PURL: Safe and Effective Sanitization of Link Decoration
This addresses privacy concerns for web users by mitigating novel tracking techniques that bypass current countermeasures, though it is an incremental improvement over existing sanitization methods.
The paper tackles the problem of tracking through link decoration by introducing PURL, a machine-learning approach that sanitizes tracking information in decorated links, showing it significantly outperforms existing countermeasures in accuracy and reduces website breakage while detecting abuse on nearly three-quarters of top websites.
While privacy-focused browsers have taken steps to block third-party cookies and mitigate browser fingerprinting, novel tracking techniques that can bypass existing countermeasures continue to emerge. Since trackers need to share information from the client-side to the server-side through link decoration regardless of the tracking technique they employ, a promising orthogonal approach is to detect and sanitize tracking information in decorated links. To this end, we present PURL (pronounced purel-l), a machine-learning approach that leverages a cross-layer graph representation of webpage execution to safely and effectively sanitize link decoration. Our evaluation shows that PURL significantly outperforms existing countermeasures in terms of accuracy and reducing website breakage while being robust to common evasion techniques. PURL's deployment on a sample of top-million websites shows that link decoration is abused for tracking on nearly three-quarters of the websites, often to share cookies, email addresses, and fingerprinting information.