Third-Party Tracking on the Web
|
|
|
- Samantha Fox
- 5 years ago
- Views:
Transcription
1 CSE 484 / CSE M 584: Computer Security and Privacy Third-Party Tracking on the Web Spring 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials...
2 Admin Reminders My office hours at 9:15am Wednesday Lab #2 due Friday 5/15/17 CSE 484 / CSE M Spring
3 Tangent: WannaCry Ransomware 5/15/17 CSE 484 / CSE M Spring
4 Tangent: WannaCry Ransomware 5/15/17 CSE 484 / CSE M Spring
5 Ads That Follow You Advertisers (and others) track your browsing behaviors for the purposes of targeted ads, website analytics, and personalized content. 5/15/17 CSE 484 / CSE M Spring
6 Third-Party Web Tracking Browsing profile for user 123: cnn.com theonion.com adult-site.com political-site.com These ads allow criteo.com to link your visits between sites, even if you never click on the ads. 5/15/17 CSE 484 / CSE M Spring
7 Concerns About Privacy ( ) 5/15/17 CSE 484 / CSE M Spring
8 Outline 1. Understanding web tracking 2. Measuring web tracking 3. Defenses 5/15/17 CSE 484 / CSE M Spring
9 Recall: First and Third Parties First-party cookie: belongs to top-level domain. Third-party cookie: belongs to domain of embedded content (such as image, iframe). s cookie (1 st party) Bar s Server s cookie (3 rd party) Foo s Server 5/15/17 CSE 484 / CSE M Spring
10 Anonymous Tracking Trackers included in other sites use third-party cookies containing unique identifiers to create browsing profiles. cookie: id=789 cookie: id=789 criteo.com user 789: theonion.com, cnn.com, adult-site.com, 5/15/17 CSE 484 / CSE M Spring
11 Basic Tracking Mechanisms Tracking requires: (1) re-identifying a user. (2) communicating id + visited site back to tracker. 5/15/17 CSE 484 / CSE M Spring
12 Tracking Technologies HTTP Cookies HTTP Auth HTTP Etags Content cache IE userdata HTML5 protocol and content handlers HTML5 storage Flash cookies Silverlight storage TLS session ID & resume Browsing history window.name HTTP STS DNS cache Zombie cookies that respawn ( 5/15/17 CSE 484 / CSE M Spring
13 Fingerprinting Web Browsers User agent HTTP ACCEPT headers Browser plug-ins MIME support Clock skew Installed fonts Cookies enabled? Browser add-ons Screen resolution HTML5 canvas (differences in graphics SW/HW!) 5/15/17 CSE 484 / CSE M Spring
14 Your browser fingerprint appears to be unique among the 3,435,834 tested so far 5/15/17 CSE 484 / CSE M Spring
15 Panopticlick Example Plugin 0: Adobe Acrobat; Adobe Acrobat Plug-In Version 7.00 for Netscape; nppdf32.dll; (Acrobat Portable Document Format; application/pdf; pdf) (Acrobat Forms Data Format; application/vnd.fdf; fdf) (XML Version of Acrobat Forms Data Format; application/vnd.adobe.xfdf; xfdf) ( Acrobat XML Data Package; application/vnd.adobe.xdp+xml; xdp) (Adobe FormFlow99 Data File; application/vnd.adobe.xfd+xml; xfd). Plugin 1: Adobe Acrobat; Adobe PDF Plug-In For Firefox and Netscape; nppdf32.dll; (Acrobat Portable Document Format; application/pdf; pdf) (Adobe PDF in XML Format; application/vnd.adobe.pdfxml; pdfxml) (Adobe PDF XML Format; application/vnd.adobe.x-mars; mars) (Acrobat Forms Data 84% Format; of application/vnd.fdf; browser fdf) fingerprints (XML Version of Acrobat are Forms unique Data Format; application/vnd.adobe.xfdf; xfdf) ( Acrobat XML Data Package; application/vnd.adobe.xdp+xml; xdp) (Adobe FormFlow99 Data File; application/vnd.adobe.xfd+xml; With Flash or Java, xfd). Plugin 94% 2: Google are Update; unique Google Update; npgoogleoneclick8.dll; (; application/x-vnd.google.oneclickctrl.8; ). Plugin 3: Microsoft Windows Media Player Firefox Plugin; np-mswmp; np-mswmp.dll; (np-mswmp; application/x-ms-wmp; *) (; application/asx; *) (; video/x-ms-asfplugin; *) (; application/x-mplayer2; *) (; video/x-ms-asf; asf,asx,*) (; video/x-ms-wm; wm,*) (; audio/x-ms-wma; wma,*) (; audio/x-ms-wax; wax,*) (; video/x-ms-wmv; wmv,*) (; video/x-ms-wvx; wvx,*). Plugin 4: Move Media Player; npmnqmp ; npmnqmp dll; (npmnqmp; application/x-vnd.moveplayer.qm; qmx,qpl) (npmnqmp; application/x-vnd.moveplay2.qm; ) (npmnqmp; application/x-vnd.movenetworks.qm; ). Plugin 5: Mozilla Default Plug-in; Default Plug-in; npnul32.dll; (Mozilla Default Plug-in; *; *). Plugin 6: Shockwave Flash; Shockwave Flash 10.0 r32; NPSWF32.dll; (Adobe Flash movie; application/x-shockwave-flash; swf) (FutureSplash movie; application/futuresplash; spl). Plugin 7: Windows Genuine Advantage; ; nplegitcheckplugin.dll; (nplegitcheckplugin; application/wgaplugin; *). 5/15/17 CSE 484 / CSE M Spring
