A Privacy Measure Turned Upside Down? Investigating the Use of HTTP Client Hints on the Web

Stephan Wiefling,Marian Hönscheid,Luigi Lo Iacono

DOI: https://doi.org/10.1145/3664476.3664478

2024-05-22

Abstract:HTTP client hints are a set of standardized HTTP request headers designed to modernize and potentially replace the traditional user agent string. While the user agent string exposes a wide range of information about the client's browser and device, client hints provide a controlled and structured approach for clients to selectively disclose their capabilities and preferences to servers. Essentially, client hints aim at more effective and privacy-friendly disclosure of browser or client properties than the user agent string.

Cryptography and Security,Networking and Internet Architecture,Social and Information Networks

What problem does this paper attempt to address?

The problem that this paper attempts to solve is: Are HTTP Client Hints (CHs) misused in practical applications, thereby posing a threat to user privacy and security? Specifically, the researchers focus on the following aspects:

1. **Adoption of HTTP Client Hints**:
- How do website homepages adapt to the transition from User Agent String (UAS) to HTTP CHs?
- Are the HTTP CHs requested by websites on the home page and the login page different?
- How do login pages using Risk - Based Authentication (RBA) adapt to the transition from UAS to HTTP CHs?
- How extensive are the HTTP CH requests on the login page, including those from embedded third - party domains and known web trackers?

2. **Requested HTTP CH data**:
- Which HTTP CH data are requested by websites and known web trackers on the login page?
- Which HTTP CH data are requested by websites using RBA on the login page?
- What is the impact of different geographical locations and Internet Service Providers (ISP) on HTTP CH data requests?
- Which levels of HTTP CH data are requested by different types of websites?
- Which levels of HTTP CH data are requested by different websites using RBA?

3. **Impacts**:
- How related are the HTTP CH requests of third - party domains between different login pages?
- How much information does the browser provide when receiving an HTTP CH request?

### Research Background

HTTP Client Hints are a set of standardized HTTP request headers, aiming to replace the traditional User Agent String (UAS) to more effectively disclose the capabilities and preferences of browsers or clients. Compared with UAS, HTTP CHs provide a controlled and structured mechanism, allowing clients to selectively disclose their capabilities and preferences to servers. However, HTTP CHs also have the potential to be misused, especially in the case of third - party websites and trackers, which can obtain more client information than UAS, and currently there is no mechanism for users to detect or control this potential data leakage.

### Research Questions

In order to deeply understand the practical applications of HTTP CHs in online services and users and their impacts on privacy and security, the researchers proposed the following research questions:

- **RQ1: Adoption of HTTP CHs**
- How does a website homepage adjust to adapt to the transition from UAS to HTTP CHs?
- Does a website request different HTTP CHs on the home page and the login page?
- How does a login page using RBA adapt to the transition from UAS to HTTP CHs?
- What is the actual extent of HTTP CH requests on the login page, including requests from embedded third - party domains and known web trackers?

- **RQ2: Requested HTTP CH data**
- Which HTTP CH data are requested by websites and known web trackers on the login page?
- Which HTTP CH data are requested by websites using RBA on the login page?
- What impact do geographical locations and ISP have on websites' requests for HTTP CH data?
- Which levels of HTTP CH data are requested by different types of websites?
- Which levels of HTTP CH data are requested by different websites using RBA?

- **RQ3: Impacts**
- How related are the HTTP CH requests of third - party domains between different login pages?
- How much information does the browser provide when receiving an HTTP CH request?

By answering these questions, the researchers hope to provide insights into the practical applications of HTTP CHs for developers, security and privacy engineers, helping them better understand and deal with possible privacy and security issues. In addition, the researchers can also obtain an overview of the popularity of HTTP CHs on the Web and obtain an open...