DOCSLIB.ORG

Swedes Online: You Are More Tracked Than You Think by Joel Purra

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

Institutionen för datavetenskap Department of Computer and Information Science Final thesis Swedes Online: You Are More Tracked Than You Think by Joel Purra LIU-IDA/LITH-EX-A--15/007--SE 2015-02-19 Linköpings universitet Linköpings universitet SE-581 83 Linköping, Sweden 581 83 Linköping This page intentionally left blank. Almost. Linköping University Department of Computer and Information Science Final Thesis Swedes Online: You Are More Tracked Than You Think by Joel Purra LIU-IDA/LITH-EX-A--15/007--SE 2015-02-19 Supervisor: Patrik Wallström The Internet Infrastructure Foundation (.SE) Supervisor: Staffan Hagnell The Internet Infrastructure Foundation (.SE) Examiner: Niklas Carlsson Division for Database and Information Techniques (ADIT) This page intentionally left blank. Almost. Master’s thesis Swedes Online: You Are More Tracked Than You Think Joel Purra [email protected], joepu444 http://joelpurra.com/ +46 70 352 1212 v1.0.0 Abstract When you are browsing websites, third-party resources record your online habits; such tracking can be considered an invasion of privacy. It was previously unknown how many third-party resources, trackers and tracker companies are present in the different classes of websites chosen: globally popular websites, random samples of .se/.dk/.com/.net domains and curated lists of websites of public interest in Sweden. The in-browser HTTP/HTTPS traffic was recorded while downloading over 150,000 websites, allowing comparison of HTTPS adoption and third-party tracking within and across the different classes of websites. The data shows that known third-party resources including known trackers are present on over 90% of most classes, that third-party hosted content such as video, scripts and fonts make up a large portion of the known trackers seen on a typical website and that tracking is just as prevalent on secure as insecure sites. Observations include that Google is the most widespread tracker organization by far, that content is being served by known trackers may suggest that trackers are moving to providing services to the end user to avoid being blocked by privacy tools and ad blockers, and that the small difference in tracking between using HTTP and HTTPS connections may suggest that users are given a false sense of privacy when using HTTPS. Acknowledgments The Internet Infrastructure Foundation1 (.SE) .SE is also known as Stiftelsen f¨orinternetinfrastruktur (IIS). This thesis was written in the office of – and in collaboration with – .SE, who graciously supported me with domain data and internet knowledge. Part of .SE’s research efforts include continuously analyzing internet infrastructure and usage in Sweden. .SE is an independent organization, responsible for the Swedish top level domain, and working for the benefit of the public that promotes the positive development of the internet in Sweden. Thesis supervision Niklas Carlsson Associate Professor (Swedish: docent and universitetslektor) at Division for Database and Information Techniques (ADIT), Department of Computer and Information Science (IDA), Link¨oping University, Sweden. Thank you for being my examiner! Patrik Wallstr¨om Project Manager within R&D, .SE (The Internet Infrastructure Founda- tion), Sweden. Thank you for being my technical supervisor! Staffan Hagnell Head of New Businesses, .SE (The Internet Infrastructure Foundation), Swe- den. Thank you for being my company supervisor! Anton Nilsson Master student in Information Technology, Link¨opingUniversity, Sweden. Thank you for being my opponent! Domains, data and software .SE (Richard Isberg, Tobbe Carlsson, Anne-Marie Eklund-L¨owinder,Erika Lund), DK Hostmas- ter A/S (Steen Vincentz Jensen, Lise Fuhr), Reach50/Webmie (Mika Wenell, Jyry Suvilehto), Alexa, Verisign. Disconnect.me, Mozilla. PhantomJS, jq, GNU Parallel, LYX. Thank you! Tips, feedback, inspiration and help Dwight Hunter, Peter Forsman, Linus Nordberg, Pamela Davidsson, Lennart Bonnevier, Isabelle Edlund, Amar Andersson, Per-Ola Mj¨omark,Elisabeth Nilsson, Mats Dufberg, Ana Rodriguez Garcia, Stanley Greenstein, Markus Bylund. Thank you! And of course everyone I forgot to mention – sorry and thank you! 1https://www.iis.se/ 2 Contents 1 Introduction 11 2 Background 13 2.1 Trackers are a commercial choice . 