Search

Internet usage has grown dramatically since the early years of its inception. The rich field of data provided by internet users in interaction with digital media content can provide insight into web-based navigation behavior and underlying psychological dimensions. Human-computer interaction in the web is an underutilized source of data for understanding human online behavior. While researchers and usability testing services do use these sources to analyze human behavior and user experience, access to the diverse range of other potentially useful data available during web-based interaction for research is limited. In this paper, we propose a novel tool in the form of a web browser extension, referred to as Latent, which can be used to simultaneously capture information from different sources while users interact with digital content. The data acquisition capabilities of Latent makes it suitable for various research purposes, ranging from studies of usability to decision-making and personality. A particular advantage of Latent is that the method and control of data acquisition is completely transparent to the user. We present the architecture of the web browser extension, describe the data that can be acquired, and report on the residual impact of the tool on the user's computer processing resources.

Targeted advertising is an inherent part of the modern Web as we know it. For this purpose, personal data is collected at large scale to optimize and personalize displayed advertisements to increase the probability that we click them. Anonymity and privacy are also important aspects of the World Wide Web since its beginning. Activists and developers relentlessly release tools that promise to protect us from Web tracking. Besides extensive blacklists to block Web trackers, researchers used machine learning techniques in the past years to automatically detect Web trackers. However, for this purpose often artificial data is used, which lacks in quality. Due to its sensitivity and the manual effort to collect it, real user data is avoided. Therefore, we present T.EX - The Transparency EXtension, which aims to record a browsing session in a secure and privacy-preserving manner. We define requirements and objectives, which are used for the design of the tool. An implementation is presented, which is evaluated for its performance. The evaluation shows that our implementation can be used for the collection of data to feed machine learning algorithms.

With the constant migration of applications from the desktop to the web, power users have found ways of enhancing web applications, at the client-side, according to their needs. In this paper, we investigate this phenomenon by focusing on the popular Greasemonkey extension which enables users to write scripts that arbitrarily change the content of any page, allowing them to remove unwanted features from web applications, or add additional, desired features to them. The creation of script markets, on which these scripts are often shared, extends the standard web security model with two new actors, introducing novel vulnerabilities. We describe the architecture of Greasemonkey and perform a large-scale analysis of the most popular, community-driven, script market for Greasemonkey. Through our analysis, we discover not only dozens of malicious scripts waiting to be installed by users, but thousands of benign scripts with vulnerabilities that could be abused by attackers. In 58 cases, the vulnerabilities are so severe, that they can be used to bypass the Same-Origin Policy of the user's browser and steal sensitive user-data from all sites. We verify the practicality of our attacks, by developing a proof-of-concept exploit against a vulnerable user script with an installation base of 1.2 million users, equivalent to a ``Man-in-the-browser'' attack. online only ispartof: pages:525-530 ispartof: ASIA CCS 2014 - Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security pages:525-530 ispartof: ASIACCS location:Kyoto, Japan date:2 Jun - 4 Jun 2014 status: published

The recently-proposed PassCard scheme enables CardSpace to be used as a password manager, thereby both improving the usability and security of passwords as well as encouraging CardSpace adoption. However, this scheme does not work with sites using HTTPS, seriously limiting its practicality. In this paper we extend PassCard to support sites using both HTTP and HTTPS. Usernames and passwords are stored in CardSpace personal cards, and these cards can be used to sign on transparently to corresponding websites. PassCard does not require any changes to login servers, default browser security settings or to the CardSpace identity selector; in particular, it does not require websites to support CardSpace. PassCard operates with both the CardSpace and the Higgins identity selectors without any modification. We describe how this new version of PassCard operates, and give security and usability analyses.