2020/01/21 by Artur Janc, Krzysztof Kotowicz, Janc, Artur +5 · 2 voices
Computer Science · Psychology · #Business #Computer science #Computer security #Internet privacy #Psychology #Security and Verification in Computing #Tracking (education) #User Authentication and Security Systems #Web Application Security Vulnerabilities #cs.CR
paper · pdf · doi:10.48550/arxiv.2001.07421
openalex publication_date 2020/01/21 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Intelligent Tracking Prevention (ITP) is a privacy mechanism implemented by Apple's Safari browser, released in October 2017. ITP aims to reduce the cross-site tracking of web users by limiting the capabilities of cookies and other website data. As part of a routine security review, the Information Security Engineering team at Google has identified multiple security and privacy issues in Safari's ITP design. These issues have a number of unexpected consequences, including the disclosure of the user's web browsing habits, allowing persistent cross-site tracking, and enabling cross-site information leaks (including cross-site search). This report is a modestly expanded version of our original vulnerability submission to Apple (WebKit bug #201319), providing additional context and edited for clarity. A number of the issues discussed here have been addressed in Safari 13.0.4 and iOS 13.3, released in December 2019.