introduction to computer security
play

Introduction to Computer Security Session 4.4 Web Privacy Prof. - PowerPoint PPT Presentation

Jan 04, 2023 •181 likes •337 views

CSCI-UA.9480 Introduction to Computer Security Session 4.4 Web Privacy Prof. Nadim Kobeissi 4.4a Web Privacy Goals 2 CSCI-UA.9480: Introduction to Computer Security Nadim Kobeissi Web privacy goals. Preventing websites from learning:

  1. CSCI-UA.9480 Introduction to Computer Security Session 4.4 Web Privacy Prof. Nadim Kobeissi

  2. 4.4a Web Privacy Goals 2 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

  3. Web privacy goals. Preventing websites from learning: User identity. ● User behavior. ● Browsing behavior. ● Browser information. ● Location. ● IP address. ● 3 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

  4. As seen previously: Cookies. Cookies act as session identifiers or key-value stores between the web client and web server. ● Once the client logs in, the server may issue POST them a secret session cookie that they both Set-Cookie: then keep track of. NAME=VALUE domain= ● Secure cookies are sent only over HTTPS. expires= httpOnly cookies can be sent over HTTP or secure= ● HTTPS (misleading name) but cannot be accessed by JavaScript via document.cookies . 4 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

  5. Cookies can be used for tracking, too. ● Store unique tracking identifier. Use it to monitor user across the Internet, ● update your model of their behavior, etc. Example: ● Facebook’s “Like” button allows it to monitor people across the entire Internet even when they’re not logged into Facebook, by setting cookies and injecting JS code. 5 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

  6. Panopticlick: test out browser fingerprinting. A “browser fingerprint” can be created by aggregating information about your browser. ● Screen size. ● Time zone. Available system fonts. ● ● Cookies. Language. ● ● Etc. Let’s try it out! https://panopticlick.eff.org/ 6 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

  7. 4.4b Web Privacy Tools 7 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

  8. Privacy Badger: blocks invisible trackers. A “browser fingerprint” can be created by aggregating information about your browser. ● Screen size. ● Time zone. Available system fonts. ● ● Cookies. Language. ● ● Etc. https://www.eff.org/privacybadger/ 8 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

  9. HTTPS Everywhere. Uses a list of rules to translate HTTP addresses to HTTPS. https://www.eff.org/https-everywhere 9 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

  10. Ad blockers: Ublock origin. Use lists to block ads, trackers, even ● malware. Also makes browsing nicer. ● Debatable ethical implications (“acceptable ● ads” a potential solution?) Note: Ublock origin is different from “ Ublock ”. 10 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

  11. Recent legal tools: Europe’s GDPR. Enforces many requirements on services: ● Anonymization and/or encryption of personal data. ● Ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services processing personal data. ● Ability to restore the availability and access to data in a timely manner in the event of a physical or technical incident. ● Process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing. 11 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

  12. Recent legal tools: Europe’s GDPR. Companies must be clear about how all personal data is treated, stored, communicated. Especially important in today’s world, where tracking is used to shake up elections, etc. But is it enough? Is it even relevant? 12 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

  13. Motivating example: Cambridge Analytica. More about this at December 3 rd event! ● Harvested Facebook profile data through the permission dialogues people consented to for access to personality quizzes and the like (“Which Harry Potter Character Are You?”) etc. 13 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

  14. 4.5 Next time: Spam and Abuse 14 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi

Recommend

Introduction to Computer Security Rev. Sept 2015 What is Computer Security? 2 Computer

Introduction to Computer Security Rev. Sept 2015 What is Computer Security? 2 Computer

Introduction to Computer Security Rev. Sept 2015 What is Computer Security? 2 Computer Security is the protection of computing systems and the data that they store or access 3 Why is Computer Security Important? Computer Security allows

690 views • 19 slides
Introduction to Computer Security Why do we need computer security? What are our goals and

Introduction to Computer Security Why do we need computer security? What are our goals and

Introduction to Computer Security Why do we need computer security? What are our goals and what threatens them? Lecture 1 Page 1 CS 236 Online Why Is Security Necessary? Because people arent always nice Because a lot of

415 views • 25 slides
Introduction Attacks Security Goals Fall 2010 CS 334 Computer Security 1 What is Computer

Introduction Attacks Security Goals Fall 2010 CS 334 Computer Security 1 What is Computer

