Hack: Site steals your browsing history based on URL link color
caughtyouwatching.com
Hack: Site steals your browsing history based on URL link color
1–10 of 21 posts
Re: Hack: Site steals your browsing history based on URL link color
#2Scary stuff, good thing i always clear my history...
Re: Hack: Site steals your browsing history based on URL link color
#3This is all very cute, but the real exploit isn't embarrassing your friends and co-workers by revealing their kinks. Imagine a phishing site which could sniff your browser history to see which bank you use, and then provide a customized login form masquerading as that same site.
Exposing browsing history via CSS color information in the DOM is a serious security hope that should be closed by browser vendors.
Re: Hack: Site steals your browsing history based on URL link color
#4http://code.google.com/p/aza/source/browse/trunk/SocialHisto...
It's one of those things which has questionable ethics…but honestly? A little awesome...
Re: Hack: Site steals your browsing history based on URL link color
#5This is really old news. Here's an HN link discussing someone's batshit crazy startup idea based on it:
Re: Hack: Site steals your browsing history based on URL link color
#6Here something similar based on social sites:
http://www.azarask.in/blog/post/socialhistoryjs/
Re: Hack: Site steals your browsing history based on URL link color
#7This is so old it’s even mentioned in the spec as something a browser can choose to avoid:
http://www.w3.org/TR/CSS21/selector.html#link-pseudo-classes
Note. It is possible for style sheet authors to abuse the :link and :visited pseudo-classes to determine which sites a user has visited without the user's consent.
UAs may therefore treat all links as unvisited links, or implement other measures to preserve the user's privacy while rendering visited and unvisited links differently. See [P3P] for more information about handling privacy.
Re: Hack: Site steals your browsing history based on URL link color
#8This is the best use of it:
http://startpanic.com/
Demonstrates how powerful the technique is.
Re: Hack: Site steals your browsing history based on URL link color
#9Yet another reason to use NoScript.
... why would I be down-voted for mentioning a solution which prevents 100% of JavaScript history attacks???
Re: Hack: Site steals your browsing history based on URL link color
#10Yet another reason to use NoScript. ... why would I be down-voted for mentioning a solution which prevents 100% of JavaScript history attacks???
It's not really relevant to anything. I could say it's another reason to go back to using BBS's instead of the WWW, but that's not really a useful observation is it.