16 History Sniffing How can a webpage figure out which sites you visited previously? Color of links CSS :visited property getcomputedstyle() Cached Web content timing DNS timing 5/15/17 CSE 484 / CSE M Spring
17 How Websites Get Your Identity Personal trackers Leakage of identifiers GET /ad.doubleclick.net/adj/... Referer: Cookie: id=35c192bcfe0000b1... Security bugs Third party buys your identity 5/15/17 CSE 484 / CSE M Spring
18 Understanding the Tracking Ecosystem In 2011, much discussion about tracking, but limited understanding of how it actually works. Our Goal: systematically study web tracking ecosystem to inform policy and defenses. Challenges: No agreement on definition of tracking. No automated way to detect trackers. (State of the art: blacklists) 5/15/17 CSE 484 / CSE M Spring
19 Our Tracking Taxonomy [NSDI 12] In the wild, tracking is much more complicated. (1) Trackers don t just use cookies. Flash cookies, HTML5 LocalStorage, etc. (2) Trackers exhibit different behaviors. Within-site vs. cross-site. Anonymous vs. non-anonymous. Specific behavior types: analytics, vanilla, forced, referred, personal. 5/15/17 CSE 484 / CSE M Spring
20 Other Trackers? Personal Trackers 5/15/17 CSE 484 / CSE M Spring
21 Personal Tracking cookie: id=franzi.roesner cookie: id=franzi.roesner cookie: id=franzi.roesner facebook.com user franzi.roesner: theonion.com, cnn.com, adult-site.com, Tracking is not anonymous (linked to accounts). Users directly visit tracker s site à evades some defenses. 5/15/17 CSE 484 / CSE M Spring
22 Outline 1. Understanding web tracking 2. Measuring web tracking 3. Defenses 5/15/17 CSE 484 / CSE M Spring
23 Measurement Study (2011) Questions: How prevalent is tracking (of different types)? How much of a user s browsing history is captured? How effective are defenses? Approach: Build tool to automatically crawl web, detect and categorize trackers based on our taxonomy. Longitudinal studies since then: tracking has increased and become more complex. 5/15/17 CSE 484 / CSE M Spring
24 How prevalent is tracking? 524 unique trackers on Alexa top 500 websites (homepages + 4 links) 457 domains (91%) embed at least one tracker. (97% of those include at least one cross-site tracker.) 50% of domains embed between 4 and 5 trackers. One domain includes 43 trackers. 5/15/17 CSE 484 / CSE M Spring
25 How prevalent is tracking? 524 unique trackers on Alexa top 500 websites (homepages + 4 links) 457 domains (91%) embed at least one tracker. Tracking is increasing! (97% of those include at least one cross-site tracker.) Unique trackers on the top % of domains embed websites (homepages only): between 4 and 5 trackers. 2011: : 409 One domain 2015: 512 includes 43 trackers. 5/15/17 CSE 484 / CSE M Spring
26 Who/what are the top trackers? (2011) 5/15/17 CSE 484 / CSE M Spring
27 How are users affected? Question: How much of a real user s browsing history can top trackers capture? Measurement challenges: - Privacy concerns. - Users may not browse realistically while monitored. Insight: AOL search logs (released in 2006) represent real user behaviors. 5/15/17 CSE 484 / CSE M Spring
28 How are users affected? Idea: Use AOL search logs to create 30 hypothetical browsing histories unique queries per user à top search hits. Trackers can capture a large fraction: - Doubleclick: Avg 39% (Max 66%) - Facebook: Avg 23% (Max 45%) - Google: Avg 21% (Max 61%) 5/15/17 CSE 484 / CSE M Spring
29 How are users affected? Idea: Use AOL search logs to create hypothetical browsing histories unique queries per user à top search hits. Trackers can capture a large fraction: - Doubleclick: Avg 39% (Max 66%) - Facebook: Avg 23% (Max 45%) - Google: Avg 21% (Max 61%) 5/15/17 CSE 484 / CSE M Spring
30 LocalStorage and Flash Cookies Surprisingly little use of these mechanisms! Of 524 trackers on Alexa Top 500: Only 5 set unique identifiers in LocalStorage 35 set unique identifiers in Flash cookies Respawning: LS à Cookie: 1 case; Cookie à LS: 3 cases Flashà Cookie: 6 cases; Cookie à Flash: 7 cases 5/15/17 CSE 484 / CSE M Spring
