DocumentCode :
29646
Title :
Measuring Privacy Disclosures in URL Query Strings
Author :
West, Andrew G. ; Aviv, Adam J.
Volume :
18
Issue :
6
fYear :
2014
fDate :
Nov.-Dec. 2014
Firstpage :
52
Lastpage :
59
Abstract :
Publicly posted URLs sometimes contain a wealth of information about the identities and activities of the users who share them. URLs often utilize query strings -- that is, key-value pairs appended to the URL path -- to pass session parameters and form data. Although often benign and necessary to render the Web page, query strings sometimes contain tracking mechanisms, usernames, email addresses, and other information that users might not wish to publicly reveal. In isolation, this isn\´t particularly problematic, but the growth of Web 2.0 platforms such as social networks and microblogging means URLs, which are often copied and pasted from Web browsers, are increasingly publicly broadcast. To study URL sharing\´s privacy ramifications, the authors ran a measurement study that looked at 892 million user-submitted URLs, many disseminated in semipublic forums. That corpus contained a trove of personal information, including 1.7 million email addresses. In the most egregious examples, query strings contain plaintext usernames and passwords for administrative and sensitive accounts. The authors identify data leakage via both key-driven and value-driven analysis using manual inspections and automatic detection logic. Additionally, they analyze the click-through rates of sensitive URLs, examine geographical and mobile behavior patterns, and measure the broader statistical properties of key-value pairs. Finally, they propose a CleanURL service that can "scrub"\´ URLs of privacy-violating content.
Keywords :
Internet; data privacy; information dissemination; query processing; security of data; CleanURL service; URL query strings; Web 2.0 platforms; information dissemination; privacy disclosures; privacy-violating content; Computer security; Electronic mail; Entropy; Internet; Mobile communication; Mobile handsets; Privacy; Query processing; Uniform resource locators; Internet computing; Internet security; URL privacy; URL sanitization; URL security; query string tracking;
fLanguage :
English
Journal_Title :
Internet Computing, IEEE
Publisher :
ieee
ISSN :
1089-7801
Type :
jour
DOI :
10.1109/MIC.2014.104
Filename :
6879052
Link To Document :
بازگشت