13 2.2 What is known by trackers? . 14 2.3 What is the information used for? . 14 3 Methodology 16 3.1 High level overview . 16 3.2 Domain categories . 16 3.3 Capturing tracker requests . 17 3.4 Data collection . 19 3.5 Data analysis and validation . 19 3.6 High level summary of datasets . 21 3.7 Limitations . 22 4 Results 24 4.1 HTTP, HTTPS and redirects . 25 4.2 Internal and external requests . 27 4.3 Tracker detection . 28 5 Discussion 30 5.1 .SE Health Status comparison . 30 5.2 Cat and Mouse ..................................... 31 5.3 Follow the Money .................................... 32 5.4 Trackers which deliver content . 32 5.5 Automated data collection and analysis . 35 5.6 Tracking and the media . 36 5.7 Privacy tool reliability . 36 5.8 Open source contributions . 36 5.9 Platform for Privacy Preferences (P3P) analysis . 37 6 Related work 40 6.1 .SE Health Status .................................... 40 6.2 Characterizing Organizational use of Web-based Services .............. 41 6.3 Challenges in Measuring Online Advertising Systems ................ 41 6.4 .SE Domain Check . 42 6.5 Cookie syncing . 42 3 Contents Swedes Online: You Are More Tracked Than You Think 6.6 HTTP Archive . 42 7 Conclusions and future work 44 7.1 Conclusions . 44 7.2 Open questions . 44 7.3 Improving information sharing . 45 7.4 Improving domain retrieval . 46 7.5 Improved data analysis and accuracy . 48 Bibliography 52 A Methodology details 57 A.1 Domains . 57 A.2 Public suffix list . 58 A.3 Disconnect.me’s blocking list . 59 A.4 Retrieving websites and resources . 62 A.5 Analyzing resources . 68 B Software 74 B.1 Third-party tools . 74 B.2 Code . 75 C Detailed results 81 C.1 Differences between datasets . 81 C.2 Failed versus non-failed . 81 C.3 HTTP status codes . 84 C.4 Internal versus external resources . 88 C.5 Domain and request counts . 93 C.6 Requests per domain and ratios . 95 C.7 Insecure versus secure resources . 97 C.8 HTTP, HTTPS and redirects . 102 C.9 Content type group coverage . 106 C.10 Public suffix coverage . 110 C.11 Disconnect’s blocking list matches . 112 C.12 Undetected external domains . 132 4 List of Tables 3.1 Domain lists in use . 18 3.2 Disconnect’s categories . 18 3.3 Organizations in more than one category . 20 3.4 TLDs in dataset in use . 23 3.5 .SE Health Status domain categories . 23 4.1 Results summary . 25 5.1 .SE Health Status HTTPS coverage 2008-2013 . 33 5.2 Cat and Mouse ad coverage . 33 5.3 Cat and Mouse ad server match distribution . 34 5.4 Follow the Money aggregators . 34 5.5 Top P3P values . 39 A.1 Machine specifications . 67 A.2 Google Tag Manager versus Google Analytics and DoubleClick . 67 A.3 Output file size . 67 A.4 Dataset variations . 67 A.5 System load . 67 A.6 Mime-type grouping . 73 C.1 Dataset HAR failure rates . 83 C.2 Dataset origin HTTP response code/group coverage . 86 C.3 Internal versus external resources coverage . 90 C.4 Requests per domain . 95 C.5 Requests per domain and ratios . 97 C.6 Secure versus insecure resources coverage . 99 C.7 Origin domains with redirects . 104 C.8 Content type group coverage (internal) . 108 C.9 Content type group coverage (external) . 110 C.10 Public suffixes in external resources . 112 C.11 Disconnect coverage for internal, external and all requests . 114 C.12 Disconnect requests, organizations and categories counts and ratios . 118 C.13 Top Disconnect domain match coverage . 122 C.14 Top Disconnect Google domain match coverage . 124 C.15 Disconnect category match coverage . 126 C.16 Top Disconnect organization match coverage . 130 C.17 Requests per domain and ratios . 134 5 List of Figures 3.1 Domains per organization . 20 4.1 HTTP status, redirects, resource security . 26 4.2.
Recommended publications
  • Canvas Developer Guide

