jSpy: Automatically detect user's history

#1

Post by milankragujevic » Sat, Jun 07, 2014, 11:16 PM UTC

jSpy: Automatically detect user's history
projects.milankragujevic.com

Re: jSpy: Automatically detect user's history

#2

Post by esqew » Sun, Jun 08, 2014, 12:10 AM UTC

Bandwidth limit. Any mirror?

Re: jSpy: Automatically detect user's history

#3

Post by rubbingalcohol » Sun, Jun 08, 2014, 12:13 AM UTC

esqew wrote: post #2

Bandwidth limit. Any mirror?

Funny, we get a modal for "Web hosting that rocks!" the second dude's website hits some arbitrary "CPU limit" (no mention of any such limits in the premium vs. free featurelist below)

F- would not host there.

Re: jSpy: Automatically detect user's history

#4

Post by milankragujevic » Sun, Jun 08, 2014, 12:16 AM UTC

Here's a mirror: https://dl.dropboxusercontent.com/u/192234503/jspy/index.htm... I'm really sorry that my hosting's down.

Re: jSpy: Automatically detect user's history

#5

Post by ghayes » Sun, Jun 08, 2014, 12:24 AM UTC

milankragujevic wrote: post #4

Here's a mirror: https://dl.dropboxusercontent.com/u/192234503/jspy/index.htm... I'm really sorry that my hosting's down.

Can you explain the specific technique you are using?

Re: jSpy: Automatically detect user's history

#6

Post by timothya » Sun, Jun 08, 2014, 12:28 AM UTC

Here's the paper on how this works: https://media.blackhat.com/us-13/US-13-Stone-Pixel-Perfect-T...

Re: jSpy: Automatically detect user's history

#7

Post by startling » Sun, Jun 08, 2014, 12:28 AM UTC

For the curious, the source[1] mentions "Pixel Perfect Timing Attacks" by Paul Stone[2].

[1]: https://dl.dropboxusercontent.com/u/192234503/jspy/scripts.j... [2]: https://media.blackhat.com/us-13/US-13-Stone-Pixel-Perfect-T...

Re: jSpy: Automatically detect user's history

#8

Post by milankragujevic » Sun, Jun 08, 2014, 12:28 AM UTC

ghayes wrote: post #5

milankragujevic wrote: post #4

Here's a mirror: https://dl.dropboxusercontent.com/u/192234503/jspy/index.htm... I'm really sorry that my hosting's down.

Can you explain the specific technique you are using?

I'm measuring the time it takes for the browser to render a known visited link (this page) and a known not visited link (random url). Then after it calibrates itself it goes through every link in the list and measures the time it took for the browser to render it. The bigger the time, the bigger chance the link was visited. It then loosely compares the times against the calibration values. It also uses some advanced css techniques to slow down the browser, like having a large box shadow and opacity. All links are hidden with opacity and absolute positioning but it's technically still visible so the browser does render it.

Re: jSpy: Automatically detect user's history

#9

Post by [deleted] » Sun, Jun 08, 2014, 12:40 AM UTC

ghayes wrote: post #5

milankragujevic wrote: post #4

Here's a mirror: https://dl.dropboxusercontent.com/u/192234503/jspy/index.htm... I'm really sorry that my hosting's down.

Can you explain the specific technique you are using?

[deleted]

Re: jSpy: Automatically detect user's history

#10

Post by lucb1e » Sun, Jun 08, 2014, 12:49 AM UTC

milankragujevic wrote: post #4

Here's a mirror: https://dl.dropboxusercontent.com/u/192234503/jspy/index.htm... I'm really sorry that my hosting's down.

You call that hosting? :P

Well I used to offer people on forums to host with me instead of the terrible 000webhost... in theory I could set things up for you (free of course), though I'd have to see how I want to arrange things, haven't had users other than myself on my server in a while now.