Thread by @goldbe

Every year (since around 2012) in my network security class @BUCompSci, we’ve asked students to form groups and audit the security and privacy of a popular websites. 🕵️‍♂️

Things change from year to year. Here are my macro observations from this years projects. 👩‍🏫 1/n

@BUCompSci Almost every site my students looked at, connects to Google, Facebook, or Twitter to track users in one form or other. 🎯 2/n

HTTPS is everywhere. Mixed HTTP/HTTPS content was found on some sites, but in most cases all HTTP traffic was upgraded automatically to HTTPS. 🎉 3/n

We continue to see old version of TLS (for instance TLS 1.0) on some second tier sites. But there are many sites that are using TLS 1.3. 4/n

Students are uniformly surprised to see the broad language used in privacy policies.

Having done this project multiple years in a row, my sense is that data is being shared more widely than ever before. 5/n

Tracking pixels are everywhere, and they capturing every move you make on a page. Every scroll, hover and click. 👁 6/n

I did, however, see fewer sites that drop 50+ cookies when I you visit their page. Most sites dropped between 5 and 30 cookies. 🍪 🍪 🍪 7/n

Most cookies were for the site’s own domain, along with ubiquitous Google, Facebook (and often Twitter) cookies. We can fairly conclude that Google and FB see pretty much everything we do on the web. 🍪 👁 🍪 8/n

No site we studied honored “Do Not Track” 😢

This was stated loud and clear in the privacy policy. 🖊

9/n

I don’t think I am saying anything especially shocking here but all in all, my anecdotal non-scientific sense is that:

the web has gotten a lot more secure (TLS, XSS / CSRF protection, etc) 🎈

but there has been no noticeable improvement in privacy. 😞

10/10