notes.lyx

#LyX 2.1 created this file. For more info see http://www.lyx.org/
\lyxformat 474
\begin_document
\begin_header
\textclass article
\begin_preamble
\usepackage{listing}
\end_preamble
\use_default_options true
\begin_modules
logicalmkup
\end_modules
\maintain_unincluded_children false
\language english
\language_package default
\inputencoding auto
\fontencoding global
\font_roman default
\font_sans default
\font_typewriter default
\font_math auto
\font_default_family default
\use_non_tex_fonts false
\font_sc false
\font_osf false
\font_sf_scale 100
\font_tt_scale 100
\graphics default
\default_output_format default
\output_sync 0
\bibtex_command bibtex
\index_command default
\paperfontsize default
\spacing single
\use_hyperref false
\papersize default
\use_geometry false
\use_package amsmath 1
\use_package amssymb 1
\use_package cancel 1
\use_package esint 1
\use_package mathdots 1
\use_package mathtools 1
\use_package mhchem 1
\use_package stackrel 1
\use_package stmaryrd 1
\use_package undertilde 1
\cite_engine basic
\cite_engine_type default
\biblio_style plain
\use_bibtopic false
\use_indices false
\paperorientation portrait
\suppress_date false
\justification true
\use_refstyle 1
\index Index
\shortcut idx
\color #008000
\end_index
\secnumdepth 3
\tocdepth 3
\paragraph_separation indent
\paragraph_indentation default
\quotes_language english
\papercolumns 1
\papersides 1
\paperpagestyle default
\tracking_changes false
\output_changes false
\html_math_output 0
\html_css_as_file 0
\html_be_strict false
\end_header

\begin_body

\begin_layout Title
Notes
\end_layout

\begin_layout Part
Interesting related work
\end_layout

\begin_layout Section
Tracking
\end_layout

\begin_layout Quote
The most common way to track web browsers (by 
\begin_inset Quotes eld
\end_inset

track
\begin_inset Quotes erd
\end_inset

 we mean associate the browser's activities at different times and with
 different websites) is via HTTP cookies, often set by with 3rd party analytics
 and advertising domains
\begin_inset CommandInset citation
LatexCommand cite
key "Krishnamurthy:2006:GPF:1177080.1177088"

\end_inset

.
\begin_inset CommandInset citation
LatexCommand cite
key "Eckersley2009unique"

\end_inset


\end_layout

\begin_layout Quote
Perhaps the most important security concept within modern browsers is the
 idea of the same-origin policy.
 The principal intent for this mechanism is to make it possible for largely
 unrestrained scripting and other interactions between pages served as a
 part of the same site (understood as having a particular DNS host name,
 or part thereof), whilst almost completely preventing any interference
 between unrelated sites.
\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "https://code.google.com/p/browsersec/wiki/Part2"

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Section
Data brokers
\end_layout

\begin_layout Quote
Private data brokers, which compile everything from our sex habits to our
 license plate license location, are a growing cause of concern.
\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "http://gigaom.com/2014/03/13/with-data-brokers-selling-lists-of-alcoholics-to-big-business-the-feds-have-some-thinking-to-do/"

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Quote
Some brokers categorize consumers as "Getting By," "Compulsive Online Gamblers"
 and "Zero Mobility" and advertise the lists as ideal leads for banks, credit-ca
rd issuers and payday and subprime lenders, according to a review of data
 brokers' websites.
 One company offers lists of "Underbanked Prime Prospects" broken down by
 race.
 Others include "Kaching! Let it Ride Compulsive Online Gamblers" and "Speedy
 Dinero," described as Hispanics in need of fast cash receptive to subprime
 credit offers.
\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "http://online.wsj.com/news/articles/SB10001424052702303874504579377164099831516"

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Section
Domain data
\end_layout

\begin_layout Quote

\emph on
AS Resource Allocations
\emph default
.
 NOTE: This data is generated by using the ISO 3166 economy code information
 provided in the allocation and assignment statistics reports as generated
 by the Regional Internet Registries.
 This code reflects the economy in which the entity to whom the allocation
 or assignment was made is located, but does not necessarily reflect the
 scope of use of deployment of the associated resource.
 Many Internet service networks have international components, and their
 numbering resources are often deployed across multiple economies.
 For this reason the report presented here does not accurately reflect the
 actual number resource distributions across these economies.
\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "http://online.wsj.com/news/articles/SB10001424052702303874504579377164099831516"

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Section
Dynamic script loading
\end_layout

\begin_layout Quote
Digital marketing made (much) easier.
 Want to focus on marketing instead of marketing technology? Google Tag
 Manager lets you add or update your website tags and mobile applications,
 easily and for free, whenever you want, without bugging the IT folks.
 
