I Do Not Know What You Visited Last Summer: Protecting Users from Third-party Web Tracking with TrackingFree Browser Xiang Pan Yinzhi Cao Yan Chen Northwestern University Columbia University Northwestern University
[email protected] [email protected] [email protected] Abstract—Stateful third-party web tracking has drawn the neither of the approaches can completely protect users from attention of public media given its popularity among top Alexa third-party tracking: in addition to browser cookies, a tracker web sites. A tracking server can associate a unique identifier can store user’s unique identifier into many other places on from the client side with the private information contained in the client-side state, such as Flash files [4] [26] [17] and browser referer header of the request to the tracking server, thus recording caches [26] [4] [17]; meanwhile, blacklist tools highly depend the client’s behavior. Faced with the significant problem, existing on all the records in the database and a tracking company can works either disable setting tracking identifiers or blacklist third- party requests to certain servers. However, neither of them can always adopt new domains to track users. completely block stateful web tracking. To address the shortcomings of existing anti-tracking ap- In this paper, we propose TrackingFree, the first anti-tracking proaches, a third-party tracking defense system should achieve browser by mitigating unique identifiers. Instead of disabling the following goals: those unique identifiers, we isolate them into different browser Complete blocking. The system can completely block all principals so that the identifiers still exist but are not unique •existing stateful third-party tracking techniques, such as those among different web sites.