-
Notifications
You must be signed in to change notification settings - Fork 11
/
index.html
185 lines (132 loc) · 13.4 KB
/
index.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
<!DOCTYPE html>
<html>
<head>
<title>Unsanctioned Web Tracking</title>
<meta charset='utf-8'>
<script src='https://www.w3.org/Tools/respec/respec-w3c-common'
async class='remove'></script>
<script class='remove'>
var respecConfig = {
specStatus: "finding",
shortName: "unsanctioned-tracking",
publishDate: "2015-07-17",
editors: [
{ name: "Mark Nottingham",
url: "https://www.mnot.net/",
}
],
otherLinks: [{
key: 'Participate',
data: [{
value: 'File a bug.',
href: 'https://github.com/w3ctag/unsanctioned-tracking/issues'
}, {
value: 'Commit history.',
href: 'https://github.com/w3ctag/unsanctioned-tracking/commits/gh-pages'
}, {
value: 'Mailing list.',
href: 'https://lists.w3.org/Archives/Public/www-tag/'
}]
}],
wg: "Technical Architecture Group",
wgURI: "https://www.w3.org/2001/tag/",
wgPublicList: "www-tag",
wgPatentURI: "https://www.w3.org/2001/tag/disclosures",
edDraftURI: "https://w3ctag.github.io/unsanctioned-tracking/",
noTOC: false,
localBiblio: {
"spy-sandbox": {
title: "The Spy in the Sandbox – Practical Cache Attacks in Javascript"
, href: "http://arxiv.org/pdf/1502.07373v2.pdf"
, authors: [
"Yossef Oren",
"Vasileios P. Kemerlis",
"Simha Sethumadhavan",
"Angelos D. Keromytis"
]
, publisher: "Computer Science Department, Columbia University"
},
"confinement": {
title: "A Note on the Confinement Problem"
, href: "http://research.microsoft.com/en-us/um/people/blampson/11-confinement/acrobat.pdf"
, authors: [
"Butler W. Lampson",
]
, publisher: "Xerox Palo Alto Research Center"
},
"udhr": {
title: "Universal Declaration of Human Rights"
, href: "http://www.un.org/en/documents/udhr/"
, publisher: "United Nations"
}
}
};
</script>
</head>
<body>
<section id="abstract">
<p>Tracking user activity on the Web using methods other than those defined for the purpose by the Web platform (“unsanctioned tracking”) is harmful to the Web, for a variety of reasons. This Finding details the TAG's stance on different forms of tracking, and how they should be addressed.</p>
</section>
<section id="sotd">
<p>This document has been produced by the <a href="https://www.w3.org/2001/tag/"><abbr title="World Wide Web Consortium">W3C</abbr> Technical
Architecture Group (TAG)</a>. The TAG approved this finding at its
<a href="https://github.com/w3ctag/meetings/blob/gh-pages/2015/07-ber/agenda.md">July 2015 F2F</a>.
Please send comments on this finding to the publicly archived TAG mailing list
<a href="mailto:[email protected]">[email protected]</a>
(<a href="https://lists.w3.org/Archives/Public/www-tag/">archive</a>).</p>
</section>
<section>
<h2>Tracking Your Activity on the Web</h2>
<p>When you use the Web, the sites you visit — including advertisements, analytics services, and other included content on them — use various tools to collect information about who you are and what you do on the site. This is very common on the Web; many sites that you browse will share what you do on them with several others — in some cases, dozens.</p>
<p>Collectively, tracking technologies form the basis of common Web features like shopping carts, persistent site preferences, and behavioral advertising, which allows many Web sites to fund themselves.</p>
<p>Some tracking mechanisms are defined by Web standards, and their design takes into account user needs for privacy and control over data flows. One of the best-known and most widespread is cookies [[RFC6265]]. More recently, other mechanisms such as [[webstorage]] have been standardized to complement cookies.</p>
<p>In particular, browsers provide explicit ways for you to limit when standards-defined tracking technologies are used, either directly or with extensions. For example, a privacy-conscious user can choose to use a cookie blocker, or manually delete cookies. As such, the standards-defined tracking technologies are effectively “opt out” — while they are on by default, you remain in control of them, as long as you accept that sites may not work as well (or at all) if you don't allow their use.</p>
<p>Standards-defined tracking mechanisms also have the benefit of transparency. Users can inspect cookies and other locally stored data and user agents can provide some notice to the user that data is stored by this site. Tools have been developed that enable those users specifically interested in awareness of the tracking of their online activity to document and visualize the use of cookies and tracking pixels; for example, <a href="https://www.mozilla.org/en-US/lightbeam/">Lightbeam</a>.</p>
<p>In practice, many end users do not themselves understand the details of the local storage mechanisms and their use for tracking. However, tracking based upon standards allows researchers, advocates and regulators to leverage their visibility and use tools to identify and evaluate the privacy-sensitive behavior of online tracking. This work is important input to making tools that can help users manage their privacy appropriately.</p>
</section>
<section>
<h2>Unsanctioned Tracking: Tracking without User Control</h2>
<p>However, sites also track user activity outside of these well-defined mechanisms:</p>
<ul>
<li><strong>Browser fingerprinting</strong> uses small variations in your Web browser implementation and configuration — as well as that of your computer itself — to uniquely identify it and correlate it with your activity.</li>
<li>So-called <strong>SuperCookies</strong> use implementation bugs, browser fingerprinting and other techniques to continue to identify you and correlate your activity even after you clear your cookies (e.g. “re-synchronizing” them).</li>
<li><strong>Header enrichment</strong> is performed by some network operators who add HTTP request headers that reveal their customers' identities to the Web sites they visit.</li>
</ul>
<p>Unlike standards-defined tracking, the operation of these unsanctioned techniques is not defined by Web standards, is not user-visible, and it is not under user control. If you use the same browser to visit two different sites, it is technically possible for the sites to identify your browser and correlate your behavior between them (and any other site that they work with). While there are a few legitimate uses of such methods (e.g., combatting Denial of Service attacks, or providing greater certainty about user identity for sites such as banks), unsanctioned tracking is often used for purposes that many consider malicious.</p>