31 How has this changed over time? The web has existed for a while now - What about tracking before 2011? (our first study) - What about tracking before 2009? (first academic study) Solution: time travel! [USENIX Security 16] 5/15/17 CSE 484 / CSE M Spring
32 The Wayback Machine to the Rescue Time travel for web tracking: 5/15/17 CSE 484 / CSE M Spring
33 : More & More Tracking More trackers of more types 5/15/17 CSE 484 / CSE M Spring
34 : More & More Tracking More trackers of more types, more per site 5/15/17 CSE 484 / CSE M Spring
35 : More & More Tracking More trackers of more types, more per site, more coverage 5/15/17 CSE 484 / CSE M Spring
36 Outline 1. Understanding web tracking 2. Measuring web tracking 3. Defenses 5/15/17 CSE 484 / CSE M Spring
37 Defenses to Reduce Tracking Do Not Track proposal? Do Not Track is not a technical defense: trackers must honor the request. 5/15/17 CSE 484 / CSE M Spring
38 Defenses to Reduce Tracking Do Not Track proposal? Private browsing mode? Private browsing mode protects against local, not network, attackers. 5/15/17 CSE 484 / CSE M Spring
39 Defenses to Reduce Tracking Do Not Track proposal? Private browsing mode? Third-party cookie blocking? s cookie (1 st party) Bar s Server s cookie (3 rd party) Foo s Server 5/15/17 CSE 484 / CSE M Spring
40 Quirks of 3 rd Party Cookie Blocking In some browsers, this option means third-party cookies cannot be set, but they CAN be sent. So if a third-party cookie is somehow set, it can be used. How to get a cookie set? One way: be a first party. etc. 5/15/17 CSE 484 / CSE M Spring
41 What 3 rd Party Cookie Blocking Misses 5/15/17 CSE 484 / CSE M Spring
42 What 3 rd Party Cookie Blocking Misses Defenses for personal trackers (red bars) were inadequate. 5/15/17 CSE 484 / CSE M Spring
43 Our Defense: ShareMeNot Prior defenses for personal trackers: ineffective or completely removed social media buttons. Our defense: - ShareMeNot (for Chrome/Firefox) protects against tracking without compromising button functionality. - Blocks requests to load buttons, replaces with local versions. On click, shares to social media as expected. - Techniques adopted by Ghostery and the EFF. 5/15/17 CSE 484 / CSE M Spring
44 Defenses to Reduce Tracking Do Not Track header? Private browsing mode? Third-party cookie blocking? Browser add-ons? uses algorithmic methods to decide what is and isn't tracking Often rely on blacklists, which may be incomplete. 5/15/17 CSE 484 / CSE M Spring
Web Tracking and Fingerprinting
CS 6431 Web Tracking and Fingerprinting Vitaly Shmatikov It s the Internet! Of course they know you re a dog. They also know your favorite brand of pet food and the name of the cute poodle at the park
The Invisible Trail: Third- Party Tracking on the Web
The Invisible Trail: Third- Party Tracking on the Web Franziska Roesner Assistant Professor Computer Science & Engineering University of Washington The Invisible Trail: Third- Party Tracking on the Web
Security, Privacy, & User Expectations:
Security, Privacy, & User Expectations: Case Studies in Web Tracking and Application Permissions Franziska Roesner Assistant Professor Computer Science & Engineering University of Washington Security,
Web Security: Loose Ends
CSE 484 / CSE M 584: Computer Security and Privacy Web Security: Loose Ends Spring 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno,
CSE 484 / CSE M 584: Computer Security and Privacy. Web Security. Autumn Tadayoshi (Yoshi) Kohno
CSE 484 / CSE M 584: Computer Security and Privacy Web Security Autumn 2018 Tadayoshi (Yoshi) Kohno yoshi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Ada Lerner, John Manferdelli,
CSE 484 / CSE M 584: Computer Security and Privacy. Usable Security. Fall Franziska (Franzi) Roesner
CSE 484 / CSE M 584: Computer Security and Privacy Usable Security Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, Ada Lerner,
CSE 484 / CSE M 584: Computer Security and Privacy. Web Security. Autumn Tadayoshi (Yoshi) Kohno
CSE 484 / CSE M 584: Computer Security and Privacy Web Security Autumn 2018 Tadayoshi (Yoshi) Kohno yoshi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Ada Lerner, John Manferdelli,
Web Security: Web Application Security [continued]
![Web Security: Web Application Security [continued]](/thumbs/89/99438321.jpg "Web Security: Web Application Security [continued]")
CSE 484 / CSE M 584: Computer Security and Privacy Web Security: Web Application Security [continued] Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
