Add text for web cache tracking

chapters/methods.tex

@@ -637,12 +637,67 @@ section~\ref{sec:storage-based tracking methods}) exploit storage interfaces
 that are meant for persisting data to disk, caches store data that has been
 generated by an operation and can be served faster on subsequent requests.
 
-This section is divided into 
+A variety of caches exist and they are utilized for different purposes, leading
+to different forms of information exploitability for tracking users. This
+section introduces methods which are in most cases not prevalent but are more
+sophisticated and can thus be much harder to circumvent or block.
+\todo{Insert structure}
+
+\subsection{Web Cache}
+\label{subsec:web cache}
+
+Using the \gls{DOM} \gls{API}'s \texttt{Window.getComputedStyle()} method,
+websites were able to check a user's browsing history by utilizing the \gls{CSS}
+\texttt{:visited} selector. Links can be coloured depending on whether they have
+already been visited or not. The colours can be set by the website trying to
+find out what the user's browsing history is. JavaScript would then be used to
+generate links on the fly for websites that will be cross-checked with the
+contents of the browsing history. After generating links, a script can check the
+colour, compare it with the colour that has been set for visited and non-visited
+websites and see if a website has already been visited or not.
+
+A solution to the problem has been proposed and subsequently implemented by
+\citeauthor{baronPreventingAttacksUser2010}
+\cite{baronPreventingAttacksUser2010} in 2010, making
+\texttt{getComputedStyle()} and similar functions lie about the state of the
+visited links and marking them as unvisited. Another solution has been developed
+by \citeauthor{jacksonProtectingBrowserState2006}
+\cite{jacksonProtectingBrowserState2006} in form of a browser extension that
+enforces the same-origin policy for browser histories as well. Although their
+approach limits access to a user's browsing history by third parties, first
+parties are unencumbered by the same-origin policy. Their browser extension
+does, however, thwart the attack carried out by
+\citeauthor{jancWebBrowserHistory2010} in \cite{jancWebBrowserHistory2010} where
+the authors were able to check for up to 30.000 links per second.
+
+\citeauthor{wondracekPracticalAttackDeanonymize2010}
+\cite{wondracekPracticalAttackDeanonymize2010} demonstrate the severity of
+history stealing attacks (e.g. visited link differentiation) on user privacy by
+probing for \glspl{URL} that encode user information such as group membership in
+social networks. By constructing a set of group memberships for each user, the
+results can uniquely identify a person. Furthermore, information that is not yet
+attributed to a single user but to a group as a whole can be used to more
+accurately identify members of said group.
+
+Other ways of utilizing a web browser's cache to track users are tracking
+whether a website asset (e.g., an image or script) has already been cached by
+the user agent or not. If it has been cached, the website knows that is has been
+visited before and if it has not been cached (the asset is downloaded from the
+server), the user agent visits for the first time. Another way is to embed
+identifiers in cached documents. An \gls{HTML} file can contain an identifier
+which is stored in a \texttt{<div>} tag and is cached by the user agent. The
+identifier can then be read from the cache on subsequent visits, even from third
+party websites.
+
+\subsection{Cache Timing}
+\label{subsec:cache timing}
+
+
+
+\subsection{Cache Control Directives}
+\label{subsec:cache control directives}
 
 \subsection{DNS Cache}
 \label{subsec:dns cache}
 
-\subsection{Browser Cache}
-\label{subsec:browser cache}
-
 \end{document}