Blocking JavaScript without Breaking the Web: An Empirical Investigation

Abstract

Modern websites heavily rely on JavaScript (JS) to implement legitimate functionality as well as privacy-invasive advertising and tracking. Browser extensions such as NoScript block any script not loaded by a trusted list of endpoints, thus hoping to block privacy-invasive scripts while avoiding breaking legitimate website functionality. In this paper, we investigate whether blocking JS on the web is feasible without breaking legitimate functionality. To this end, we conduct a large-scale measurement study of JS blocking on 100K websites. We evaluate the effectiveness of different JS blocking strategies in tracking prevention and functionality breakage. Our evaluation relies on quantitative analysis of network requests, and resource loads as well as manual qualitative analysis of visual breakage. First, we show that while blocking all scripts is quite effective at reducing tracking, it significantly degrades functionality on approximately two-thirds of the tested websites. Second, we show that selective blocking of a subset of scripts based on a curated list achieves a better tradeoff. However, there remain approximately 15% "mixed" scripts, which essentially merge tracking and legitimate functionality and thus cannot be blocked without causing website breakage. Finally, we show that fine-grained blocking of a subset of JS methods, instead of scripts, reduces major breakage by 3.7× while providing the same level of tracking prevention. Our work highlights the promise and open challenges in fine-grained JS blocking for tracking prevention without breaking the web.

FP-Fed: Privacy-Preserving Federated Detection of Browser Fingerprinting

“…While browser fingerprinting can be used for acceptable purposes, e.g., web authentication [8,49], bot [18,33,85] or fraud detection [38,53], it largely represents a threat to user privacy [19,31,78,81]. In fact, it can be even more intrusive than third-party cookies: the latter are easily detectable and can be cleared at any time, whereas browser fingerprinting is less transparent, and countermeasures often result in significant website breakage [10,39]. Moreover, it can be effective even in incognito mode [7] and potentially track users for months [70].…”