arXiv subjects

Matteo Varvello

Publications and source records attributed to Matteo Varvello.

At least 19 recordsLinked to original sources

arXiv2025

Not All Visitors are Bilingual: A Measurement Study of the Multilingual Web from an Accessibility Perspective

English is the predominant language on the web, powering nearly half of the world's top ten million websites. Support for multilingual content is nevertheless growing, with many websites increasingly combining English with regional or native languages in both visible content and hidden metadata. This multilingualism introduces significant barriers for users with visual impairments, as assistive technologies like screen readers frequently lack robust support for non-Latin scripts and misrender or mispronounce non-English text, compounding accessibility challenges across diverse linguistic contexts. Yet, large-scale studies of this issue have been limited by the lack of comprehensive datasets on multilingual web content. To address this gap, we introduce LangCrUX, the first large-scale dataset of 120,000 popular websites across 12 languages that primarily use non-Latin scripts. Leveraging this dataset, we conduct a systematic analysis of multilingual web accessibility and uncover widespread neglect of accessibility hints. We find that these hints often fail to reflect the language diversity of visible content, reducing the effectiveness of screen readers and limiting web accessibility. We finally propose Kizuki, a language-aware automated accessibility testing extension to account for the limited utility of language-inconsistent accessibility hints.

cs.CL↗

arXiv2025

Collusion Resistant DNS With Private Information Retrieval

There has been a growing interest in Internet user privacy, demonstrated by the popularity of privacy-preserving products such as Telegram and Brave, and the widespread adoption of HTTPS. The Domain Name System (DNS) is a key component of Internet-based communication and its privacy has been neglected for years. Recently, DNS over HTTPS (DoH) has improved the situation by fixing the issue of in-path middleboxes. Further progress has been made with proxy-based solutions such as Oblivious DoH (ODoH), which separate a user's identity from their DNS queries. However, these solutions rely on non-collusion assumptions between DNS resolvers and proxies -- an assumption difficult to guarantee in practice. To address this, we explore integrating single-server Private Information Retrieval (PIR) into DNS to enable encrypted query processing without relying on trust assumptions. However, applying PIR to DNS is challenging due to its hierarchical nature -- particularly, interactions with recursive resolvers can still leak information. Navigating performance and privacy trade-offs, we propose PDNS, a DNS extension leveraging single-server PIR to strengthen privacy guarantees. We have implemented a prototype of PDNS and compared its performance against state-of-the-art solutions via trace-driven experiments. The results show that PDNS achieves acceptable performance (2x faster than DoH over Tor with similar privacy guarantees) and strong privacy guarantees today, mainly at the cost of its scalability, which specialized hardware for PIR can address in the near future.

cs.NI↗

arXiv2025

SONIC: Cost-Effective Web Access for Developing Countries

Over 2.6 billion people remain without access to the Internet in 2025. This phenomenon is especially pronounced in developing regions, where cost and infrastructure limitations are major barriers to connectivity. In response, we design SONIC, a low-cost, scalable data delivery system that builds on existing infrastructures: FM radio for downlink broadcasting, and SMS for personalized uplink. SONIC is motivated by the widespread availability of FM radio and SMS infrastructure in developing regions, along with embedded FM radio tuners in affordable mobile phones. SONIC offers several innovations to effectively transmit Web content over sound over FM radio, in a reliable and compressed form. For example, we transmit pre-rendered webpages and leverage pixel interpolation to recover errors at the receiver. We further modify Android to offer a simpler deployment pipeline, supporting a wide range of devices. We deployed SONIC at an FM radio station in Cameroon for six weeks with 30 participants. Our results demonstrate a sustained downlink throughput of 10 kbps, less than 20% loss for a majority of transmissions with signal strength above -90 dbM, and a strong user engagement across both Web browsing and ChatGPT interactions.