    Canvas Developer Guide

    Canvas Developer Guide Version 53.0, Winter ’22 @salesforcedocs Last updated: August 5, 2021 © Copyright 2000–2021 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of salesforce.com, inc., as are other names and marks. Other marks appearing herein may be trademarks of their respective owners. CONTENTS GETTING STARTED . 1 Chapter 1: Introducing Canvas . 1 Canvas Scenarios . 3 Where Canvas Apps Appear . 3 Supported Browsers . 4 Supported Salesforce Editions . 4 User Permissions Required . 5 User Interface Considerations . 5 Canvas App Process . 6 Canvas Personal Apps . 8 Canvas Personal App Process . 8 Enabling Canvas Personal Apps within an Organization . 9 Making an App a Canvas Personal App . 10 Uninstalling a Canvas Personal App . 10 Chapter 2: Quick Start . 12 Prerequisites . 13 Create the App . 13 Set the App Location . 14 Chapter 3: Quick Start—Advanced . 16 Prerequisites . 17 Clone the Project from GitHub . 17 Run the Web App Locally . 18 Create the Canvas App . 19 Configure Who Can Access the Canvas App . 21 Deploy the Web App to Heroku . 22 Update the Canvas App . 23 Package the Canvas App . 24 Upload the Canvas App Package . 25 Install the Canvas App . 25 Configure Who Can Access the Installed Canvas App . 26 USING CANVAS . 27 Chapter 4: Canvas SDK . 27 Referencing the Canvas SDK . 28 Authentication . 28 Signed Request Authentication . 28 Contents OAuth Authorization . 36 SAML Single Sign-On for Canvas Apps . 40 Getting Context in Your Canvas App . 40 Cross-Domain XHR . 41 Getting a List of Chatter Users . 41 Posting to a Chatter Feed . 42 Alternatives to Cookies for User Tracking .
  • The Web Never Forgets: Persistent Tracking Mechanisms in the Wild

    The Web Never Forgets: Persistent Tracking Mechanisms in the Wild

    The Web Never Forgets: Persistent Tracking Mechanisms in the Wild Gunes Acar1, Christian Eubank2, Steven Englehardt2, Marc Juarez1 Arvind Narayanan2, Claudia Diaz1 1KU Leuven, ESAT/COSIC and iMinds, Leuven, Belgium {name.surname}@esat.kuleuven.be 2Princeton University {cge,ste,arvindn}@cs.princeton.edu ABSTRACT 1. INTRODUCTION We present the first large-scale studies of three advanced web tracking mechanisms — canvas fingerprinting, evercookies A 1999 New York Times article called cookies compre­ and use of “cookie syncing” in conjunction with evercookies. hensive privacy invaders and described them as “surveillance Canvas fingerprinting, a recently developed form of browser files that many marketers implant in the personal computers fingerprinting, has not previously been reported in the wild; of people.” Ten years later, the stealth and sophistication of our results show that over 5% of the top 100,000 websites tracking techniques had advanced to the point that Edward employ it. We then present the first automated study of Felten wrote “If You’re Going to Track Me, Please Use Cook­ evercookies and respawning and the discovery of a new ev­ ies” [18]. Indeed, online tracking has often been described ercookie vector, IndexedDB. Turning to cookie syncing, we as an “arms race” [47], and in this work we study the latest present novel techniques for detection and analysing ID flows advances in that race. and we quantify the amplification of privacy-intrusive track­ The tracking mechanisms we study are advanced in that ing practices due to cookie syncing. they are hard to control, hard to detect and resilient Our evaluation of the defensive techniques used by to blocking or removing.
  • Do Not Track a Nokia Browser Look

