Untangling the Web Tracking Ecosystem to Design Effective Defenses PDF Free Download
1 / 80/80
100%
HAL Id: tel-05316147
https://hal.science/tel-05316147v1
Submitted on 15 Oct 2025
HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entic research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.
L’archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diusion de documents
scientiques de niveau recherche, publiés ou non,
émanant des établissements d’enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.
Untangling the Web Tracking Ecosystem to Design
Eective Defenses
Pierre Laperdrix
To cite this version:
Pierre Laperdrix. Untangling the Web Tracking Ecosystem to Design Eective Defenses. Web. Uni-
versité de Lille, 2025. �tel-05316147�
présentée et soutenue publiquement le 13 octobre 2025 par
Pierre Laperdrix
Abstract
Résumé
Contents
1 Introduction 4
2 Web tracking 9
3 Exploring novel web defenses 38
4 Conclusions and perspectives 61
Chapter 1
Introduction
1.1 Context
1.1.1 What is so special about the web architecture
web
lemonde.fr
LeMonde.fr
LeMonde.fr
Le Monde
Le Monde
Le
Monde
a single webpage
hundreds of requests
1.1.2 What is online tracking and why we all should care about it
Online tracking
▶
▶
▶
▶
▶
▶
1.1.3 e current shi in the ad industry
interest-based advertising
identity graphs
contextual advertising
Server-side tagging
1.2 Challenges
the frantic pace of evolution
the complexity of a web browser
what is happening on the server
side
1.3 My research
1.4 Organisation of this manuscript
▶Chapter 2
▶Chapter 3
▶Chapter 4
Chapter 2
Web tracking
A problem does not have to reach our
doorstep for it to be our responsibility.
e problem
▶
–
dailymail.co.uk
–
dailymail.co.uk
–
▶
How did we reach this point?
e ultimate goal
My work
▶
▶
2.1 Understanding the current tracking ecosystem
2.1.1 Deepening our understanding of known and new tracking techniques
Impact of browser ngerprinting at a large scale
AmIUnique.org
▶
▶
▶
WWW
OS Study data AmIUnique StatCounter
<
H X
x1;...;xn P(X)
H(X) = −
n
∑
i=1
p(xi)2p(xi)
H(X)/HM
HM
Impact of the IP address on online tracking
WWW
Maxmind GeoLite2 database
Who is my ISP?
0 5 10 15 20 25 30 35 40
11.59
5.04
19.62
36.96
3.95
18.39
4.52
21.38
18.93
5.42
Retention Period Percentage Number of IPs
<
>
Hiding tracking techniques on the server side
Proc. Priv. Enhancing
Technol.
a pre-SST crawl
a post-SST crawl
a User specic crawl
Takeaways
▶
▶
▶
2.1.2 Reliance on third parties
Understanding tracking made by third parties in Android games
WWW
AndroZoo
Tracker Reports
+
Game Metadata
games list
+ metadata
games list
+ metadata
free game
APKs
free + paid
game APKs
download
games from
AndroZoo
download
games from
Play Pass
Perform Exodus analysis
collect list of games
collect list of games
collect game
metadata
Play
Store
1) AndroZoo games collection
2) Play Pass games collection
3) Exodus analysis
Play Pass
Play
Store
collect game
metadata
1
2
3
6,035 0 6,035
320 396 716
6,355 396 6,751
▶
▶
▶
▶
▶
▶
▶
▶
▶
1∼12 0∼4
Advertisement Analytics Identification Profiling Location Crash_reporting
0.0
0.5
1.0
1.5
2.0
2.5
Number of trackers
Free
Paid
Advertisement Analytics Identification Profiling Location Crash_reporting
0.0
0.5
1.0
1.5
2.0
2.5
Number of trackers
Normal
Teacher approved
Understanding the dangers of trusting third parties
AsiaCCS
Domain RelaxationpostMessages CORS
4,454
▶
www.americanexpress.com
americanexpress.com
▶
▶
Understanding the dangers of relying on a third-party free proxy
MADWeb
