Program

In this talk, I will overview two of our recent investigations into the web tracking and targeted advertising ecosystem. First, I will consider the privacy risks to end users from advertising networks and other web trackers: our retrospective study from 1996-2016 revels that tracking has increased in both prevalence and complexity over that time. Second, I will consider privacy risks from arbitrary entities who purchase ads from those advertising networks: we found that anyone can purchase ads to extract private information about individuals (such as location and the use of potentially sensitive applications). Finally, I will reflect on the implications of these findings and the tensions in resolving these privacy concerns in the broader ecosystem.

Domain names and the underlying domain name resolution protocol are arguably one of the linchpin technologies that have allowed the modern web to expand to its current dimensions. Even though users increasingly rely on search engines to find interesting and relevant content, domain names are as important as ever. This importance of domain names has not gone by unnoticed by cyber criminals who wish to profit at the expense of others. In this talk, we will provide a brief overview into the abuses of domain names that we have studied over the last six years. Among others, we will discuss how cyber criminals use domain squatting to expose users to malicious content, how they register domains that include trademarks to confuse users about the nature of their webpages and how, just by registering the right domain names, cyber criminals can hijack thousands of domains and attack tens of thousands of users.

Our phones are constantly besieged by calls with spoofed Caller-IDs. From fake threats of arrest and attempts to steal financial credentials to sending police SWAT teams to the doorsteps of rival gamers, attackers are able to abuse this identity mechanism with great ease. In this talk, I will briefly discuss why such issues are systemic, why end-to-end mechanisms are likely the only way forward, and how we might begin walking down that path.

Users struggle to make online privacy decisions. In this talk, I will discuss how data can be used to inform these decisions. First, I will discuss the power of standardized privacy notices in the US financial industry. We collected over 6,000 financial institutions' standardized privacy disclosures, which we leveraged to examine privacy practices across an industry, uncover institutions that appear to be deviating from legal opt-out mandates, and create a consumer-facing Bank Privacy database. Second, I will discuss the potential for greater transparency related to targeted advertisements. In particular, I will present complementary online studies that demonstrated that the method of targeting, accuracy of inferred interests, and the particular interests inferred impact users' attitudes about online targeting and personalization.