    Do Not Track a Nokia Browser Look

    Do Not Track Nokia Browser Position - Vikram Malaiya Copyright: Nokia Corporation, 2011 Our understanding of Do Not Track (DNT) • DNT is a technology to enables users to opt out of third-party web tracking • No agreed upon definition of DNT. There are currently 3 major technology proposals for responding to third-party privacy concern. 1. Stanford University and Mozilla’s DNT HTTP Header technique. 2. Blacklist based technique such as Microsoft’s ‘Tracking Protection’ which is part of IE9 3. Network Advertising Initiative’s model of a per company opt-out cookie. Opt-out cookie approach is being promoted by Google. DNT as HTTP Header The Browser adds ‘DNT’/ ‘X-Do-Not-Track’ to its http header. The header is sent out to the server with every web request. This header acts as a signal to the server suggesting that the user wishes to opt out of tracking. Adoption: Firefox 4, IE9 DNT as HTTP Header • Pros: – Scope: Server could apply restrictions to all third party entities and tracking mechanisms – Persistent: No reconfiguration needed once set – Simple: Easy to implement on the browser side • Cons: – Only work as long as the server honors users preferences – No way to enforce national regulations/legislations to servers located beyond country boundaries Block(Black) List / Tracking Protection This is a consumer opt-in mechanism which blocks web connections from known tracking domains that are compiled on a list. First party Third party Adoption: ‘Tracking Protection’ in Internet Explorer 9 cy.analytix.com The downloadable Tracking allow Protection Lists enable IE9 xy.ads.com consumers to control what deny third-party site content can deny track them when they’re ads.tracker.com Tracking Protection online.
  • Rishi.Narang (At) Thirdbrigade.Com +91 988.6982.678

    Rishi.Narang (At) Thirdbrigade.Com +91 988.6982.678

    END USER PRIVACY BREACHES Rishi Narang Vulnerability Research Analyst Third Brigade Security Labs rishi.narang (at) thirdbrigade.com +91 988.6982.678 OWASP 06th September, 2007 Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation http://www.owasp.org HAWK‟S EYE Web Application Security - 10 Steps to Secure - IE vs. Firefox Competition Common User Behaviors - Warnings & Error Messages - SURVEY: What End Users Say About Warnings Security Products vs. Attacks - Current Security Architecture - Security Myths Ideal World vs. Real World - Security Awareness (Geographically) - Plans & Actions + Prime Focus Privacy Approach - Data Gathering - Privacy Policies & Drives OWASP 2 WEB APPLICATION SECURITY … lot many web apps, but are they secured ?? Can they live together ?? OWASP 3 10 STEPS TO SECURE WEB 2.0 brings Threat 2.0 STEP 01. Policy: Fair policy @ every Gateway STEP 02. Tuning the Policy: Tuning as per custom applications STEP 03. Dealing with Malwares: HOST level protection against Malwares STEP 04. Block Undesirable URLs: Block Black-Listed and undesirables STEP 05. File Format Scans: Protection against malicious file downloads STEP 06. Upload Scans: Upload scan log for malicious activities STEP 07. IM traffic scans: IM traffic scan for file sharing and scripts STEP 08. Web Activity Monitoring: Passive monitoring for Anomalies STEP 09. Policy Enforcements: User Education and simplified process STEP 10. Emerging Web Activities: Keep an Eye on it ! OWASP 4 BROWSER VULNERABILITIES Source: Internet Security Threat Report Volume XI, Symantec Corporation IE & FIREFOX reported high number of vulnerabilities as compared to other browsers.
  • Bibliography of Erik Wilde

