SudoWeb: Minimizing Information Disclosure to Third Parties in Single Sign-on Platforms
Over the past few months we are seeing a large and ever increasing number of Web sites encouraging users to log in with their Facebook, Twitter, or Gmail identity, or personalize their browsing experience through a set of plug-ins that interact with the users’ social profile. Research results suggest that more than two million Web sites have already adopted Facebook’s social plug-ins, and the number is increasing sharply. Although one might theoretically refrain from such single sign-on platforms and cross-site interactions, usage statistics show that more than 250 million people might not fully realize the privacy implications of opting-in. To make matters worse, certain Web sites do not offer even the minimum of their functionality unless the users meet their demands for information and social interaction. At the same time, in a large number of cases, it is unclear why these sites require all that personal information for their purposes.
In this paper we mitigate this problem by designing and developing a framework for minimum information disclosure across third-party sites with single sign-on interactions. Our example case is Facebook, which combines a very popular single sign-on platform with information-rich social networking profiles. When a user wants to browse a Web site that requires authentication or social interaction with his Facebook identity, our system employs, by default, a Facebook session that reveals the minimum amount of information necessary. The user has the option to explicitly elevate that Facebook session in a manner that reveals more or all of the information tied to his social identity. This enables users to disclose the minimum possible amount of personal information during their browsing experience on third-party Web sites.
KeywordsSocial Networking Site Session Manager Browser Extension Session Monitor Session Store
Unable to display preview. Download preview PDF.
- 2.Facebook for Websites, https://developers.facebook.com/docs/guides/web/
- 3.Facebook Statistics, https://www.facebook.com/press/info.php?statistics
- 4.OAuth, http://oauth.net/
- 5.OpenID Foundation - OpenID Authentication 2.0 Specifications, http://openid.net/specs/openid-authentication-2_0.html
- 6.Sign in with Twitter, http://dev.twitter.com/pages/sign_in_with_twitter
- 7.Symantec Official Blog - Facebook Applications Accidentally Leaking Access to Third Parties, http://www.symantec.com/connect/blogs/facebook-applications-accidentally-leaking-access-third-parties
- 8.The Chromium Projects - Multiple Profiles, http://www.chromium.org/user-experience/multi-profiles
- 9.WebProNews - Million Sites Have Added Facebook’s Social Plugins Since f8, http://www.webpronews.com/2-million-sites-have-added-facebooks-social-plugins-since-f8-2010-09
- 10.Ardagna, C.A., De Capitani di Vimercati, S., Foresti, S., Paraboschi, S., Samarati, P.: Supporting privacy preferences in credential-based interactions. In: Proceedings of the 9th Annual ACM Workshop on Privacy in the Electronic Society (2010)Google Scholar
- 11.Barth, A., Jackson, C., Mitchell, J.C.: Robust defenses for cross-site request forgery. In: Proceedings of the 15th ACM Conference on Computer and Communications Security (2008)Google Scholar
- 12.Dey, A., Weis, S.: PseudoID: Enhancing privacy in federated login. In: Hot Topics in Privacy Enhancing Technologies (2010)Google Scholar
- 13.Felt, A., Evans, D.: Privacy protection for social networking platforms. In: Proceedings of the Workshop on Web 2.0 Security and Privacy (2008)Google Scholar
- 14.Luo, W., Xie, Q., Hengartner, U.: Facecloak: An architecture for user privacy on social networking sites. In: Proceedings of the International Conference on Computational Science and Engineering (2009)Google Scholar
- 15.Meiss, M., Duncan, J., Gonçalves, B., Ramasco, J.J., Menczer, F.: What’s in a session: tracking individual behavior on the web. In: Proceedings of the 20th ACM Conference on Hypertext and Hypermedia (2009)Google Scholar
- 16.Singh, K., Bhola, S., Lee, W.: xbook: redesigning privacy control in social networking platforms. In: Proceedings of the 18th Conference on USENIX Security Symposium (2009)Google Scholar
- 17.Stone, B.: Facebook aims to extend its reach across the web. New York Times (2008)Google Scholar