I Block You Because I Love You: Social Account Identification Attack Against a Website Visitor
summary
A practical side-channel attack is demonstrated that reveals which social web service account belongs to a visitor of an attacker-controlled website. The method exploits how social service user pages and profiles leak identifying information (name and activities) to correlate a visitor with their social account using web-based side channels and measurements.
AI-written summary · about
chapters (5)
- 0:00Introduction
- 13:06Blocking reveals behavior
- 23:37Non-blocking risks
- 37:01Attack implications
- 39:07Q&A
related talks
48mI'm Unique, Just Like You: Human Side-Channels and Their Implications for Security and Privacy
24mSide-Channel Attacks on Everyday Applications
25mTesting Your Organization's Social Media Awareness
29mBecoming You: A Glimpse Into Credential Abuse
49mApp Arch: Login API Security — is that you attacking my system?
49mBeyond Takeover: Attacker’s in. Now what?
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research
22mO Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-On