CrowdSurf: Empowering Informed Choices in the Web

TL;DR

CrowdSurf is a system designed to empower users and companies to understand and control data leakage on the web by providing a collaborative auditing infrastructure that operates below HTTP layer.

Contribution

It introduces CROWDSURF, a novel infrastructure and algorithms for comprehensive, collaborative, and customizable data auditing at the network level, even with HTTPS traffic.

Findings

Prototype implementation demonstrates feasibility.

Operates below HTTP layer for HTTPS inspection.

Enables customizable privacy control rules.

Abstract

When surfing the Internet, individuals leak personal and corporate information to third parties whose (legitimate or not) businesses revolve around the value of collected data. The implications are serious, from a person unwillingly exposing private information to an unknown third party, to a company unable to manage the flow of its information to the outside world. The point is that individuals and companies are more and more kept out of the loop when it comes to control private data. With the goal of empowering informed choices in information leakage through the Internet, we propose CROWDSURF, a system for comprehensive and collaborative auditing of data that flows to Internet services. Similarly to open-source efforts, we enable users to contribute in building awareness and control over privacy and communication vulnerabilities. CROWDSURF provides the core infrastructure and algorithms to let individuals and enterprises regain control on the information exposed on the web. We advocate CROWDSURF as a data processing layer positioned right below HTTP in the host protocol stack. This enables the inspection of clear-text data even when HTTPS is deployed and the application of processing rules that are customizable to fit any need. Preliminary results obtained executing a prototype implementation on ISP traffic traces demonstrate the feasibility of CROWDSURF.