A Bibliography of Details & Techniques
2018
Abbas Razaghpanah, Rishab Nithyanand, Narseo Vallina-Rodriguez, Srikanth Sundaresan, Mark Allman, Christian Kreibich, and Phillipa Gill, "Apps, Trackers, Privacy, and Regulators: A Global Study of the Mobile Tracking Ecosystem" (Network and Distributed Systems Security [NDSS] Symposium 2018). dx.doi.org/10.14722/ndss.2018.23353). haystack.mobi/papers/ndss18_ats.pdf
Abstract: Third-party services form an integral part of the mobile ecosystem: they ease application development and enable features such as analytics, social network integration, and app monetization through ads. However, aided by the general opacity of mobile systems, such services are also largely invisible to users. This has negative consequences for user privacy as third-party services can potentially track users without their consent, even across multiple applications. ...
2017
Terrell McSweeny (Commissioner, Federal Trade Commission) and Mignon Clyburn (Commissioner, Federal Communications Commission), "The commissioners of the FTC and FCC are worried about your online privacy," Los Angeles Times, Mar 31, 2017. beta.latimes.com/opinion/op-ed/la-oe-mcsweeny-clyburn-internet-privacy-20170331-story.html (also linked from ftc.gov/public-statements/2017/03/blog-post-commissioners-ftc-fcc-are-worried-about-your-online-privacy).
Jay Coen Gilbert, "Is Data The New Oil? How One Startup Is Rescuing The World's Most Valuable Asset" (Forbes, Social Entrepreneurs, August 23, 2017). forbes.com/sites/jaycoengilbert/2017/08/23/rescuing-the-worlds-most-valuable-stranded-asset-the-company-democratizing-data-the-new-oil
Cross-Device Tracking: A Federal Trade Commission Staff Report (January 2017).
ftc.gov/reports/cross-device-tracking-federal-trade-commission-staff-report-january-2017
2016
Arthur Baxter, "The Truth About Data Mining: How Online Trackers Gather Your Info and What They See" (The Observer, July 21, 2016).
observer.com/2016/07/the-truth-about-data-mining-how-online-trackers-gather-your-info-and-what-they-see
Englehardt, Steven, and Arvind Narayanan. "Online Tracking: A 1-million-site Measurement and Analysis." Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 1388-1401 (New York: Association for Computing Machinery, 2016). ftc.gov/system/files/documents/public_comments/2016/10/00045-129154.pdf
Abstract: We present the largest and most detailed measurement of online tracking conducted to date, based on a crawl of the top 1 million websites. We make 15 types of measurements on each site, including stateful (cookie-based) and stateless (fingerprinting-based) tracking, the effect of browser privacy tools, and the exchange of tracking data between different sites (“cookie syncing”). Our findings include multiple sophisticated fingerprinting techniques never before measured in the wild. ...
Oleksii Starov, Phillipa Gill, and Nick Nikiforakis, "Are You Sure You Want to Contact Us? Quantifying the Leakage of PII via Website Contact Forms" (Proceedings on Privacy Enhancing Technologies, 2016). cyber-investigator.org/wp-content/uploads/2016/02/contactus_pets2016.pdf
Abstract: The majority of commercial websites provide users the ability to contact them via dedicated contact pages. In these pages, users are typically requested to provide their names, email addresses, and reason for contacting the website. This effectively makes contact pages a gateway from being anonymous or pseudonymous, i.e., identified via stateful and stateless identifiers, to being eponymous. As such, the environment where users provide their personally identifiable information (PII) has to be trusted and free from intentional and unintentional information leaks. In this paper, we report on the first large-scale study of PII leakage via contact pages of the 100,000 most popular sites of the web. We develop a reliable methodology for identifying and interacting with contact forms as well as techniques that allow us to discover the leakage of PII towards thirdparties, even when that information is obfuscated. Using these methods, we witness the leakage of PII towards third-parties in a wide range of ways, including the leakage through third-party form submissions, third-party scripts that collect PII information from a first-party page, and unintended leakage through a browser’s Referer header. ...
Narseo Vallina-Rodriguez, Srikanth Sundaresan, Abbas Razaghpanah, Rishab Nithyanand, Mark Allman, Christian Kreibich, Phillipa Gill, "Tracking the Trackers: Towards Understanding the Mobile Advertising and Tracking Ecosystem" (FTC Public Comments, Consumer Privacy and Security Issues #38) ftc.gov/system/files/documents/public_comments/2016/10/00038-129143.pdf
Abstract: Third-party services form an integral part of the mobile ecosystem: they allow app developers to add features such as performance analytics and social network integration, and to monetize their apps by enabling user tracking and targeted ad delivery. At present users, researchers, and regulators all have at best limited understanding of this third-party ecosystem. In this paper we seek to shrink this gap. ...
