Research and Development in E-Business through Service-Oriented Solutions Katalin Tarnay University of Pannonia, Hungary & Budapest University of Technology and Economics, Hungary Sandor Imre Budapest University of Technology and Economics, Hungary Lai Xu Bournemouth University, UK A volume in the Advances in E-Business Research (AEBR) Book Series Managing Director: Lindsay Johnston Editorial Director: Joel Gamon Production Manager: Jennifer Yoder Publishing Systems Analyst: Adrienne Freeland Development Editor: Myla Merkel Assistant Acquisitions Editor: Kayla Wolfe Typesetter: Christina Henning Cover Design: Jason Mull Published in the United States of America by Business Science Reference (an imprint of IGI Global) 701 E. Chocolate Avenue Hershey PA 17033 Tel: 717-533-8845 Fax: 717-533-8661 E-mail: [email protected] Web site: http://www.igi-global.com Copyright © 2013 by IGI Global. All rights reserved. No part of this publication may be reproduced, stored or distributed in any form or by any means, electronic or mechanical, including photocopying, without written permission from the publisher. Product or company names used in this set are for identification purposes only. Inclusion of the names of the products or companies does not indicate a claim of ownership by IGI Global of the trademark or registered trademark. Library of Congress Cataloging-in-Publication Data Research and development in e-business through service-oriented solutions / Katalin Tarnay, Sandor Imre and Lai Xu, editors. pages cm Includes bibliographical references and index. Summary: “This book highlights the main concepts of e-business as well as the advanced methods, technologies, and aspects that focus on technical support for professors, students, researchers, developers, and other industryexperts in order to provide a vast amount of specialized knowledge sources for promoting e-business”--Provided by publisher. ISBN 978-1-4666-4181-5 (hardcover) -- ISBN 978-1-4666-4182-2 (ebook) -- ISBN 978-1-4666-4183-9 (print & perpetual access) 1. Service-oriented architecture (Computer science) 2. Data mining. 3. Electronic commerce. I. Tarnay, Katalin. II. Imre, S?ndor. III. Xu, Lai, 1970- TK5105.5828.R47 2013 658.8’72--dc23 2013009512 This book is published in the IGI Global book series Advances in E-Business Research (AEBR) Book Series (ISSN: 1935- 2700; eISSN: 1935-2719) British Cataloguing in Publication Data A Cataloguing in Publication record for this book is available from the British Library. All work contributed to this book is new, previously-unpublished material. The views expressed in this book are those of the authors, but not necessarily of the publisher. 134 Chapter 7 Tracking and Fingerprinting in E-Business: New Storageless Technologies and Countermeasures Károly Boda Gábor György Gulyás Budapest University of Technology and Budapest University of Technology and Economics, Hungary Economics, Hungary Ádám Máté Földes Sándor Imre Budapest University of Technology and Budapest University of Technology and Economics, Hungary Economics, Hungary ABSTRACT Online user tracking is a widely used marketing tool in e-business, even though it is often neglected in the related literature. In this chapter, the authors provide an exhaustive survey of tracking-related identification techniques, which are often applied against the will and preferences of the users of the Web, and therefore violate their privacy one way or another. After discussing the motivations behind the information-collecting activities targeting Web users (i.e., profiling), and the nature of the information that can be collected by various means, the authors enumerate the most important techniques of the three main groups of tracking, namely storage-based tracking, history stealing, and fingerprinting. The focus of the chapter is on the last, as this is the field where both the techniques intended to protect users and the current legislation are lagging behind the state-of-the-art technology; nevertheless, the authors also discuss conceivable defenses, and provide a taxonomy of tracking techniques, which, to the authors’ knowledge, is the first of its kind in the literature. At the end of the chapter, the authors attempt to draw the attention of the research community of this field to new tracking methods. DOI: 10.4018/978-1-4666-4181-5.ch007 Copyright © 2013, IGI Global. Copying or distributing in print or electronic forms without written permission of IGI Global is prohibited. Tracking and Fingerprinting in E-Business INTRODUCTION as pursuing behavioral advertising or monetiz- ing user profiles by other means. According to Many Website operators involved in end-user the report of IAB Internet Advertising Revenue oriented e-business have an interest in monetizing Report (IAB, 