Browser Tracking Protections - SuperWeek 2020

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Browsers Eat Data Quality
For BREAKFAST
@SimoAhava from @8_bit_sheep at #SPWK

Browser
Tracking
Prevention

www.CookieStatus.com

Quick quiz

https://blog.superweek.hu/welcome.html
SOURCE TARGET
https://shop.superweek.hu/image.jpg
HTTP request includes cookies wri...

https://blog.superweek.hu/welcome.html
SOURCE TARGET
https://shop.superweek.hu/image.jpg
Is this an example of 3RD PARTY R...

Cross-site tracking

Graphic adapted from https://web.dev/samesite-cookies-explained/
https://www.simoahava.com/

Graphic adapted from https://web.dev/samesite-cookies-explained/
Same-site === First-party context
https://www.simoahava.c...

Graphic adapted from https://web.dev/samesite-cookies-explained/
https://image.cdn.com/image.gif
https://www.simoahava.com/

Graphic adapted from https://web.dev/samesite-cookies-explained/
Cross-site === Third-party context
https://image.cdn.com/...

Graphic adapted from https://web.dev/samesite-cookies-explained/
https://page.somedomain.com/
https://page.otherdomain.com...

Some popular exploits

Leverage other script-writable storage.

Decorate outbound links with identifiers.

Decorate referring URL with identifiers.

Stateless tracking with fingerprints.

Third-party-to-first-party collusion, e.g. with CNAME.

Browsers take the initiative

2003
Defaultcookie
policy
blocks
3P
cookies
w
ithoutprior"seeding"

2003
Defaultcookie
policy
blocks
3P
cookies
w
ithoutprior"seeding"
2013
Partitioned
and
ephem
eral3P
H
TM
L5
storage

2003
Defaultcookie
policy
blocks
3P
cookies
w
ithoutprior"seeding"
ITP
1-Algorithm
ic
classification,3P
cookies
partitione...

2003
Defaultcookie
policy
blocks
3P
cookies
w
ithoutprior"seeding"
ITP
1-Algorithm
ic
classification,3P
cookies
partitione...

2003
Defaultcookie
policy
blocks
3P
cookies
w
ithoutprior"seeding"
ITP
1-Algorithm
ic
classification,3P
cookies
partitione...

2003
Defaultcookie
policy
blocks
3P
cookies
w
ithoutprior"seeding"
ITP
1-Algorithm
ic
classification,3P
cookies
partitione...

2003
Defaultcookie
policy
blocks
3P
cookies
w
ithoutprior"seeding"
ITP
1-Algorithm
ic
classification,3P
cookies
partitione...

9/2019
ITP
2.3
-Allscript-w
ritable
storage
gets
lim
ited
lifetim
e,
docum
ent.referrerfrom
classified
dom
ain
stripped
to...

9/2019
ITP
2.3
-Allscript-w
ritable
storage
gets
lim
ited
lifetim
e,
docum
ent.referrerfrom
classified
dom
ain
stripped
to...

ETP
introduced
-3P
tracking
cookies
blocked
ifactivated
10/2018
9/20192003 9/2017 3/2018 9/20182013 3/2019 4/2019 12/2019

ETP
introduced
-3P
tracking
cookies
blocked
ifactivated
ETP
m
odes
introduced
-Standard
is
the
default
10/2018
1/2019
9/20...

ETP
introduced
-3P
tracking
cookies
blocked
ifactivated
ETP
m
odes
introduced
-Standard
is
the
default
ETP
released
-Stand...

ETP
introduced
-3P
tracking
cookies
blocked
ifactivated
ETP
m
odes
introduced
-Standard
is
the
default
ETP
released
-Stand...

10/2018
1/2019
6/2019
Brave
Shields
released
9/20192003 9/2017 3/2018 9/20182013 3/2019 4/2019 12/2019

10/2018
1/2019
6/2019
Brave
Shields
released
Restrictions
to
fingerprinting
9/20192003 9/2017 3/2018 9/20182013 3/2019 4/2...

10/2018
1/2019
6/2019
Brave
Shields
released
Restrictions
to
fingerprinting
Im
proved
ad
blockeralgorithm
9/20192003 9/201...

10/2018
1/2019
6/2019
Brave
Shields
released
Restrictions
to
fingerprinting
Rem
ove
know
n
tracking
param
eters
from
U
RLs...

10/2018
1/2019
6/2019
Tracking
prevention
(Edge
beta)blocks
cookies
from
know
n
trackers
9/20192003 9/2017 3/2018 9/201820...

10/2018
1/2019
6/2019
Tracking
prevention
(Edge
beta)blocks
cookies
from
know
n
trackers
(Edge
beta)adds
additionalm
itiga...

10/2018
1/2019
6/2019
Tracking
prevention
(Edge
beta)blocks
cookies
from
know
n
trackers
(Edge
beta)adds
additionalm
itiga...

10/2018
1/2019
6/2019
1/2020
Cliqz
introduces
its
ow
n
ad
blocking
tech
11/2019
9/20192003 9/2017 3/2018 9/20182013 3/2019...

11/201910/2018
1/2019
6/2019
1/2020
Sam
eSite
enforcem
ent*
* not a tracking protection mechanism
2/20209/20192003 9/2017 ...