CSE 484 / CSE M 584: Computer Security and Privacy. Anonymity Mobile. Autumn Tadayoshi (Yoshi) Kohno
CSE 484 / CSE M 584: Computer Security and Privacy Anonymity Mobile Autumn 2018 Tadayoshi (Yoshi) Kohno yoshi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Ada Lerner, John Manferdelli,
Crypto meets Web Security: Certificates and SSL/TLS
CSE 484 / CSE M 584: Computer Security and Privacy Crypto meets Web Security: Certificates and SSL/TLS Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
Internet Jones and the Raiders of the Lost Trackers
Internet Jones and the Raiders of the Lost Trackers An Archaeological Study of Web Tracking from 1996 to 2016 Adam Lerner* Anna Kornfeld Simpson* *Joint First Authors in Alphabetical Order Tadayoshi Kohno
Cryptography [Symmetric Encryption]
![Cryptography [Symmetric Encryption]](/thumbs/89/100564864.jpg "Cryptography [Symmetric Encryption]")
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography [Symmetric Encryption] Spring 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin,
Web Security: Web Application Security [continued]
![Web Security: Web Application Security [continued]](/thumbs/89/99438401.jpg "Web Security: Web Application Security [continued]")
CSE 484 / CSE M 584: Computer Security and Privacy Web Security: Web Application Security [continued] Spring 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
Software Security: Buffer Overflow Defenses
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Defenses Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin,
Web Security [SSL/TLS and Browser Security Model]
![Web Security [SSL/TLS and Browser Security Model]](/thumbs/92/107868368.jpg "Web Security [SSL/TLS and Browser Security Model]")
CSE 484 / CSE M 584: Computer Security and Privacy Web Security [SSL/TLS and Browser Security Model] Fall 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
Software Security: Misc and Principles
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Misc and Principles Spring 2015 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin,
Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes Spring 2016 Franziska (Franzi) Roesner franzi@cs.washington.edu
Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes Spring 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu
Cryptography: Symmetric Encryption [continued]
![Cryptography: Symmetric Encryption [continued]](/thumbs/86/93317133.jpg "Cryptography: Symmetric Encryption [continued]")
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography: Symmetric Encryption [continued] Fall 2016 Ada (Adam) Lerner lerner@cs.washington.edu Thanks to Franzi Roesner, Dan Boneh, Dieter Gollmann,
Software Security: Buffer Overflow Defenses and Miscellaneous
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Defenses and Miscellaneous Spring 2017 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter
Browser fingerprinting
Browser fingerprinting (how did we get here) SecAppDev February 2014 Nick Nikiforakis www.securitee.org echo `whoami` Postdoctoral researcher at KU Leuven Working, mainly, on web security and privacy Identify
Software Security: Buffer Overflow Attacks (continued)
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Attacks (continued) Spring 2015 Franziska (Franzi) Roesner franzi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
User Authentication + Other Human Aspects
CSE 484 (Winter 2010) User Authentication + Other Human Aspects Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for
HTML5 Tracking Techniques in Practice
Bachelor thesis Computer Science Radboud University HTML5 Tracking Techniques in Practice Author: Ivar Derksen 4375408 First supervisor/assessor: Dr. Ir. Erik Poll e.poll@cs.ru.nl Second assessor: Fabian
Everything you always wanted to know about web-based device fingerprinting
Everything you always wanted to know about web-based device fingerprinting (but were afraid to ask) Nick Nikiforakis echo `whoami` Postdoctoral researcher at KU Leuven Working, mainly, on web security
Software Security: Buffer Overflow Attacks
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Buffer Overflow Attacks (continued) Autumn 2018 Tadayoshi (Yoshi) Kohno yoshi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann,
Cryptography (cont.)
