Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who am I: A mind reader (don't forget to view source)

tinsnail.neocities.org

Post reply on HN
Print view View original

111–120 of 181 posts

Re: Who am I: A mind reader (don't forget to view source)

#111

Post by praptak »

btgeekboy wrote: post #99
eli wrote: post #54

Earlier quoted context omitted.

Wouldn't that also require a hundred same sized differently colored buttons, just like this site?

Not necessarily. What if the un-visited box was set to display:none? That would leave you with just the visited boxes showing. Now make it even less obvious: create a false box with the proper :visited color. That's your bottom layer, your fallthrough if the user hasn't visited any of them. Now position all of the :visited boxes as exactly the same size and position over that bottom layer. Now, when the user clicks t…

> Not necessarily. What if the un-visited box was set to display:none?

Then it would remain 'none' for the visited box too. Messing with 'display' is disabled in 'visited' to prevent this class of workarounds.

Re: Who am I: A mind reader (don't forget to view source)

#113

Post by xmonkee »

amjd wrote: post #101
analog31 wrote: post #92

Earlier quoted context omitted.

For those of us who don't know Javascript, I'll just ask in broad terms: What is it, how's it work, what's it do?

It's a neat little hack to predict your interests among various categories. The hundreds of grey boxes that you see are actually links to sites belonging to different categories like programming, science etc. and the red ones are those that you have visited (based on your browser history). The basic idea here is of using the CSS selector a:visited to highlight visited links in red, and by clicking the red boxes the u…

Apart from making it seem like a game, is there any reason why the user has to click the squares? Is there a way for the browser to report back which elements are currently red?

Re: Who am I: A mind reader (don't forget to view source)

#114

Post by _delirium »

xmonkee wrote: post #113
amjd wrote: post #101

Earlier quoted context omitted.

It's a neat little hack to predict your interests among various categories. The hundreds of grey boxes that you see are actually links to sites belonging to different categories like programming, science etc. and the red ones are those that you have visited (based on your browser history). The basic idea here is of using the CSS selector a:visited to highlight visited links in red, and by clicking the red boxes the u…

Apart from making it seem like a game, is there any reason why the user has to click the squares? Is there a way for the browser to report back which elements are currently red?

That used to be possible by reading the styling in JS, but that was considered a privacy bug, since any website could slurp information from your browser history. Therefore there was an overhaul of what kind of styling could be done based on history, and what could be read back about it in JS: https://blog.mozilla.org/security/2010/03/31/plugging-the-cs...

Re: Who am I: A mind reader (don't forget to view source)

#116

Post by neoveller »

Geee wrote: post #88
neoveller wrote: post #53

Earlier quoted context omitted.

I spent an unfortunate chunk of time trying to auto-click all the red square via jquery in chrome console. After a lot of reading and experimenting, I can verify that the exploit is thoroughly addressed (so far), and I cannot achieve my goal because of it :(. The most promising workaround would be to find a JS screenshot tool that doesn't rely on the DOM, and then run some client-side image analysis to get the index…

You could access the webcam and zoom/enhance the reflection in the eyes to get the screenshot.

Think I just found a way using canvas with a semi transparent element inside of it, then overlaying that on each square, grabbing the computed/resulting color of the canvas to decipher which block is what. S O O N

Re: Who am I: A mind reader (don't forget to view source)

#117

Post by dalke »

xmonkee wrote: post #113
amjd wrote: post #101

Earlier quoted context omitted.

It's a neat little hack to predict your interests among various categories. The hundreds of grey boxes that you see are actually links to sites belonging to different categories like programming, science etc. and the red ones are those that you have visited (based on your browser history). The basic idea here is of using the CSS selector a:visited to highlight visited links in red, and by clicking the red boxes the u…

Apart from making it seem like a game, is there any reason why the user has to click the squares? Is there a way for the browser to report back which elements are currently red?

No. Or rather, there isn't supposed to be. About 8 years ago (see http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-yo... for an early demonstration) it was possible. This was considered bad, because it could help malicious sites gain information about the browser history which might help with an attack.

The browser developers responded by minimizing what a ":visited" can do, so Javascript shouldn't be able to get direct, or indirect through CSS, access to that information.

Re: Who am I: A mind reader (don't forget to view source)

#118

Post by LaurentVB »

andybak wrote: post #106
megablast wrote: post #80

Earlier quoted context omitted.

Could your draw the screen, then save that as a screenshot, and analyse the image?

Just what I was thinking. Can't you render the DOM to a canvas and then access the pixels in that?

Apparently not: https://developer.mozilla.org/en-US/docs/Web/HTML/Canvas/Dra...

> Visited-link styles aren't applied to links rendered in SVG images, so history information can't be retrieved, and native themes aren't rendered in SVG images, which makes it harder to determine the user's platform.

Re: Who am I: A mind reader (don't forget to view source)

#119

Post by maaarghk »

mbrubeck wrote: post #22

Here's the same exploit disguised as a game, to make it less obvious that it's tricking the user into interacting with it: http://lcamtuf.coredump.cx/yahh/ Documentation of the game proof-of-concept: http://lcamtuf.blogspot.com/2013/05/some-harmless-old-fashio...

That's really good, and a very informative forum post!
Post reply on HN