Lisa Weintraub Schifferle, "Online tracking – more than cookies" (Federal Trade Commission, Division of Consumer & Business Education, June 23, 2016). consumer.ftc.gov/blog/2016/06/online-tracking-more-cookies
Amy Hebert, "Getting tracked online even after you try to stop it" (Federal Trade Commission, December 20, 2016). consumer.ftc.gov/blog/2016/12/getting-tracked-online-even-after-you-try-stop-it
General Online Tracking info from the FTC: consumer.ftc.gov/articles/0042-online-tracking
2015
Chris Jay Hoofnagle, Ashkan Soltani, Nathaniel Good, Dietrich J. Wambach, and Mika D. Ayenson, "Behavioral Advertising: The Offer You Cannot Refuse" (Public Comment, FTC Workshop on Cross-Device Tracking Nov. 16, 2015, Submission #00048). ftc.gov/system/files/documents/public_comments/2015/10/00048-97807.pdf
(FTC landing page: ftc.gov/policy/public-comments/2015/10/07/comment-00048)
Intro: At UC Berkeley, we are informing political debates surrounding online privacy through empirical study of website behaviors. In 2009 and 2011, we surveyed top websites to determine how they were tracking consumers. We found that advertisers were using persistent tracking technologies that were relatively unknown to consumers. Two years later, we found that the number of tracking cookies expanded dramatically and that advertisers had developed new, previously unobserved tracking mechanisms that users cannot avoid even with the strongest privacy settings. These empirical observations are valuable for the political debate surrounding online privacy because they inform the framing and assumptions surrounding the merits of privacy law. Our work demonstrates that advertisers use new, relatively unknown technologies to track people, specifically because consumers have not heard of these techniques. Furthermore, these technologies obviate choice mechanisms that consumers exercise. ...
Public Comments #603: FTC Workshop on Cross-Device Tracking; Matter Number: P155403. ftc.gov/policy/public-comments/2015/03/initiative-603
Cross-Device Tracking: An FTC Workshop. ftc.gov/news-events/events-calendar/2015/11/cross-device-tracking
Amit Datta, Michael Carl Tschantz, and Anupam Datta, "Automated Experiments on Ad Privacy Settings" (Privacy Enhancing Technologies 2015, 1 [2015]: 92-112). andrew.cmu.edu/user/danupam/dtd-pets15.pdf
Abstract: To partly address people’s concerns over web tracking, Google has created the Ad Settings webpage to provide information about and some choice over the profiles Google creates on users. We present AdFisher, an automated tool that explores how user behaviors, Google’s ads, and Ad Settings interact. AdFisher can run browser-based experiments and analyze data using machine learning and significance tests. Our tool uses a rigorous experimental design and statistical analysis to ensure the statistical soundness of our results. We use AdFisher to find that the Ad Settings was opaque about some features of a user’s profile, that it does provide some choice on ads, and that these choices can lead to seemingly discriminatory ads. ...
More from Prof. Datta: andrew.cmu.edu/user/danupam/
Andreas Kuehn, "Cookies versus Clams: Clashing Tracking Technologies and Online Privacy" (info 15, no. 6 [2013], 19-31, DOI 10.1108/info-04-2013-0013).
Abstract: This article compares the use of deep packet inspection (DPI) technology to the use of cookies for online behavioral advertising (OBA), in the form of two competing paradigms. It seeks to explain why DPI was eliminated as a viable option due to political and regulatory reactions whereas cookies technology was not, even though it raises some of the same privacy issues. ... Comparing the two cases from a technological, economic, and institutional perspective, the article argues that both paradigms were equally privacy intrusive. Thus, it rejects the generally held view that privacy issues can explain the outcome of the battle. Politics and regulatory legacy tilted the playing field towards the cookies paradigm, impeding a competing technology. ...
