公共WiFi强制门户网站的隐私风险研究
On Privacy Risks of Public WiFi Captive Portals
摘要：
开放获取WiFi热点被广泛部署在许多公共场所，包括餐馆、公园、咖啡店、商场、火车、机场、酒店和图书馆。虽然这些热点提供了保持连接的有吸引力的选择，但它们也可以通过在其强制门户和登陆网站中使用跟踪器来跟踪用户活动并与第三方共享用户/设备信息。在本文中，我们提出了一个全面的隐私分析，位于加拿大蒙特利尔的67个独特的公共WiFi热点，并阐明了这些热点的网络跟踪和数据汇集行为。我们的研究揭示了通过使用社交登录（例如，Facebook和Google）和注册表单，以及许多跟踪活动的实例，有时甚至在用户接受热点的隐私和服务条款政策之前。大多数热点在其强制门户网站内使用持久的第三方跟踪Cookie;这些Cookie可用于在用户离开热点后很长一段时间内跟踪用户的浏览行为，例如，最多20年。此外，多个热点与许多第三方跟踪域明确共享（有时通过HTTP）收集的个人和唯一设备信息。
英文摘要：
Open access WiFi hotspots are widely deployed in many public places, including restaurants, parks, coffee shops, shopping malls, trains, airports, hotels, and libraries. While these hotspots provide an attractive option to stay connected, they may also track user activities and share user/device information with third-parties, through the use of trackers in their captive portal and landing websites. In this paper, we present a comprehensive privacy analysis of 67 unique public WiFi hotspots located in Montreal, Canada, and shed some light on the web tracking and data collection behaviors of these hotspots. Our study reveals the collection of a significant amount of privacy-sensitive personal data through the use of social login (e.g., Facebook and Google) and registration forms, and many instances of tracking activities, sometimes even before the user accepts the hotspot's privacy and terms of service policies. Most hotspots use persistent third-party tracking cookies within their captive portal site; these cookies can be used to follow the user's browsing behavior long after the user leaves the hotspots, e.g., up to 20 years. Additionally, several hotspots explicitly share (sometimes via HTTP) the collected personal and unique device information with many third-party tracking domains.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