CSE 484 / CSE M 584 (Autumn 2011) Cryptography (cont.) Daniel Halperin Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others
Jared Moore
CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner, Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, John Manferdelli, John Mitchell,
Learning Center Computer and Security Settings
Learning Center Computer and Security Settings Learning Center Computer Settings Please Note: To allow your computer to communicate most effectively with the Learning Center, and update your training record
Robust Defenses for Cross-Site Request Forgery
Robust Defenses for Cross-Site Request Forgery Tsampanaki Nikoleta Lilitsis Prodromos Gigis Petros Paper Authors: Adam Barth, Collin Jackson, John C. Mitchell Outline What is CSRF attack? What is a login
Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes
CSE 484 / CSE M 584: Computer Security and Privacy Cryptography: Symmetric Encryption (finish), Hash Functions, Message Authentication Codes Fall 2016 Adam (Ada) Lerner lerner@cs.washington.edu Thanks
Computer Security and Privacy
CSE P 590 / CSE M 590 (Spring 2010) Computer Security and Privacy Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for
Web Fingerprinting. How, Who, and Why? Nick Nikiforakis
Web Fingerprinting How, Who, and Why? Nick Nikiforakis echo `whoami` Final year PhD student at KU Leuven Working, mainly, on web security and privacy Identify online ecosystems Players Interactions Common
Recommended Browser Settings
Recommended Browser Settings Internet Explorer Settings (PC) Mozilla Firefox Settings (PC) Mozilla Firefox Settings (Mac) Safari Settings (Mac) Chrome Settings (PC) Infinite Campus recommends modifying
Digital Marketing, Privacy, and New Technologies. Jules Polonetsky, CEO Future of Privacy Forum
Digital Marketing, Privacy, and New Technologies Jules Polonetsky, CEO Future of Privacy Forum 9.26.17 Future of Privacy Forum The Members 140+ Companies 25+ Leading Academics 10+ Advocates The Mission
Surfing safely over the Tor anonymity network. Georg Koppen Philipp Winter
Surfing safely over the Tor anonymity network Georg Koppen gk@torproject.org Philipp Winter phw@torproject.org How does Tor work? What are exit relays? Currently ~7,000 relays, ~1,000 are exits All run
Web browsers - Firefox
N E W S L E T T E R IT Computer Technical Support Newsletter Web browsers - Firefox February 09, 2015 Vol.1, No.16 A Web Browser is a program that enables the user to view web pages. TABLE OF CONTENTS
User Authentication and Human Factors
CSE 484 / CSE M 584 (Autumn 2011) User Authentication and Human Factors Daniel Halperin Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee,
Software Security: Miscellaneous
CSE 484 / CSE M 584: Computer Security and Privacy Software Security: Miscellaneous Fall 2016 Adam (Ada) Lerner lerner@cs.washington.edu Thanks to Franzi Roesner, Dan Boneh, Dieter Gollmann, Dan Halperin,
Web Security: 1) UI-based attacks 2) Tracking on the web
Web Security: 1) UI-based attacks 2) Tracking on the web CS 161: Computer Security Prof. Raluca Ada Popa November 15, 2016 Contains new slides, slides from past CS 161 offerings and slides from Dan Boneh
Web-based Fingerprinting Techniques
Web-based Fingerprinting Techniques Vítor Bernardo and Dulce Domingos LaSIGE, Faculdade de Ciências, Universidade de Lisboa, Lisboa, Portugal Keywords: Abstract: Fingerprinting, Cross-browser Fingerprinting,
Recommended Browser Settings
Recommended Browser Settings August 2015 This document is intended for restricted use only. Infinite Campus asserts that this document contains proprietary information that would give our competitors undue
Learning Center Computer and Security Settings
Learning Center Computer and Security Settings Learning Center Computer Settings Please Note: To allow your computer to communicate most effectively with the Learning Center, and update your training record
User Authentication. Tadayoshi Kohno
CSE 484 / CSE M 584 (Spring 2012) User Authentication Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others
Introduction to Cryptography (cont.)
CSE 484 / CSE M 584 (Autumn 2011) Introduction to Cryptography (cont.) Daniel Halperin Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee,
Software Security Design Principles + Intro to Crypto
CSE 484 (Winter 2011) Software Security Design Principles + Intro to Crypto Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many
How to Troubleshoot Panopto Viewing Issues
How to Troubleshoot Panopto Viewing Issues Overview This documentation will go over how to troubleshoot Panopto Viewing Issues. Our current release of Panopto uses a combination of Adobe Flash Player and
Founded the web application security lab
Robert RSnake Hansen - CEO SecTheory LLC Bespoke Boutique Internet Security Web Application/Browser Security Network/OS Security Advisory capacity to VCs/start-ups We solve tough problems. http://www.sectheory.com/
Outline. Web browsers & Web servers
Web browsers & Web servers 1 Outline Goals and Objectives Topics headlines Introduction Finding a web page Browser Tasks Top browsers Browser window structure Internet Explorer Netscape / Mozilla Opera
How to Use Panopto Video Series Transcript
How to Use Panopto Video Series Transcript Video 1: Introduction Hello new students and welcome to Auburn Agriculture Online at Auburn University! In this video, I m going to briefly show you how to use
Device Recognition Best Practices Guide
Copyright Information 2017. SecureAuth is a copyright of SecureAuth Corporation. SecureAuth s IdP software, appliances, and other products and solutions, are copyrighted products of SecureAuth Corporation.
