There's No Trick, Its Just a Simple Trick: A Web-Compat and Privacy Improving Approach to Third-party Web Storage

While much current web privacy research focuses on browser fingerprinting,\nthe boring fact is that the majority of current third-party web tracking is\nconducted using traditional, persistent-state identifiers. One possible\nexplanation for the privacy community's focus on fingerprinting is that to date\nbrowsers have faced a lose-lose dilemma when dealing with third-party stateful\nidentifiers: block state in third-party frames and break a significant number\nof webpages, or allow state in third-party frames and enable pervasive\ntracking. The alternative, middle-ground solutions that have been deployed all\ntrade privacy for compatibility, rely on manually curated lists, or depend on\nthe user to manage state and state-access themselves. This work furthers\nprivacy on the web by presenting a novel system for managing the lifetime of\nthird-party storage, "page-length storage". We compare page-length storage to\nexisting approaches for managing third-party state and find that page-length\nstorage has the privacy protections of the most restrictive current option\n(i.e., blocking third-party storage) but web-compatibility properties mostly\nsimilar to the least restrictive option (i.e., allowing all third-party\nstorage). This work further compares page-length storage to an alternative\nthird-party storage partitioning scheme and finds that page-length storage\nprovides superior privacy protections with comparable web-compatibility. We\nprovide a dataset of the privacy and compatibility behaviors observed when\napplying the compared third-party storage strategies on a crawl of the Tranco\n1k and the quantitative metrics used to demonstrate that page-length storage\nmatches or surpasses existing approaches. Finally, we provide an open-source\nimplementation of our page-length storage approach, implemented as patches\nagainst Chromium.\n