Geolocation Inference

• Users can use VPN or Tor for anonymity
• Not accurate for mobile networks

• Users can easily decline permission

<img src="some-location-specific-resource" />

var image = document.createElement(‘img’);
image.src = url;
image.setAttribute(‘startTime’, (new Date().getTime()));
image.onload = function()
{
	var endTime = new Date().getTime();
	var loadTime = endTime - parseInt(this.	getAttribute(‘startTime’));
}

• Similar to the previous technique but make the request manually in JavaScript

var starTime, endTime, loadTime;
var xmlhttp = new XMLHttpRequest();
xmlhttp.onloadstart = function()
{
	startTime = (new Date()).getTime();
}
xmlhttp.onloadend = function()
{
	endTime = (new Date()).getTime();
	loadTime = endTime - startTime;
}

<img src="some-location-specific-resource" complete="complete"/>

• Check the complete attribute of the image tag immediately after setting its src property

function cached(url)
{
	var image = document.createElement(‘img’);
	image.src = url;
	return image.complete || image.width+image.height > 0;
}

• Similar to CORS, measure the start and end time then compute the difference

var page = document.createElement(‘iframe’);
page.setAttribute(‘startTime’, (new Date()).getTime());
page.onload = function ()
{
  var endTime = (new Date()).getTime();
  var loadTime = ( endTime - parseInt(this.getAttribute(‘startTime’)));
}

• google.com.sg
• /images/srpr/logo11w.png

• https://cleveland.craigslist.org/
• https://toledo.craigslist.org/

google.com/maps/vt/pb=!1m5!1m4!1i15!2i12627!3i23720!4i128!2m1!1e0!3m3!5e1105!12m1!1e47!4e0

• Sites related to specific countries (e.g. google.de)
• Sites with pornographic material
• Unreachable sites (e.g. akamaihd.net)

• Cache is only cleared once the browser is closed not during its use

• Would work but is expensive in terms of load time
• 50% performance overhead

• Would need to be carefully engineered to not interfere with browser performance

• Prototype tool collects URLs of cached resources and labels location-sensitive resources
• Can be utilized to identify resources that require the cache-invalidating header

• Automatically clear the browser cache on each tab open and close
• Could make it smarter by only clearing items in cache containing a given URL