2024 - Workshop on Measurements, Aacks, and Defenses for the Web
10.14722/madweb.2024.23035 https://hal.science/
hal-04489166
▶
▶
▶
Takeaways
2.1.3 Fragmentation of browsers
NDSS
Category Content # Tests
Same-Origin Policy
Cookie
X-Frame-Options header
X-Content-Type-Options header
Iframe sandbox aribute
Content Security Policy
Referrer policy
Strict-Transport-Security header
Total
Rank Package name # Installs # Versions Oldest Latest
1
1
4
5
5
3
2
7
3
3
5
2
1
4
2
2
7
3
3
5
1
1
1
4
5
3
1
1
6
4
3
5
0
5
10
15
20
CSP Cookie
Referrer−Policy
X−Frame−Options
Strict−Transport−Security
X−Content−Type−Options
Security mechanism category
# browser families
Year: 2018 2017 2016 2015 2014 2013 2012 2011
0
5
10
15
20
25
SOP CSP Cookie
Referrer−Policy
X−Frame−Options
Strict−Transport−Security
X−Content−Type−Options
Iframe sandbox
Security mechanism category
% browser families
Regression type:
Permanent regression
Temporary regression
Takeaways
2.2 Trying to nd new ways to leak information and identify users
2.2.1 Deepening the world of ngerprinting by looking at the hardware
ACM Trans. Web
EuroS&P
Designing a GPU ngerprinting technique
NDSS
stall function
trace
Graphical Processing Unit
... ...
1
2
3
Browser
Main render loop (JavaScript)
requestAnimationFrame
drawArrays
OpenGL API
Operating System
GPU Drivers
deterministic
non-deterministic
0
1
2
3
4
0 0.2 0.4 0.6 0.8 1 1.2 1.4 1.6
Probability Density
Euclidean Distance
Same device
Diff. device, same renderer
Diff. device, diff. renderer
Takeaways
2.2.2 Investigating the side eects of extensions on browser ngerprinting
WWW
USENIX
Security Symposium
▶
▶
getComputedStyle
getComputedStyle
Takeaways
2.2.3 Identifying weaknesses in standards
BaeryManager
Proc. Priv. Enhancing Technol.
i.e.
▶Expires
Cache-Control
HTTP/1.1
▶Cache-Control Cache-Control
HTTP/1.1
Expires Expires
Cache-Control
max-age
Cache-Control max-age=3600
60 3,600
▶
Cache-Control:max-age
xed expiry date
User 1 :
Date =Fri, 28 Aug 2020 12:00:00 GMT
Expires =Mon, 31 Aug 2020 12:00:00 GMT
max-age =259200
User 2 :
Date =Fri, 28 Aug 2020 12:01:00 GMT
Expires =Mon, 31 Aug 2020 12:00:00 GMT
max-age =259140
max-age
max-age
fixed expiry date
Date =xed expiry date −Cache-Control:max-age
▶
Expires
User 1 :
Date =Fri, 21 Aug 2020 04:08:15 GMT
Expires =Mon, 24 Aug 2020 04:08:15 GMT
max-age =259200
User 2 :
Date =Fri, 21 Aug 2020 16:23:42 GMT
Expires =Mon, 24 Aug 2020 16:23:42 GMT
max-age =259200
max-age
Expires Expires
Date =Expires −xed expiry duration
Cache-Control Expires
Takeaways
2.3 Discussion
▶
▶
▶
Chapter 3
Exploring novel web defenses
For those who come aer.
e problem
Secure HpOnly
SameSite
e ultimate goal
My work
▶
▶
▶
3.1 Leveraging ngerprinting to improve security
3.1.1 Detecting bots and suspicious browsing environments
Understanding how commercial anti-bot services work
DIMVA
Fingerprint & Events
Server Side Events
Risk Score /
Recommended Action
Web Browser
Web ServerAnti-bot Service
HTTP Connection
Create Automation Scripts
For Each Triplet
(Target, Attack, Tool)
0. Data Collection
PublicWWW NerdyData Alexa Top
1M
1. Test Preparation
Anti-Bot Protected Websites
Anti-Bot Service
Signatures
Prepare Attack Sites
Campus IPs Cloud IPs
2. Test Execution
Execute Selected Attack
Anti-Bot Protected Websites
Randomly Selected
Representative Clients
3. Post-processing of Results
Web Automation Tools
Commercial/Research
Anti-Fingerprinting Tools
Blink
Python AppleScript
FraudFox
Selenium
Web Server User Actions
Anti-Bot Service
Verdict .