Software Security and Intro to Cryptography
CSE 484 / CSE M 584 (Spring 2012) Software Security and Intro to Cryptography Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet
Adobe Flash Player 11 Plugin 64 Bit Windows 7
Adobe Flash Player 11 Plugin 64 Bit Windows 7 Firefox 2 replies, 8 have this problem, 3328 views, Last reply by alacer 11 months ago I am having a problem with firefox crashing my OS which is Windows 7
OWASP AppSec Research The OWASP Foundation New Insights into Clickjacking
New Insights into Clickjacking Marco `embyte` Balduzzi iseclab @ EURECOM embyte@iseclab.org AppSec Research 2010 Joint work with Egele, Kirda, Balzarotti and Kruegel Copyright The Foundation Permission
Revised: March 8 th, 2017 for Firefox 52.0
Configuring Mozilla Firefox for Spectrum v14 Spectrum v14 runs in a browser window. As a result, there are a number of browser settings that impact how Spectrum will function. This document covers the
Annoyed Users: Ads and Ad-Block Usage in the Wild
Annoyed Users: Ads and Ad-Block Usage in the Wild Enric Pujol TU Berlin Oliver Hohlfeld RWTH Aachen Anja Feldmann TU Berlin IMC 15 Tokyo, Japan 2 http://www.journalism.org/2015/04/29/digital-news-revenue-fact-sheet
FITECH FITNESS TECHNOLOGY
Browser Software & Fitech FITECH FITNESS TECHNOLOGY What is a Browser? Well, What is a browser? A browser is the software that you use to work with Fitech. It s called a browser because you use it to browse
Combatting Browser Fingerprinting with ChromeDust
Combatting Browser Fingerprinting with ChromeDust Ram Bhaskar Rishikesh Tirumala Timmy Galvin 6.858 Final Project (Lab 7) December 12, 2013 Introduction
BROWSER POLICY: DESCRIPTION OF SUPPORT 2 SUPPORTED BROWSERS 2 TIER 2 SUPPORTED BROWSERS 2 UNSUPPORTED BROWSERS 2
Browser Policy June 2016 Table of Contents BROWSER POLICY: DESCRIPTION OF SUPPORT 2 SUPPORTED BROWSERS 2 TIER 1 SUPPORTED BROWSERS 2 TIER 2 SUPPORTED BROWSERS 2 UNSUPPORTED BROWSERS 2 SCOPE OF APPLICABILITY
Trouble Shooting Portable Documents Format (PDF) Q/A Solutions: AT ANY TIME THE USER CAN SAVE THE FILE TO THEIR COMPUTER AND FILL OUT THE FORM
Trouble Shooting Portable Documents Format (PDF) Q/A Solutions: 1. How do I save PDF forms to my computer? 2. Please wait screen 3. Browsers and 3rd party extensions fixes AT ANY TIME THE USER CAN SAVE
Control What You Include! Server- Side Protec7on against Third Party Web Tracking. Dolière Francis Somé, Nataliia Bielova, Tamara Rezk Privaski 2017
Control What You Include! Server- Side Protec7on against Third Party Web Tracking Dolière Francis Somé, Nataliia Bielova, Tamara Rezk Privaski 2017 thanks to eprivacy direc7ve 2009 bcc.co.uk emp.bcci.co.uk
CPD Online System Requirements and Browser Settings
CPD Online System Requirements and Browser Settings Browser & Operating System Compatibility Matrix IE 11.0 1 Edge 1 Firefox 51 Chrome 56 Safari 8.0.7 Safari 9.1.2 Safari 10.0 Supported Operating Systems
Machine Learning: A Promising Direction for Web Tracking Countermeasures
, Jonathan Mayer, Hristo Paskov and John C. Mitchell Stanford University Stanford Computer Security Lab Machine Learning: A Promising Direction for Web Tracking Countermeasures Motivation Consumers want
Browser Guide for PeopleSoft
Browser Guide for PeopleSoft Business Process Guide For Academic Support Specialists (Advisors) TABLE OF CONTENTS PURPOSE...2 INTERNET EXPLORER 7...3 GENERAL TAB...4 SECURITY TAB...6 PRIVACY TAB...10 CONTENT
Browser Based Defenses
Browser Based Defenses Introducing x06d james@bluenotch.com Browser Based Defenses - (c) 2010 All Rights Reserved 1 The Problem: Re-Anonymizing You! Overall State of the Web Client/Browser issues Hard
Publishing overview. HTML wrapper for AS3 documents
Publishing overview You can play content in the following ways: In Internet browsers that are equipped with Flash Player As a stand-alone application called a projector With the Flash ActiveX control in
User Authentication + Human Aspects
CSE 484 (Winter 2011) User Authentication + Human Aspects Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample
Robust Defenses for Cross-Site Request Forgery
University of Cyprus Department of Computer Science Advanced Security Topics Robust Defenses for Cross-Site Request Forgery Name: Elena Prodromou Instructor: Dr. Elias Athanasopoulos Authors: Adam Barth,
User Authentication. Daniel Halperin Tadayoshi Kohno
CSE 484 / CSE M 584 (Autumn 2011) User Authentication Daniel Halperin Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others
Symmetric Cryptography
CSE 484 (Winter 2010) Symmetric Cryptography Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials...
