experience com- then pushing a malicious update to the extension’s users through pared to a browser without extensions. Correspondingly, we the browser’s update mechanism [5, 33]. urge browser vendors to retain functionality necessary for The discovery of these security problems led to a debate among privacy-focused extensions, but which is slated for depre- browser vendors to remove some capabilities for extensions, with cation, as the presented performance argument does not the most dangerous capability being the ability to inspect and mod- appear to be valid. ify or prevent any request that the browser makes, to any website. • We open source our measurement tools and techniques, so that Removing the functionality would clearly prevent malicious exten- other researchers can build upon it and reproduce it. sions from misusing it, and, hence, protect users’ privacy. However, Following, we frst provide the background of how privacy-focused removing this capability also afects benign extensions. In particu- browser extensions work (Section 2). We then detail methodology of lar, it renders existing privacy-focused extensions that rely on this our study, like the selection of the extensions, browsers, and metrics, functionality to protect users’ privacy inoperable, like anti-tracking as well as the experimental setup (Section 3). Subsequently, we extensions and ad-blockers. A particularly interesting angle on this evaluate how the extensions afect browser and system performance argument is that extensions requiring these capabilities have been (Section 4) and discuss our results (Section 4.3). Finally, we compare preventing security and privacy issues that the browser vendors to related work (Section 5) and conclude (Section 6). have not tackled (in some cases because they have no fnancial incentive to do so). For example, by blocking all ads, malicious ads 2 BACKGROUND cannot become a security issue. Similarly, a user may be less willing Following, we briefy describe current techniques that users can em- to accept that an ad company is tracking her than her extension ploy to protect their privacy against online tracking, how privacy- being compromised, as she trusts the extension developer more focused extensions work internally, that is, how they inspect and than the ad company. As such, preventing extensions from privacy- modify or prevent requests that the browser would otherwise make, sensitive capabilities or allowing such extensions represents a se- and how they decide which requests to modify and prevent. curity and privacy trade-of, and removing