    Bibliography of Erik Wilde

    dretbiblio dretbiblio Erik Wilde's Bibliography References [1] AFIPS Fall Joint Computer Conference, San Francisco, California, December 1968. [2] Seventeenth IEEE Conference on Computer Communication Networks, Washington, D.C., 1978. [3] ACM SIGACT-SIGMOD Symposium on Principles of Database Systems, Los Angeles, Cal- ifornia, March 1982. ACM Press. [4] First Conference on Computer-Supported Cooperative Work, 1986. [5] 1987 ACM Conference on Hypertext, Chapel Hill, North Carolina, November 1987. ACM Press. [6] 18th IEEE International Symposium on Fault-Tolerant Computing, Tokyo, Japan, 1988. IEEE Computer Society Press. [7] Conference on Computer-Supported Cooperative Work, Portland, Oregon, 1988. ACM Press. [8] Conference on Office Information Systems, Palo Alto, California, March 1988. [9] 1989 ACM Conference on Hypertext, Pittsburgh, Pennsylvania, November 1989. ACM Press. [10] UNIX | The Legend Evolves. Summer 1990 UKUUG Conference, Buntingford, UK, 1990. UKUUG. [11] Fourth ACM Symposium on User Interface Software and Technology, Hilton Head, South Carolina, November 1991. [12] GLOBECOM'91 Conference, Phoenix, Arizona, 1991. IEEE Computer Society Press. [13] IEEE INFOCOM '91 Conference on Computer Communications, Bal Harbour, Florida, 1991. IEEE Computer Society Press. [14] IEEE International Conference on Communications, Denver, Colorado, June 1991. [15] International Workshop on CSCW, Berlin, Germany, April 1991. [16] Third ACM Conference on Hypertext, San Antonio, Texas, December 1991. ACM Press. [17] 11th Symposium on Reliable Distributed Systems, Houston, Texas, 1992. IEEE Computer Society Press. [18] 3rd Joint European Networking Conference, Innsbruck, Austria, May 1992. [19] Fourth ACM Conference on Hypertext, Milano, Italy, November 1992. ACM Press. [20] GLOBECOM'92 Conference, Orlando, Florida, December 1992. IEEE Computer Society Press. http://github.com/dret/biblio (August 29, 2018) 1 dretbiblio [21] IEEE INFOCOM '92 Conference on Computer Communications, Florence, Italy, 1992.
  • Internet Explorer 9 Features

    Internet Explorer 9 Features

    m National Institute of Information Technologies NIIT White Paper On “What is New in Internet Explorer 9” Submitted by: Md. Yusuf Hasan Student ID: S093022200027 Year: 1st Quarter: 2nd Program: M.M.S Date - 08 June 2010 Dhaka - Bangladesh Internet Explorer History Abstract: In the early 90s—the dawn of history as far as the World Wide Web is concerned—relatively few users were communicating across this Internet Explorer 9 (abbreviated as IE9) is the upcoming global network. They used an assortment of shareware and other version of the Internet Explorer web browser from software for Microsoft Windows operating system. In 1995, Microsoft Microsoft. It is currently in development, but developer hosted an Internet Strategy Day and announced its commitment to adding Internet capabilities to all its products. In fulfillment of that previews have been released. announcement, Microsoft Internet Explorer arrived as both a graphical Web browser and the name for a set of technologies. IE9 will have complete or nearly complete support for all 1995: Internet Explorer 1.0: In July 1995, Microsoft released the CSS 3 selectors, border-radius CSS 3 property, faster Windows 95 operating system, which included built-in support for JavaScript and embedded ICC v2 or v4 color profiles dial-up networking and TCP/IP (Transmission Control support via Windows Color System. IE9 will feature Protocol/Internet Protocol), key technologies for connecting to the hardware accelerated graphics rendering using Direct2D, Internet. In response to the growing public interest in the Internet, Microsoft created an add-on to the operating system called Internet hardware accelerated text rendering using Direct Write, Explorer 1.0.
  • Statement of Justin Brookman Director, Consumer Privacy Center for Democracy & Technology Before the U.S. Senate Committee O

    Statement of Justin Brookman Director, Consumer Privacy Center for Democracy & Technology Before the U.S. Senate Committee O

    Statement of Justin Brookman Director, Consumer Privacy Center for Democracy & Technology Before the U.S. Senate Committee on Commerce, Science, and Transportation Hearing on “A Status Update on the Development of Voluntary Do-Not-Track Standards” April 24, 2013 Chairman Rockefeller, Ranking Member Thune, and Members of the Committee: On behalf of the Center for Democracy & Technology (CDT), I thank you for the opportunity to testify today. We applaud the leadership the Chairman has demonstrated in examining the challenges in developing a consensus Do Not Track standard and appreciate the opportunity to address the continued insufficiency of self-regulatory consumer privacy protections. CDT is a non-profit, public interest organization dedicated to preserving and promoting openness, innovation, and freedom on the decentralized Internet. I currently serve as the Director of CDT’s Consumer Privacy Project. I am also an active participant in the Worldwide Web Consortium’s Tracking Protection Working Group, where I serve as editor of the “Tracking Compliance and Scope” specification — the document that purports to define what Do Not Track should mean. My testimony today will briefly describe the history of online behavioral advertising and the genesis of the Do Not Track initiative. I will then describe the current state of the World Wide Web Consortium’s efforts to create Do Not Track standards and the challenges going forward to implement Do Not Track tools successfully. I will conclude with my thoughts on the future of Do Not Track. and why I believe that this protracted struggle demonstrates the need for the fundamental reform of our nation’s privacy protection framework for commercial and government collection and use of personal information.
  • Amazon Silk Developer Guide Amazon Silk Developer Guide

