Program analysis and quantitative techniques against Web Tracking

Web Tracking is an important problem in today's web applications. It is used to track the user's behaviour on the Web, and build rich user profiles. In today's web applications, tracking is implemented by a number of web technologies, including cookie management and browser fingerprinting. We start this presentation by explaining the basics of web tracking and focus on a technique that distinguish the users by their browser characteristics.

We then show that this web tracking technique is realised by the means of JavaScript programs. We show that program analysis is a viable technique for evaluating how much identifying information a web tracker collects about the user. We present standard program analysis techniques that ensure the absence of flow of secret (identifying) information in programs, and explain another approach that allows for quantification of information leakage. We also establish the guarantees that such analysis should satisfy, such as, (1) finding all the actual information leaks, and (2) giving as few false positives as possible.