Also available as a symposium paper: papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID2809792_code2291099.pdf?abstractid=2809792&mirid=1
Natasha Singer, "Sharing Data, but Not Happily" (New York Times, Technology, June 4, 2015). nytimes.com/2015/06/05/technology/consumers-conflicted-over-data-mining-policies-report-finds.html
2014
Jennifer M. Urban, Chris Jay Hoofnagle, and Su Li, "Mobile Phones and Privacy" (Public Comment, FTC Workshop on Mobile Device Tracking, February 19, 2014, Submission #00048) ftc.gov/system/files/documents/public_comments/2013/12/00007-89101.pdf
Intro: Mobile phones are a rich source of personal information about individuals. Both private and public sector actors seek to collect this information. Many mobile applications seek identification information, location data, and other user information. Facebook, among other companies, recently ignited a controversy by collecting address book information from users’ mobile phones via its mobile app. And a recent Congressional investigation found that law enforcement agencies sought access to wireless phone records over one million times in 2011. As these developments receive greater attention in the media, a public policy debate has started concerning the collection and use of information by private and public actors. To inform this debate and to better understand Americans’ attitudes towards privacy in data generated by or stored on mobile phones, we commissioned a nationwide, telephonic (both wireline and wireless) survey of 1,200 households. The survey questions covered in this paper focused on known ways that mobile phones and service providers are likely to store data, and on likely scenarios under which service providers—including mobile “app” providers—are likely to collect and share information about consumers. ...
Public Comments #516: FTC Workshop on Mobile Device Tracking; Matter Number: P145401
ftc.gov/policy/public-comments/2014/02/initiative-516
2012
Claude Castelluccia, "Behavioural Tracking on the Internet: A Technical Perspective," in European Data Protection in Good Health, edited by Serge Gutwirth, Ronald Leenes, Paul de Hert, Yves Poullet, 21-33 (Dordrecht: Springer Netherlands, 2012).
springer.com/cda/content/document/cda_downloaddocument/9789400729025-c1.pdf
Intro: The concept of Behavioural Profiling (also known as “targeting”) consists of collecting and analysing several events, each attributable to a single originating entity, in order to gain information relating to the originating entity. It consists of, in other words, transforming data into knowledge (Hildebrandt 2006). Behavioural profiling involves collecting data (recording, storing and tracking) and searching it for identifying patterns (with the help of data mining algorithms). The data collection phase is often referred to as Behavioural Tracking. ...
Jonathan R. Mayer and John C. Mitchell, "Third-Party Web Tracking: Policy and Technology" (IEEE Symposium on Security and Privacy, 2012). jonathanmayer.org/papers_data/trackingsurvey12.pdf
Abstract: In the early days of the web, content was designed and hosted by a single person, group, or organization. No longer. Webpages are increasingly composed of content from myriad unrelated “third-party” websites in the business of advertising, analytics, social networking, and more. Thirdparty services have tremendous value: they support free content and facilitate web innovation. But third-party services come at a privacy cost: researchers, civil society organizations, and policymakers have increasingly called attention to how third parties can track a user’s browsing activities across websites. This paper surveys the current policy debate surrounding third-party web tracking and explains the relevant technology. ...
Other great papers form Jonathan Mayer: jonathanmayer.org/papers
Franziska Roesner, Tadayoshi Kohno, and David Wetherall, "Detecting and Defending Against Third-Party Tracking on the Web" (9th USENIX Symposium on Networked Systems Design and Implementation, 2012). usenix.org/system/files/conference/nsdi12/nsdi12-final17.pdf
Abstract: While third-party tracking on the web has garnered much attention, its workings remain poorly understood. Our goal is to dissect how mainstream web tracking occurs in the wild. We develop a client-side method for detecting and classifying five kinds of third-party trackers based on how they manipulate browser state. We run our detection system while browsing the web and observe a rich ecosystem, with over 500 unique trackers in our measurements alone. We find that most commercial pages are tracked by multiple parties, trackers vary widely in their coverage with a small number being widely deployed, and many trackers exhibit a combination of tracking behaviors. ...
More, including video of the presentation: usenix.org/conference/nsdi12/technical-sessions/presentation/roesner
Stephen Cobb, "Google's data mining bonanza and your privacy: an infographic" (welivesecurity.com, 2012).
https://www.welivesecurity.com/2012/03/14/google-data-mining-bonanza-and-your-privacy-infographic/
[GREAT infographic]
2010
Dongseok Jang, Ranjit Jhala, Sorin Lerner, Hovav Shacham, "An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications" (CCS '10, Proceedings of the 17th ACM Conference on Computer and Communications Security, New York: ACM, 2010). dl.acm.org/ft_gateway.cfm?id=1866339&ftid=849805&dwn=1&CFID=847363526&CFTOKEN=38377694 (also at: goto.ucsd.edu/~rjhala/papers/an_empirical_study_of_privacy_violating_flows_in_javascript_web_applications.ps and via the Table of Contents tab at dl.acm.org/citation.cfm?id=1866307)
2006
Mireille Hildebrandt, "Profiling: From Data to Knowledge" (DuD: Datenschutz und Datensicherheit 30, no. 9 [2012]: 548-552).
pdfs.semanticscholar.org/c0a1/aa843e812925127dfb8f9540089e1a0a72b5.pdf
|
