Who Left Open the Cookie Jar?
summary
A black-box framework uses Selenium, a controllable web server and a proxy to run comprehensive tests and a distributed crawler over the Alexa top 10k (160k pages) to find concrete bypasses. Tests cover all cross-site mechanisms (PDFs, redirects, prerender, JS, favicons) and evaluate 7 browsers and 46 extensions. Results show many built-in policies and every extension fail in practice: PDF and extension-API blindspots and a pre-render bypass let same-site and third-party cookie protections be circumvented.
AI-written summary · about
chapters (5)
related talks
27mWho Left Open the Cookie Jar? A Comprehensive Evaluation of Third-Party Cookie Policies
45mThe evil friend in your browser
35mServer-Side Browsers: Exploring the Web’s Hidden Attack Surface
21mDeath to Cookies
55mCall To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering
28mCookie Crumbles: Unveiling Web Session Integrity Vulnerabilities
49mBeyond Cookies: The Unseen Privacy Risks of Web Analytics
40mClient-Side Protection Against DOM-Base...