Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who am I: A mind reader (don't forget to view source)

tinsnail.neocities.org

Post reply on HN
Print view View original

11–20 of 181 posts

Re: Who am I: A mind reader (don't forget to view source)

#11

Post by bilalq »

gburt wrote: post #8
irises_come wrote: post #7

Hm. Do you really need interaction at all? Can't you just :visited { margin/pos/whatever }, then probe the dom on that or related elems to extract the juice? Or have browser vendors thought of this?

This is a very old attack that has numerous security measures to prevent you from doing that now.

Interesting. Could this maybe be bypassed by looking at computed CSS values of an element?

Re: Who am I: A mind reader (don't forget to view source)

#13

Post by srl »

bilalq wrote: post #11
gburt wrote: post #8

Earlier quoted context omitted.

This is a very old attack that has numerous security measures to prevent you from doing that now.

Interesting. Could this maybe be bypassed by looking at computed CSS values of an element?

Apparently not. https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...

Re: Who am I: A mind reader (don't forget to view source)

#14

Post by russellsprouts »

bilalq wrote: post #11
gburt wrote: post #8

Earlier quoted context omitted.

This is a very old attack that has numerous security measures to prevent you from doing that now.

Interesting. Could this maybe be bypassed by looking at computed CSS values of an element?

Browsers lie in the computed CSS values. Regardless of whether you have visited the link or not, the computed style that JavaScript sees is always unvested.

Re: Who am I: A mind reader (don't forget to view source)

#16

Post by irises_come »

gburt wrote: post #8
irises_come wrote: post #7

Hm. Do you really need interaction at all? Can't you just :visited { margin/pos/whatever }, then probe the dom on that or related elems to extract the juice? Or have browser vendors thought of this?

This is a very old attack that has numerous security measures to prevent you from doing that now.

I presumed as much. But if you can covertly jimmy the UI and parse the user's interaction, you can more or less get at the history like that anyway.

I don't see any secure way to handle this besides disallowing :visited styling entirely.

Re: Who am I: A mind reader (don't forget to view source)

#17

Post by danbruc »

Obvious question - how was the list of URLs compiled? Some are really specific like YouTube channels. On the other hand there are only 15 categories and there are probably a lot of people that would not get a single match or only something very generic like Wikipedia.

Re: Who am I: A mind reader (don't forget to view source)

#18

Post by chc »

irises_come wrote: post #16
gburt wrote: post #8

Earlier quoted context omitted.

This is a very old attack that has numerous security measures to prevent you from doing that now.

I presumed as much. But if you can covertly jimmy the UI and parse the user's interaction, you can more or less get at the history like that anyway. I don't see any secure way to handle this besides disallowing :visited styling entirely.

I'm having a hard time following here. What is "covertly jimmying a UI" and how would it allow you to exploit visited styles?

Re: Who am I: A mind reader (don't forget to view source)

#19

Post by tomasien »

This just solved a huge problem I've been struggling with. This is beautiful - I don't actually want to know the information I've been trying to access, but it will make the experience better for the user. I now realize I don't HAVE to know - the browser knows, and that's all that matters. I just have to teach the browser what to do.
Post reply on HN