We present a study of how local frames (i.e., iframes loading content like ''about:blank'') are mishandled by a wide range of popular Web security and privacy tools. As a result, users of these tools remain vulnerable to the very attack techniques against which they seek to protect themselves, including browser fingerprinting, cookie-based tracking, and data exfiltration. The tools we study are vulnerable in different ways, but all share a root cause: legacy Web functionality interacts with browser privacy boundaries in unexpected ways, leading to systemic vulnerabilities in tools developed, maintained, and recommended by privacy experts and activists.

Browser fingerprinting is often associated with cross-site user tracking, a practice that many browsers (e.g., Safari, Brave, Edge, Firefox, and Chrome) want to block. However, less is publicly known about its uses to enhance online safety, where it can provide an additional security layer against service abuses (e.g., in combination with CAPTCHAs) or during user authentication. To the best of our knowledge, no fingerprinting defenses deployed thus far consider this important distinction when blocking fingerprinting attempts, so they might negatively affect website functionality and security.

This work presents a systematic study of UID smuggling, an emerging tracking technique that is designed to evade browsers' privacy protections. Browsers are increasingly attempting to prevent cross-site tracking by partitioning the storage where trackers store user identifiers (UIDs). UID smuggling allows trackers to synchronize UIDs across sites by inserting UIDs into users' navigation requests. Trackers can thus regain the ability to aggregate users' activities and behaviors across sites, in defiance of browser protections.

Governments around the world enacted stay-at-home orders in response to the COVID-19 pandemic, which changed many aspects of life, including how people interacted with the Internet. These draconian restrictions on in-person social interactions were perhaps most acutely felt by people living alone. We study the changes in network traffic of one such population, students remaining in the (single-occupancy) on-campus dormitories at a large residential educational institution during the onset and initial few months of the lock-down. Specifically, we analyze how students shifted their online work and leisure behaviors at an application level. Further, we segment the population into domestic and international students, and find that even within these two broad sub-populations, there are significant differences in Internet-based behavior. Our work provides a focused lens on pandemic Internet usage, examining both 1) a concentrated user population and 2) the differing impacts of a global pandemic on disparate sub-populations.