Decision To Block
Browsing Session Fingerprint
▶
▶
▶
▶
Understanding the dangers of anti-ngerprinting countermeasures
USENIX Security Symposium
DIMVA
▶
inconsistent
OS navigator.platform WebGL Renderer WebGL Vendor
▶
▶
Takeaways
▶
▶
▶
3.1.2 Reinforcing authentication with ngerprinting
Tracking ngerprint evolutions over time
IEEE Symposium on Security and Privacy
▶Automatic evolutions
▶Context-dependent evolutions
▶User-triggered evolutions
th th
Attribute Trigger 50th 90th 95th
Percentile (days)
Designing a novel system based on canvas ngerprinting
Morellian Analysis
protocol challenge generation
DIMVA
•Step #1 c1 c2
▶ c1
▶ c2 r2
c2
•Step #2 f
k
•Step #3
▶String Content.
▶Size and rotation of strings.
▶Curves.
▶Color gradient.
▶Number of strings and curves.
▶Shadow.
Measuring the use of ngerprinting for online authentication
DIMVA
Takeaways
FP-STALKER Morellian Analysis
3.2 Exploring novel protective solutions with minimum page break-
age
3.2.1 A web without JavaScript?
Reliance of the modern web on JavaScript
ACM Trans. Internet Techn.
an element is
considered broken if, due to JavaScript being disabled, it fails to perform its intended func-
tion from a user’s perspective
▶
<img> <picture>
▶
▶
▶
▶
▶
Web crawl
Hispar list
URL filter
(top 3 URLs
of each domain)
JS
Browser
NoJS
Browser
Differential
breakage
analysis
(heuristics)
Visual
differential
breakage
analysis
100 k URLs 6384 URLs
5241 screenshots
5741 pages
(breakage count)
5966 pages
(breakage count)
5610 screenshots
javascript.enabled false
DOMContentLoaded
load
▶counts of broken and working elements
▶a page screenshot
▶the page DOM
▶
▶
▶
▶
▶
▶
A technical solution to reduce JavaScript dependency
WWW (Companion Volume)
<noscript>
<input type=”radio”>
position: sticky
<input type=”checkbox”>
<input type=”radio”>
<input type=”checkbox”>
<input type=”checkbox”>
<input type=”radio”>:target
<input type=”checkbox”>
<input type=”checkbox”>
no access to viewport in CSS
<input type=”checkbox”>
:hover:focus
cannot replicate autocompletion
Can we live without JavaScript?
▶
▶
▶
▶
Takeaways
3.2.2 A web without ngerprintable attributes?
WPES@CCS
Cascading Style Sheets
JavaScript
HTML markup
HTML content
JavaScript CSS
visual rendering
”None”
HTML
structure
HTML
content
Visual
rendering
JavaScript
CSS
60
70
80
Chromium vs. Chromium-None (CCN)
Firefox vs. Firefox-None (FFN)
Webkit vs. WebKit-None (WWN)
www.academiabarilla.it
▶
▶
▶
▶
▶
▶
Takeaways
UA-
Radar User Agent
3.3 Discussion
Chapter 4
Conclusions and perspectives
4.1 Main results
4.2 Perspectives
4.2.1 On the importance of secure designs
BaeryManager
4.2.2 On the importance of constant analysis
4.2.3 On the importance of maintainability
AvailableFunctional Reproduced
4.2.4 On the importance of considering both new and old threats
Bibliography
‘AntiDetect’ Helps ieves Hide Digital Fingerprints – Krebs on Securityhttps://krebsonsecurity.
com/2015/03/antidetect-helps-thieves-hide-digital-fingerprints/
”Web Environment Integrity”: Locking Down the Web – Brave bloghttps://brave.com/web-
standards-at-brave/9-web-environment-integrity/
2025 Bad Bot Report – Impervahttps://www.imperva.com/resources/resource-library/
reports/2025-bad-bot-report/
A family tracking app was leaking real-time location data – TechCrunchhttps://techcrunch.
