1Cache Cookies for Browser Authentication

Abstract—Like conventional cookies, cache cookies are data objects that servers store in Web browsers. Cache cookies, however, are essentially unintentional byproducts of protocol design for browser caches. They do not enjoy any explicit interface support or security policies. In this paper, we show that despite limitations, cache cookies can play a useful role in the identification and authentication of users. Many users today block con-ventional cookies in their browsers as a privacy mea-sure. The cache-cookie tools we propose can help re-store lost usability and convenience to such users while maintaining good standards for privacy. As we show, our techniques can also help combat online security threats as phishing and pharming that ordinary cook-ies cannot. In fact, the ideas we introduce for cache-cookie management can strengthen ordinary cookies as well. Because cache cookies have been viewed tradition-ally as a threat to user privacy, and lack important read-access restrictions, we propose cache-cookie pro-tocols that aim to protect privacy by design