Who am I: A mind reader (don't forget to view source)
tinsnail.neocities.org
Who am I: A mind reader (don't forget to view source)
1–10 of 181 posts
Re: Who am I: A mind reader (don't forget to view source)
#2This was really accurate to me. It seems they're using a:visited on several domains to create the "red square" effect.
Re: Who am I: A mind reader (don't forget to view source)
#3Heh. I clicked a few before I realized what was going on (looking at the status bar shows the link, which somewhat gives it away). You could prevent this by adding mouseover/out and onclick logic that removed the :href on hover and just colored itself red.
Re: Who am I: A mind reader (don't forget to view source)
#4nice.
Re: Who am I: A mind reader (don't forget to view source)
#5Reminds me of that hunter2 password thing. http://www.bash.org/?244321
Basically, the website doesn't know which of the squares are red, that depends on your browser state. By clicking the red squares, you're feeding it data.
The interesting observation I made out of this is that navigating there in an incognito window prevents any links from being considered as visited. That's good to know.
Re: Who am I: A mind reader (don't forget to view source)
#6I remember reading about the old CSS history hack (an automated variation of the same theme), which worked until FF4 and IE9.
It's quite interesting to see how such a seemingly simple feature (a:visited) can completely override user privacy if not accounted for.
Re: Who am I: A mind reader (don't forget to view source)
#7Hm. Do you really need interaction at all?
Can't you just :visited { margin/pos/whatever }, then probe the dom on that or related elems to extract the juice? Or have browser vendors thought of this?
Re: Who am I: A mind reader (don't forget to view source)
#8Hm. Do you really need interaction at all? Can't you just :visited { margin/pos/whatever }, then probe the dom on that or related elems to extract the juice? Or have browser vendors thought of this?
This is a very old attack that has numerous security measures to prevent you from doing that now.
Re: Who am I: A mind reader (don't forget to view source)
#9Hmm, clever.
Re: Who am I: A mind reader (don't forget to view source)
#10Here's a related Mozilla bug report from 2002 regarding the link visited issue: https://bugzilla.mozilla.org/show_bug.cgi?id=147777