    Amazon Silk Developer Guide Amazon Silk Developer Guide

    Amazon Silk Developer Guide Amazon Silk Developer Guide Amazon Silk: Developer Guide Copyright © 2015 Amazon Web Services, Inc. and/or its affiliates. All rights reserved. The following are trademarks of Amazon Web Services, Inc.: Amazon, Amazon Web Services Design, AWS, Amazon CloudFront, AWS CloudTrail, AWS CodeDeploy, Amazon Cognito, Amazon DevPay, DynamoDB, ElastiCache, Amazon EC2, Amazon Elastic Compute Cloud, Amazon Glacier, Amazon Kinesis, Kindle, Kindle Fire, AWS Marketplace Design, Mechanical Turk, Amazon Redshift, Amazon Route 53, Amazon S3, Amazon VPC, and Amazon WorkDocs. In addition, Amazon.com graphics, logos, page headers, button icons, scripts, and service names are trademarks, or trade dress of Amazon in the U.S. and/or other countries. Amazon©s trademarks and trade dress may not be used in connection with any product or service that is not Amazon©s, in any manner that is likely to cause confusion among customers, or in any manner that disparages or discredits Amazon. All other trademarks not owned by Amazon are the property of their respective owners, who may or may not be affiliated with, connected to, or sponsored by Amazon. AWS documentation posted on the Alpha server is for internal testing and review purposes only. It is not intended for external customers. Amazon Silk Developer Guide Table of Contents What Is Amazon Silk? .................................................................................................................... 1 Split Browser Architecture ......................................................................................................
  • I Can't Generalize a Whole Lot About the Maxthon Cloud Browser, Which Got

    I Can't Generalize a Whole Lot About the Maxthon Cloud Browser, Which Got

    I can’t generalize a whole lot about the Maxthon Cloud Browser, which got a major upgrade to Version 4.x in a December preview and was officially released on February 25. Maxthon Cloud Browser versions are available for Windows, OS X, iOS and Android, and it’s designed to provide users with a seamless and unified user experience across multiple devices and platforms. I can’t speak to the Windows and Android versions, but I’m unevenly impressed with the OS X and iOS variants. I found myself quickly becoming a fan of the OS X version; it’s a lot like Google’s Chrome browser—very fast and slick with super-smooth performance—but more so. It incorporates pretty much everything I like about Chrome, such as an automatic Google Translate machine translation option. The iOS version isn’t bad, just not nearly as outstanding as the OS X version. Interestingly, that would be my assessment of Google Chrome for iOS compared with Chrome for OS X, as well, and I think the reason in both instances is Apple’s imposition on its own WebKit technology on iOS browsers. Using Maxthon Cloud Browser for iOS is not terribly different from the standard iOS Safari experience in terms of speed, but the iOS version of Maxthon has an absolutely maddening bug that sporadically turns the screen brightness on my iPad 2 down to minimum, obliging a trip to the iOS Settings to restore it. I suspect that Maxthon for iOS’s Brightness Control feature that purportedly lets you adjust screen brightness from within the browser, and/or Night Mode that adjusts screen brightness in low light situations are responsible for this behavior.
  • Privacy Knowledge Modelling for Internet of Things