com/2019/03/23/family-tracking-location-leak/
CCS
MSR
AmIUnique Chrome extension – Chrome web storehttps://chrome.google.com/webstore/
detail/amiunique/pigjfndpomdldkmoaiiigpbncemhjeca
AmIUnique Firefox extension – Firefox browser add-onshttps : / / addons . mozilla . org /
firefox/addon/amiunique/
An introduction to server-side tagging – Google Developershttps://developers.google.com/
tag-platform/tag-manager/server-side/intro
An updated timeline for Privacy Sandbox milestones – Google bloghttps :// blog. google/
products/chrome/updated- timeline- privacy- sandbox - milestones/
Apple wins privacy bale in China – Financial Timeshttps://www.ft.com/content/c79a5f6a-
0827-47a4-9b3b-622a81fcc75a
Internet Measurement Conference
USENIX Security Symposium
DIMVA
DIMVA
Commun.
ACM
Baery Status API - W3C Candidate Recommendation 08 May 2012https://www.w3.org/TR/
2012/CR-battery-status-20120508/
Baery Status API - W3C Working Dra 24 October 2024https://www.w3.org/TR/battery-
status/
Baery Status Event Specication - W3C Working Dra 26 April 2011https://www.w3.org/TR/
2011/WD-battery-status-20110426/
CNS
Beware Evil APIshttps://browser.yandex.com/blog/beware-evil-apis
Bug 1313580 - Remove web content access to Baery APIhttps://bugzilla.mozilla.org/
show_bug.cgi?id=1313580
Bug 164213 - Remove Baery Status API from the treehttps://bugs.webkit.org/show_bug.
cgi?id=164213
Building a more private web: A path towards making third party cookies obsolete – Chromium blog
https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html
Canvas Defender by Multilogin – Firefox browser add-onshttps://addons.mozilla.org/fr/
firefox/addon/no-canvas-fingerprinting/
CanvasBlocker – kkapsnerhttps://github.com/kkapsner/CanvasBlocker
CAPEC - Common Aack Paern Enumeration and Classication (CAPEC™)https://capec.
mitre.org/
Chromium (Google Chrome) languages – OpenHubhttps://openhub.net/p/chrome/analyses/
latest/languages_summary
Content Security Policy 1.0 W3C Working Group Note 19 February 2015https://www.w3.org/
TR/CSP1/
Content Security Policy Level 2 W3C Recommendation, 15 December 2016https://www.w3.org/
TR/CSP2/
Content Security Policy Level 3 W3C Working Dra, 11 July 2025https://www.w3.org/TR/
CSP3/
Dear tech companies, I don’t want to see pregnancy ads aer my child was stillborn – e Washing-
ton Posthttps://www.washingtonpost.com/lifestyle/2018/12/12/dear-tech-companies-
i-dont-want-see-pregnancy-ads-after-my-child-was-stillborn/
DIMVA
Early design review for the Topics API - Comment from rhiaro on Jan 12, 2023 – W3C Tag De-
sign Reviewshttps://github.com/w3ctag/design- reviews/issues/726#issuecomment-
1379908459
CCS
Exodus Privacy: Analyzes privacy concerns in Android applicationshttps://exodus-privacy.
eu.org/
Expanding testing for the Privacy Sandbox for the Web – Google bloghttps://blog.google/
products/chrome/update- testing- privacy- sandbox- web/
Facebook is bombarding cancer patients with ads for unproven treatments – MIT Technology Re-
viewhttps://www.technologyreview.com/2022/06/27/1054784/facebook-meta-cancer-
treatment-ads-misinformation/
DBSec
Fingerprint randomization – Brave bloghttps://brave.com/privacy-updates/3-fingerprint-
randomization/
Fingerprinting Protections – Brave browserhttps://github.com/brave/brave- browser/
wiki/Fingerprinting-Protections
Fingerprinting threat using the TOPICS API - Comment from jkarlin on Jun 22, 2023 – Google Po-
sitionhttps://github.com/patcg-individual-drafts/topics/issues/74#issuecomment-
1603204126
Proc. Priv. Enhancing
Technol.