\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "http://www.google.com/tagmanager/"

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Section
CDN usage
\end_layout

\begin_layout Quote
Figure 14: Density of log2 of ratios for objects of Akamai customers requested
 from TUM and LMU.
\begin_inset CommandInset citation
LatexCommand cite
key "Feldmann:2004:MEI:1028788.1028833"

\end_inset


\end_layout

\begin_layout Section
External resources
\end_layout

\begin_layout Quote
Several popular Web sites have a significant component of extraneous material.
 This material includes advertisements, user-related data gathering mechanisms
 and flash animations.
 Such non-essential parts of the page sought by downloaders can be viewed
 as 
\emph on
extraneous
\emph default
 content from the perspective of the user and thus potentially undesirable.
 However, from the content owner's viewpoint, such material is integral
 for delivering content of interest to subsets of users.
\begin_inset CommandInset citation
LatexCommand cite
key "Krishnamurthy:2006:CMC:1135777.1135829"

\end_inset


\end_layout

\begin_layout Quote
Popular sites on the Web routinely include extraneous content.
 Part of the extraneous content may be small images or specific script routines
 used to detect subsequent click access.
 Even without registration many Web sites gather information about users
 via traditional mechanisms such as cookies, tracking navigation patterns
 via the 
\begin_inset Flex Code
status collapsed

\begin_layout Plain Layout
Referer
\end_layout

\end_inset

 HTTP header, or through third party sites such as DoubleClick.
\begin_inset CommandInset citation
LatexCommand cite
key "Krishnamurthy:2006:CMC:1135777.1135829"

\end_inset


\end_layout

\begin_layout Quote
The first issue is defining extraneous content: a subjective issue dependent
 on individual users or groups of users.
 There is a consensus on what 
\emph on
kinds
\emph default
 of content may generally be viewed as extraneous and this undesirable from
 the viewpoint of latency.
 Advertisements and resources that are placed on a user's site solely for
 the purpose of gathering user/specific data, i.e., content extraneous to
 the core content of the page, could be considered undesirable.
 Pop-up and pop-under windows are annoyances that modern browsers often
 suppress.
\begin_inset CommandInset citation
LatexCommand cite
key "Krishnamurthy:2006:CMC:1135777.1135829"

\end_inset


\end_layout

\begin_layout Quote
The midday results show a 57% reduction in the number of servers accessed
 when Adblock is enabled.
 There is a 27% reduction both in number of objects retrieved and number
 of bytes downloaded with Adblock enabled.
 The other timeframes show similar results for the recution in servers,
 objects and bytes.
\begin_inset CommandInset citation
LatexCommand cite
key "Krishnamurthy:2006:CMC:1135777.1135829"

\end_inset


\end_layout

\begin_layout Quote
The last column of Table 5 shows a how these differences translate into
 median download latency reductions.
 We see a 33% median reduction across the three time periods - consistent
 with both mean (27-37%) and 90th percentile (28-46%) figures (not shown
 in Table 5).
 The latency results are expected given the significant reduction in the
 number of servers contacted and the number of objects and bytes downloaded.
\begin_inset CommandInset citation
LatexCommand cite
key "Krishnamurthy:2006:CMC:1135777.1135829"

\end_inset


\end_layout

\begin_layout Part
Ideas
\end_layout

\begin_layout Section
Questions
\end_layout

\begin_layout Subsection
Already added in some form
\end_layout

\begin_layout Itemize
What kind of external resources are there?
\end_layout

\begin_layout Itemize
How to mark certain external resources as known trackers?
\end_layout

\begin_layout Itemize
How many external resources/trackers per type image/script/font/css/video/audio/
object per site/service?
\end_layout

\begin_layout Itemize
Is there a difference between government, commercial and personal sites
 and services?
\end_layout