    Privacy Knowledge Modelling for Internet of Things

    Privacy Knowledge Modelling for Internet of Things: A Look Back Charith Perera (Open University), Chang Liu (CSIRO), Rajiv Ranjan (Newcastle University), Lizhe Wang (China University of Geosciences), Albert Y. Zomaya (University of Sydney) Abstract Internet of Things (IoT) and cloud computing together give us the ability to sense, collect, process, and analyse data so we can use them to better understand behaviours, habits, preferences and life patterns of users and lead them to consume resources more efficiently. In such knowledge discovery activities, privacy becomes a significant challenge due to the extremely personal nature of the knowledge that can be derived from the data and the potential risks involved. Therefore, understanding the privacy expectations and preferences of stakeholders is an important task in the IoT domain. In this paper, we review how privacy knowledge has been modelled and used in the past in different domains. Our goal is not only to analyse, compare and consolidate past research work but also to appreciate their findings and discuss their applicability towards the IoT. Finally, we discuss major research challenges and opportunities. Keywords: Internet of Things, Privacy Preferences, Knowledge Modelling Introduction The Internet of Things allows people and things to be connected anytime, anyplace, with anything and anyone, ideally using any path, any network and any service [1]. Over the last few years, a large number of Internet of Things (IoT) solutions have come to the IoT marketplace [2]. These IoT solutions together collect a large amount of data that can be used to derive useful but extremely personal knowledge about users [3]. On the other hand, cloud computing provides ubiquitous, convenient, on- demand access to a shared pool of configurable computing resources.
  • Recommendations for Businesses and Policymakers Ftc Report March 2012

    Recommendations for Businesses and Policymakers Ftc Report March 2012

    RECOMMENDATIONS FOR BUSINESSES AND POLICYMAKERS FTC REPORT FEDERAL TRADE COMMISSION | MARCH 2012 RECOMMENDATIONS FOR BUSINESSES AND POLICYMAKERS FTC REPORT MARCH 2012 CONTENTS Executive Summary . i Final FTC Privacy Framework and Implementation Recommendations . vii I . Introduction . 1 II . Background . 2 A. FTC Roundtables and Preliminary Staff Report .......................................2 B. Department of Commerce Privacy Initiatives .........................................3 C. Legislative Proposals and Efforts by Stakeholders ......................................4 1. Do Not Track ..............................................................4 2. Other Privacy Initiatives ......................................................5 III . Main Themes From Commenters . 7 A. Articulation of Privacy Harms ....................................................7 B. Global Interoperability ..........................................................9 C. Legislation to Augment Self-Regulatory Efforts ......................................11 IV . Privacy Framework . 15 A. Scope ......................................................................15 1. Companies Should Comply with the Framework Unless They Handle Only Limited Amounts of Non-Sensitive Data that is Not Shared with Third Parties. .................15 2. The Framework Sets Forth Best Practices and Can Work in Tandem with Existing Privacy and Security Statutes. .................................................16 3. The Framework Applies to Offline As Well As Online Data. .........................17
  • Web Tracking: Mechanisms, Implications, and Defenses Tomasz Bujlow, Member, IEEE, Valentín Carela-Español, Josep Solé-Pareta, and Pere Barlet-Ros

    Web Tracking: Mechanisms, Implications, and Defenses Tomasz Bujlow, Member, IEEE, Valentín Carela-Español, Josep Solé-Pareta, and Pere Barlet-Ros

    ARXIV.ORG DIGITAL LIBRARY 1 Web Tracking: Mechanisms, Implications, and Defenses Tomasz Bujlow, Member, IEEE, Valentín Carela-Español, Josep Solé-Pareta, and Pere Barlet-Ros Abstract—This articles surveys the existing literature on the of ads [1], [2], price discrimination [3], [4], assessing our methods currently used by web services to track the user online as health and mental condition [5], [6], or assessing financial well as their purposes, implications, and possible user’s defenses. credibility [7]–[9]. Apart from that, the data can be accessed A significant majority of reviewed articles and web resources are from years 2012 – 2014. Privacy seems to be the Achilles’ by government agencies and identity thieves. Some affiliate heel of today’s web. Web services make continuous efforts to programs (e.g., pay-per-sale [10]) require tracking to follow obtain as much information as they can about the things we the user from the website where the advertisement is placed search, the sites we visit, the people with who we contact, to the website where the actual purchase is made [11]. and the products we buy. Tracking is usually performed for Personal information in the web can be voluntarily given commercial purposes. We present 5 main groups of methods used for user tracking, which are based on sessions, client by the user (e.g., by filling web forms) or it can be collected storage, client cache, fingerprinting, or yet other approaches. indirectly without their knowledge through the analysis of the A special focus is placed on mechanisms that use web caches, IP headers, HTTP requests, queries in search engines, or even operational caches, and fingerprinting, as they are usually very by using JavaScript and Flash programs embedded in web rich in terms of using various creative methodologies.