21–30 of 63 posts
Earlier quoted context omitted.
But dont you need js to check for the styles to see if the link is visited?
No, each square the user clicks could be a checkbox that is submitted to the backend as a form when they click done.
They already do that with referers, there is a security level to only let the site see referers that are local to its domain. I think this is the default for https
That's all I see - https://i.imgur.com/zl1iv6O.png
Recent Firefox + uBlock.
Also sidenote: I like the creative and subtle plug for the author's 'Quickz' project (seems to be a Kahoot alternative - I have never heard of either) in the "not visited category".
Keep up the good work!
Earlier quoted context omitted.
What is going on with those new accounts preaching against online privacy recently? Edit: For the lurkers trying to educate themselves, I recommend those resources: https://en.wikipedia.org/wiki/Nothing_to_hide_argument https://en.wikipedia.org/wiki/Citizenfour https://vimeo.com/nothingtohide
I don't think the new account was actually arguing against privacy (those words have basically become a strawman now); rather it was just a bit of dry humour.
I rarely see websites that actually make use of `:visited` style as intended, it would be good if browsers had an option to just disable it and prevent this class of leaks completely.
Some well-known websites do it, such as Google and Wikipedia.
Earlier quoted context omitted.
It does not require js to work. In essense, it uses css styles to exploit visited links.
You need js to extract the PI though?
I rarely see websites that actually make use of `:visited` style as intended, it would be good if browsers had an option to just disable it and prevent this class of leaks completely.
Any site I make will have sane blue underlined links and purple underlined visited links. I’m willing to vary the shades of blue and purple, and I prefer to reduce the opacity of the underline when not interacting with the link, but I say general links should be blue and purple and underlined, and anything else is troublemaking.
(In https://github.com/w3c/csswg-drafts/issues/3012, there’s talk of changing :visited to essentially work from the site’s perspective—exposing only history that the site could have tracked itself—rather than for the user as global visitedness does. This makes me sad, though I quite understand the perspective; to me, :visited has always been about the user, even though such first-party link following is its primary use.)
Are there any extensions that protect from this?
