A first look at the privacy harms of the public suffix list
Abstract
The public suffix list is a community-maintained list of rules that can be applied to domain names to determine how they should be grouped into logical organizations or companies. We present the first large-scale measurement study of how the public suffix list is used by open-source software on the Web and the privacy harm resulting from projects using outdated versions of the list. We measure how often developers include out-of-date versions of the public suffix list in their projects, how old included lists are, and estimate the real-world privacy harm with a model based on a large-scale crawl of the Web. We find that incorrect use of the public suffix list is common in open-source software, and that at least 43 open-source projects use hard-coded, outdated versions of the public suffix list. These include popular, security-focused projects, such as password managers and digital forensics tools. We also estimate that, because of these out-of-date lists, these projects make incorrect privacy decisions for 1313 effective top-level domains (eTLDs), affecting 50,750 domains, by extrapolating from data gathered by the HTTP Archive project.
Citation
McQuistin , S , Snyder , P , Perkins , C , Haddadi , H & Tyson , G 2023 , A first look at the privacy harms of the public suffix list . in IMC '23: Proceedings of the 2023 ACM on Internet Measurement Conference . ACM , New York, NY , pp. 383–390 , ACM Internet Measurement Conference 2023 , Montreal , Canada , 24/10/23 . https://doi.org/10.1145/3618257.3624836 conference
Publication
IMC '23: Proceedings of the 2023 ACM on Internet Measurement Conference
Type
Conference item
Description
Funding: This work was supported in part by the UK Engineering and Physical Sciences Research Council under grant EP/S036075/1.Collections
Items in the St Andrews Research Repository are protected by copyright, with all rights reserved, unless otherwise indicated.