A Survey on Web Tracking: Mechanisms, Implications, and Defenses

Abstract

Abstract-Privacy seems to be the Achilles' heel of today's web. Most web services make continuous efforts to track their users and to obtain as much personal information as they can from the things they search, the sites they visit, the people they contact, and the products they buy. This information is mostly used for commercial purposes, which go far beyond targeted advertising. Although many users are already aware of the privacy risks involved in the use of Internet services, the particular methods and technologies used for tracking them are much less known. In this survey, we review the existing literature on the methods used by web services to track the users online as well as their purposes, implications, and possible user's defenses. We present 5 main groups of methods used for user tracking, which are based on sessions, client storage, client cache, fingerprinting, and other approaches. A special focus is placed on mechanisms that use web caches, operational caches, and fingerprinting, as they are usually very rich in terms of using various creative methodologies. We also show how the users can be identified on the web and associated with their real names, e-mail addresses, phone numbers, or even street addresses. We show why tracking is being used and its possible implications for the users. For each of the tracking methods, we present possible defenses. Some of them are specific to a particular tracking approach, while others are more universal (block more than one threat). Finally, we present the future trends in user tracking and show that they can potentially pose significant threats to the users' privacy.

HTTPS traffic analysis and client identification using passive SSL/TLS fingerprinting

“…The client identification and browser fingerprinting contribute largely to network security and detection of malicious activities, e.g., by outdated system identification or unusual behavior detection. Identification and fingerprinting are moreover useful for commercial purposes (targeting ads, price discrimination, assessing financial credibility), network accounting, and client behavior monitoring [3].…”

“…A survey of web tracking and its mechanisms was proposed by Bujlow et al [3]. The authors placed a special focus on fingerprinting as it is rich in various methods.…”

“…Bujlow et al [3] surveyed defense strategies against currently known tracking mechanisms, e.g., browser fingerprinting. We are not aware of any method which would prevent SSL/TLS fingerprinting apart from using a proxy or manually changing the cipher suite list.…”

Secure and efficient protection for HTTP cookies with self‐verification

“…Therefore, a tailor-made cryptosystem for web cookies should be developed. [13][14][15][16] In 2017, Bujlow, Carela-Español, Solé-Pareta, and Barlet-Ros conducted a survey on web tracking using cookies. 12 Many studies have been conducted on web security.…”

“…12 Many studies have been conducted on web security. [13][14][15][16] In 2017, Bujlow, Carela-Español, Solé-Pareta, and Barlet-Ros conducted a survey on web tracking using cookies. 14 In 2016, Sivakorn, Polakis, and Keromytis analyzed the functionality and information that are exposed to attackers who hijack users' cookies 17 .…”