1,720,966 research outputs found
Empirical analysis of google's privacy-preserving targeted advertising
No full textLAUREA MAGISTRALERecentemente, Google ha annunciato piani per eliminare i cookie di terze parti ed è attualmente nel processo di
implementazione del Chrome Privacy Sandbox, una raccolta di API e standard web che offrono alternative che tutelano
la privacy rispetto alle tecnologie esistenti, specialmente per l’ecosistema della pubblicità digitale. Questo include
FLEDGE, anche chiamato Protected Audience, che fornisce i meccanismi necessari per condurre in modo efficace
offerte in tempo reale e aste pubblicitarie direttamente nei browser degli utenti. FLEDGE è progettato per eliminare la
raccolta invasiva di dati e le pratiche di tracciamento pervasivo utilizzate per il remarketing e la pubblicità mirata. In
questa tesi, presentiamo uno studio dell’ecosistema FLEDGE prima e dopo la sua implementazione ufficiale su Chrome.
Abbiamo scoperto che nonostante siano entrati nel settore diversi piattaforme pubblicitarie di rilievo, Google ha gestito
il 99,8% delle aste che abbiamo osservato, evidenziando il suo ruolo dominante. Successivamente, forniamo la prima
analisi empirica approfondita di FLEDGE e scopriamo una serie di gravi difetti di progettazione e implementazione.
Utilizziamo questi difetti per condurre 12 nuovi attacchi, tra cui tracciamento, cross-site leakage, interruzioni di servizio
e attacchi di tipo pollution. Nonostante l’obiettivo di FLEDGE di migliorare la privacy degli utenti, la nostra ricerca
dimostra che attualmente espone gli utenti a rischi significativi e delineiamo soluzioni per affrontare i problemi che
abbiamo scoperto. Abbiamo anche comunicato in modo responsabile le nostre scoperte a Google per avviare gli sforzi
di correzione. Crediamo che la nostra ricerca metta in evidenza la grave necessità di investigare approfonditamente
l’intero Chrome Privacy Sandbox, a causa dell’enorme impatto che avrà sulla privacy degli utenti.Google recently announced plans to phase out third-party cookies and is cur-
rently in the process of rolling out the Chrome Privacy Sandbox, a collection of APIs and
web standards that offer privacy-preserving alternatives to existing technologies, particu-
larly for the digital advertising ecosystem. This includes FLEDGE, also referred to as the
Protected Audience, which provides the necessary mechanisms for effectively conducting
real-time bidding and ad auctions directly within users’ browsers. FLEDGE is designed to
eliminate the invasive data collection and pervasive tracking practices used for remarket-
ing and targeted advertising. In this thesis, we provide a study of the FLEDGE ecosystem
both before and after its official deployment in Chrome. We find that even though mul-
tiple prominent ad platforms have entered the space, Google ran 99.8% of the auctions
we observed, highlighting its dominant role. Subsequently, we provide the first in-depth
empirical analysis of FLEDGE, and uncover a series of severe design and implementation
flaws. We leverage those for conducting 12 novel attacks, including tracking, cross-site
leakage, service disruption, and pollution attacks. While FLEDGE aims to enhance user
privacy, our research demonstrates that it is currently exposing users to significant risks,
and we outline mitigations for addressing the issues that we have uncovered. We have
also responsibly disclosed our findings to Google so as to kickstart remediation efforts.
