Watching them watching us - How websites are leaking sensitive data to third-parties.
Tags: showdev, discuss, javascript, webdev
Published: 2019-05-02 06:38:17

---
title: Watching them watching us - How websites are leaking sensitive data to third-parties.
published: true
tags: showdev,discuss,javascript, webdev
canonical_url: 
---


![](https://cdn-images-1.medium.com/max/1024/1*S5zyXVDrpVR24gnN9Vs0Tg.jpeg)


### **What is a TellTale URL ?**

URL is the most commonly tracked piece of information, the innocent choice to structure a URL based on page content can make it easier to learn a users’ browsing history, address, health information or more sensitive details. They contain sensitive information or can lead to a page which contains sensitive information.

We call such URLs as TellTaleURLs.

Let’s take a look at some examples of such URLs.

### **EXAMPLE #1:**

**Website** : _donate.mozilla.org (Fixed)_

After you have finished the payment process on _donate.mozilla.org_, you are redirected to a “thank you” page. If you look carefully at the URL shown in the below screenshot, it contains some private information like _email, country, amount, payment method._

![](https://cdn-images-1.medium.com/max/1024/1*N0v34u76BSmU2BHaiBu3bA.png)<figcaption>PII in URL on donate.mozilla.org</figcaption>

Now because this page loads some resources from third-parties and the URL is not sanitised, the same information is also shared with those third-parties via referrer and as a value inside payload sent to the third-parties.

![](https://cdn-images-1.medium.com/max/1024/1*poYlvlf4vFjZkUFtSIokMA.png)<figcaption>URL with PII shared when fonts being loaded from Google Apis.</figcaption>

In this particular case, there were 7 third-parties with whom this information was shared.

Mozilla was prompt to fix these issues, more details can be found here: [_https://bugzilla.mozilla.org/show\_bug.cgi?id=1516699_](https://bugzilla.mozilla.org/show_bug.cgi?id=1516699)

### EXAMPLE #2:

**Website** : trainline.eu, _JustFly.com (Last checked: Aug’18)_

Once you finish a purchase like train tickets / flight tickets, you receive an email which has a link to manage your booking. Most of the time, when you click on the link, you are shown the booking details — without having to enter any more details like booking code, username/password.

This means that the URL itself contains some token which is unique to the user and provides access to the users’ booking.

It so happens that these URLs are also shared with third-parties, giving these third-parties [highly sensitive data](https://medium.freecodecamp.org/how-airlines-dont-care-about-your-privacy-case-study-emirates-com-6271b3b8474b) and [access to your bookings](https://cliqz.com/en/magazine/lufthansa-data-leak-what-a-single-url-can-reveal-about-you).

![](https://cdn-images-1.medium.com/max/1024/1*8NtyWY9h2A6dXtpII0mKJw.png)<figcaption>JustFly.com leaking bookingID to 10 third-party domains</figcaption>

![](https://cdn-images-1.medium.com/max/1024/1*_DuSiJxfPFzVRMo03uZAow.png)<figcaption>trainline.eu sharing booking token with 17 third-party domains.</figcaption>

![](https://cdn-images-1.medium.com/max/1024/1*VrCooHuQytKFgichc18Tug.png)<figcaption>URL with token being shared via Ref and inside the payload.</figcaption>

### EXAMPLE #3:

**Website** : _foodora.de, grubhub.com (Last checked: Aug’18)_

One of the pre-requisites to order food online is entering the address where you want the food to be delivered.

Some popular food delivery websites, convert the address to fine latitude-longitude values and add them to the URL.

The URL is also shared with third-parties, potentially leaking where the user lives.

![](https://cdn-images-1.medium.com/max/1024/1*AFuu-VDuK1obV1slx8jtqw.png)<figcaption>Foodora leaking address details to 15 third-party domains.</figcaption>

> To be clear, it’s not just these websites that suffer from such leaks. This problem exists everywhere — it’s a default situation, not a rarity. We’ve seen it with Lufthansa, Spotify, Flixbus, Emirates, and even with medical providers.

### Risks of TellTale URLs:

- Websites are carelessly leaking sensitive information to plethora of third-parties.
- Most often without users’ consent.
- More dangerously: Most websites are not aware of these leaks while implementing third-party services.

### Are these problems hard to fix?

As a Software Engineer who has worked for some of the largest eCommerce companies, I understand the need to use third party services for optimising and enhancing not only the Digital Product but also how users interact with the product.

It is not the usage of third party services that is of concern in this case but the implementation of these services. Owners should always have the control of their website and what the website shares with third party services.

It is this control that needs to be exercised to limit the leakage of User information.