Trouble shooting. In case of any further queries / issues, please call our support team on the numbers provided below.
Trouble shooting In case of any further queries / issues, please call our support team on the numbers provided below. 040-66663050, 040-66668030 +91-9177305050, +91-9177205050, +91-9703158080 www.icharts.in
You Are Being Watched Analysis of JavaScript-Based Trackers
You Are Being Watched Analysis of JavaScript-Based Trackers Rohit Mehra IIIT-Delhi rohit1376@iiitd.ac.in Shobhita Saxena IIIT-Delhi shobhita1315@iiitd.ac.in Vaishali Garg IIIT-Delhi vaishali1318@iiitd.ac.in
EDGE, MICROSOFT S BROWSER
EDGE, MICROSOFT S BROWSER To launch Microsoft Edge, click the Microsoft Edge button (it s the solid blue E) on the Windows Taskbar. Edge Replaces Internet Explorer Internet Explorer is no longer the default
How Facebook knows exactly what turns you on
How Facebook knows exactly what turns you on We have developed our anti tracking system to combat a culture of user data collection which, we believe, has gone too far. These systems operate hidden from
FCSLA PRODUCER GATEWAY
FCSLA PRODUCER GATEWAY DETAILED SUPPORT FOR GOOGLE CHROME WEB BROWSERS Contents FCSLA PRODUCER GATEWAY... 2 FREE ACROBAT READER Download and Install... 3 CHROME Pop Ups Blocking our Illustration... 5 CHROME
Instructions for Configuring Your Browser Settings and Online Security FAQ s
Instructions for Configuring Your Browser Settings and Online Security FAQ s General Settings The following browser settings and plug-ins are required to properly access Digital Insight s webbased solutions.
Symmetric Cryptography
CSE 484 (Winter 2010) Symmetric Cryptography Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials...
Do Not Track. Nokia Browser Position. - Vikram Malaiya
Do Not Track Nokia Browser Position - Vikram Malaiya Copyright: Nokia Corporation, 2011 Our understanding of Do Not Track (DNT) DNT is a technology to enables users to opt out of third-party web tracking
Digital Ad Slate for XMP
Digital Ad Slate for XMP Ad-ID is the registration authority for advertising across all media in the United States. Only authorized users can create and read Ad-ID codes and associated metadata. To learn
Unit 4 The Web. Computer Concepts Unit Contents. 4 Web Overview. 4 Section A: Web Basics. 4 Evolution
Unit 4 The Web Computer Concepts 2016 ENHANCED EDITION 4 Unit Contents Section A: Web Basics Section B: Browsers Section C: HTML Section D: HTTP Section E: Search Engines 2 4 Section A: Web Basics 4 Web
CS Paul Krzyzanowski
Computer Security 17. Tor & Anonymous Connectivity Anonymous Connectivity Paul Krzyzanowski Rutgers University Spring 2018 1 2 Anonymity on the Internet Often considered bad Only criminals need to hide
Wednesday, 10 October 2012 PRELIMINARY SLIDES
PRELIMINARY SLIDES THIS WAY NO, it is not about horror stories concerning JavaScript WE ALL LOVE FEAR- MONGERING. Wednesday, 10 October 2012 starting with the credits... A Short History of the javascript
Comodo Dragon. User Guide Guide Version Software Version Comodo Security Solutions 525 Washington Blvd. Jersey City, NJ 07310
Comodo Dragon Software Version 20.0 User Guide Guide Version 20.0.070312 Comodo Security Solutions 525 Washington Blvd. Jersey City, NJ 07310 Table of Contents 1. Comodo Dragon - Introduction... 4 2. System
Website Report for test.com
NeatWidget contact@neatwidget.com.au neatwidget.com.au Website Report for test.com This report grades your website on the strength of a range of important factors such as on-page optimization, off-page
MyNursingLab Installation Checklist and Troubleshooting Guide
MyNursingLab Installation Checklist and Troubleshooting Guide Audience Overview This document is intended for users, computer lab administrators, field support personnel, and others responsible for installing
HTTP Protocol and Server-Side Basics