We believe that our research highlights the dire need for more in-depth investigations
of the entire Privacy Sandbox, due to the massive effect it will have on user privacy
Stealthy credential-stealing attacks against password managers in desktop environments
No full textLAUREA MAGISTRALEI password manager migliorano significativamente l'autenticazione basata su password, generando credenziali forti e uniche e semplificando il processo di accesso attraverso la funzionalità di compilazione automatica. In particolare, questa funzione offre ulteriori protezioni di sicurezza quando utilizzata in un ambiente di navigazione tradizionale (ovvero i browser), poiché può contrastare facilmente gli attacchi di phishing grazie alla disponibilità immediata delle informazioni sul dominio del sito web. Con la crescente diffusione di applicazioni native standalone da parte dei principali servizi web, i password manager hanno iniziato ad estendere la compilazione automatica e altre funzionalità anche agli ambienti desktop. Tuttavia, attualmente non è chiaro come le loro protezioni di sicurezza si applichino in questi contesti. Per colmare questa lacuna, in questa tesi presento la prima analisi empirica sistematica delle funzionalità di compilazione automatica offerte dai più diffusi password manager (tra cui 1Password, Keeper e LastPass) nei due principali ambienti desktop: MacOS e Windows. Abbiamo riscontrato che i vari password manager adottano strategie diverse per interagire con le applicazioni desktop, e implementano livelli di protezione molto variabili contro gli attacchi basati sull'interfaccia utente. Ad esempio, su MacOS, un alto livello di sicurezza può essere raggiunto sfruttando le API e i controlli forniti dal sistema operativo. Al contrario, su Windows abbiamo riscontrato una mancanza di adeguati controlli di sicurezza, principalmente a causa di limitazioni intrinseche del sistema operativo. In ciascuno scenario, presento attacchi proof-of-concept che permettono ad altre applicazioni di aggirare i controlli di sicurezza esistenti e di sottrarre furtivamente le credenziali e le one-time password (OTP) degli utenti. Infine, propongo una serie di contromisure volte a mitigare questi attacchi. Data la gravità delle vulnerabilità riscontrate, abbiamo condiviso le nostre scoperte e proposto le contromisure ai fornitori dei password manager analizzati.Password managers significantly improve password-based authentication, by generating strong and unique passwords while also streamlining the actual authentication process through autofill functionality. Crucially, autofill provides additional security protections when employed within a traditional browsing environment, as it can trivially thwart phishing attacks due to the website's domain information being readily available. With the increasing trend of major web services also deploying standalone native applications, passwords managers have also started offering universal autofill and other user-friendly capabilities for desktop application environments. However, it is currently unclear how password managers' security protections apply in these environments. To fill that gap, in this thesis I present the first systematic empirical analysis of the autofill-related functionalities made available by popular password managers (including 1Password, Keeper and LastPass) in two major desktop environments: MacOS and Windows. We find that password managers adopt different strategies for interacting with desktop apps, and employ widely different levels of safeguards against UI-based attacks. For instance, on MacOS we find that a high level of security can be achieved by leveraging OS-provided APIs and checks, while on Windows we identify a lack of proper security checks mainly due to OS limitations. In each scenario, I demonstrate proof-of-concept attacks that allow other applications to bypass the security checks in place and stealthily steal user's credentials and one-time-passwords. Accordingly, I propose a series of countermeasures that can mitigate our attacks. Due to the severity of our attacks, we disclosed our findings and proposed countermeasures to the analyzed password manager vendors
Differential security analysis of cross-platform electron applications
No full textLAUREA MAGISTRALELa seguente tesi presenta un'analisi dettagliata dei meccanismi di sicurezza di applicazioni cross-platform sviluppate in Electron, in particolare esaminando come vengono gestiti gli header HTTP e altri meccanismi di sicurezza rispetto a Google Chrome.
La ricerca valuta come Electron gestisce gli header HTTP attraverso una fase di test sviluppati manualmente, e successivamente attraverso l'utilizzo della test suite cross-browser Web Platform Tests (WPT). Particolare attenzione é stata posta alle vulnerabilità introdotte dall'architettura unica di Electron, includendo l'utilizzo di webviews e file HTML locali, che consentono di evitare protocolli standard di sicurezza. Successivamente esploreremo le implicazioni dell'utilizzo di file locali circa la nozione di origine nell'ambito della sicurezza web, dimostrando che differisce da quella fornita dai browser moderni.
In breve, questo studio identifica importanti mancanze di sicurezza, in particolare riguardanti come Electron gestisce CORS, permessi, e l'origine nel contesto di file locali. Queste discrepanze possono esporre applicazioni Electron a problemi inerenti la condivisone di risorse in un contesto cross-origin, inconsistenze nella gestione dei cookie, e approvazione intenzionale dei permessi. Questo porta ad una serie di minacce significanti, come il consentire a risorse di terze parti di navigare liberamente attraverso il file system ed accedere a informazioni sensibili.
In luce di questi ritrovamenti, sosteniamo un'implementazione piú restrittiva delle impostazioni di sicurezza di default in Electron, per garantire maggiore sicurezza nelle applicazioni e per gli utenti.This thesis presents an in-depth analysis of security mechanisms in Electron-based cross-platform applications, specifically examining how it manages HTTP headers and security mechanisms compared to Google Chrome.