It is not a mammoth task, it is just a matter of commitment to preserving the basic right to privacy.

For example:

1. Private pages should have [noindex meta tags](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta).
2. Limit the presence of third-party services on private pages.
3. [Referrer-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy) on pages with sensitive data.
4. Implement CSP and SRI. Even with a huge footprint of third-party services [CSP](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP), [SRI](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) are not enabled on majority of the websites.

### Introducing Local Sheriff:

Given that such information leakage is dangerous to both users and the organisations, then why is it a wide-spread problem?

One big reason that these issues exist is lack of awareness.

A good starting point for websites is to see what information is being leaked or detect presence of TellTaleURLs.

But in order to find out if the same is happening with the websites you maintain or visit, you need to learn some tools to inspect network traffic, understand first-party — third-party relationship and then make sure you have these tools open during the transaction process.

To help bridge this gap, we wanted to build a tool with the following guidelines:

- Easy to install.
- Monitors and stores all data being exchanged between websites and third-parties — Locally on the user machine.
- Helps identify the users which companies are tracking them on the internet.
- Interface to search information being leaked to third-parties.

Given the above guidelines, browser extension seemed like a reasonable choice. After you install Local-Sheriff, in the background:

1. Using the WebRequest API, it monitors interaction between first-party and third-party.
2. Classifies what URL is first-party and third-party.
3. Ships with a copy of database from [WhoTracksMe](https://whotracks.me/). To map which domain belongs to which company.

4. Provides an interface you can search for values that you think are private to you and see which websites leak it to which third-parties. Eg: name, email, address, date of birth, cookie etc.

### Revisiting EXAMPLE #1

**Website:** _donate.mozilla.org_

- The user has Local-Sheriff installed and donates to mozilla.org.

![](https://cdn-images-1.medium.com/max/1024/1*N0v34u76BSmU2BHaiBu3bA.png)<figcaption>PII in URL on donate.mozilla.org</figcaption>

- Clicks on the icon to open search interface.

![](https://cdn-images-1.medium.com/max/352/1*VJpOHOy-ckODGxGlCIDZZw.png)<figcaption>Local sheriff icon.</figcaption>

- Enters emailID used on the website donate.mozilla.org.

![](https://cdn-images-1.medium.com/max/1024/1*6MM--lchMe0o7HUm-KaQgA.png)<figcaption>Search interface Local-Sheriff</figcaption>

It can be seen that email address used at the time of donation was shared with **~7 third-party domains.**

You can try it yourselves by installing it:

**Firefox:** [https://addons.mozilla.org/de/firefox/addon/local-sheriff/](https://addons.mozilla.org/de/firefox/addon/local-sheriff/)

**Chrome:** [https://chrome.google.com/webstore/detail/local-sheriff/ckmkiloofgfalfdhcfdllaaacpjjejeg](https://chrome.google.com/webstore/detail/local-sheriff/ckmkiloofgfalfdhcfdllaaacpjjejeg)

**More details** : [_https://www.ghacks.net/2018/08/12/local-sheriff-reveals-if-sites-leak-personal-information-with-third-parties/_](https://www.ghacks.net/2018/08/12/local-sheriff-reveals-if-sites-leak-personal-information-with-third-parties/)

**Source Code** : [_https://github.com/cliqz-oss/local-sheriff_](https://github.com/cliqz-oss/local-sheriff)

**Conferences:** [_Defcon 26 Demo Labs_](https://www.defcon.org/html/defcon-26/dc-26-demolabs.html)_ ,_ [_FOSDEM 2019_](https://fosdem.org/2019/schedule/event/web_extensions_exposing_privacy_leaks/)

**Code:** [https://github.com/cliqz-oss/local-sheriff](https://github.com/cliqz-oss/local-sheriff)

**Chrome store:** [https://chrome.google.com/webstore/detail/local-sheriff/ckmkiloofgfalfdhcfdllaaacpjjejeg](https://chrome.google.com/webstore/detail/local-sheriff/ckmkiloofgfalfdhcfdllaaacpjjejeg)

Thanks for reading and sharing ! :)

If you liked this story, feel free to 👏👏👏 a few times (Up to 50 times. Seriously).

Happy Hacking !

[- Konark Modi](https://twitter.com/konarkmodi)

**_Credits:_**

- _Special thanks to_ [_Remi_](https://twitter.com/Pythux)_ ,_ [_Pallavi_](https://twitter.com/Pi_Modi) _for reviewing this post :)_
- _Title “Watching them watching us “ comes from a joint talk between Local Sheriff and_ [_Trackula_](https://trackula.org/en/) _at FOSDEM 2019._