1. I Do Not Know What You Visited Last Summer: Protecting users from stateful third-party web tracking with TrackingFree browser Xiang Pan, Northwestern University Fengli Zhang 11/17/2015

2. Outline Background System Design Evaluation Summary

3. Background More than 90% Alexa Top 500 websites have adopted third party web tracking. The tracking server can associate the users’ unique identifier with the private information contained in the referrer header of the request to the tracking server, thus recording the users’ behaviors.

4. Referer : http://online.wsj.com/ Cookie : id = 12345 User Tracker (doubleclick) visit Referer : http://www.cnn.com/ Cookie : id = 12345

5. No effective defense approach Disable third-party cookie Can be easily bypassed Blacklist-based anti-tracking tools Priori knowledge of tracking server It’s never a good idea to address them one by one, We need a system that can protect users from tracking practice, no matter what techniques they tracker used.

6. TrackingFree Goals and Challenges Anti-tracking Completeness Functionality/compatbility Performance Core Idea : TrackingFree partitions client-side states into multiple isolation units so that the identifiers still exists but not unique any more! Referer : http://online.wsj.com/ Cookie : id = 12345 Referer : http://www.cnn.com/ Cookie : id = 24578

7. outline Background System Design Evaluation Summary

8. Architectur e

9. Contents Allocation Mechanism Initial Contents Allocation Handles those top frames that are navigated by users directly TrackingFree will group them in the same principal if and only if they have the same registered domain Derivative Contents Allocation Handles those frames that are generated due to the contents on other frames, which we call child frame

10. 10 Initial Contents Allocation

11. Derivative Contents Allocation Principal Switch Should we switch principle for child frame? The deficiencies of two intuitive yet extreme policies ： No privacy-preserving (no switch) Unnecessary overhead (too much switch) Our solution: switch principal only if the following two conditions are met: Cross-site User-triggered

12. Architectur e

13. Same principal Different principal

14. Principal Communication Explicit communication is widely used, but break the isolation mechanism. Disabling communication may break the functionalities of the existing web service Solution: Adopt different policies for different communication channels

15. Explicit communication Restrict the use of explicit communication as follows: Third-party elements in one principle can not explicitly communicate with other principals. First-party elements can only explicitly communicate with the first-party elements placed in its neighbor principals

16. Principal Communication Implicit Communication History Sharing public history manager Accepts information from other managers Only public manager gets associated with browser UI

17. outline Background System Design Evaluation Summary

18. Evaluation Anti-tracking capability Experiments with real world websites Performance Overhead (latency, memory, disk)

19. Anti-tracking Capability with Real World Web Sites Gathered trackers on Alexa Top web sites by following the tracker detection of [Roesner et al. NSDI 2012]. Conduct the experiment on Alexa Top 500 websites All of trackers are blocked.

20. Performance Experiment setting 1.3GHz dual-core Intel Core i5 processor, 4GB memory, 128GB flash storage Latency randomly click 25 cross-site links from Alexa Top websites Cross-site Navigation On average, it takes 5,232.90ms for TrackingFree and 4.381.46ms for Chromium to fully load the cross-site navigation page. TrackingFree incurs an overhead of 19.43%.

21. (3). Cross Site Navigation Avg. Overhead 19.43%

22. Within-site Navigation TrackingFree incurs an overhead of 4.70%.

23. Memory/Disk Overhead MemoryChromiumTrackingFreeIncrease 1 Principal477.1(MB)505(MB)27.9(MB) 4 Principals623.6(MB)702.8(MB)79.2(MB) 12 Principals434.6(MB)642.5(MB)297.9(MB) MemoryChromiumTrackingFreeIncrease 1 Principal21.3(MB)21.8(MB)0.5(MB) 4 Principals22.5(MB)25.9MB)3.4(MB) 12 Principals23.7(MB)29.4(MB)5.7(MB) Disk Overhead on 12 Web Pages (~0.6MB/Principal) Memory Overhead on 12 Web Pages (~25MB/Principal) Each loaded and opened principle takes about 20MB space in memory and 0.5-1 MB space in disk.

24. outline Background System Design Evaluation Summary

25. Design and implement TrackingFree browser that completely protect users from third-party web tracking by isolating resources in different principals. Experimentally proved TrackingFree’s anti-tracking capability. TrackingFree incurs affordable overhead and compatibility cost.

26. Questions?