cs.NI↗

arXiv2025

PixLift: Accelerating Web Browsing via AI Upscaling

Accessing the internet in regions with expensive data plans and limited connectivity poses significant challenges, restricting information access and economic growth. Images, as a major contributor to webpage sizes, exacerbate this issue, despite advances in compression formats like WebP and AVIF. The continued growth of complex and curated web content, coupled with suboptimal optimization practices in many regions, has prevented meaningful reductions in web page sizes. This paper introduces PixLift, a novel solution to reduce webpage sizes by downscaling their images during transmission and leveraging AI models on user devices to upscale them. By trading computational resources for bandwidth, PixLift enables more affordable and inclusive web access. We address key challenges, including the feasibility of scaled image requests on popular websites, the implementation of PixLift as a browser extension, and its impact on user experience. Through the analysis of 71.4k webpages, evaluations of three mainstream upscaling models, and a user study, we demonstrate PixLift's ability to significantly reduce data usage without compromising image quality, fostering a more equitable internet.

cs.PF↗

arXiv2025

A Tale of Three Location Trackers: AirTag, SmartTag, and Tile

Bluetooth Low Energy (BLE) location trackers, or "tags", are popular consumer devices for monitoring personal items. These tags rely on their respective network of companion devices that are capable of detecting their BLE signals and relay location information back to the owner. While manufacturers claim that such crowd-sourced approach yields accurate location tracking, the tags' real-world performance characteristics remain insufficiently understood. To this end, this study presents a comprehensive analysis of three major players in the market: Apple's AirTag, Samsung's SmartTag, and Tile. Our methodology combines controlled experiments -- with a known large distribution of location-reporting devices -- as well as in-the-wild experiments -- with no control on the number and kind of reporting devices encountered, thus emulating real-life use-cases. Leveraging data collection techniques improved from prior research, we recruit 22 volunteers traveling across 29 countries, examining the tags' performance under various environments and conditions. Our findings highlight crucial updates in device behavior since previous studies, with AirTag showing marked improvements in location report frequency. Companion device density emerged as the primary determinant of tag performance, overshadowing technological differences between products. Additionally, we find that post-COVID-19 mobility trends could have contributed to enhanced performance for AirTag and SmartTag. Tile, despite its cross-platform compatibility, exhibited notably lower accuracy, particularly in Asia and Africa, due to limited global adoption. Statistical modeling of spatial errors -- measured as the distance between reported and actual tag locations -- shows log-normal distributions across all tags, highlighting the need for improved location estimation methods to reduce occasional significant inaccuracies.

cs.PF↗

arXiv2025

Non-Western Perspectives on Web Inclusivity: A Study of Accessibility Practices in the Global South

The Global South faces unique challenges in achieving digital inclusion due to a heavy reliance on mobile devices for internet access and the prevalence of slow or unreliable networks. While numerous studies have investigated web accessibility within specific sectors such as education, healthcare, and government services, these efforts have been largely constrained to individual countries or narrow contexts, leaving a critical gap in cross-regional, large-scale analysis. This paper addresses this gap by conducting the first large-scale comparative study of mobile web accessibility across the Global South. In this work, we evaluate 100,000 websites from 10 countries in the Global South to provide a comprehensive understanding of accessibility practices in these regions. Our findings reveal that websites from countries with strict accessibility regulations and enforcement tend to adhere better to Web Content Accessibility Guidelines (WCAG) guidelines. However, accessibility violations impact different disability groups in varying ways. Blind and low-vision individuals in the Global South are disproportionately affected, as only 40% of the evaluated websites meet critical accessibility guidelines. This significant shortfall is largely due to developers frequently neglecting to implement valid alt text for images and ARIA descriptions, which are essential specification mechanisms in the HTML standard for the effective operation of screen readers.

cs.SE↗

arXiv2025

MAML: Towards a Faster Web in Developing Regions

The web experience in developing regions remains subpar, primarily due to the growing complexity of modern webpages and insufficient optimization by content providers. Users in these regions typically rely on low-end devices and limited bandwidth, which results in a poor user experience as they download and parse webpages bloated with excessive third-party CSS and JavaScript (JS). To address these challenges, we introduce the Mobile Application Markup Language (MAML), a flat layout-based web specification language that reduces computational and data transmission demands, while replacing the excessive bloat from JS with a new scripting language centered on essential (and popular) web functionalities. Last but not least, MAML is backward compatible as it can be transpiled to minimal HTML/JavaScript/CSS and thus work with legacy browsers. We benchmark MAML in terms of page load times and sizes, using a translator which can automatically port any webpage to MAML. When compared to the popular Google AMP, across 100 testing webpages, MAML offers webpage speedups by tens of seconds under challenging network conditions thanks to its significant size reductions. Next, we run a competition involving 25 university students porting 50 of the above webpages to MAML using a web-based editor we developed. This experiment verifies that, with little developer effort, MAML is quite effective in maintaining the visual and functional correctness of the originating webpages.

