A QUIC Look at Web Tracking

Sy, Erik; Burkert, Christian; Federrath, Hannes; Fischer, Mathias

doi:10.2478/popets-2019-0046

Cited by 9 publications

(7 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A similar tracking mechanisms has been reported for the QUIC transport protocol [31]. However, QUIC's address validation tokens are distributed via an encrypted channel and do not allow a passive network observer to correlate different connections to the same user.…”

Section: Related Workmentioning

confidence: 77%

Enhanced Performance and Privacy for TLS over TCP Fast Open

Sy¹,

Müller²,

Burkert³

et al. 2019

Preprint

Self Cite

View full text Add to dashboard Cite

Small TCP flows make up the majority of web flows. For them, the TCP three-way handshake represents a significant delay overhead. The TCP Fast Open (TFO) protocol provides zero round-trip time (0-RTT) handshakes for subsequent TCP connections to the same host. In this paper, we present real-world privacy and performance limitations of TFO. We investigated its deployment on popular websites and browsers. We found that a client revisiting a web site for the first time fails to use an abbreviated TFO handshake about 40% of the time due to web server load-balancing. Our analysis further reveals significant privacy problems in the protocol design and implementation. Network-based attackers and online trackers can exploit these shortcomings to track the online activities of users. As a countermeasure, we introduce a novel protocol called TCP Fast Open Privacy (FOP). It overcomes the performance and privacy limitations of TLS over TFO by utilizing a custom TLS extension. TCP FOP prevents tracking by network attackers and impedes thirdparty tracking, while still allowing for 0-RTT handshakes as in TFO. As a proof-of-concept, we have implemented the proposed protocol. Our measurements indicate that TCP FOP outperforms TLS over TFO when websites are served from multiple IP addresses.

show abstract

Section: Related Workmentioning

confidence: 77%

Enhanced Performance and Privacy for TLS over TCP Fast Open

Sy¹,

Müller²,

Burkert³

et al. 2019

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…While research work on privacy issues within TCP that allows distinguishing clients or servers based on their TCP timestamps [17,22] exists, our reported storage-based tracking mechanism is unrelated to such tracking approaches via the TCP timestamps. A similar tracking mechanism has been reported for the QUIC transport protocol [30]. However, QUIC's address validation tokens are distributed via an encrypted channel and do not allow a passive network observer to link different connections to the same user.…”

Section: Related Workmentioning

confidence: 81%

Enhanced Performance and Privacy for TLS over TCP Fast Open

Mueller

Burkert

et al. 2020

Proceedings on Privacy Enhancing Technologies

Self Cite

View full text Add to dashboard Cite

Small TCP flows make up the majority of web flows. For them, the TCP three-way handshake induces significant delay overhead. The TCP Fast Open (TFO) protocol can significantly decrease this delay via zero round-trip time (0-RTT) handshakes for all TCP handshakes that follow a full initial handshake to the same host. However, this comes at the cost of privacy limitations and also has some performance limitations. In this paper, we investigate the TFP deployment on popular websites and browsers. We found that a client revisiting a web site for the first time fails to use an abbreviated TFO handshake in 40% of all cases due to web server load-balancing using multiple IP addresses. Our analysis further reveals significant privacy problems of the protocol design and implementation. Network-based attackers and online trackers can exploit TFO to track the online activities of users. As a countermeasure, we introduce a novel protocol called TCP Fast Open Privacy (FOP). TCP FOP prevents tracking by network attackers and impedes third-party tracking, while still allowing 0-RTT handshakes as in TFO. As a proof-of-concept, we have implemented the proposed protocol for the Linux kernel and a TLS library. Our measurements indicate that TCP FOP outperforms TLS over TFO when websites are served from multiple IP addresses.

show abstract

“…( 2018 ), the researchers show that QUIC accounted for 2.6–9.1% of the traffic in the internet in 2017, with Google using QUIC for 42.1% of its traffic, and Sy et al. ( 2019 ) mention that approximately 7% of global internet traffic in 2018 was QUIC. In Sy et al.…”

Section: Passive Identificationmentioning

confidence: 99%

Study of methods for endpoint aware inspection in a next generation firewall

2022

View full text Add to dashboard Cite

Given the global increase in remote work with the COVID-19 pandemic and deperimeterization due to cloud deployment of next generation firewalls, the concept of a next generation firewall is at a breaking point. It is becoming more difficult to define the barrier between the good and the bad. To provide the best security for an endpoint with minimal false positives or false negatives it is often necessary to identify the communicating endpoint application. In this study, we present an analysis of key research and methods for providing endpoint aware protection in the context of a next generation firewall. We examine both academic research as well as state-of-the-art of the existing next generation firewall implementations. We divide endpoint application identification into passive and active methods. For passive endpoint application identification, we study several traffic fingerprinting methods for different protocols. For active methods we consider active scanning, endpoint metadata analysis and content injection and reference existing implementations. We conclude that there are several open areas for future research, and that none of the considered methods is a silver bullet solution for endpoint aware inspection in the context of a next generation firewall. To our best knowledge, this is the first study to examine current research and existing implementations of endpoint aware inspection.

show abstract

A QUIC Look at Web Tracking

Cited by 9 publications

References 19 publications

Enhanced Performance and Privacy for TLS over TCP Fast Open

Enhanced Performance and Privacy for TLS over TCP Fast Open

Enhanced Performance and Privacy for TLS over TCP Fast Open

Study of methods for endpoint aware inspection in a next generation firewall

Contact Info

Product

Resources

About