{"id":"https://openalex.org/W3082301429","doi":"https://doi.org/10.2478/popets-2020-0070","title":"No boundaries: data exfiltration by third parties embedded on web pages","display_name":"No boundaries: data exfiltration by third parties embedded on web pages","publication_year":2020,"publication_date":"2020-08-17","ids":{"openalex":"https://openalex.org/W3082301429","doi":"https://doi.org/10.2478/popets-2020-0070","mag":"3082301429"},"language":"en","primary_location":{"id":"doi:10.2478/popets-2020-0070","is_oa":true,"landing_page_url":"https://doi.org/10.2478/popets-2020-0070","pdf_url":null,"source":{"id":"https://openalex.org/S4210183172","display_name":"Proceedings on Privacy Enhancing Technologies","issn_l":"2299-0984","issn":["2299-0984"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320322","host_organization_name":"De Gruyter Open","host_organization_lineage":["https://openalex.org/P4310320322","https://openalex.org/P4310313990"],"host_organization_lineage_names":["De Gruyter Open","De Gruyter"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings on Privacy Enhancing Technologies","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.2478/popets-2020-0070","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5011677863","display_name":"G\u00fcne\u015f Acar","orcid":"https://orcid.org/0000-0002-1621-8333"},"institutions":[{"id":"https://openalex.org/I196972281","display_name":"Imec the Netherlands","ror":"https://ror.org/01ezq2j76","country_code":"NL","type":"facility","lineage":["https://openalex.org/I196972281"]},{"id":"https://openalex.org/I20089843","display_name":"Princeton University","ror":"https://ror.org/00hx57361","country_code":"US","type":"education","lineage":["https://openalex.org/I20089843"]},{"id":"https://openalex.org/I99464096","display_name":"KU Leuven","ror":"https://ror.org/05f950310","country_code":"BE","type":"education","lineage":["https://openalex.org/I99464096"]}],"countries":["BE","NL","US"],"is_corresponding":false,"raw_author_name":"Gunes Acar","raw_affiliation_strings":["imec-COSIC KU Leuven","Princeton University","imec-COSIC KU Leuven,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"imec-COSIC KU Leuven","institution_ids":["https://openalex.org/I196972281","https://openalex.org/I99464096"]},{"raw_affiliation_string":"Princeton University","institution_ids":["https://openalex.org/I20089843"]},{"raw_affiliation_string":"imec-COSIC KU Leuven,","institution_ids":["https://openalex.org/I196972281","https://openalex.org/I99464096"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075220166","display_name":"Steven Englehardt","orcid":null},"institutions":[{"id":"https://openalex.org/I196972281","display_name":"Imec the Netherlands","ror":"https://ror.org/01ezq2j76","country_code":"NL","type":"facility","lineage":["https://openalex.org/I196972281"]},{"id":"https://openalex.org/I20089843","display_name":"Princeton University","ror":"https://ror.org/00hx57361","country_code":"US","type":"education","lineage":["https://openalex.org/I20089843"]},{"id":"https://openalex.org/I99464096","display_name":"KU Leuven","ror":"https://ror.org/05f950310","country_code":"BE","type":"education","lineage":["https://openalex.org/I99464096"]}],"countries":["BE","NL","US"],"is_corresponding":false,"raw_author_name":"Steven Englehardt","raw_affiliation_strings":["Mozilla","imec-COSIC KU Leuven,","Princeton University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Mozilla","institution_ids":[]},{"raw_affiliation_string":"imec-COSIC KU Leuven,","institution_ids":["https://openalex.org/I196972281","https://openalex.org/I99464096"]},{"raw_affiliation_string":"Princeton University","institution_ids":["https://openalex.org/I20089843"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5058102069","display_name":"Arvind Narayanan","orcid":"https://orcid.org/0000-0001-7176-4479"},"institutions":[{"id":"https://openalex.org/I196972281","display_name":"Imec the Netherlands","ror":"https://ror.org/01ezq2j76","country_code":"NL","type":"facility","lineage":["https://openalex.org/I196972281"]},{"id":"https://openalex.org/I20089843","display_name":"Princeton University","ror":"https://ror.org/00hx57361","country_code":"US","type":"education","lineage":["https://openalex.org/I20089843"]},{"id":"https://openalex.org/I99464096","display_name":"KU Leuven","ror":"https://ror.org/05f950310","country_code":"BE","type":"education","lineage":["https://openalex.org/I99464096"]}],"countries":["BE","NL","US"],"is_corresponding":false,"raw_author_name":"Arvind Narayanan","raw_affiliation_strings":["Princeton University","imec-COSIC KU Leuven,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Princeton