Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who am I: A mind reader (don't forget to view source)

tinsnail.neocities.org

Post reply on HN
Print view View original

61–70 of 181 posts

Re: Who am I: A mind reader (don't forget to view source)

#62

Post by cynwoody »

balls187 wrote: post #43

I thought the a:visited exploit was addressed.

That's why you have to click. Before the a:visited exploit was patched, a simple loop with GetComputedStyle would have sufficed. If you do that in a modern browser, all the squares come back color gray. The content script only gets to see the style attributes as they would be in the unvisited state.

Re: Who am I: A mind reader (don't forget to view source)

#64

Post by lrichardson »

Question:

I know that the `:visited` exploit is handled by the browsers so that you can't figure out by javascript what is going on...

but what if you used just CSS to figure it out? For instance, what if you generated the CSS which had a unique image it requested via the `background-image` property, stored the data on the server, then just requested the data from the server after the fact?

Do the browsers prohibit the usage of url-based css properties on CSS selectors with `:visited` or something? Does anyone have a link/reference to how the exploits were patched up?

Re: Who am I: A mind reader (don't forget to view source)

#65

Post by RussianCow »

lrichardson wrote: post #64

Question: I know that the `:visited` exploit is handled by the browsers so that you can't figure out by javascript what is going on... but what if you used just CSS to figure it out? For instance, what if you generated the CSS which had a unique image it requested via the `background-image` property, stored the data on the server, then just requested the data from the server after the fact? Do the browsers prohibit t…

Yes, they prohibit anything that might be used for this purpose.[0] So the CSS allowed for :visited selectors is limited to a small subset.

[0]: https://hacks.mozilla.org/2010/03/privacy-related-changes-co...

Re: Who am I: A mind reader (don't forget to view source)

#67

Post by tomblomfield »

danbruc wrote: post #17

Obvious question - how was the list of URLs compiled? Some are really specific like YouTube channels. On the other hand there are only 15 categories and there are probably a lot of people that would not get a single match or only something very generic like Wikipedia.

fivethirtyeight.com appears about a dozen times for me?

Re: Who am I: A mind reader (don't forget to view source)

#69

Post by Conlectus »

neya wrote: post #66

This is mind-blowing, mine was pretty accurate! I know I can view the source code, but is this/similar code available from GitHub or somewhere for us to use in our own weekend projects? (:

I hope to clean up the code and post it to GitHub tomorrow.
Post reply on HN