Subject: "An Empirical Study of Web Cookies"

From: Mark Nottingham <[email-masked]>
Date: Tue, 19 Apr 2016 17:25:59 +1000

Given our current activities around cookies, this may be interesting to many (if you haven't seen it already):
  http://pages.cs.wisc.edu/~pb/www16_final.pdf

"""
Web cookies are used widely by publishers and 3rd parties to track users and their behaviors. Despite the ubiquitous use of cookies, there is little prior work on their characteristics such as standard attributes, placement policies, and the knowledge that can be amassed via 3rd party cookies. In this paper, we present an empirical study of web cookie characteristics, placement practices and information transmission. To conduct this study, we implemented a lightweight web crawler that tracks and stores the cookies as it navigates to websites. We use this crawler to collect over 3.2M cookies from the two crawls, separated by 18 months, of the top 100K Alexa web sites. We report on the general cookie characteristics and add context via a cookie category index and website genre labels. We consider privacy implications by examining specific cookie attributes and placement behavior of 3rd party cookies. We find that 3rd party cookies outnumber 1st party cookies by a factor of two, and we illuminate the connection between domain genres and cookie attributes. We find that less than 1% of the entities that place cookies can aggregate information across 75% of web sites. Finally, we consider the issue of information transmission and aggregation by domains via 3rd party cookies. We develop a mathematical framework to quantify user information leakage for a broad class of users, and present findings using real world domains. In particular, we demonstrate the interplay between a domain’s footprint across the Internet and the browsing behavior of users, which has significant impact on information transmission.
"""

Cheers,

--
Mark Nottingham   https://www.mnot.net/

---

From: "Poul-Henning Kamp" <[email-masked]>
Date: Tue, 19 Apr 2016 19:22:51 +0000

--------
In message <[email-masked]>, Mark Nottingham wri

>  http://pages.cs.wisc.edu/~pb/www16_final.pdf

... furthermore I think that cookies should be removed.

They do far more harm to privacy than any lack of encryption ever did.

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
[email-masked]         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.

---

From: Phil Lello <[email-masked]>
Date: Thu, 21 Apr 2016 19:56:21 +0100

"We find that less than 1% of the entities that place cookies can aggregate
information across 75% of web sites."

For me, the worrying implication is that there are more than 0% of entities
capable of aggregating information accross 75% of web sites.