University","institution_ids":["https://openalex.org/I20089843"]},{"raw_affiliation_string":"imec-COSIC KU Leuven,","institution_ids":["https://openalex.org/I196972281","https://openalex.org/I99464096"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.2824,"has_fulltext":true,"cited_by_count":29,"citation_normalized_percentile":{"value":0.90532016,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"2020","issue":"4","first_page":"220","last_page":"238"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/login","display_name":"Login","score":0.8691697120666504},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.7334067225456238},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.6586928367614746},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6425378322601318},{"id":"https://openalex.org/keywords/password","display_name":"Password","score":0.6111573576927185},{"id":"https://openalex.org/keywords/third-party","display_name":"Third party","score":0.6070877909660339},{"id":"https://openalex.org/keywords/web-page","display_name":"Web page","score":0.5225386619567871},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.511559784412384},{"id":"https://openalex.org/keywords/suite","display_name":"Suite","score":0.4904644191265106},{"id":"https://openalex.org/keywords/web-application","display_name":"Web application","score":0.41243448853492737},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.4007452428340912},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.11274445056915283}],"concepts":[{"id":"https://openalex.org/C113324615","wikidata":"https://www.wikidata.org/wiki/Q472302","display_name":"Login","level":2,"score":0.8691697120666504},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.7334067225456238},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.6586928367614746},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6425378322601318},{"id":"https://openalex.org/C109297577","wikidata":"https://www.wikidata.org/wiki/Q161157","display_name":"Password","level":2,"score":0.6111573576927185},{"id":"https://openalex.org/C2983583741","wikidata":"https://www.wikidata.org/wiki/Q16785388","display_name":"Third party","level":2,"score":0.6070877909660339},{"id":"https://openalex.org/C21959979","wikidata":"https://www.wikidata.org/wiki/Q36774","display_name":"Web page","level":2,"score":0.5225386619567871},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.511559784412384},{"id":"https://openalex.org/C79581498","wikidata":"https://www.wikidata.org/wiki/Q1367530","display_name":"Suite","level":2,"score":0.4904644191265106},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.41243448853492737},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.4007452428340912},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.11274445056915283},{"id":"https://openalex.org/C166957645","wikidata":"https://www.wikidata.org/wiki/Q23498","display_name":"Archaeology","level":1,"score":0.0},{"id":"https://openalex.org/C95457728","wikidata":"https://www.wikidata.org/wiki/Q309","display_name":"History","level":0,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.2478/popets-2020-0070","is_oa":true,"landing_page_url":"https://doi.org/10.2478/popets-2020-0070","pdf_url":null,"source":{"id":"https://openalex.org/S4210183172","display_name":"Proceedings on Privacy Enhancing Technologies","issn_l":"2299-0984","issn":["2299-0984"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320322","host_organization_name":"De Gruyter Open","host_organization_lineage":["https://openalex.org/P4310320322","https://openalex.org/P4310313990"],"host_organization_lineage_names":["De Gruyter Open","De Gruyter"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings on Privacy Enhancing Technologies","raw_type":"journal-article"},{"id":"pmh:oai:lirias2repo.kuleuven.be:123456789/671533","is_oa":true,"landing_page_url":"https://lirias.kuleuven.be/handle/123456789/671533","pdf_url":"https://lirias.kuleuven.be/bitstream/123456789/671533/2/article-3196.pdf","source":{"id":"https://openalex.org/S7407055369","display_name":"Lirias","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Proceedings on Privacy Enhancing Technologies, vol. 2020 (4), Art.No. 4, (220-238)","raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:doaj.org/article:696cbbf1f27a402296869b21e67056bd","is_oa":false,"landing_page_url":"https://doaj.org/article/696cbbf1f27a402296869b21e67056bd","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Proceedings on Privacy Enhancing Technologies, Vol 2020, Iss 4, Pp 220-238 (2020)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.2478/popets-2020-0070","is_oa":true,"landing_page_url":"https://doi.org/10.2478/popets-2020-0070","pdf_url":null,"source":{"id":"https://openalex.org/S4210183172","display_name":"Proceedings on Privacy Enhancing Technologies","issn_l":"2299-0984","issn":["2299-0984"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320322","host_organization_name":"De Gruyter Open","host_organization_lineage":["https://openalex.org/P4310320322","https://openalex.org/P4310313990"],"host_organization_lineage_names":["De Gruyter Open","De Gruyter"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings on Privacy Enhancing Technologies","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Quality Education","id":"https://metadata.un.org/sdg/4","score":0.6000000238418579}],"awards":[{"id":"https://openalex.org/G3226550142","display_name":"TWC: Small: Online tracking: Threat Detection, Measurement and Response","funder_award_id":"1526353","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G349501025","display_name":null,"funder_award_id":"CNS 1526353","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G4435414571","display_name":null,"funder_award_id":"VR20192203","funder_id":"https://openalex.org/F4320327336","funder_display_name":"Vlaamse regering"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320321730","display_name":"Fonds Wetenschappelijk Onderzoek","ror":"https://ror.org/03qtxy027"},{"id":"https://openalex.org/F4320327336","display_name":"Vlaamse regering","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W1818320871","https://openalex.org/W1927921928","https://openalex.org/W1995290095","https://openalex.org/W2025636081","https://openalex.org/W2123582298","https://openalex.org/W2146717998","https://openalex.org/W2208157769","https://openalex.org/W2401729792","https://openalex.org/W2535603283","https://openalex.org/W2580132588","https://openalex.org/W2604173668","https://openalex.org/W2604188240","https://openalex.org/W2753515421","https://openalex.org/W2758544228","https://openalex.org/W2782867239","https://openalex.org/W2783255459","https://openalex.org/W2784134919","https://openalex.org/W2796498984","https://openalex.org/W3004148183","https://openalex.org/W3012679427","https://openalex.org/W3098133640"],"related_works":["https://openalex.org/W4231704780","https://openalex.org/W143386018","https://openalex.org/W1004582678","https://openalex.org/W2083794993","https://openalex.org/W2656445685","https://openalex.org/W352609212","https://openalex.org/W2115218409","https://openalex.org/W1511772879","https://openalex.org/W4379115841","https://openalex.org/W2090949570"],"abstract_inverted_index":{"Abstract":[0],"We":[1,56,125],"investigate":[2],"data":[3,25,96,113],"exfiltration":[4],"by":[5,145],"third-party":[6,69,150],"scripts":[7],"directly":[8],"embedded":[9],"on":[10,46],"web":[11,51],"pages.":[12],"Specifically,":[13],"we":[14,39,106],"study":[15],"three":[16],"attacks:":[17],"misuse":[18],"of":[19,33,48,85,122,137],"browsers\u2019":[20],"internal":[21],"login":[22,80],"managers,":[23],"social":[24,94],"exfiltration,":[26],"and":[27,62,90,92,111,140,152],"whole-DOM":[28],"exfiltration.":[29],"Although":[30],"the":[31,41,86,98,123,127,131,134,146],"possibility":[32],"these":[34,65],"attacks":[35,66],"was":[36],"well":[37],"known,":[38],"provide":[40],"first":[42],"empirical":[43],"evidence":[44],"based":[45],"measurements":[47],"300,000":[49],"distinct":[50],"pages":[52],"from":[53,130],"50,000":[54],"sites.":[55],"extend":[57],"OpenWPM\u2019s":[58],"instrumentation":[59],"to":[60,67,82,115,119,133],"detect":[61],"precisely":[63],"attribute":[64],"specific":[68],"scripts.":[70],"Our":[71],"analysis":[72],"reveals":[73],"invasive":[74],"practices":[75],"such":[76],"as":[77],"inserting":[78],"invisible":[79],"forms":[81],"trigger":[83],"autofilling":[84],"saved":[87],"user":[88,99],"credentials,":[89],"reading":[91],"exfiltrating":[93],"network":[95],"when":[97],"logs":[100],"in":[101],"via":[102],"Facebook":[103],"login.":[104],"Further,":[105],"uncovered":[107],"password,":[108],"credit":[109],"card,":[110],"health":[112],"leaks":[114],"third":[116],"parties":[117],"due":[118],"wholesale":[120],"collection":[121],"DOM.":[124],"discuss":[126],"lessons":[128],"learned":[129],"responses":[132],"initial":[135],"disclosure":[136],"our":[138],"findings":[139],"fixes":[141],"that":[142],"were":[143],"deployed":[144],"websites,":[147],"browser":[148],"vendors,":[149],"libraries":[151],"privacy":[153],"protection":[154],"tools.":[155]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":7},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":1}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}