Introduction Attacks Security Goals Fall 2010 CS 334 Computer Security 1 What is Computer Security? Generally concerned with protection of computer related assets Risk analysis and management! Manage could mean prevention of

537 views • 26 slides
Outline The web from a security perspective CSci 5271 Introduction to Computer Security SQL

Outline The web from a security perspective CSci 5271 Introduction to Computer Security SQL

Outline The web from a security perspective CSci 5271 Introduction to Computer Security SQL injection Web security, part 1 Announcements intermission Stephen McCamant University of Minnesota, Computer Science & Engineering Web

522 views • 5 slides
Outline Usability and security CSci 5271 Introduction to Computer Security Announcements

Outline Usability and security CSci 5271 Introduction to Computer Security Announcements

Outline Usability and security CSci 5271 Introduction to Computer Security Announcements intermission Day 24: Usability and security Stephen McCamant Usable security example areas University of Minnesota, Computer Science & Engineering

219 views • 5 slides
Outline Usability and security CSci 5271 Introduction to Computer Security Announcements

Outline Usability and security CSci 5271 Introduction to Computer Security Announcements

Outline Usability and security CSci 5271 Introduction to Computer Security Announcements intermission Day 25: Usability and security Stephen McCamant Usable security example areas University of Minnesota, Computer Science & Engineering

419 views • 4 slides
Foundations of Network and Foundations of Network and Computer Security Computer Security J ohn

Foundations of Network and Foundations of Network and Computer Security Computer Security J ohn

Foundations of Network and Foundations of Network and Computer Security Computer Security J ohn Black J CSCI 6268/TLEN 5831, Fall 2004 Introduction UC Davis PhD in 2000 Cryptography Interested in broader security as well

492 views • 12 slides
CSCI 8260 Spring 2016 Computer and Networks Security INTRODUCTION 1 Research in Computer

CSCI 8260 Spring 2016 Computer and Networks Security INTRODUCTION 1 Research in Computer

CSCI 8260 Spring 2016 Computer and Networks Security INTRODUCTION 1 Research in Computer Security Studies in what ways security mechanisms may fail Can we gain access to a computer system without authorizaDon? Can we compromise

986 views • 84 slides
Outline CSci 5271 Big-Picture Introduction Introduction to Computer Security Day 1:

Outline CSci 5271 Big-Picture Introduction Introduction to Computer Security Day 1:

Outline CSci 5271 Big-Picture Introduction Introduction to Computer Security Day 1: Introduction and Logistics Course Logistics Stephen McCamant University of Minnesota, Computer Science & Engineering What is computer security? Two

362 views • 7 slides
Outline Brief introduction to networking CSci 5271 Introduction to Computer Security

Outline Brief introduction to networking CSci 5271 Introduction to Computer Security

Outline Brief introduction to networking CSci 5271 Introduction to Computer Security Announcements intermission Day 13: Network, etc., security overview Some classic network attacks Stephen McCamant University of Minnesota, Computer Science

504 views • 5 slides
Introduction to Computer Security Formal Security Models Pavel Laskov Wilhelm Schickard

Introduction to Computer Security Formal Security Models Pavel Laskov Wilhelm Schickard

Introduction to Computer Security Formal Security Models Pavel Laskov Wilhelm Schickard Institute for Computer Science Security instruments learned so far Symmetric and asymmetric cryptography confidentiality, integrity, non-repudiation

319 views • 29 slides
Outline Security risk and management Some terminology CSci 5271 Introduction to Computer

Outline Security risk and management Some terminology CSci 5271 Introduction to Computer

Outline Security risk and management Some terminology CSci 5271 Introduction to Computer Security Logistics intermission Day 2: Intro to Software and OS Security Example security failures Stephen McCamant University of Minnesota, Computer

608 views • 8 slides
Outline Security risk and management Some terminology CSci 5271 Introduction to Computer

Outline Security risk and management Some terminology CSci 5271 Introduction to Computer

Outline Security risk and management Some terminology CSci 5271 Introduction to Computer Security Logistics intermission Day 2: Intro to Software and OS Security Example security failures Stephen McCamant University of Minnesota, Computer

395 views • 7 slides
INTRODUCTION COMPUTER & NETWORK SECURITY CMSC 414 JAN 25 2018 TODAY What is

INTRODUCTION COMPUTER & NETWORK SECURITY CMSC 414 JAN 25 2018 TODAY What is

INTRODUCTION COMPUTER & NETWORK SECURITY CMSC 414 JAN 25 2018 TODAY What is security? Why is it so hard to achieve? Administrative The security mindset Analyzing a systems security 1. Summarize the system 2.

