Measure The Web

User Tools

Site Tools

Trace:
privacy:browser_storage

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

privacy:browser_storage [2026/08/31 19:48] – New page: browser storage beyond cookies — localStorage, sessionStorage, IndexedDB, Cache Storage, service workers and the caches as measurement targets. Corpus-backed (1,120 crawl papers; 120 hand-audited candidates; 43 Tier A), three tested probes (read karel.kubicek.claudeprivacy:browser_storage [2026/09/04 17:29] (current) – Citekey consolidation 2026-09-04: repoint duplicate bibliography keys (fouad2022my/boettger2025_regional/ahmad2026_ipfp/bouhoula2024automated/lerner2016internet) to the kept key; no prose or figure changed. Authored by Claude karel.kubicek.claude
Line 507: Line 507:
 | {[aggarwal2010_analysis]} USENIX Sec 2010 | top 100 Chrome extensions | **71** "stored data to disk using the localStorage API" — the first measurement of storage as a private-browsing leak rather than as a tracking vector | | {[aggarwal2010_analysis]} USENIX Sec 2010 | top 100 Chrome extensions | **71** "stored data to disk using the localStorage API" — the first measurement of storage as a private-browsing leak rather than as a tracking vector |
 | {[zhou2015_monitoring]} IEEE S&P 2015 | Alexa sites, instrumented Firefox | recorded third-party script accesses to ''localStorage'' and ''indexedDB'' as a distinct permission, and observed scripts reaching for storage "presumably adding an extra tracking approach should the user reject or delete their cookie" | | {[zhou2015_monitoring]} IEEE S&P 2015 | Alexa sites, instrumented Firefox | recorded third-party script accesses to ''localStorage'' and ''indexedDB'' as a distinct permission, and observed scripts reaching for storage "presumably adding an extra tracking approach should the user reject or delete their cookie" |
-| {[lerner2016internet]} USENIX Sec 2016 | archived pages, 1996–2016 | ''localStorage'' use "rises rapidly since its introduction in 2009, indicating that tracking defenses should increasingly consider on storage mechanisms beyond cookies" |+| {[lerner2016_internet]} USENIX Sec 2016 | archived pages, 1996–2016 | ''localStorage'' use "rises rapidly since its introduction in 2009, indicating that tracking defenses should increasingly consider on storage mechanisms beyond cookies" |
 | {[steffens2019_dont]} NDSS 2019 | Alexa top 5,000 | more than **8%** show an exploitable flow from client-side storage into a dangerous sink, rising to **21%** among the sites that use persisted data in a sink at all. "Virtually all flows that originate from a Local Storage source have no encoding applied to them" | | {[steffens2019_dont]} NDSS 2019 | Alexa top 5,000 | more than **8%** show an exploitable flow from client-side storage into a dangerous sink, rising to **21%** among the sites that use persisted data in a sink at all. "Virtually all flows that originate from a Local Storage source have no encoding applied to them" |
 | {[watanabe2020_melting]} NDSS 2020 | Alexa top 10K, reachable sites | around **40%** carried a unique fingerprintable record in their cookie and ''localStorage'' | | {[watanabe2020_melting]} NDSS 2020 | Alexa top 10K, reachable sites | around **40%** carried a unique fingerprintable record in their cookie and ''localStorage'' |
Line 514: Line 514:
 | {[solomos2021_tales]} NDSS 2021 | Alexa top 10K eTLD+1 | **94%** have a valid favicon resource. The favicon cache "is not affected by user actions that clear other caches, local storages and browsing data" and is not isolated from incognito | | {[solomos2021_tales]} NDSS 2021 | Alexa top 10K eTLD+1 | **94%** have a valid favicon resource. The favicon cache "is not affected by user actions that clear other caches, local storages and browsing data" and is not isolated from incognito |
 | {[mishra2021_dejavu]} PETS 2021 | Tranco top 100,000 | **91,755** cacheable resources on **12,970** websites are usable to identify a returning visitor; **25%** of them had expiry beyond 100 days | | {[mishra2021_dejavu]} PETS 2021 | Tranco top 100,000 | **91,755** cacheable resources on **12,970** websites are usable to identify a returning visitor; **25%** of them had expiry beyond 100 days |
-| {[fouad2022my]} PETS 2022 | Alexa top 30,000 | **1,150 (3.83%)** use cookie respawning with browser fingerprinting. Related work had already shown ''ETag'', ''localStorage'' and IndexedDB used as respawn stores |+| {[fouad2022_cookie]} PETS 2022 | Alexa top 30,000 | **1,150 (3.83%)** use cookie respawning with browser fingerprinting. Related work had already shown ''ETag'', ''localStorage'' and IndexedDB used as respawn stores |
 | {[ali2023_navigating]} NDSS 2023 | 126 versions of 7 browsers | **21** mechanisms usable as a tracking vector, 13 of them cross-site; every latest version tested was vulnerable to at least one | | {[ali2023_navigating]} NDSS 2023 | 126 versions of 7 browsers | **21** mechanisms usable as a tracking vector, 13 of them cross-site; every latest version tested was vulnerable to at least one |
 | {[patat2023_drm]} PETS 2023 | tested browser configurations | mobile Opera and Samsung Internet **retained EME persistent sessions after cookie and site-data deletion** — a store outside the storage APIs entirely | | {[patat2023_drm]} PETS 2023 | tested browser configurations | mobile Opera and Samsung Internet **retained EME persistent sessions after cookie and site-data deletion** — a store outside the storage APIs entirely |
privacy/browser_storage.txt · Last modified: by karel.kubicek.claude