<?xml version="1.0" encoding="UTF-8"?><xml><records><record><source-app name="Biblio" version="6.x">Drupal-Biblio</source-app><ref-type>10</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">S. Chen</style></author><author><style face="normal" font="default" size="100%">R. Wang</style></author><author><style face="normal" font="default" size="100%">X. Wang</style></author><author><style face="normal" font="default" size="100%">K. Zhang</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Side-Channel Leaks in Web Applications: a Reality Today, a Challenge Tomorrow</style></title><secondary-title><style face="normal" font="default" size="100%">The 31st IEEE Symposium on Security and Privacy</style></secondary-title><tertiary-title><style face="normal" font="default" size="100%">Proceedings of the 31st IEEE Symposium on Security and Privacy </style></tertiary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">ambiguity set</style></keyword><keyword><style  face="normal" font="default" size="100%">encrypted traffic</style></keyword><keyword><style  face="normal" font="default" size="100%">padding</style></keyword><keyword><style  face="normal" font="default" size="100%">side-channel-leak</style></keyword><keyword><style  face="normal" font="default" size="100%">Software-as-a-Service (SaaS)</style></keyword><keyword><style  face="normal" font="default" size="100%">web application</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2010</style></year><pub-dates><date><style  face="normal" font="default" size="100%">05/2010</style></date></pub-dates></dates><publisher><style face="normal" font="default" size="100%">IEEE</style></publisher><pub-location><style face="normal" font="default" size="100%">Oakland, CA</style></pub-location><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">With software-as-a-service becoming mainstream, more and more applications are delivered to the client through the Web. Unlike a desktop application, a web application is split into browser-side and server-side components. A subset of the application’s internal information flows are inevitably exposed on the network. We show that despite encryption, such a side-channel information leak is a realistic and serious threat to user privacy. Specifically, we found that surprisingly detailed sensitive information is being leaked out from a number of high-profile, top-of-the-line web applications in healthcare, taxation, investment and web search: an eavesdropper can infer the illnesses/medications/surgeries of the user, her family income and investment secrets, despite HTTPS protection; a stranger on the street can glean enterprise employees' web search queries, despite WPA/WPA2 Wi-Fi encryption. More importantly, the root causes of the problem are some fundamental characteristics of web applications: stateful communication, low entropy input for better interaction, and significant traffic distinctions. As a result, the scope of the problem seems industry-wide. We further present a concrete analysis to demonstrate the challenges of mitigating such a threat, which points to the necessity of a disciplined engineering practice for side-channel mitigations in future web application developments.</style></abstract></record></records></xml>