cs.NI↗

arXiv2024

Challenges and Opportunities for Global Cellular Connectivity

Traditional cellular service was designed for global connectivity, but business and logistical constraints led to its fragmentation, with deployments limited to individual countries and regions. Initiatives like Mobile Virtual Network Operators (MVNOs), Mobile Network Aggregators (MNAs), and regulations like ''roam-like-at-home'' have partially restored global service potential, though often at high costs in terms of user bills, application performance, and traffic efficiency. This paper makes two key contributions: first, it surveys the global cellular ecosystem, analyzing the strengths and weaknesses of major players using data from prior research, proprietary datasets, and public sources. Second, it argues that the technology for seamless global service exists in Local Breakout (LBO), a roaming architecture which allows user traffic to be routed directly to the Internet through the visited network, bypassing the home network and/or third-party infrastructures. However, LBO adoption is hindered by issues such as policy enforcement, billing, and Quality of Service (QoS) guarantees, rooted in a lack of trust between operators. The paper concludes by exploring technological advances that could enable LBO, and pave the way for truly global cellular connectivity.

cs.NI↗

arXiv2024

Unraveling the Airalo Ecosystem

In recent years, we have witnessed myriad flavours of Mobile Network Aggregators (MNAs) which exploit the coverage footprint of a handful of base operators to provide global mobile connectivity. Under the MNA model, emerging operators reap the benefits of network softwarization and virtualization, including eSIM technology or control/data-plane separation. This paper investigates an emergent MNA type - a thick MNA - that relies on multiple (core) base operators from different economies to provision eSIM profiles, while employing gateway functions to the public internet located outside the respective base operators' home country. Specifically, our work is the first to capture the intricacies of Airalo - a thick MNA that operates in 219 countries. Unlike other MNAs that our community scrutinized, we show that Airalo often decouples the geographical location of the public internet gateway from the native country of the base operator via IPX Hub Breakout (IHBO). To map Airalo's underlying infrastructure, we ran web-based measurements that 14 volunteers performed while traveling and using an Airalo eSIM on their personal devices. We further dive into Airalo's performance by running device-based measurements (speedtest, traceroute, video streaming, etc.) in 10 countries with rooted Android devices. Finally, we examine Airalo's pricing by monitoring its marketplace.

cs.NI↗

arXiv2024

SONIC: Connect the Unconnected via FM Radio & SMS

As of 2022, about 2.78 billion people in developing countries do not have access to the Internet. Lack of Internet access hinders economic growth, educational opportunities, and access to information and services. Recent initiatives to ``connect the unconnected'' have either failed (project Loon and Aquila) or are characterized by exorbitant costs (Starlink and similar), which are unsustainable for users in developing regions. This paper proposes SONIC, a novel connectivity solution that repurposes a widespread communication infrastructure (AM/FM radio) to deliver access to pre-rendered webpages. Our rationale is threefold: 1) the radio network is widely accessible -- currently reaching 70% of the world -- even in developing countries, 2) unused frequencies are highly available, 3) while data over sound can be slow, when combined with the radio network, it takes advantage of its broadcast nature, efficiently reaching a large number of users. We have designed and built a proof of concept of SONIC which shows encouraging initial results.

cs.NI↗

arXiv2024

A First Look at Immersive Telepresence on Apple Vision Pro

Due to the widespread adoption of "work-from-home" policies, videoconferencing applications (e.g., Zoom) have become indispensable for remote communication. However, they often lack immersiveness, leading to the so-called "Zoom fatigue" and degrading communication efficiency. The recent debut of Apple Vision Pro, a mobile headset that supports "spatial persona", aims to offer an immersive telepresence experience. In this paper, we conduct a first-of-its-kind in-depth and empirical study to analyze the performance of immersive telepresence with Apple FaceTime, Cisco Webex, Microsoft Teams, and Zoom on Vision Pro. We find that only FaceTime provides a truly immersive experience with spatial personas, whereas others still operate 2D personas. Our measurement results reveal that (1) FaceTime delivers semantic data to optimize bandwidth consumption, which is even lower than that of 2D persona for other applications, and (2) it employs visibility-aware optimizations to reduce rendering overhead. However, the scalability of FaceTime remains limited, with a simple server-allocation strategy that potentially leads to high network delay for users.

