51–60 of 181 posts
Couldn't one simply make a display:none on normal links and display:block on :visited, then stack them all on top each other with position:absolute and catch mouse events from each element via JS?
Browsers have a very limited set of properties that they allow in :visited rules, and display isn't one of them.
I thought the a:visited exploit was addressed.
The most promising workaround would be to find a JS screenshot tool that doesn't rely on the DOM, and then run some client-side image analysis to get the index values of the red squares, and then go from there to click the things. Well played, exploit fixers, well played.
Earlier quoted context omitted.
I'm having a hard time following here. What is "covertly jimmying a UI" and how would it allow you to exploit visited styles?
For a less "covert" example than I am sure the OP was thinking, you could have "click the red button to continue" sort of like this page does. :)
This was really accurate to me. It seems they're using a:visited on several domains to create the "red square" effect.
And the only reason you have to click the red squares is to let it know which ones are red. If you try to look up the color of a square using GetComputedStyle, it always comes back gray. That was the resolution of privacy Bug 147777† (":visited support allows queries into global history").
I can answer any questions people have.
Obvious question - how was the list of URLs compiled? Some are really specific like YouTube channels. On the other hand there are only 15 categories and there are probably a lot of people that would not get a single match or only something very generic like Wikipedia.
I just pushed an update that added more topics and graphs. I have had reported problems after the update. Can anyone confirm?