ABSTRACT JUECKSTOCK, JORDAN PHILIP. Enhancing the Security and Privacy of the Web Browser Platform via Improved Web Measurement Methodology. (Under the direction of Alexandros Kapravelos.) The web browser platform today serves as a dominant vehicle for commerce, communication, and content consumption, rendering the assessment and improvement of that platform’s user security and privacy important research priorities. Accurate web measurement via simulated user browsing across popular real-world web sites is essential to the process of assessing and improving web browser platform security and privacy, particularly when developing improved policies that can be deployed in production to millions of real-world users. However, the state of the art in web browser platform measurement instrumentation and methodology leaves much to be desired in terms of robust instrumentation, reproducible experiments, and realistic design parameters. We propose that enhancing web browser policies to improve privacy while retaining compatibility with legacy content requires robust and realistic web measurement methodologies leveraging deep browser instrumentation. This document comprises research results supporting the above-stated thesis. We demonstrate the limitations of shallow, in-band JavaScript (JS) instrumentation in web browsers, then describe and demonstrate an open source out-of-band instrumentation tool, VisibleV8 (VV8), embedded in the V8 JS engine. We show that VV8 consistently outperforms equivalent in-band instrumentation, provides coverage unavailable to in-band techniques, yet has proved readily maintainable across numerous updates to Chromium and the V8 JS engine. Next, we test the assumption, implicit in typical web measurement studies, that automated crawls generalize to the experience of typical web users with a robustly controlled parallel web measurement experiment comparing observations from multiple network vantage points (VP) and via naive or realistic browser configurations (BC). Our results indicate that VP and especially BC selection result in measurable shifts in HTTP traffic and JS behaviors observed from third-party content providers, underscoring the importance of realism in web measurement experiment design. Finally, we apply the insights gained from our work on instrumentation and experiment design to evaluate a novel web browser third-party storage policy designed to improve user protection against stateful online tracking while retaining compatibility with real-world content. Our evaluation results suggest that our proposed policy achieves its privacy and compatibility goals, as does Brave Software’s recent public deployment of a directly derived storage policy. © Copyright 2021 by Jordan Philip Jueckstock All Rights Reserved Enhancing the Security and Privacy of the Web Browser Platform via Improved Web Measurement Methodology by Jordan Philip Jueckstock A dissertation submitted to the Graduate Faculty of North Carolina State University in partial fulfillment of the requirements for the Degree of Doctor of Philosophy Computer Science Raleigh, North Carolina 2021 APPROVED BY: Anupam Das William Enck Bradley Reaves Alexandros Kapravelos Chair of Advisory Committee DEDICATION To my parents, who laid the moral and mental foundations of my life at great personal cost. To my wife, who built with me a loving and stable home for our three children and sustained it through this entire saga despite my late nights and frayed nerves. And to my Creator, without Whom none of this would matter. Soli Deo gloria. ii BIOGRAPHY Jordan Jueckstock was born in Princeton, West Virginia, and raised near Vicenza, Italy. He was homeschooled by his mother, a former secretary who never encountered a job too unimportant to do carefully, and by his father, a musicologist and former music teacher with a fearless talent for practical engineering. Jordan earned his Bachelor of Science in Computer Science from Bob Jones University (BJU) in Greenville, SC, in May 2009. After starting a graduate program at Clemson University the following fall, he transferred to the NSF CyberCorps program at The University of Tulsa in Tulsa, OK, completing a Master of Science in Computer Science there in December 2011. Following two-and-a-half years of work at the National Security Agency in Ft. Meade, MD, Jordan returned to BJU as an instructor. He set out to complete his formal education in computer science by joining the doctoral program at NC State in the fall of 2017. He collaborated with privacy researchers at Brave Software as a summer intern in 2020. Following his graduation from NC State, he will be resuming full-time teaching at BJU. iii ACKNOWLEDGEMENTS This document and the work it represents have been possible only with tremendous