cs.NI↗

arXiv2023

Exploring the Potential of Generative AI for the World Wide Web

Generative Artificial Intelligence (AI) is a cutting-edge technology capable of producing text, images, and various media content leveraging generative models and user prompts. Between 2022 and 2023, generative AI surged in popularity with a plethora of applications spanning from AI-powered movies to chatbots. In this paper, we delve into the potential of generative AI within the realm of the World Wide Web, specifically focusing on image generation. Web developers already harness generative AI to help crafting text and images, while Web browsers might use it in the future to locally generate images for tasks like repairing broken webpages, conserving bandwidth, and enhancing privacy. To explore this research area, we have developed WebDiffusion, a tool that allows to simulate a Web powered by stable diffusion, a popular text-to-image model, from both a client and server perspective. WebDiffusion further supports crowdsourcing of user opinions, which we use to evaluate the quality and accuracy of 409 AI-generated images sourced from 60 webpages. Our findings suggest that generative AI is already capable of producing pertinent and high-quality Web images, even without requiring Web designers to manually input prompts, just by leveraging contextual information available within the webpages. However, we acknowledge that direct in-browser image generation remains a challenge, as only highly powerful GPUs, such as the A40 and A100, can (partially) compete with classic image downloads. Nevertheless, this approach could be valuable for a subset of the images, for example when fixing broken webpages or handling highly private content.

cs.AI↗

arXiv2023

Dissecting the Performance of Satellite Network Operators

The rapid growth of satellite network operators (SNOs) has revolutionized broadband communications, enabling global connectivity and bridging the digital divide. As these networks expand, it is important to evaluate their performance and efficiency. This paper presents the first comprehensive study of SNOs. We take an opportunistic approach and devise a methodology which allows to identify public network measurements performed via SNOs. We apply this methodology to both M-Lab and RIPE public datasets which allowed us to characterize low level performance and footprint of up to 18 SNOs operating in different orbits. Finally, we identify and recruit paid testers on three popular SNOs (Starlink, HughesNet, and ViaSat) to evaluate the performance of popular applications like web browsing and video streaming.

cs.NI↗

arXiv2023

I Tag, You Tag, Everybody Tags!

Location tags are designed to track personal belongings. Nevertheless, there has been anecdotal evidence that location tags are also misused to stalk people. Tracking is achieved locally, e.g., via Bluetooth with a paired phone, and remotely, by piggybacking on location-reporting devices which come into proximity of a tag. This paper studies the performance of the two most popular location tags (Apple's AirTag and Samsung's SmartTag) through controlled experiments - with a known large distribution of location-reporting devices - as well as in-the-wild experiments - with no control on the number and kind of reporting devices encountered, thus emulating real-life use-cases. We find that both tags achieve similar performance, e.g., they are located 55% of the times in about 10 minutes within a 100 m radius. It follows that real time stalking to a precise location via location tags is impractical, even when both tags are concurrently deployed which achieves comparable accuracy in half the time. Nevertheless, half of a victim's exact movements can be backtracked accurately (10m error) with just a one-hour delay, which is still perilous information in the possession of a stalker.

cs.PF↗

arXiv2022

A Worldwide Look Into Mobile Access Networks Through the Eyes of AmiGos

How does the mobile experience compare between Germany and Nigeria? There is currently no public data or test-bed to provide an answer to this question. This is because deploying and maintaining such test-bed can be both challenging and expensive. To fill this gap, this paper proposes a novel test-bed design called "AmiGo", which relies on travelers carrying mobile phones to act as vantage points and collect data on mobile network performance. The "AmiGo" design has three key advantages: it is easy to deploy, has realistic user mobility, and runs on real Android devices. We further developed a suite of measurement tools for "AmiGo" to perform network measurements, e.g., pings, speedtests, and webpage loads. We leverage these tools to measure the performance of 24 mobile networks across five continents over a month via an "AmiGo" deployment involving 31 students. We find that 50% of networks face a 40-70% chance of providing low data rates, only 20% achieve low latencies, and networks in Asia, Central/South America, and Africa have significantly higher CDN download times than in Europe. Most news websites load slowly, while YouTube performs well. We made both test-bed and measurement tools open source.