HTTP Protocol and Server-Side Basics Web Programming Uta Priss ZELL, Ostfalia University 2013 Web Programming HTTP Protocol and Server-Side Basics Slide 1/26 Outline The HTTP protocol Environment Variables
Eolas Technologies Incorporated v. Adobe Systems Incorporated et al Doc. 586 Att. 3. Exhibit L. Dockets.Justia.com
Eolas Technologies Incorporated v. Adobe Systems Incorporated et al Doc. 586 Att. 3 Exhibit L Dockets.Justia.com Claim Chart For Adobe Showing Indirect Infringement Of The 985 Patent Through pdf authoring
Five9 Virtual Contact Center Online Help and Browser Usage Guidelines
Cloud Contact Center Software Five9 Virtual Contact Center Online Help and Browser Usage Guidelines Five9 Virtual Contact Center Online Help Overview The Five9 Virtual Contact Center (VCC) Online Help
End User System Requirements. Marsh ClearSight, Marsh ClearSight Apps, Enterprise, Stars Discovery, and Stars Intake Release Version: 17.1.
End User System Requirements Marsh ClearSight, Marsh ClearSight Apps, Enterprise, Stars Discovery, and Stars Intake Release Version: 17.1.0 Contents Introduction... 4 End User Workstation Components...
CS Paul Krzyzanowski
Original Browser Static content on clients Servers were responsible for dynamic parts Computer Security 14. Web Security Security attacks were focused on servers Malformed URLs, buffer overflows, root
Computer Security. 14. Web Security. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 14. Web Security Paul Krzyzanowski Rutgers University Spring 2018 April 15, 2018 CS 419 2018 Paul Krzyzanowski 1 Original Browser Static content on clients Servers were responsible for
Firefox on Steroids? or Addons and Plugins and Themes, oh my!
Firefox on Steroids? or Addons and Plugins and Themes, oh my! Pat Murphy NRAO Webmaster (East) When you first use Firefox... You just get the basics: a web browser. But isn't that enough? Decide after
Authentication. Tadayoshi Kohno
CSE 484 / CSE M 584 (Winter 2013) Authentication Tadayoshi Kohno Thanks to Vitaly Shmatikov, Dan Boneh, Dieter Gollmann, Dan Halperin, John Manferdelli, John Mitchell, Bennet Yee, and many others for sample
Software Security (cont.): Defenses, Adv. Attacks, & More
CSE 484 / CSE M 584 (Autumn 2011) Software Security (cont.): Defenses, Adv. Attacks, & More Daniel Halperin Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly
1. LOGIN & CLASS PREPARATION
1. LOGIN & CLASS PREPARATION At the end of this topic, you should be able to: 1 Know the hardware requirements for accessing GOALS system. 2 Know how to log into GOALS system. 3 Updating personal profile.
Do Not Beg: Moving Beyond DNT through Privacy by Design
Do Not Beg: Moving Beyond DNT through Privacy by Design Mike Perry The Tor Project, Inc mikeperry@torproject.org Abstract The Do Not Track header (henceforth DNT:1) seeks to provide privacy protections
Web Security. Course: EPL 682 Name: Savvas Savva
Web Security Course: EPL 682 Name: Savvas Savva [1] A. Barth and C. Jackson and J. Mitchell, Robust Defenses for Cross-Site Request Forgery, pub. in 15th ACM Conference, 2008. [2] L. Huang and A. Moshchuk
Setting up to download Grants Group Application Forms
Setting up to download Grants Group Application Forms Guidance on setting up Adobe Reader Although it is in common use, we recognise that you may not use Adobe Reader as your preferred pdf reader but it
ecollege and VitalSource System and Hardware Specifications
ecollege and VitalSource System and Hardware Specifications As with any software, the faster the processor, the more RAM, and the larger hard drive space you provide, the better the performance. Users
AJAX: Rich Internet Applications
AJAX: Rich Internet Applications Web Programming Uta Priss ZELL, Ostfalia University 2013 Web Programming AJAX Slide 1/27 Outline Rich Internet Applications AJAX AJAX example Conclusion More AJAX Search