801 views • 43 slides
INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT

INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT

ADVANCED COMPUTER SECURITY INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT IS SECURITY? A systems security policies describe What the system is supposed to do Store and provide access

479 views • 16 slides
Introduction to Computing Principles

Introduction to Computing Principles

Introduction to Computing Principles Computer Safe Computer Security Attacks Practices What is Computer Security? Computer Security, also known as cybersecurity or IT

974 views • 63 slides
Outline Elections and their security CSci 5271 Introduction to Computer Security System

Outline Elections and their security CSci 5271 Introduction to Computer Security System

Outline Elections and their security CSci 5271 Introduction to Computer Security System security of electronic voting Electronic voting Announcements intermission Stephen McCamant University of Minnesota, Computer Science & Engineering

420 views • 5 slides
Session 1 Introduction to Computer Security Sbastien Combfis Fall 2019 This work is

Session 1 Introduction to Computer Security Sbastien Combfis Fall 2019 This work is

I5020 Computer Security Session 1 Introduction to Computer Security Sbastien Combfis Fall 2019 This work is licensed under a Creative Commons Attribution NonCommercial NoDerivatives 4.0 International License. Objectives Computer

864 views • 61 slides
CSE 543 - Computer Security Lecture 2 - Introduction August 30, 2007 URL:

CSE 543 - Computer Security Lecture 2 - Introduction August 30, 2007 URL:

CSE 543 - Computer Security Lecture 2 - Introduction August 30, 2007 URL: http://www.cse.psu.edu/~tjaeger/cse543-f07/ CSE543 Computer (and Network) Security - Fall 2007 - Professor Jaeger 1 A historical moment Mary Queen of Scots is

631 views • 29 slides
Outline SSL/TLS DNSSEC CSci 5271 Introduction to Computer Security Announcements intermission

Outline SSL/TLS DNSSEC CSci 5271 Introduction to Computer Security Announcements intermission

Outline SSL/TLS DNSSEC CSci 5271 Introduction to Computer Security Announcements intermission Day 19: Web security, part 1 The web from a security perspective Stephen McCamant University of Minnesota, Computer Science & Engineering SQL

492 views • 9 slides
Introduction CMSC 414: Computer and Network Security Spring 2016 What is computer & network

Introduction CMSC 414: Computer and Network Security Spring 2016 What is computer & network

Introduction CMSC 414: Computer and Network Security Spring 2016 What is computer & network security? Normally, we are concerned with correctness Does the software achieve the desired behavior? Security is a form of correctness

682 views • 47 slides
Introduction to Computer Security Cunsheng Ding HKUST, Hong Kong, CHINA cding@cs.ust.hk C.

Introduction to Computer Security Cunsheng Ding HKUST, Hong Kong, CHINA cding@cs.ust.hk C.

Introduction to Computer Security Cunsheng Ding HKUST, Hong Kong, CHINA cding@cs.ust.hk C. Ding - COMP4631 - L02 1 Outline of this Lecture A brief introduction to computer security A theoretical framework of computer security

972 views • 47 slides
Outline SSH SSL/TLS CSci 5271 DNSSEC Introduction to Computer Security Announcements

Outline SSH SSL/TLS CSci 5271 DNSSEC Introduction to Computer Security Announcements

Outline SSH SSL/TLS CSci 5271 DNSSEC Introduction to Computer Security Announcements intermission Protocols and web combined slides The web from a security perspective Stephen McCamant SQL injection University of Minnesota, Computer

490 views • 11 slides
Introduction to Computer Security UNIX Security Pavel Laskov Wilhelm Schickard Institute for

Introduction to Computer Security UNIX Security Pavel Laskov Wilhelm Schickard Institute for

Introduction to Computer Security UNIX Security Pavel Laskov Wilhelm Schickard Institute for Computer Science Genesis: UNIX vs. MULTICS MULTICS (Multiplexed Information and Computing Service) a high-availability, modular, multi-component

480 views • 35 slides

More recommend