The research evaluates Electron's handling of critical headers through both manual testing and the use of the Web Platform Tests (WPT) cross-browser test suite. Special attention is given to vulnerabilities introduced by Electron’s unique architecture, including its use of webviews and local HTML files, which may enable bypasses of standard security protocols. We then explore the implications of local file handling in regards to the fundamental web security notion of an origin, and find that it substantially differs from that of modern browsers.
In summary, this study identifies significant security gaps, particularly in how Electron handles CORS, permissions, and origins in local file contexts. These discrepancies can expose Electron applications to cross-origin resource-sharing issues, inconsistencies in cookie handling, and unintended permission granting. This enables a series of significant threats, including allowing third-party web resources to freely navigate through the file system and access sensitive information.
In light of these findings, we advocate for implementing stricter default security settings in Electron to better protect applications and their users
Going Beyond Counting First Authors in Author Co-citation Analysis
Get PDFThe present study examines one of the fundamental aspects of author co-citation analysis (ACA) - the way co-citation
counts are defined. Co-citation counting provides the data on which all subsequent statistical analyses and mappings
are based, and we compare ACA results based on two different types of co-citation counting - the traditional type that
only counts the first one among a cited work's authors on the one hand and a non-traditional type that takes into
account the first 5 authors of a cited work on the other hand. Results indicate that the picture produced through this non-traditional author co-citation counting contains more coherent author groups and is therefore considerably clearer. However, this picture represents fewer specialties in the research field being studied than that produced through the traditional first-author co-citation counting when the same number of top-ranked authors is selected and analyzed. Reasons for these effects are discussed
Variations on the Author
Get PDF“Variations on the Author” discusses two of Eduardo Coutinho’s recent films (Um Dia na Vida, from 2010, and Últimas Conversas, posthumously released in 2015) and their contribution to the general question of documentary authorship. The director’s filmography is characterized by a consistent yet self-effacing form of authorial self-inscription: Coutinho often features as an interviewer that rather than express opinions propels discourses; an interviewer that is good at listening. This mode of self-inscription characterizes him as an author who is not expressive but who is nonetheless markedly present on the screen. In Um Dia na Vida, however, Coutinho is completely absent form the image, while Últimas Conversas, on the contrary, includes a confessional prologue that moves the director from the margins to the center of his films. This article examines the ways in which these works stand out in the filmography of a director who offers new insights into the notion of cinematic authorship
Appropriate Similarity Measures for Author Cocitation Analysis
Get PDFWe provide a number of new insights into the methodological discussion about author cocitation analysis. We first argue that the use of the Pearson correlation for measuring the similarity between authors’ cocitation profiles is not very satisfactory. We then discuss what kind of similarity measures may be used as an alternative to the Pearson correlation. We consider three similarity measures in particular. One is the well-known cosine. The other two similarity measures have not been used before in the bibliometric literature. Finally, we show by means of an example that our findings have a high practical relevance.information science;Pearson correlation;cosine;similarity measure;author cocitation analysis
Dispelling the Myths Behind First-author Citation Counts
Get PDFWe conducted a full-scale evaluative citation analysis study of scholars in the XML research field to explore just how different from each other author rankings resulting from different citation counting methods actually are, and to demonstrate the capability of emerging data and tools on the Web in supporting more realistic citation counting methods. Our results contest some common arguments for the continued
use of first-author citation counts in the evaluation of scholars, such as high correlations between author rankings by first-author citation counts and other citation
counting methods, and high costs of using more realistic citation counting methods that are not well-supported by the ISI databases. It is argued that increasingly available digital full text research papers make it possible for citation analysis studies to go beyond what the ISI databases have directly supported and to employ more
sophisticated methods
koamabayili/VECTRON-author-checklist: VECTRON author checklist
No full textWe have done our best to complete the author checklist relating to the use of animals in the hut study. Note that the objective for the hut study was to evaluate the IRS treatment applications for residual efficacy against Anopheles mosquitoes, including the local An. coluzzii mosquito population. Cows were only used to attract mosquitoes into the huts and no tests were carried out directly on the cows. The author checklist is intended for use with studies where experiments are carried out on animals, which is why we have had such difficulty in completing this for the hut study, as many of the questions do not relate to how the cows were used
- …
