Third-party Identity Management Usage on the Web
A. Vapen, N. Carlsson, A. Mahanti, and N. Shahmehri,
"Third-party Identity Management Usage on the Web",
Proc. Passive and Active Measurement Conference (PAM),
Los Angeles, CA, Mar. 2014.
(pdf)
Abstract:
Many websites utilize third-party identity management services to simplify access to their services. With privacy and security implications for the end users, an important question is how websites select their third-party identity providers and how this impacts the characteristics of the emerging identity management landscape seen by the users. In this paper we first present a novel Selenium-based data collection methodology that identifies and captures the identity management relationships between sites and the intrinsic characteristics of the websites that form these relationships. Second, we present the first large-scale characterization of the third-party identity management landscape and the relationships that makes up this emerging landscape. As a reference point, we compare and contrast our observations with the somewhat more understood third-party content provider landscape. Interesting findings include a much higher skew towards websites selecting popular identity provider sites than is observed among content providers, with sites being more likely to form identity management relationships that have similar cultural, geographic, and general site focus. These findings are both positive and negative. For example, the high skew in usage places greater responsibility on fewer organizations that are responsible for the increased information leakage cost associated with highly aggregated personal information, but also reduces the user's control of the access to this information.
Datasets
The datasets used in our paper are made available here for use by the wider research community.
Please refer to Section 2 of our paper for a description of the data collection methodology and a
summary of the datasets.
Note:
If you use our datasets in your research,
please include a reference to our PAM 2014 paper
(pdf)
in your work.
- File with the per-site information for the sampled sites in the crawled dataset.
- Format:
-
site|rank|NA|region-whois|region-server|region-audience|num-CP|num-CU|num-RP|num-IDP|list-of-IDPs|list-of-RPs|
-
where site "site" is the domain name of the site, "rank" is the alexa rank of the website at the time of the measurements,
"category" is our manual classification of the website, "region-whois" is the geographic region
using the whois service, "region-server" is the geographic region using the server approach,
and "region-audience" is the geographic region using the audience approach,
"num-CP" is the number of content providers identified for the site,
"num-CU" is the number of content users of the site,
"num-RP" is the number of RPs of the site,
"num-IDP" is the number of IDPs used by the site,
"list-of-IDPs" contains a list of the IDPs for the site (as identified by the rank of those sites),
and "list-of-RPs" is the corresponding list of the RPs that the site serves.
-
File with the top-1M websites according to alexa.com on 17/4/2012.
- File with the per-site information for the top-200 sites in the manual dataset.
- Format:
-
site|rank|category|region-whois|region-server|region-audience|NA|NA|NA|num-IDP|list-of-IDPs|NA|
-
where each column is defined as for the crawled dataset.