ACM Trans. Internet Techn.
WWW (Companion Volume)
Gaining security and privacy by partitioning the cache – Chrome for Developers bloghttps:
//developer.chrome.com/blog/http- cache- partitioning
Proc. ACM Hum. Comput. Interact.
GeoLite Databases and Web Services – MaxMindhttps://dev.maxmind.com/geoip/geolite2-
free-geolocation-data/
Get to know the new Topics API for Privacy Sandbox – Google Bloghttps://blog.google/
products/chrome/get-know-new-topics-api-privacy-sandbox/
Going Behind e Scenes On CAID, e Chinese IDFA Workaround Causing Such A Headache For
Apple – Ad Exchangerhttps: / /www. adexchanger.com /data - driven- thinking/ going-
behind - the - scenes - with - caid - the - chinese - idfa - workaround - causing - such - a -
headache-for-apple/
USENIX Security Symposium
WWW
Google is launching a Gemini integration in Chrome – TechCrunchhttps://techcrunch.com/
2025/05/20/google-is-launching-a-gemini-integration-in-chrome/
Google wants devs to promise they won’t abuse new Chrome ad API – Techradarhttps://www.
techradar.com/pro/google-wants-devs-to-promise-they-wont-abuse-new-chrome-ad-
api
Google’s Topics API: Rebranding FLoC Without Addressing Key Privacy Issues – Brave bloghttps:
//brave.com/web-standards-at-brave/7-googles-topics-api/
ACM Com-
put. Surv.
Have I Been Pwned? https://haveibeenpwned.com/
Heads up: Google’s going o Topics again – Vivaldi bloghttps://vivaldi.com/blog/technology/
heads-up-googles-going-off-topics-again/
2017 19th International Conference on Advanced Communication Technology (ICACT)
10.23919/ICACT.2017.7890236
How Trump Consultants Exploited the Facebook Data of Millions – e New York Timeshttps://
www.nytimes.com/2018/03/17/us/politics/cambridge-analytica-trump-campaign.html
HTTP State Management Mechanism – RFC 2109https://www.ietf.org/rfc/rfc2109.txt
Identity Graphs on AWS – Amazon AWShttps : / / aws . amazon . com / neptune / identity -
graphs-on-aws/
Improving user privacy and developer experience with User-Agent Client Hints – Chrome for
developershttps://developer.chrome.com/docs/privacy-security/user-agent-client-
hints
Install and manage extensions – Chrome Web Store Helphttps : / / support . google . com /
chrome?p=enable_extensions
Introducing NLWeb: Bringing conversational interfaces directly to the web – Microsohttps:
//news.microsoft.com/source/features/company-news/introducing-nlweb-bringing-
conversational-interfaces-directly-to-the-web/
WPES@CCS
NDSS
USENIX Security Sym-
posium
Internet Measurement Conference
NDSS
DIMVA
ESSoS
ACM Trans. Web
WWW
SEAMS@ICSE
USENIX Secu-
rity Symposium
Leaked Location Data Shows Another Muslim Prayer App Tracking Users – Vicehttps://www.
vice.com/en/article/xgz4n3/muslim-app-location-data-salaat- first
lemonde.fr Trac Analytics, Ranking & Audience [June 2025] – Similarwebhttps : / / www .
similarweb.com/website/lemonde.fr/#technologies
USENIX Security Symposium
Internet Measurement Conference
NDSS
NDSS
Workshop on the Economics of Information Security
MADWeb 2024
- Workshop on Measurements, Aacks, and Defenses for the Web
10.14722/madweb.2024.23035 https://hal.science/hal-
04489166
AsiaCCS
Microso’s plan to x the web: leing every website run AI search for cheap – e Vergehttps:
//www.theverge.com/web/669437/nlweb-microsoft-ai-agents- open-web
Enigma 2018 (Enigma 2018)
https://www.usenix.org/node/208154
Mimic Browser: Multilogin’s Powerful Chromium Antidetect Engine – Multiloginhttps : / /
multilogin.com/blog/the-most-advanced-browser-fingerprinting-protection-ever-
created-enter-mimic/
Proc. Priv. Enhancing Technol.
