Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I too know the websites you visited

oxplot.github.com

Post reply on HN
Print view View original

41–50 of 98 posts

Re: I too know the websites you visited

#41

Post by bergie »

AshleysBrain wrote: post #27

What would be a possible use of this attack? I can't think of anything useful you'd do with knowing that you've visited Facebook. And so many people use sites like Facebook you might get a better success rate just always returning "visited" rather than measuring this way!

Maybe you could use it to only show those social sharing widgets that are for services the visitor actually uses. Though I guess WebIntents will eventually be a better way to handle that.

Re: I too know the websites you visited

#43

Post by cookiecaper »

shaggyfrog wrote: post #7

I think it got 100% for me, on Safari/Mac. Note that it doesn't need to be 100% accurate to be effective. If it guesses better than 50% (i.e. coin flip), then it could be used to give guesses with at least some confidence. No different than analyzing any other noisy dataset. Because this all works client-side, it can also be done quite invisibly.

Right, but those applications will be for things like online advertising, which is already tracking your visits and/or just assuming you use the popular sites anyway. Can this be used to violate privacy in a meaningful manner if it misses 50% or more of the time? You'd have complete plausible deniability if you were pinned to have accessed some site you don't want people to know you accessed. It can't be used as evidence in anything. What would the threat look like?

Re: I too know the websites you visited

#44

Post by aespinoza »

Extremely wrong on Chrome. The first time I ran it, it said I had not visited any of them. Google and HN were definitely browsed today.

Ran it again, ALL of them appeared visited. Even sites like abebooks, which I have not visited at all.

Re: I too know the websites you visited

#45

Post by dangrossman »

aespinoza wrote: post #44

Extremely wrong on Chrome. The first time I ran it, it said I had not visited any of them. Google and HN were definitely browsed today. Ran it again, ALL of them appeared visited. Even sites like abebooks, which I have not visited at all.

That's because the second time you ran it, all the images were in your cache from the first time you ran it. That's the expected result.

Re: I too know the websites you visited

#47

Post by mahmud »

It said "not visited" for EVERYTHING, except google which says "whoops". I have visited nearly all of them in the last 2 months.

But don't despair, I have one of the most hostile browser settings. I have RequestPolicy, NoScript,and Flashblock.

Re: I too know the websites you visited

#48

Post by dangrossman »

AshleysBrain wrote: post #27

What would be a possible use of this attack? I can't think of anything useful you'd do with knowing that you've visited Facebook. And so many people use sites like Facebook you might get a better success rate just always returning "visited" rather than measuring this way!

Ad retargeting without going through one of the high-reach ad networks. Or any product site instantly knowing which competitors you've researched, and tailoring their pricing to that.

Re: I too know the websites you visited

#50

Post by bermanoid »

mahmud wrote: post #47

It said "not visited" for EVERYTHING, except google which says "whoops". I have visited nearly all of them in the last 2 months. But don't despair, I have one of the most hostile browser settings. I have RequestPolicy, NoScript,and Flashblock.

Same results here, and I'm not running any of the things you mentioned; also been to many of those sites, within the past few days in many cases. I'm basically on stock Chrome (though I do have Adblock).
Post reply on HN