cs.NI↗

arXiv2022

BatteryLab: A Collaborative Platform for Power Monitoring

Advances in cloud computing have simplified the way that both software development and testing are performed. This is not true for battery testing for which state of the art test-beds simply consist of one phone attached to a power meter. These test-beds have limited resources, access, and are overall hard to maintain; for these reasons, they often sit idle with no experiment to run. In this paper, we propose to share existing battery testbeds and transform them into vantage points of BatteryLab, a power monitoring platform offering heterogeneous devices and testing conditions. We have achieved this vision with a combination of hardware and software which allow to augment existing battery test-beds with remote capabilities. BatteryLab currently counts three vantage points, one in Europe and two in the US, hosting three Android devices and one iPhone 7. We benchmark BatteryLab with respect to the accuracy of its battery readings, system performance, and platform heterogeneity. Next, we demonstrate how measurements can be run atop of BatteryLab by developing the "Web Power Monitor" (WPM), a tool which can measure website power consumption at scale. We released WPM and used it to report on the energy consumption of Alexa's top 1,000 websites across 3 locations and 4 devices (both Android and iOS).

cs.NI↗

arXiv2021

Can You See Me Now? A Measurement Study of Zoom, Webex, and Meet

Since the outbreak of the COVID-19 pandemic, videoconferencing has become the default mode of communication in our daily lives at homes, workplaces and schools, and it is likely to remain an important part of our lives in the post-pandemic world. Despite its significance, there has not been any systematic study characterizing the user-perceived performance of existing videoconferencing systems other than anecdotal reports. In this paper, we present a detailed measurement study that compares three major videoconferencing systems: Zoom, Webex and Google Meet. Our study is based on 48 hours' worth of more than 700 videoconferencing sessions, which were created with a mix of emulated videoconferencing clients deployed in the cloud, as well as real mobile devices running from a residential network. We find that the existing videoconferencing systems vary in terms of geographic scope, which in turns determines streaming lag experienced by users. We also observe that streaming rate can change under different conditions (e.g., number of users in a session, mobile device status, etc), which affects user-perceived streaming quality. Beyond these findings, our measurement methodology can enable reproducible benchmark analysis for any types of comparative or longitudinal study on available videoconferencing systems.

cs.NI↗

arXiv2021

POW-HOW: An enduring timing side-channel to evade online malware sandboxes

Online malware scanners are one of the best weapons in the arsenal of cybersecurity companies and researchers. A fundamental part of such systems is the sandbox that provides an instrumented and isolated environment (virtualized or emulated) for any user to upload and run unknown artifacts and identify potentially malicious behaviors. The provided API and the wealth of information inthe reports produced by these services have also helped attackers test the efficacy of numerous techniques to make malware hard to detect.The most common technique used by malware for evading the analysis system is to monitor the execution environment, detect the presence of any debugging artifacts, and hide its malicious behavior if needed. This is usually achieved by looking for signals suggesting that the execution environment does not belong to a the native machine, such as specific memory patterns or behavioral traits of certain CPU instructions. In this paper, we show how an attacker can evade detection on such online services by incorporating a Proof-of-Work (PoW) algorithm into a malware sample. Specifically, we leverage the asymptotic behavior of the computational cost of PoW algorithms when they run on some classes of hardware platforms to effectively detect a non bare-metal environment of the malware sandbox analyzer. To prove the validity of this intuition, we design and implement the POW-HOW framework, a tool to automatically implement sandbox detection strategies and embed a test evasion program into an arbitrary malware sample. Our empirical evaluation shows that the proposed evasion technique is durable, hard to fingerprint, and reduces existing malware detection rate by a factor of 10. Moreover, we show how bare-metal environments cannot scale with actual malware submissions rates for consumer services.

cs.CR↗