Domain name encryption is not enough: privacy leakage via IP-based website fingerprinting

Abstract Although the security benefits of domain name encryption technologies such as DNS over TLS (DoT), DNS over HTTPS (DoH), and Encrypted Client Hello (ECH) are clear, their positive impact on user privacy is weakened by—the still exposed—IP address information. However, content delivery networks, DNS-based load balancing, co-hosting of different websites on the same server, and IP address churn, all contribute towards making domain–IP mappings unstable, and prevent straightforward IP-based browsing tracking. In this paper, we show that this instability is not a roadblock (assuming a universal DoT/DoH and ECH deployment), by introducing an IP-based website finger-printing technique that allows a network-level observer to identify at scale the website a user visits. Our technique exploits the complex structure of most websites, which load resources from several domains besides their primary one. Using the generated fingerprints of more than 200K websites studied, we could successfully identify 84% of them when observing solely destination IP addresses. The accuracy rate increases to 92% for popular websites, and 95% for popular and sensitive web-sites. We also evaluated the robustness of the generated fingerprints over time, and demonstrate that they are still effective at successfully identifying about 70% of the tested websites after two months. We conclude by discussing strategies for website owners and hosting providers towards hindering IP-based website fingerprinting and maximizing the privacy benefits offered by DoT/DoH and ECH.

Download Full-text

Integration of Database and Internet Technologies for Scalable End-to-End E-Commerce Systems

Architectural Issues of Web-Enabled Electronic Business ◽

10.4018/978-1-59140-049-3.ch006 ◽

2011 ◽

pp. 84-112

Author(s):

K. Selcuk Candan ◽

Wen-Syun Li

Keyword(s):

Web Sites ◽

Business Processes ◽

Content Delivery ◽

Web Content ◽

Content Delivery Networks ◽

Current State ◽

Network Delays ◽

High Scalability ◽

End To End ◽

Delivery Networks

The content of many Web sites changes frequently. Especially in most e-commerce sites, Web content is created on request, based on the current state of business processes represented in application servers and databases. In fact, currently 25% of all Web content consists of such dynamically generated pages, and this ratio is likely to be higher in e-commerce sites. Web site performance, including system up-time and user response time, is a key differentiation point among companies that are eager to reach, attract, and keep customers. Slowdowns can be devastating for these sites, as shown by recent studies. Therefore, most commercial content-providers pay premium prices for services, such as content delivery networks (CDNs), that promise high scalability, reduced network delays, and lower risk of failure. Unfortunately, for e-commerce sites, whose main source of content is dynamically generated on demand, most existing static content-based services are not applicable. In fact, dynamically generated content poses many new challenges for the design of end-to-end (client-to-server-to-client) e-commerce systems. In this chapter, we discuss these challenges and provide solutions for integrating Internet services, business logic, and database technologies, and for improving end-to-end scalability of e-commerce systems.

Download Full-text