Saw You on the Web

Saw you on the web

"with your permission of course"

A look at cookies downloaded from top sites, their function and possible risks.

By John J Healy

Abstract

Privacy on the internet has been an issue since the outset of the web and have become more focused since the development of cookies. Issues about the effect on users privacy, browsing experience and what information is being stored are to the forefront.

In this paper we set out to analyze the top five sites in ten categories using Alexa.com to select the sites. The types of cookies present are analyzed and a view given as to personal privacy issues based on the information.

We quantify the cookies from each site, look at the replication of cookies across sites, attempt to categorize the cookie function and look at present or past security implication associated with that particular cookie or its owner. Further did these cookies and their associated sites pose any direct risk to us or is there risks associated with how they use the information. Commercially cookies are an essential device for the digital advertising industry and we look at use of cookies by that sector.

Background

Initially some background information regarding cookies and web privacy.

As we browse the web and click from one site to another adding a search term in some instance or inputting personal information in other instance, we are leaving a click stream of personal preferences and possibly personal information.

Since Netscape employee Lou Mountuelli developed the first cookie system for browsers in 1994 which was patented in 1995, web sites are able to glean more information about people browsing. Netscape made no effort to publicize this development and it was left to the Financial times to highlight the possible privacy issues.("Lou Montulli," 2013)

In the intervening years use of cookies has spawned a whole industry and until recent times the person browsing seemed to have little control.

The use and sophistication of cookies has grown in tandem with the growth in the digital advertizing industry and this growth is set to continue as can be seen from Illustration 1. ("Digital to Account for One in Five Ad Dollars - eMarketer," n.d.)

Illustration 1

New legislation in Europe and America has made the use of cookies more transparent with an opt-in or out of cookies now becoming evident on sites. This development is mainly due to the response to privacy violations that have occurred.("EU Directive," n.d.)("Google's unanswered privacy questions: Europe promises action before summer | ZDNet," n.d.)

On the other hand civil rights groups especially in the US point out the Patriot act and the present attempt to introduce the CISPA Act as legislation that interferes with an individual's privacy. If the present ACT is passed into legislation web databases will be forced to give over private information without any need to consult or refer to the person or persons involved. Legislation in any jurisdiction is likely to have implications for every web user because of the growth of cloud computing and big data. ("Microsoft, the USA PATRIOT Act, and European cloud computing : CloudAve," n.d.)("CISPA is back.," n.d.),("Define It - What Is Big Data?," n.d.) .

Cookies can have different functions and time frames, so to provide some clarity we reprint below a cookie definition from webopedia. "Cookies are messages that a Web server transmits to a Web browser so that the Web server can keep track of the user's activity on a specific Web site. The message that the Web server conveys to the browser is in the form of an HTTP header that consists of a text-only string. The text is entered into the memory of the browser. The browser in turn stores the cookie information on the hard drive so when the browser is closed and reopened at a later date the cookie information is still available." App Nexus a technology platform which is used to buy, sell and deliver online advertising gives a good description of the various cookies its platform uses and it has cookies which check configuration, check how many times a user has seen a particular advert , cookies which segment the market, cookies which determine which add to show etc.("AppNexus Cookies," n.d.)

According to Webopedia legitimate cookies generally have the following attributes:

* The name, The value, the expiration date , the URL path the cookie is valid for , the domain the cookie is valid for and if it is only activated in a secure environment.("Do Cookies Compromise Security? - Webopedia.com," n.d.)

Research Methodology

To carry out the research we decided to choose sites in an empirical manner, without the risk of bias towards sites we might visit ourselves. Thus we chose the sites using the ranking and categorization service provided by Alexa.com.

Alexa was formed in 1996 and acquired in 1999 by Amazon ("Alexa Internet," 2013), the website information it trawls and stores is the basis for the waybackmachine, where the previous reincarnations of sites can be viewed.

Some people and organizations would query how they arrive at the Alexa ranking of sites, especially lower ranked sites, but generally web analytics companies agree with the higher ranked companies in sectors. For our research we have cross checked with Quantcast top sites and all the top sites are also evident in their information. Quantcast do not offer category information on their free service

Alexa.com offers web traffic metrics, including average page views per each individual user, bounce rate, and user time on site and further features, including visitor demographics, clickstream and search traffic statistics. Similar to competing companies such as Compete.com and Quantcast.com.

Within Alexa the sites were chosen using the following methodology Alexa divides sites into categories, so we decided to use the top ten categories excluding categories where possible duplication might take place and excluding the Adult category.

Within each category we choose the top five sites, unless the site was already duplicated in another category, in that instance the next ranked site was chosen.

The