<p>There is ample evidence that many sites already use such unsanctioned tracking methods. For more information, see resources like <a href="https://panopticlick.eff.org">Panopticlick</a>, <a href="http://samy.pl/evercookie/">Evercookie</a>, and <a href="http://dl.acm.org/citation.cfm?id=2516674">FPDetective</a>.</p>
</section>
<section>
<h2>Why Unsanctioned Tracking is Harmful</h2>
<p>Staying in control of personal data is important to many people, because data about a person — in particular their activity on the Web — can be used to understand how they think, work and live. Users expect that their browsing information will be kept relatively private. This trust, and users controlling their experience, is a fundamental part of how the Web works.</p>
<p>Recognizing the importance of this information in monetary terms, the World Economic Forum has <a href="http://www.weforum.org/reports/personal-data-emergence-new-asset-class">classified personal data as “a new asset class”</a> — with the implication that if you are unable to control your data, you are on the losing side of a forced transaction.</p>
<p>Furthermore, tracking users' activity without their consent or knowledge is also a blatant violation of the human right to privacy [[udhr]].</p>
<p>As a result, a growing body of legal, social and technical constraints have developed around the use of standards-based tracking technology on the Web. Because they are well-defined, it is possible to discuss and regulate their use, as well as build tools to understand, visualize and control them.</p>
<p>For example, the <a href="http://eucookiedirective.com/">EU Cookie Directive</a> regulates the use of cookies in that jurisdiction; browsers have cookie control interfaces and extensions; and researchers can plot how cookies are used on the Web.</p>
<p>Unsanctioned tracking, on the other hand, has little such affordance; it is difficult (and sometimes, impossible) to detect using purely technical means in the browser. It stems not from a well-defined specification, but instead from exploitation of certain aspects of how the Web works.</p>
<p>The aggregate effect of unsanctioned tracking is to undermine user trust in the Web itself. Moreover, if browsers cannot isolate activity between sites and offer users control over their data, they are unable to act as trusted agents for the user.</p>
<p>Notably, unsanctioned tracking can be harmful even if non-identifying data is shared, because it provides the linkage among disparate information streams across contextual boundaries. For example the sharing of an opaque fingerprint among a set of unrelated online purchases can provide enough information to enable advertisers to determine that user of that browser is pregnant — and hence to target her with pregnancy-specific advertisements even before she has disclosed her pregnancy.</p>
</section>
<section>
<h2>Limitations of Technical Solutions</h2>
<p>We have had numerous discussions throughout the Web community about limiting the the browser fingerprinting “surface area” that a browser exposes, by reducing the variability in how browsers behave. In those discussions, we have tried to consider the full span of characteristics about a user, their browser and their activities that may be tracked.</p>
<p>While reducing fingerprinting surface area may mitigate some kinds of unsanctioned tracking, it is inadequate to foil a determined adversary. The variety of documented techniques for browser fingerprinting, from enumerating the extensions installed in the browser to examining exactly how fonts are displayed on screens, continues to increase as new features are developed.</p>
<p>As an extreme example, it has now been shown possible [[spy-sandbox]] to “listen” to the CPU on a computer to detect mouse, network and other activity, using only some JavaScript in a Web page. This information can then be used in the machine fingerprint.</p>
<p>In this environment, it is impractical for specification design to eliminate fingerprinting; not only would such restriction severely hobble the capability of the Web, it would also break a substantial amount of existing content. Moreover, theory confirms that we cannot expect to eliminate these problems on a general-purpose system: From a theoretical perspective, eliminating browser fingerprinting is essentially the same problem as eliminating covert channels [[confinement]].</p>
<p>As a result, we cannot solve the issues that unsanctioned tracking raises through solely technical means. At times, they may be more appropriately addressed through policy (e.g., legislation and/or regulation).</p>
</section>
<section>
<h3>Findings</h3>
<p>Therefore, the TAG:</p>
<ul>
<li>Finds that unsanctioned tracking is actively harmful to the Web, because it is not under the control of users and not transparent.</li>
<li>Believes that, because combatting fingerprinting is difficult, new Web specifications should take reasonable measures to avoid adding unneeded fingerprinting surface area. However, added surface area should not be a primary factor in determining whether to add a new feature.</li>
<li>Asserts that when a new feature does add fingerprinting surface area, it should be documented as such.</li>
<li>Finds that new local storage features and other potential tracking mechanisms should maintain and interoperate with existing user controls.</li>
<li>Encourages browser vendors to expose appropriate controls to users who wish to minimize their fingerprinting surface area.</li>
<li>Acknowledges that despite best efforts, technical solutions to unsanctioned tracking are not able to completely prevent its use by a determined adversary. Instead, our focus should be on making sure that unsanctioned tracking does not become “normal” on the Web.</li>
<li>Encourages policy makers to be aware that unsanctioned tracking may introduce privacy, security and consumer protection concerns within their jurisdiction, and to consider appropriate action.</li>
</ul>
<p>The TAG is happy to provide guidance to community members who need specific advice regarding fingerprinting in their specifications.</p>
</section>
</body>
</html>