41–50 of 99 posts
Earlier quoted context omitted.
This has mostly been fixed. See http://dbaron.org/mozilla/visited-privacy and https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...
Yes. If you're using a browser version that's been updated past 2010-2011, this will no longer work.
This approach is rather interesting. But I'm wondering whether a similar attack could be made by placing links on a web page and using the CSS :visited selector to change the style of visited web pages. Couldn't you then check which links have that formatting and which don't via JS?
I hit the page from Chrome 45.0.2454.101 and it literally did not get a single site that I regularly visit. It did make a hit on Reddit, I guess, but I have only visited the site two or three times, and you could probably say that about 2/3 of the population.
Note: in China, so sometimes HTTPS actually fails to establish
One nice thing is that it is quite inaccurate, I've visited a large number of the sites it tells me I haven't.
It's accurate depending on what you're looking for. Saying you didn't visit a site means you either did, or did not, but saying you did visit a site means you 100% did for sure. In the case of a negative the results are meaningless, but in the case of a positive they are accurate. Similar to a bloom filter
How much of this is accurate, and how much of this is simply the top XXX sites that people visit?
I didn't set up analytics to figure out how accurate results are for the average person; having manually checked with a few people's browsers, I'd say the accuracy rate is ~75%.
Earlier quoted context omitted.
It's accurate depending on what you're looking for. Saying you didn't visit a site means you either did, or did not, but saying you did visit a site means you 100% did for sure. In the case of a negative the results are meaningless, but in the case of a positive they are accurate. Similar to a bloom filter
I've just checked my history and the sites I thought I have not visited do not show (2/14). Maybe 85%?
Probably a good idea to edit the title to indicate that this is an example attack site as well, not my favorite thing in general to land on without warning. No js seems to mean no worries though.
The results never leave your browser, though, so there's not much to worry about.
Earlier quoted context omitted.
CSP, HSTS, and HPKP were all known to be exploitable for "supercookie" purposes, but not history sniffing like this. So it's fair to call this a novel attack.
No. Leaks were known far beyond the "supercookie", but attacks were not as high quality as these.