Tales of Favicons and Caches: Persistent Tracking in Modern Browsers

Abstract

Statement from the NDSS 2021 Program Committee: NDSS is devoted to ethical principles and encourages the research community to ensure its work protects the privacy, security, and safety of users and others involved. While the NDSS 2021 PC appreciated the technical contributions of this paper, it was the subject of a debate in our community regarding the responsible disclosure of vulnerabilities for the Firefox web browser. The PC examined and discussed the ethics concerns raised and the authors' response. Although no harm came to users, the authors' oversight could have made a non-vulnerable browser vulnerable to the attack proposed in the paper. The PC does not believe the authors acted in bad faith. Nevertheless, we decided to add this note as well as the authors' response (in an Appendix) to the paper because the NDSS PC takes both the ethics of responsible disclosure and fairness towards the authors seriously. It is the PC's view that researchers must not engage in disclosure practices that subject users to an appreciable risk of substantial harm. NDSS will work with other conferences to further improve the transparency of vulnerability disclosure to reduce such errors in the future.

Pool-Party: Exploiting Browser Resource Pools as Side-Channels for Web Tracking

“…Stateful-tracking also describes other ways websites can set and read identifiers, by using APIs and browser capabilities not intended for such purposes. Examples of such techniques include exploiting the browser HTTP cache, DNS cache or other ways of setting long term state (e.g., HSTS instructions [1], favicon caches [2], or, ironically, storage intended to prevent tracking [3]).…”

“…Distinct from browser fingerprinting, researchers have also found other ways of misusing browser features to construct unique user identifiers. Solomos et al [2] transformed the browser's "favicon" cache into a persistent tracking mechanism, Janc et al [3] showed that Safari's "Intelligent Tracking Prevention" 26 features could be abused to re-identify users, and Syverson and Traudt [1] showed how the browsers "HTTP Strict-Transport-Security" system could be re-purposed to construct and assign unique identifiers.…”

Residue-Free Computing

“…These modes prevent websites from accessing cookies stored in non-private mode, and it erases browsing history, search history, and cookies upon exit. However, private browsing modes have historically not removed all forensic traces [27,28]. Prior work has also shown that many users are unaware of private browsing modes, and many of those who are aware do not understand the actual privacy protections offered by these modes [13].…”

“…Subtle errors can lead to tracking. For example, Solomos et al recently showed that malicious websites could bypass incognito mode on all major browsers using favicons [27]. ResidueFree avoids such tracking by eliminating all persistent data.…”

“…In addition, ResidueFree did not preserve any files from Firefox or Chromium, including favicons where the supercookie attempts to persist between sessions. As Solomos et al [27] note, these favicon-based supercookies persisted past all major browsers' "private" or "incognito" modes. While these incognito modes are generally effective, they are vulnerable to novel persistent storage techniques like this one.…”