Standard Classification: Everything You Always Wanted to Know About Finge...
summary
Claims that extensions leak identity via three concrete vectors: web-accessible resources, DOM side effects and a new CSS-based extension fingerprinting technique. Implements an automated DOM-diffing tool and a large-scale scan (≈116,000 extensions) and reports numbers: ~6,000 inject stylesheets, ~86% make at least one unique change, ~10% detectable on arbitrary URLs (16% on popular sites) and 1,074 newly detectable by the CSS trick. Prototype runs fast (≈15 ms for 20 extensions). Proposes access-control and decoy-CSS defenses.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:13Browser Extensions
- 2:24Browser Fingerprinting
- 5:16App Blocking
- 5:53Implications
- 7:48Anonymization
- 9:10Fingerprinting
- 12:36Attack
- 13:57Side Effects
- 16:04Lastpass
- 17:35Experiment Results
- 18:48Unique Changes
- 19:41Fingerprinting Types
- 20:36The Middle Way
- 21:31Example Extension
- 22:58Injected CSS
- 24:20Results
- 26:58Defenses
- 28:37Conclusion
related talks
25mExtension Breakdown...
42mPrivacy Toolkit: Privacy Awareness In The Digital Age
24mTales From the Trenches: Fingerprints on the Web
45mThe evil friend in your browser
21mFp-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies
40mAn Analysis of the Fingerprinting-Scripts and their Actors on the Internet
14mBrowser Fingerprinting: Stalking With a Personal Touch
38mDoubleX: Statically Detecting Vulnerable Data Flows in Browser ...