browser history

browser history

The Impact of Browser History on Privacy and Security

1. Introduction to Browser History

The history leaking information about page visits makes it possible for a malicious attacker to track a user. Furthermore, viewing behavior is not always intended to be known to others. Even with access controls on user computers, user history might be available to other users. Arrests have been made where browsing history is becoming increasingly important. For example, the Electronic Communications Privacy Act (US) allows a court order to access a subscriber’s internet services, such as browsing history, to their identity if law enforcement believes that person is planning serious harm. In the case of the USA Patriot Act, the FBI can subpoena an ISP’s business records, including subscriber browsing history and e-mail headers, or information of a specific user, with a law enforcement letter requiring nothing but the signature of various FBI officials with no initial court review.

Web browsers allow users to easily retrieve previously visited web pages via history mechanisms. Most browsers maintain a detailed browsing history, which can be used for personal information management needs and gain insights into user behavior. On the positive side, history can be analyzed for various user needs, such as bookmarking, web-page revisitation, or predicting the next page a user might visit. However, history mechanisms can negatively impact user privacy and security. Malicious websites can infer user intentions by determining the pages the user has previously visited.

2. Privacy Concerns and Risks

A number of technological, economic, and regulatory factors contribute to the increasing importance of controlling privacy exposures in web browsing. The browser’s design treats visits to web sites as first-party exchanges: the user willingly and with full knowledge passes through the intermediating browser on the way to the remote server. When users realize that something is amiss, it is difficult for them to discern either the parties involved or the details of recorded interactions. A healthy web ecosystem requires that users continue to trust, rather than fear or mistrust, the monopolistic and oligopolistic core web management companies in order for even more users to come online through these technologies. The resulting user affiliations help web site creators attract audiences, and enable various stakeholders to finance innovation and production work. The ease of manipulation makes web tracking information the closest proxy available to a user’s underlying interests and characteristics. Retailers value this information because the same user (or users like that same user) continuously express their preferences while benefiting from the increased convenience of a personal, customized presentation. The IP address link between a recorded web site visit allows the creation of an even more powerful user profile by adding in network-level exposures. Interaction with a wider array of legitimate web sites and traffic engineering proxies make much more volatile and unique browsing characteristics easier to create.

The large footprint left by today’s web browsers in recording piecewise observations of a user’s browsing activity enables countless scenarios for potential privacy risks. The broad concerns stem from the fact that recorded browsing data reveals a wealth of knowledge about previous web pages visited, the sequence of pages visited, and the intervals of time between visits. This data can reveal user interests, habits, preferences, political views, health information, and much additional information, which can then be used for behavioral tracking, behavioral targeting, and constructing user profiles without the user’s knowledge or consent.

3. Security Vulnerabilities

It was shown through a carefully constructed experiment that the list of pages a user visited with timestamps can be partially revealed by browsers by tracking the timing of fetches from the network. The attack described by the authors does not work for Firefox and Internet Explorer as they have a timing attack protection mechanism that normalizes image sizes and makes all network fetches identical in duration. However, the list of sizes of elements on the visited page can often uniquely identify visited pages and is unique across quite a few sites. This allows the user’s browsing history to be partially revealed. Since the attack uses image sizes, it works for all browsers. Data using other HTML tags (object, embed) can potentially be used to attack browsers that block normal images.

The behavioral profile of the user that can be extracted from the browser history (objects visited, time spent, clicks, and dwell time on objects) can provide information to the attacker. Furthermore, pages can redirect the user to another page via the location object or the malicious JavaScript code. Once executed, it can modify the document.location if the current browser history entry is not an object of the attacker’s choice. The attacker can control the attacker’s web server or use a method to profile the pages accessed by the victim. The user’s history can be exposed to an attacker through a combination of a timing attack, JavaScript, and an external server.

4. Best Practices for Managing Browser History

Efficient management of browser history for security organizations who have specific needs and concerns about their protection of web usage. Different needs result in different best practices or different defaults. Therefore, we recommend continued research in browser behaviors in response to detection of user agent tampering. Furthermore, we believe that there are additional browser settings or other settings that are suited to such web security-sensitive organizations. In particular, we wish to understand the risks in each level of end user control that might allow a less discerning user to delete evidence of specific actions or areas of malicious conduct. The negative privacy implications of using this browser version are counterbalanced by the privacy gains realized if a third-party or a criminal should take control of the targeted user’s LDAP-owned commercial box.

While the risk of data leakage through the browser is present, the good news is that some simple best practices can significantly improve the privacy and security of both organizations and their users. For organizations, using a policy enforcement tool can help protect sensitive and confidential data. There are browser settings that allow users to control retention of visited sites and cookie contents, and finally, an ad and tracker blocker can be useful for websites that are less than desirable. For governments or high targeted individuals, an extra tamper-proof browser can be warranted.

5. Future Trends and Technologies

Users who choose to architectively forget recently accessed remote sites of potential adversarial interest will not mitigate traceback vulnerabilities. Such deliberate undermining implicates measured approach proposals that can be expected to have minor impacts at most. They include voluntary enhanced radio location responses. The potential benefit of greatly reduced user behavior and non-usage creates avenues for business negotiation between privacy-concerned users and public content providers wisely disposing of finely detailed user usage details.

It is true that in principle, the end user could set their access points to forward all their traffic to a remote network security facility that uses any required security surveillance and then forwards the remainder to the access point of the user’s choice. This would largely isolate the user from the wireless infrastructure management and thus alleviate the concern about adversarial traceback, billing consequences, and privacy-concerned uses of tracked browser searches if the access points are trustworthy.

With the advent of wireless Internet and pervasive mobile devices, we believe that as long as the access to the wireless infrastructure demands a billing relationship, the openness of network management and browser history will be superfluous. The wireless infrastructure operators and the person responsible for managing the network facility will have a high motivation and well-entrenched mechanism to ascertain that the browser history of mobile stations is minimal or does not exist.

Most security techniques are based on the presence of a known and open set of threats. But currently, this opens the door for adversarial traceback attacks. The power and ease of using web services has influenced the user’s behavioral adherence to a tool and platform. Hence, a careful balance between security and privacy must be attained between the user and the system that ensures trust without eradicating the benefits of library harness and user convenience.