support, help, and encouragement from many people and sources. The following deserve particular attention and thanks for their essential role in whatever success I have achieved in this process: ...my advisor: Dr. Alexandros Kapravelos. Thanks to his proactive outreach, I actually missed out on that most stressful of freshman-PhD-student activities: finding an advisor. My advisor found me! His practical approach to research removed my chief barriers to entry, and his personal manner made meeting and working with him a genuine pleasure. His bleeding-edge approach to lab infrastructure may have caused me some uncomfortably deep dives into Kubernetes documentation and code, but it forced me to grow both my technical and management skills. He made me a researcher, to the extent that I am one; a better teacher; and a better hacker. ...my committee members: Drs. Will Enck, Brad Reaves, and Anupam Das. Individually they have provided both encouragement and challenges to me in classrooms, lab meetings, and personal conversations. As a committee, they have provided a healthy blend of confirmation, criticism, and counsel in directing me to the conclusion of my studies and rounding out my education in the art and science of research. ...my WSPR lab colleagues who shared valuable educational and technical advice, daily com- miseration, and memorable life stories. At the risk of leaving out somebody important, memorable names (past and present) include: Micah Bushouse, Lucas Enloe, Abida Haque, Igibek Koishybayev, Nikolaos Pantelaios, and Isaac Polinsky. Two of my lab mates require special mention: Shaown Sarker and Kyle Martin. Shaown has shared with me friendship, serial coauthorship, intriguing philo- sophical discussion, and the special misery of debugging distributed systems written in NodeJS. Kyle has shared with me friendship, serial late-night collaboration at DARPA hackathons, and the mystical bond of brothers-in-arms formed in joint combat against recalcitrant routers, switches, servers, and Ansible playbooks. He even does not hate me—too much, anyway—for making him learn Rust for that compiler class project. ...the collaborators and mentors I met working with Brave Software: Pete Snyder, Matteo Varvello, Panos Papadopoulos, and Ben Livshits. Special thanks to Pete for multiple research project ideas and collaborations, for engineering my Brave internship at the last possible moment, and for tearing apart and reworking my writing when necessary (which was ... frequently). ... my family, already mentioned but impossible to thank enough. My parents, John and Judy Jueckstock, deserve all credit for whatever positive character traits and skills I possessed when starting my higher education saga, to say nothing of life in general. My in-laws, David and Deborah Andrews, are responsible for the raising of the most wonderful woman in the world: Jessica Jueck- stock, nee Andrews, my darling wife. Our three children, Johnny, Josie, and Jadyn, have suffered much in the way of an absent-minded if not simply absent father at various points over the last four years, but their love and joy and energy in spite of it are reflections of their mother’s steadfast home-making magic. This is yours, too, Jessica. It simply could not have happened without you. iv TABLE OF CONTENTS LIST OF TABLES ......................................................... viii LIST OF FIGURES ........................................................ ix Chapter 1 Introduction .................................................. 1 1.1 Thesis Statement.................................................. 1 1.2 Contributions .................................................... 2 1.3 Thesis Organization................................................ 4 Chapter 2 Background & Motivation ........................................ 6 2.1 Overview........................................................ 6 2.2 JavaScript Instrumentation for Browsers................................. 7 2.2.1 Trends and Trade-offs......................................... 7 2.2.2 Fundamental Criteria......................................... 8 2.2.3 The Case Against In-Band JS Instrumentation ....................... 9 2.2.4 Summary.................................................. 12 2.3 Web Browser Storage & Security Policies................................. 12 2.3.1 Same-Origin Policy & Storage Basics .............................. 12 2.3.2 User Tracking............................................... 14 2.3.3 Threat Model............................................... 15 2.3.4 Deployed Stateful Tracking Defenses.............................. 16 2.3.5 Compatibility and Tracking Protections............................ 18 Chapter 3 VisibleV8: In-browser Monitoring of JavaScript in the Wild ............... 20 3.1