Live data from Hacker News

Retrieving your browsing history through a CAPTCHA

varun.ch

11–20 of 63 posts

Re: Retrieving your browsing history through a CAPTCHA

#11
post #5

This is a terrible PI leak ... JS should really be disabled by default and only be enabled on sites that really need it and you somewhat trust.

It does not require js to work. In essense, it uses css styles to exploit visited links.

You need js to extract the PI though?

Re: Retrieving your browsing history through a CAPTCHA

#12
post #10
post #5

Earlier quoted context omitted.

It does not require js to work. In essense, it uses css styles to exploit visited links.

But dont you need js to check for the styles to see if the link is visited?

No, each square the user clicks could be a checkbox that is submitted to the backend as a form when they click done.

Re: Retrieving your browsing history through a CAPTCHA

#14
post #2

Are there any extensions that protect from this?

Tor Browser is not vulnerable.

I don't think you can defend against this by adding CSS rules, only removing them. Extensions would need to parse the entire CSS of a website and replace it, which would be cumbersome.

Re: Retrieving your browsing history through a CAPTCHA

#15

Quoted post unavailable.

What is going on with those new accounts preaching against online privacy recently?

Edit: For the lurkers trying to educate themselves, I recommend those resources:

https://en.wikipedia.org/wiki/Nothing_to_hide_argument

https://en.wikipedia.org/wiki/Citizenfour

https://vimeo.com/nothingtohide

Re: Retrieving your browsing history through a CAPTCHA

#16
post #4

I rarely see websites that actually make use of `:visited` style as intended, it would be good if browsers had an option to just disable it and prevent this class of leaks completely.

The only time I ever see a visited style link is when links aren't styled at all. It's anachronistic and the feature should probably be dropped altogether. If some users want to see it, it could be done with an extension that has history access (or a coarse-grained version of history). Then they'd be able to see it for all sites, not just the tiny fraction of sites that don't style links.

Re: Retrieving your browsing history through a CAPTCHA

#17
post #15

Quoted post unavailable.

What is going on with those new accounts preaching against online privacy recently? Edit: For the lurkers trying to educate themselves, I recommend those resources: https://en.wikipedia.org/wiki/Nothing_to_hide_argument https://en.wikipedia.org/wiki/Citizenfour https://vimeo.com/nothingtohide

I don't think the new account was actually arguing against privacy (those words have basically become a strawman now); rather it was just a bit of dry humour.

Re: Retrieving your browsing history through a CAPTCHA

#18
post #4

I rarely see websites that actually make use of `:visited` style as intended, it would be good if browsers had an option to just disable it and prevent this class of leaks completely.

The last sentence of the article claims you do have that option, but I can't find it?

I can see an option to always overridde the color with my choice.

Re: Retrieving your browsing history through a CAPTCHA

#19
post #4

I rarely see websites that actually make use of `:visited` style as intended, it would be good if browsers had an option to just disable it and prevent this class of leaks completely.

The site we are on right now uses visited links in a different style (although annoyingly subtle). I find this feature incredibly valuable.

I would've be opposed to a feature to disable it but I certainly wouldn't use it. I can imagine that Tor may want to enable it by default though.

Edit: Apparently Firefox has this feature and Tor does use it.

Re: Retrieving your browsing history through a CAPTCHA

#20
post #4

I rarely see websites that actually make use of `:visited` style as intended, it would be good if browsers had an option to just disable it and prevent this class of leaks completely.

The last sentence of the article claims you do have that option, but I can't find it? I can see an option to always overridde the color with my choice.

Looks like Firefox has it in their advanced settings under "layout.css.visited_links_enabled", but on Chrome (or other Chromium based browsers) you have to clear history regularly, or use incognito mode.
Post reply on HN