11/201910/2018
1/2019
6/2019
1/2020 2/2020
Sam
eSite
enforcem
ent
2022
N
o
m
ore
3P
cks
9/20192003 9/2017 3/2018 9/2018201...

11/201910/2018
1/2019
6/2019
1/2020 2/2020 2022
GDPR enforceable
Collection #1 breach
773M unique emails
verifications.io ...

GDPR enforceable
Collection #1 breach
773M unique emails
verifications.io breach
763M unique emails
People Data Labs breac...

Impact

Build graphs and comprehensive audience profiles

Build graphs and comprehensive audience profiles
Target ads

Target ads
Manage ad frequency
Build graphs and comprehensive audience profiles

View-through attribution
Manage ad frequency
Build graphs and comprehensive audience profiles
Target ads

Manage ad frequency
Build graphs and comprehensive audience profiles
Cookie matching/syncing
View-through attribution
Targ...

Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-thro...

Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-thro...

Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-thro...

Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-thro...

Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-thro...

Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-thro...

Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-thro...

Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-thro...

Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-thro...

Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-thro...

Manage ad frequency
Build graphs and comprehensive audience profiles
Cross-site tracking
Cookie matching/syncing
View-thro...

Classification of "known trackers"
Algorithmic, on-device Heuristic, global

3rd party context

Block Restrict
Brave
3rd party context
Strips all cookies from 3P
requests.
Blocks all requests to
domains in filter lists...

Block Restrict
Brave
3rd party context
Cookies, requests, referrers Referrers, request URLs
Chrome - -
Cliqz

Block Restrict
Brave
3rd party context
Cookies, requests, referrers Referrers
Chrome - -
Blocks cookies in 3P
context if t...

Block Restrict
Brave
3rd party context
Cookies, requests, referrers Referrers, request URLs
Chrome - -
Cliqz Cookies Cooki...

Block Restrict
Brave
3rd party context
Cookies, requests, referrers Referrers
Chrome - -
Cliqz Cookies Cookies, request UR...

Block Restrict
Brave
3rd party context
Cookies, requests, referrers Referrers, request URLs
Chrome - -
Cliqz Cookies
Edge
...

Block Restrict
Brave
3rd party context
Cookies, requests, referrers Referrers
Chrome - -
Cliqz Cookies Cookies, request UR...

Block Restrict
Brave
3rd party context
Cookies, requests, referrers Referrers, request URLs
Chrome - -
Cliqz Cookies
Edge ...

Block Restrict
Brave
3rd party context
Cookies, requests, referrers Referrers, request URLs
Chrome - -
Cliqz Cookies Cooki...

Block Restrict
Brave
3rd party context
Cookies, requests, referrers Referrers, request URLs
Chrome - -
Cliqz Cookies
Edge ...

1st party context

Block Restrict
Brave
1st party context
Cookies set with JavaScript
expire in 7 days.
Cookies set with HTTP headers
expire ...

Block Restrict
Brave
1st party context
- Cookies
Chrome - -
Cliqz

Block Restrict
Brave
1st party context
Cookies, requests, referrers Referrers
Chrome - -
Non-HttpOnly cookies expire
in 7 ...

Block Restrict
Brave
1st party context
- Cookies
Chrome - -
Cliqz - Cookies
Edge - -
Firefox - -
Safari

Block Restrict
Brave
1st party context
Cookies, requests, referrers Referrers, request URLs
Chrome - -
Cliqz Cookies Cooki...

Block Restrict
Brave
1st party context
- Cookies
Chrome - -
Cliqz - Cookies
Edge - -
Firefox - -
Safari - Cookies, storage

Bubbling under

Brave Chrome Cliqz Edge Firefox Safari
Cookies set to SameSite=Lax by default.
Reject SameSite=None cookies that are not s...

Brave Chrome Cliqz Edge Firefox Safari
Default referrer policy strict-origin-when-cross-origin.
Chrome 80, Feb 4!
! !!

Cap lifetime of all script-writable storage.
Brave Chrome Cliqz Edge Firefox Safari
Technology Preview 99

Brave Chrome Cliqz Edge Firefox Safari
Technology Preview 99
Block all cookies in 3P context - access only through Storage...

Brave Chrome Cliqz Edge Firefox Safari
Technology Preview 99
The isLoggedIn API (experimental).

Brave Chrome Cliqz Edge Firefox Safari
Private Click Measurement / Ad Click Attribution.

DO’s and DON’Ts

DO
-Periodically audit the use of client-side state in your sites, services, and applications. Avoid
over-reliance; use Ht...

DO NOT
-Look at "server-side analytics" as a silver bullet.
-Ignore small market share web browsers.
-Expect tracking prev...

Follow and participate

@BrendanEich
@EricLaw
@JohnWilander
@JustinSchuh
@Log3OverLog2
@pes10k
@RandomnessnCats
@SimoAhava
@TheZEdwards
bit.ly/pri...

log(`Thank you, ${yourName}`)

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1012946 views
Storytelling For The Web: Integrate... by Chiara Aliotta 921259 views
Artificial Intelligence, Data and C... by OECD Directorate ... 824586 views
How to Leverage AI to Boost Employe... by SocialHRCamp 344056 views
2024 State of Marketing Report – by... by Marius Sescu 196216 views
Everything You Need To Know About C... by Expeed Software 219258 views

View on Slideshare

1 of 94 Ad

View on Slideshare

1 of 94 Ad