CGI-Browser-CGI qux.com foo.org geht.net bar.com . p.1/ ?? - PowerPoint PPT Presentation

CGI-Browser-CGI qux.com foo.org geht.net bar.com . – p.1/ ??

CGI-Browser-CGI qux.com foo.org /cgi−bin/img.pl /cgi−bin/img.pl geht.net bar.com /cgi−bin/img.pl /cgi−bin/img.pl . – p.1/ ??

CGI-Browser-CGI qux.com foo.org /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif geht.net bar.com /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif . – p.1/ ??

CGI-Browser-CGI qux.com foo.org /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif geht.net bar.com /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif http://harmless.org/index.html . – p.1/ ??

CGI-Browser-CGI qux.com foo.org /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif geht.net bar.com /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif http://harmless.org/index.html <img src="http://foo.org/cgi−bin/img.pl"> . – p.1/ ??

CGI-Browser-CGI qux.com foo.org /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif geht.net bar.com /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif http://harmless.org/index.html <img src="http://foo.org/cgi−bin/img.pl"> . – p.1/ ??

CGI-Browser-CGI qux.com foo.org /cgi−bin/img.pl /cgi−bin/img.pl img.gif geht.net bar.com spool /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif http://harmless.org/index.html <img src="http://foo.org/cgi−bin/img.pl"> . – p.1/ ??

CGI-Browser-CGI qux.com foo.org /cgi−bin/img.pl /cgi−bin/img.pl img.gif geht.net bar.com spool /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif http://harmless.org/index.html 303 Location http://geht.net/cgi−bin/img.pl?id=aswHu3gw49hh4... <img src="http://foo.org/cgi−bin/img.pl"> . – p.1/ ??

CGI-Browser-CGI qux.com foo.org /cgi−bin/img.pl /cgi−bin/img.pl img.gif geht.net bar.com /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif http://harmless.org/index.html GET /cgi−bin/img.pl?id=aswHu3gw49hh4... . – p.1/ ??

CGI-Browser-CGI qux.com foo.org /cgi−bin/img.pl /cgi−bin/img.pl img.gif geht.net bar.com /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif spool http://harmless.org/index.html . – p.1/ ??

CGI-Browser-CGI qux.com foo.org /cgi−bin/img.pl /cgi−bin/img.pl img.gif geht.net bar.com /cgi−bin/img.pl /cgi−bin/img.pl img.gif img.gif 500 http://harmless.org/index.html Content−Type: image/gif .... . – p.1/ ??

CGI-Browser-CGI qux.com foo.org geht.net bar.com http://some.com/index.html http://some.com/index.html http://some.com/index.html http://some.com/index.html . – p.1/ ??

Same with Acks qux.com foo.org geht.net bar.com http://some.com/index.html <frame src="http://foo.org/ cgi−bin/img.pl"> . – p.2/ ??

Same with Acks qux.com foo.org geht.net bar.com 303 Location http://geht.net/cgi−bin/img.pl?id=9gXe0pl1f... http://some.com/index.html <frame src="http://foo.org/ cgi−bin/img.pl"> . – p.2/ ??

Same with Acks qux.com foo.org geht.net bar.com http://some.com/index.html <frame src="http://foo.org/ cgi−bin/img.pl"> GET /cgi−bin/img.pl?id=9gXe0pl1f... . – p.2/ ??

Same with Acks qux.com foo.org geht.net bar.com http://some.com/index.html <img src="http://foo.org/ cgi−bin/img.pl?ack=0xd34.."> . – p.2/ ??

Same with Acks qux.com foo.org geht.net bar.com GET /cgi−bin/img.pl?ack=0xd34... http://some.com/index.html <img src="http://foo.org/ cgi−bin/img.pl?ack=0xd34.."> . – p.2/ ??

Same with Acks qux.com foo.org geht.net bar.com 500 Content−Type: image/gif ... http://some.com/index.html <img src="http://foo.org/ cgi−bin/img.pl?ack=0xd34.."> . – p.2/ ??

� Other ways Cookies with Domain= .something.tld (Broadcast) . – p.3/ ??

� � Other ways Cookies with Domain= .something.tld (Broadcast) Javascript: . – p.3/ ??

� � � Other ways Cookies with Domain= .something.tld (Broadcast) Javascript: submit prepared FORMs OnLoad . – p.3/ ??

� � � � Other ways Cookies with Domain= .something.tld (Broadcast) Javascript: submit prepared FORMs OnLoad Talking Frames ? . – p.3/ ??

� End Points Have the receiver parse the HTML with a script. . – p.4/ ??

� � End Points Have the receiver parse the HTML with a script. Steganography, but: Where on the Web are images unique per request with sufficient entropy? . – p.4/ ??

� � � End Points Have the receiver parse the HTML with a script. Steganography, but: Where on the Web are images unique per request with sufficient entropy? . – p.4/ ??

� Properties Hapless browsers transport the data, indistinguishable from users of the PET . – p.5/ ??

� � Properties Hapless browsers transport the data, indistinguishable from users of the PET Established protocol (Firewalls, NAT,..) . – p.5/ ??

� � � Properties Hapless browsers transport the data, indistinguishable from users of the PET Established protocol (Firewalls, NAT,..) Anonymity set depends on popularity of web pages . – p.5/ ??