2012), the advertising revenues set their user base (e.g., by realizing as many clicks a new record at $8.4 billion in Q1 2012, clearly on their advertisements as possible). One way of showing the significance and the growth of the achieving this goal is collecting diverse informa- advertising industry. tion about the user (or profiling her), the vehicles In two recent studies, Goldfarb & Tucker of which are technologies that can be used for (January and May, 2011) concluded that targeted identifying returning visitors, and those that infer advertising can successfully influence individuals sensitive information (such as browsing history) in favor of buying a product, and targeted advertis- that users are not necessarily willing to disclose ing has a significant positive (economic) impact (e.g., purchase preferences). This controversial on advertising. These claims are consistent with method may be a necessity for better serving the the ever-increasing presence of Web tracking needs of online customers, but it often goes beyond techniques (the most used tools for profiling) and user demands, and is used for business purposes the revenues the industry reached in 2012, presum- against the will of the clients. ably with a continuously increasing proportion It is not surprising that certain users are of behavioral advertising. By summarizing the concerned about pervasive profiling. In fact, measurements of Krishnamurthy & Wills between this problem has been discussed from so many 2006 and 2012 (Krishnamurthy & Wills, 2006; viewpoints in academia that not only effective 2009; Krishnamurthy, 2010), Mayer & Mitchell technological, but also more or less effective leg- (2012) highlighted that the coverage on top sites islative countermeasures have been implemented of large tracking companies increased during these in order to mitigate the privacy risks arising from years, and so did the number of trackers per page. the proliferation of a subset of profiling-related Today, researchers estimate that there are track- technologies. That said, this chapter is inspired ers capable of monitoring more than one fifth of by the rest (primarily by fingerprinting attacks), user activity while browsing online (Roesner et for which neither defensive technology nor the al., 2012). law seems to be able to keep up with the pace However, as can be expected, tracking for of development dictated by pro-profiling actors, targeted advertising is not favored by users. A leaving users of the Web powerless against and Harris Interactive poll (Krane, 2008), a TRUSTe vulnerable to them. survey (2009), and a nationally representative telephone survey in the USA conducted by Turow et al. (2009) uniformly confirmed that the majority PROFILING AND USER of individuals (around 60% in all cases) found it PRIVACY ON THE WEB uncomfortable when they faced advertisements on Websites adjusted to their preferences by pre- There are several motives of profiling users on viously observing their online activities. A more the Web. For instance, an enormous number of recent online survey conducted by McDonald & Web services can be accessed for free; however, Cranor (2010) also confirmed this result with contrary to how it looks (or is communicated), 55% of respondents rejecting targeted advertising; free access often comes with a greater sacrifice another recent survey conducted by TRUSTe in of user privacy, as many of these companies gain partnership with Harris Interactive (2011) reported revenue from profiling-related activities, such a higher rate of respondents, namely 85%, who 135 Tracking and Fingerprinting in E-Business would not consent to being tracked for targeted fingerprints all types of devices (Oracle, 2011). advertising. Somewhat in contrast with user attitude towards Nevertheless, targeted advertising is not the commercial tracking, a survey of TRUSTe & only goal of tracking and profiling; there are several Harris Interactive (2011) shows that 42% of re- other commercial use cases. Besides monetizing spondents would consent to tracking to enhance profiles in trades (i.e., exchanging large databases security and to detect frauds. It must be noted that of pseudonymous profiles), they can be utilized such identification can be used for quite different to provide additional user interface features; for and questionable purposes, such as identification example, recommendations on news or Web shop for censorship or surveillance, too. items, customized user interfaces, or to facilitate price discrimination (dynamic pricing, i.e., adjust- Who Needs Users to be Identified? ing price tags for customer price sensitivity for profit maximization of the vendor). There are several actors in the online era arguing The case of Amazon.com–namely when the against