WWW
Mitigating Browser Fingerprinting in Web Specications – W3C Group Note 21 March 2025https:
//www.w3.org/TR/fingerprinting-guidance/
New in Chrome 115 – Chrome Developershttps://developer.chrome.com/blog/new- in-
chrome-115/
Next steps for Privacy Sandbox and tracking protections in Chrome – e Privacy Sandbox blog
https://privacysandbox.com/news/privacy-sandbox-next-steps/
Number of adblock users worldwide in selected quarters from 2012 to 2023 – Statistahttps://
www.statista.com/statistics/435252/adblock-users-worldwide/
DPM/QASA@ESORICS
IWPE@SP
On Giovanni Morelli, or How to See A Renaissance Painting Computationally – Christopher J.
Nygrenhttps://sites.haa.pitt.edu/cva/on- giovanni-morelli-or- how- to- see-a-
renaissance-painting-computationally/
Paerns | APG | WAI – W3Chttps://www.w3.org/WAI/ARIA/apg/patterns/
COMP-
SAC
NDSS
Privacy – Web Almanac by HTTP Archivehttps://almanac.httparchive.org/en/2024/
privacy
Privacy Principles W3C Statement 15 May 2025https://www.w3.org/TR/privacy-principles/
Privacy Sandbox for the Web reaches general availability – e Privacy Sandbox Bloghttps://
privacysandbox.com/news/privacy-sandbox-for-the-web-reaches-general-availability/
Random Agent Spoofer – dillbyrnehttps://github.com/dillbyrne/random-agent-spoofer
Remote Test Lab – Samsung Developershttps://developer.samsung.com/remotetestlab
Request for Position: Topics API - Comment from martinthomson on Jan 6, 2023 – Mozilla Stan-
dards Positionhttps://github.com/mozilla/standards-positions/issues/622#issuecomment-
1372979100
Resist ngerprinting – Firefox helphttps:/ /support .mozilla . org / en- US /kb / resist -
fingerprinting
EuroS&P
CCS
Schema.org Ocial website – Schema.orghttps://schema.org/
WWW
CODASPY
USENIX Security Symposium
CCS
ACSAC
Some Bad News and Some Good News – Microso Learnhttps://learn.microsoft.com/en-
us/previous-versions/ms972826(v=msdn.10)?redirectedfrom=MSDN
WWW
IEEE Symposium on Security and Privacy
NDSS
Technologies used on lemonde.fr – Wappalyzerhttps://www.wappalyzer.com/lookup/lemonde.
fr/
e “Checkbox Hack” (and things you can do with it) – CSS Trickshttps://css-tricks.com/
the-checkbox-hack/
e Browser Company launches its AI-rst browser, Dia, in beta – TechCrunchhttps://techcrunch.
com/2025/06/11/the-browser-company-launches-its-ai-first-browser-dia-in-beta/
e industry’s response to Google’s third-party cookie U-turn: ‘endless millions have been wasted’
– Digidayhttps://digiday.com/media-buying/the-industrys-response- to-googles-
third-party-cookie-u-turn-endless-millions-have-been-wasted/
e SameSite Aribute – RFC 6265 bishttps://datatracker.ietf.org/doc/html/draft-
ietf-httpbis-rfc6265bis-02#section-5.3.7
e Topics API - Comment from annevk on Dec 20, 2022 – WebKit Standards Positionhttps:
/ / github . com / WebKit / standards - positions / issues / 111 # issuecomment - 1359609317
e Ultimate Anti Fingerprint Browser List Of 2024 – Gologinhttps://gologin.com/blog/anti-
fingerprint-browser-list-2023/
is tool may make it easier for thieves to empty bank accounts – CSOhttps://www.csoonline.
