SudoWeb: Minimizing Information Disclosure to Third Parties in Single Sign-on Platforms

  • Georgios Kontaxis
  • Michalis Polychronakis
  • Evangelos P. Markatos
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7001)

Abstract

Over the past few months we are seeing a large and ever increasing number of Web sites encouraging users to log in with their Facebook, Twitter, or Gmail identity, or personalize their browsing experience through a set of plug-ins that interact with the users’ social profile. Research results suggest that more than two million Web sites have already adopted Facebook’s social plug-ins, and the number is increasing sharply. Although one might theoretically refrain from such single sign-on platforms and cross-site interactions, usage statistics show that more than 250 million people might not fully realize the privacy implications of opting-in. To make matters worse, certain Web sites do not offer even the minimum of their functionality unless the users meet their demands for information and social interaction. At the same time, in a large number of cases, it is unclear why these sites require all that personal information for their purposes.

In this paper we mitigate this problem by designing and developing a framework for minimum information disclosure across third-party sites with single sign-on interactions. Our example case is Facebook, which combines a very popular single sign-on platform with information-rich social networking profiles. When a user wants to browse a Web site that requires authentication or social interaction with his Facebook identity, our system employs, by default, a Facebook session that reveals the minimum amount of information necessary. The user has the option to explicitly elevate that Facebook session in a manner that reveals more or all of the information tied to his social identity. This enables users to disclose the minimum possible amount of personal information during their browsing experience on third-party Web sites.

Keywords

Social Networking Site Session Manager Browser Extension Session Monitor Session Store 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    BuiltWith - Facebook for Websites Usage Trends, http://trends.builtwith.com/javascript/Facebook-for-Websites
  2. 2.
  3. 3.
  4. 4.
  5. 5.
    OpenID Foundation - OpenID Authentication 2.0 Specifications, http://openid.net/specs/openid-authentication-2_0.html
  6. 6.
  7. 7.
    Symantec Official Blog - Facebook Applications Accidentally Leaking Access to Third Parties, http://www.symantec.com/connect/blogs/facebook-applications-accidentally-leaking-access-third-parties
  8. 8.
    The Chromium Projects - Multiple Profiles, http://www.chromium.org/user-experience/multi-profiles
  9. 9.
    WebProNews - Million Sites Have Added Facebook’s Social Plugins Since f8, http://www.webpronews.com/2-million-sites-have-added-facebooks-social-plugins-since-f8-2010-09
  10. 10.
    Ardagna, C.A., De Capitani di Vimercati, S., Foresti, S., Paraboschi, S., Samarati, P.: Supporting privacy preferences in credential-based interactions. In: Proceedings of the 9th Annual ACM Workshop on Privacy in the Electronic Society (2010)Google Scholar
  11. 11.
    Barth, A., Jackson, C., Mitchell, J.C.: Robust defenses for cross-site request forgery. In: Proceedings of the 15th ACM Conference on Computer and Communications Security (2008)Google Scholar
  12. 12.
    Dey, A., Weis, S.: PseudoID: Enhancing privacy in federated login. In: Hot Topics in Privacy Enhancing Technologies (2010)Google Scholar
  13. 13.
    Felt, A., Evans, D.: Privacy protection for social networking platforms. In: Proceedings of the Workshop on Web 2.0 Security and Privacy (2008)Google Scholar
  14. 14.
    Luo, W., Xie, Q., Hengartner, U.: Facecloak: An architecture for user privacy on social networking sites. In: Proceedings of the International Conference on Computational Science and Engineering (2009)Google Scholar
  15. 15.
    Meiss, M., Duncan, J., Gonçalves, B., Ramasco, J.J., Menczer, F.: What’s in a session: tracking individual behavior on the web. In: Proceedings of the 20th ACM Conference on Hypertext and Hypermedia (2009)Google Scholar
  16. 16.
    Singh, K., Bhola, S., Lee, W.: xbook: redesigning privacy control in social networking platforms. In: Proceedings of the 18th Conference on USENIX Security Symposium (2009)Google Scholar
  17. 17.
    Stone, B.: Facebook aims to extend its reach across the web. New York Times (2008)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Georgios Kontaxis
    • 1
  • Michalis Polychronakis
    • 1
  • Evangelos P. Markatos
    • 2
  1. 1.Computer Science DepartmentColumbia UniversityUSA
  2. 2.Institute of Computer ScienceFoundation for Research and TechnologyHellasGreece

Personalised recommendations