From 3eb33ae78357ac66c3cb59d99f0fde59ec2e8d4f Mon Sep 17 00:00:00 2001 From: Tobias Eidelpes Date: Tue, 31 Mar 2020 17:49:05 +0200 Subject: [PATCH] Review text so far, add titlepage and erklaerung --- .gitignore | 6 +++ chapters/erklaerung.tex | 29 +++++++++++ chapters/methods.tex | 111 ++++++++++++++++++++-------------------- chapters/titlepage.pdf | Bin 0 -> 47896 bytes main.tex | 11 +++- 5 files changed, 100 insertions(+), 57 deletions(-) create mode 100644 chapters/erklaerung.tex create mode 100644 chapters/titlepage.pdf diff --git a/.gitignore b/.gitignore index 6fde91e..30d03ab 100644 --- a/.gitignore +++ b/.gitignore @@ -18,3 +18,9 @@ main.pdf main.run.xml main.synctex.gz main.toc +main.acr +main.alg +main.glg +main.gls +main.ilg +main.ind diff --git a/chapters/erklaerung.tex b/chapters/erklaerung.tex new file mode 100644 index 0000000..5c43d87 --- /dev/null +++ b/chapters/erklaerung.tex @@ -0,0 +1,29 @@ +\documentclass[../main.tex]{subfiles} + +\begin{document} + +\chapter*{Erklärung zur Verfassung der Arbeit} + +\textsf{Tobias Eidelpes} \\ + +Hiermit erkläre ich, dass ich diese Arbeit selbständig verfasst habe, dass ich +die verwendeten Quellen und Hilfsmittel vollständig angegeben habe und dass +ich die Stellen der Arbeit---einschließlich Tabellen, Karten und Abbildungen---, +die anderen Werken oder dem Internet im Wortlaut oder dem Sinn nach entnommen +sind, auf jeden Fall unter Angabe der Quelle als Entlehnung kenntlich gemacht habe. + +\vspace{2cm} + +\bigskip + +\begin{minipage}{0.55\textwidth} + \textsf{Wien, 31. März 2020} \\ +\end{minipage} +\begin{minipage}{0.45\textwidth} +\begin{tabular}{c} +\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \\ +\textsf{Tobias Eidelpes} +\end{tabular} +\end{minipage} + +\end{document} diff --git a/chapters/methods.tex b/chapters/methods.tex index 4bf69b3..a0e684b 100644 --- a/chapters/methods.tex +++ b/chapters/methods.tex @@ -27,7 +27,7 @@ identifiers. \section{Session-based Tracking Methods} \label{sec:session-based tracking methods} -One of the simplest and most used forms of tracking on the Internet rely on +One of the simplest and most used forms of tracking on the Internet relies on sessions. Since HTTP is a stateless protocol, web servers cannot by default keep track of any previous client requests. In order to implement specific features such as personalized advertising, some means to save current and recall previous @@ -94,12 +94,12 @@ web \cite{westMeasuringPrivacyDisclosures2014}. \subsection{Hidden Form Fields} \label{subsec:hidden form fields} -The \gls{HTML} provides a specification for form elements, which allow users to +The \gls{HTML} provides a specification for form elements, which allows users to submit information (e.g., for authentication) to the server via POST or GET methods. Normally, a user would input data into a form and on clicking \emph{submit} the input would be sent to the server. Sometimes it is necessary to include additional information that the user did not enter. For this reason -there exist \emph{hidden} web forms. Hidden web forms do not show on the website +there exist \emph{hidden} web forms. Hidden web forms do not show on the web site and therefore the user cannot enter any information. Similar to \gls{URL} parameters, the value parameter in a hidden field contains additional information like the user's preferred language for example. Since almost @@ -126,7 +126,7 @@ is sent to the server along with the data the user has filled in. \subsection{HTTP Referer} \label{subsec:http referer} -Providers of web services often want to know where visitors to their website +Providers of web services often want to know where visitors to their web site come from to understand more about their users and their browsing habits. The \gls{HTTP} specification accounts for this by introducing the \emph{\gls{HTTP} Referer field} [\emph{sic}] in the header. By checking the referrer, the server @@ -147,7 +147,7 @@ identifiability of users on the web. \label{subsec:explicit authentication} Explicit authentication requires a user to \emph{explicitly} log in or register -to the website. This way, specific resources are only available to the user when +to the web site. This way, specific resources are only available to the user when he or she has authenticated themselves to the service. Actions taken on an authenticated user account are tied to that account and crafting a personal profile is more or less a built-in function in this case. Since merely asking a @@ -167,12 +167,12 @@ efforts are not detected by the average user \cite{}, it is known that actions taken on an account are logged to provide better service through service optimization and profile personalization. -Making an account on a website to use their services to their full extent, can +Making an account on a web site to use their services to their full extent, can be beneficial in some cases. Facebook for example, allows their users to configure what they want to share with the public and their friends. Research has shown however, that managing which posts get shown to whom is not as straightforward as one might think. -\todo{Wrong chapter?