com/article/550290/this-tool- may-make- it- easier- for- thieves-to- empty-bank-
accounts.html
underbeam-Lightbeam for Chrome – Chrome Web Storehttps : / / chrome . google . com /
webstore/detail/thunderbeam-lightbeam-for/hjkajeglckopdkbggdiajobpilgccgnj
Timeline of HTTPS adoption – Timelineshttps://timelines.issarice.com/wiki/Timeline_
of_HTTPS_adoption
Proceedings of the 20th European Symposium on Research in Com-
puter Security (ESORICS 2015)
Try Gemini in Chrome – Google bloghttps://blog.google/products/gemini/gemini-app-
updates-io-2025/#chrome
Ultimate User Agent Switcher – URL snierhttps://iblogbox.com/chrome/useragent/alert.
php
Understanding Server-Side Tagging in Google Tag Manager – Christos Pontikishttps://www.
pontikis.gr/understanding-server-side-tagging-in-gtm/
Update on the plan for phase-out of third-party cookies on Chrome – e Privacy Sandbox blog
https://privacysandbox.com/intl/en_us/news/update-on-the-plan-for-phase-out-of-
third-party-cookies-on-chrome/
USENIX Association badges – Security Research Artifactshttps://secartifacts.github.io/
usenixsec2025/badges
USENIX Security Symposium
IEEE Symposium on Security and Privacy
W3C Process Document 3 November 2023https://www.w3.org/policies/process/
Web Environment Integrity Explainer – Googlehttps : / / github . com / explainers - by -
googlers/Web-Environment-Integrity/blob/main/explainer.md
Web Environment Integrity” is an all-out aack on the free Internet – Free Soware Foundation
https://www.fsf.org/blogs/community/web-environment-integrity-is-an-all-out-
attack-on-the-free-internet
Web Neural Network API W3C Candidate Recommendation Dra, 26 June 2025https://www.
w3.org/TR/webnn/
WebGPU W3C Candidate Recommendation Dra, 11 July 2025https ://www. w3.org/TR /
webgpu/
What Is Identity Resolution and Why Is It Important? – LiveRamp bloghttps://liveramp.com/
blog/what-is-identity-resolution/
What is my ISP — Find your Internet Service Providerhttps : / / www . whatismyisp . com/
Your Computer Should Say What You Tell It To Say – EFFhttps://www.eff.org/deeplinks/
2023/08/your-computer-should-say-what-you-tell-it-say-1
Publications from October 2017 to June
2025
MADWeb 2024
- Workshop on Measurements, Aacks, and Defenses for the Web
10.14722/madweb.2024.23035 https://hal.science/hal-
04489166
Proc. Priv. Enhancing
Technol.
ACM Trans. Internet Techn.
WPES@CCS
MTD@CCS
WWW (Companion Volume)
NDSS
WWW
DIMVA
USENIX Secu-
rity Symposium
AsiaCCS
Proc. Priv. Enhancing Technol.
EuroS&P
DIMVA
DIMVA
ACM Trans. Web
WWW
USENIX Security Symposium
DIMVA
NDSS
WWW
WWW
IEEE Symposium on Security and Privacy
USENIX Security Symposium
Soware related to my research from
October 2017 to June 2025
▶ https://github.com/intumwa/ua-radar
https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.
com/intumwa/ua-radar
▶ https://gitlab.inria.fr/Spirals/breaking-bad
https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://gitlab.
inria.fr/Spirals/breaking-bad.git
▶ https://github.com/antonin-durey/the-price-to-play
https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.
com/antonin-durey/the-price-to-play
▶ https://gitlab.inria.fr/jsrehab
https://archive.softwareheritage.org/browse/search/?q=jsrehab&with_visit=true&with_
content=true
▶ https://github.com/drawnapart/drawnapart
https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.
com/drawnapart/drawnapart
▶ https://github.com/thomasrokicki/in-search-of-lost-time
https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.
com/thomasrokicki/in-search-of-lost-time
▶ https://github.com/plaperdr/fingerprinting-in-style
https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.
com/plaperdr/fingerprinting-in-style
▶ https://zenodo.org/records/3872144
▶ https://github.com/plaperdr/extension-access-control
https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.
com/plaperdr/extension-access-control
▶ https://github.com/plaperdr/morellian-canvas
https://archive.softwareheritage.org/browse/origin/directory/?origin_url=https://github.
com/plaperdr/morellian-canvas
▶ https://github.com/silverfoxy/PHPDebloating