\begin_layout Itemize
Which external resources are loaded from Sweden and abroad respectively?
\end_layout

\begin_layout Itemize
Which external resource has the biggest coverage?
\end_layout

\begin_layout Itemize
What data could potentially be collected, and subsequently inferred?
\end_layout

\begin_layout Itemize
To what extent can the average internet user's browsing habits be correlated
 across the most commonly visited webpages?
\end_layout

\begin_layout Itemize
Are you as tracked using secure HTTPS as insecure HTTP?
\end_layout

\begin_layout Itemize
How does this compare to historical data (if readily available from earlier
 .SE status checks) or other ccTLDs/newTLDs?
\end_layout

\begin_layout Subsection
New questions
\end_layout

\begin_layout Itemize
None
\end_layout

\begin_layout Section
Look at
\end_layout

\begin_layout Itemize
Bonnier, and the companies they own.
\end_layout

\begin_layout Itemize
Tidningsstatistik, running stats on the Swedish magazines and newspapers.
\end_layout

\begin_layout Itemize
KIA-index
\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "http://www.kiaindex.net/"

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Itemize
Alexa, to list the biggest sites in Sweden.
 There's also a related service, for Swedish sites only?
\end_layout

\begin_layout Itemize
Disconnect.me.
 It's supposed to be the current go-to browser privacy tool after Ghostery.
\end_layout

\begin_layout Itemize
Ghostery.
 Seems to have lost momentum with the tech crowd since it got bought by
 an advertisement company.
 
\begin_inset Quotes eld
\end_inset

We found Ghostery still leaks full name, city, zip code, gender, region,
 gender, age, DOB, IP Address and browser fingerprint.
\begin_inset Quotes erd
\end_inset


\begin_inset CommandInset citation
LatexCommand cite
key "Malandrino:2013:PAI:2517840.2517868"

\end_inset


\end_layout

\begin_layout Itemize
Server side tracking, or tracking values sent to the same domain and then
 proxied to external services.
\end_layout

\begin_layout Itemize
P3P policies, and if they are in use.
 Check HTTP response headers.
\end_layout

\begin_layout Itemize
Page speed statistics per category or country, for example from Google.
\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "http://analytics.blogspot.se/2012/04/global-site-speed-overview-how-fast-are.html"

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Itemize
Domains serving different content to browsers versus spiders/automated software.
\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "http://hasardbonus.se/"

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Itemize
The hidden perils of cookie syncing
\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "https://securehomes.esat.kuleuven.be/~gacar/persistent/the_web_never_forgets.pdf"

\end_inset


\end_layout

\end_inset


\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "https://freedom-to-tinker.com/blog/englehardt/the-hidden-perils-of-cookie-syncing/"

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Itemize
Third party by Mozilla
\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "https://wiki.mozilla.org/Thirdparty"

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Itemize
Versign's analysis of the .se TLD.
\end_layout

\begin_layout Itemize
Patrik's list of site titles to ignore.
\end_layout

\begin_layout Itemize

\emph on
The Tangled Web: A Guide to Securing Modern Web Applications
\emph default
 by Michał Zalewski
\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "https://en.wikipedia.org/wiki/Micha%C5%82_Zalewski"

\end_inset


\end_layout

\end_inset


\end_layout

\begin_layout Itemize
Toppdomänlagen, which affects .SE's work, and possibly the 
\emph on
.SE Health Status
\emph default
.
\end_layout

\begin_layout Itemize
Internet-Wide Scan Data Repository
\begin_inset Foot
status open

\begin_layout Plain Layout
\begin_inset CommandInset href
LatexCommand href
target "https://scans.io/"

\end_inset


\end_layout

\end_inset

 to upload data into?
\end_layout

\begin_layout Part
Who to talk to
\end_layout

\begin_layout Description
JN Scans the Swedish internet for malware daily.
 Now working at B.
\end_layout

\begin_layout Description
FH Domain name statistics, like number or characters, adwords etcetera.
 Also known as K.
\end_layout

\begin_layout Description
RL Developed one of the predecessors for web page downloading for .SE.
\end_layout

\begin_layout Standard
\begin_inset CommandInset bibtex
LatexCommand bibtex
bibfiles "../references/thesis"
options "bibtotoc,plain"

\end_inset


\end_layout

\end_body
\end_document