While privacy-focused browsers have taken steps to block third-party cookies
and mitigate browser fingerprinting, novel tracking techniques that can bypass
existing countermeasures continue to emerge. Since trackers need to share
information from the client-side to the server-side through link decoration
regardless of the tracking technique they employ, a promising orthogonal
approach is to detect and sanitize tracking information in decorated links. To
this end, we present PURL (pronounced purel-l), a machine-learning approach
that leverages a cross-layer graph representation of webpage execution to
safely and effectively sanitize link decoration. Our evaluation shows that PURL
significantly outperforms existing countermeasures in terms of accuracy and
reducing website breakage while being robust to common evasion techniques.
PURL's deployment on a sample of top-million websites shows that link
decoration is abused for tracking on nearly three-quarters of the websites,
often to share cookies, email addresses, and fingerprinting information.
外部データセット
20K sample of top-million sites
参考文献
Proc. Priv. Enhancing Technol.
No boundaries: data exfiltration by third parties embedded on web pages