} \citeauthor{liuAnalyzingFacebookPrivacy2011} +\citeauthor{liuAnalyzingFacebookPrivacy2011} \cite{liuAnalyzingFacebookPrivacy2011} conducted a survey where they asked Facebook users about their desired privacy and visibility settings and cross-checked them with the actual settings they have used for their posts. The @@ -236,11 +236,11 @@ A method which is most often associated with tracking on the Internet is tracking with \gls{HTTP} cookies. Cookies are small files that are placed in the browser's storage on the user's computer. They are limited to four kilobytes in size and are generally used to identify and authenticate users and to store -website preferences. They were introduced to the web to allow stateful +web site preferences. They were introduced to the web to allow stateful information to be stored because the \gls{HTTP} is a stateless protocol and therefore does not have this capability. It is also a way of reducing the server's load by not having to recompute states every time a user visits a -website. Shopping cart functionality for example can thus be implemented by +web site. Shopping cart functionality for example can thus be implemented by setting a cookie in the user's browser, saving the items which are currently added to the shopping cart and giving the user the possibility to resume shopping at a later point provided that they do not delete their cookies. With @@ -279,7 +279,7 @@ soon as the session is `torn down'. By adding an expiration date (demonstrated in Listing~\ref{lst:permanent cookie header}) or a maximum age, the cookie becomes permanent. Additionally, the domain attribute can be specified, meaning that cookies which list a different domain than the origin, are rejected by the -user agent \cite[Section 4.1.2.3]{barthHTTPStateManagement2011}. The same-origin +user agent \cite[section 4.1.2.3]{barthHTTPStateManagement2011}. The same-origin policy applies to cookies, disallowing access by other domains. \begin{listing} @@ -308,7 +308,7 @@ Additionally, a length of more than 35 characters in the value field applies to 80\% of non-tracking cookies. \emph{Cookie Chunking}, where a cookie of larger length is split into multiple cookies with smaller length, did not appear to affect detection by their method negatively. They also present a site -measurement of the Alexa Top 10,000 websites, finding that 46\% of websites use +measurement of the Alexa Top 10,000 web sites, finding that 46\% of web sites use third party tracking. More recent research \cite{gonzalezCookieRecipeUntangling2017} has shown that tracking cookies do not have to be long lasting to accumulate data about users. Some cookies---like the @@ -332,7 +332,7 @@ detect and block cookies (see chapter~\ref{chap:defences against tracking}). \label{subsec:flash cookies and java jnlp persistenceservice} Flash Cookies are similar to HTTP cookies in that they too are a store of -information that helps websites and servers to recognize already seen users. +information that helps web sites and servers to recognize already seen users. They are referred to as \glspl{LSO} by Adobe and are part of the Adobe Flash Player runtime. Instead of storing data in the browser's storage, they have their own storage in a different location on the user's computer. Another @@ -352,11 +352,11 @@ posed by \gls{HTTP} cookies and reacted by taking countermeasures. \citeauthor{soltaniFlashCookiesPrivacy2009} \cite{soltaniFlashCookiesPrivacy2009} were the first to report on the usage of -Flash cookies by advertisers and popular websites. While surveying the top 100 -websites at the time, they found that 54\% of them used Flash cookies. Some -websites were setting Flash cookies as well as \gls{HTTP} cookies with the same +Flash cookies by advertisers and popular web sites. While surveying the top 100 +web sites at the time, they found that 54\% of them used Flash cookies. Some +web sites were setting Flash cookies as well as \gls{HTTP} cookies with the same values, suggesting that Flash cookies serve as backup to \gls{HTTP} cookies. -Several websites were found using Flash cookies to respawn already deleted +Several web sites were found using Flash cookies to respawn already deleted \gls{HTTP} cookies, even across domains. \citeauthor{acarWebNeverForgets2014} \cite{acarWebNeverForgets2014} automated detecting Flash cookies and access to them by monitoring file access with the GNU/Linux \emph{strace} tool @@ -367,10 +367,10 @@ top 100 sites use Flash cookies for respawning. Even though Flash usage has declined during the last few years thanks to the development of the HTML5 standard, \citeauthor{buhovFLASH20thCentury2018} \cite{buhovFLASH20thCentury2018} have shown that despite major security flaws, -Flash content is still served by 7.5\% of the top one million websites (2017). +Flash content is still served by 7.5\% of the top one million web sites (2017). The W3Techs Web Technology Survey shows a similar trend and also offers an -up-to-date measurement of 2.7\% of the top ten million websites for the year -2020 \cite{w3techsHistoricalYearlyTrends2020}. Due to the security concerns in +up-to-date measurement of 2.7\% of the top ten million web sites for the year +2020 \cite{w3techsHistoricalYearlyTrends2020}. Due to the security concerns with using Flash, Google's popular video sharing platform YouTube switched by default to the HTML5