CERN Accelerating science

LHCb Note
Report number	LHCb-PROC-2010-036 ; CERN-LHCb-PROC-2010-036
Title	Web Browser History Detection as a Real-World Privacy Threat
Author(s)	Janc, A ; Olejnik, L
Note	Lecture Notes in Computer Science, 2010, Volume 6345/2010, 215-231, ISBN 978-3-642-15496-6. The original publication is available at www.springerlink.com
Submitted to	European Symposium on Research in Computer Security 2010, Athens, Greece, 20 - 22 Sep 2010
Submitted by	anu.liisa.saarelainen@cern.ch on 21 Sep 2010
Subject category	Computing and Computers
Accelerator/Facility, Experiment	CERN LHC ; LHCb
Abstract	Web browser history detection using CSS $visited$ styles has long been dismissed as an issue of marginal impact. However, due to recent changes in Web usage patterns, coupled with browser performance improvements, the long-standing issue has now become a significant threat to the privacy of Internet users. In this paper we analyze the impact of CSS-based history detection and demonstrate the feasibility of conducting practical attacks with minimal resources. We analyze Web browser behavior and detectability of content loaded via standard protocols and with various HTTP response codes. We develop an algorithm for efficient examination of large link sets and evaluate its performance in modern browsers. Compared to existing methods our approach is up to 6 times faster, and is able to detect up to 30,000 visited links per second. We present a novel Web application capable of effectively detecting clients’ browsing histories and discuss real-world results obtained from 271,576 Internet users. Our results indicate that at least 76%of Internet users are vulnerable to history detection, including over 94% of Google Chrome users, for a test of most popular Internet websites we were able to detect, on average, 62.6 (median 22) visited locations per client. We also demonstrate the potential to profile users based on social news stories they visited, and to detect private data such as zip codes or search queries typed into online fo rms.
Copyright/License	Preprint: (License: CC-BY-4.0)

Email contact(s) : lukasz.olejnik@man.poznan.pl