Consent-O-Matic: Automatically Answering Consent Pop-ups Using Adversarial Interoperability

In the modern web, users are confronted with a plethora of complex privacy-related decisions about cookies and consent, often com- pounded by misleading policies and deceptive patterns. Past efforts to enhance online privacy have failed due to their dependence on website compliance. A solution to this lies in privacy-enhancing tools that are directly controlled by the user. However, challenges related to the usability and flawed understanding of the tools’ func- tionality hinder their widespread adoption. To address this problem, we evaluated the browser extension CookieBlock as an example of a current tool, which supports users by blocking tracking cookies independent of website compliance. We used a complementary approach consisting of an expert eval- uation of CookieBlock and the related tools NoScript and Ghostery, and a laboratory user study focusing on the unique details of how users interact with CookieBlock specifically. The laboratory study with 42 participants investigated usage, mental models, and us- ability of CookieBlock based on eye tracking, interaction, and self- report data. While CookieBlock received good usability ratings, 18 participants were unable to solve a website breakage caused by cookie misclassification on their own. Overall, the results revealed flawed mental models of CookieBlock’s functionality and resulting challenges in making the connection between website breakage and cookie misclassification. Implications for CookieBlock and related applications include interface design recommendations supporting accurate mental models and the proposal of improved heuristics to better guide users and warn them about potential identified website breakage.

Section: Discussionmentioning

confidence: 99%

Section: Browser Extensionsmentioning

confidence: 99%

Block Cookies, Not Websites: Analysing Mental Models and Usability of the Privacy-Preserving Browser Extension CookieBlock

Schöni,

Kubicek,

Zimmermann

2024

“…Second, we were unable to gather data from some websites because the cookie banner would block any clicks or other interaction with the website until the banner has been filled in. This could be solved by making use of addons that automatically close cookie banners such as Consent-O-Matic [31]. Different service providers might request non-minimal scopes for legitimate purposes, depending on the application.…”

Section: Limitationsmentioning

confidence: 99%

Everybody's Looking for SSOmething: A large-scale evaluation on the privacy of OAuth authentication on the web

Dimova

Goethem

Joosen

2023

The management of many different login credentials can be tricky for the average web user. OAuth eases this process by invoking identity providers (IdPs) as intermediaries, which identify the users and access their data on behalf of the website, without sharing their credentials. However, the information that IdPs share with websites is not always limited to basic data. Our work observes and documents that IdPs make a variety of resources (scopes) available to be requested by websites, most of which are not necessary for user identification (e.g., location, interests). By performing a large-scale analysis on OAuth-based login on the web, we show that 18.53% of websites using OAuth request at least one non-minimal scope. Additionally, our findings show that at least part of the requested information is redundant since websites provide alternative login methods that require less information from the user. Moreover, through a manual analysis we observe that revoking access to these scopes seems not to hinder the functionality of the website. Finally, when comparing OAuth-based login with registering a new account, we find that OAuth is often the more privacy-friendly option in terms of the amount of personal data being shared with the website.

“…Different tools help users cope with cookie banners by automatizing the interaction process [4,24,33,34,39]. These tools are usually implemented as a browser extension and often use rule-based approaches to identify and interact with banners.…”

Section: Introductionmentioning

confidence: 99%

“…Previous studies have either analyzed the design of different banners [8,15,41,44] or have built new tools to interact with banners in a meaningful way [4,34]. While we build upon prior work by utilizing some of the presented tools in this work, we investigate an entirely different problem: The effectiveness of different tools that automatically interact with cookie banners.…”

Section: Introductionmentioning

confidence: 99%

A Large-Scale Study of Cookie Banner Interaction Tools and their Impact on Users' Privacy

Demir,

Urban,

Pohlmann

et al. 2024

Cookie notices (or cookie banners) are a popular mechanism for websites to provide (European) Internet users a tool to choose which cookies the site may set. Banner implementations range from merely providing information that a site uses cookies over offering the choice to accepting or denying all cookies to allowing fine-grained control of cookie usage. Users frequently get annoyed by the banner's pervasiveness as they interrupt ''natural'' browsing on the Web. As a remedy, different browser extensions have been developed to automate the interaction with cookie banners. In this work, we perform a large-scale measurement study comparing the effectiveness of extensions for ''cookie banner interaction.'' We configured the extensions to express different privacy choices (e.g., accepting all cookies, accepting functional cookies, or rejecting all cookies) to understand their capabilities to execute a user's preferences. The results show statistically significant differences in which cookies are set, how many of them are set, and which types are set---even for extensions that aim to implement the same cookie choice. Extensions for ''cookie banner interaction'' can effectively reduce the number of set cookies compared to no interaction with the banners. However, all extensions increase the tracking requests significantly except when rejecting all cookies.