Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

jSpy: Automatically detect user's history

projects.milankragujevic.com

Post reply on HN
Print view View original

31–40 of 43 posts

Re: jSpy: Automatically detect user's history

#31

Post by milankragujevic »

belandrew wrote: post #30

This really didn't work at all. I'm using the latest stable Chrome on a Mac. Roughly 3/4 of the results (there's too many to bother counting) are sites I've never been to.

Either your CPU is too fast or too slow. I can't really fix anything since I don't have a Mac to test with. It works fine on Windows.

Re: jSpy: Automatically detect user's history

#34

Post by milankragujevic »

mnx wrote: post #33

Doesn't work on chromium on linux, detected two sites that I've never been to, on a completely fresh install.

Yes, it's not accurate. It's a timing attack which means you have to be on the website all the time during the processing for it to actually work. But still it does work better for smaller sets of sites (up to 7) when set up to do every step 4 times for more accuracy.

Re: jSpy: Automatically detect user's history

#35

Post by samuelgabriel »

belandrew wrote: post #30

This really didn't work at all. I'm using the latest stable Chrome on a Mac. Roughly 3/4 of the results (there's too many to bother counting) are sites I've never been to.

Have the same problem. Even if I'm using either Chrome or Safari on my Macbook.

Re: jSpy: Automatically detect user's history

#37

Post by milankragujevic »

SchizoDuckie wrote: post #36

Okay, so this is basically brute forcing against a kown list of websites. Not all that impressive IMO. Although you could possibly try to use this for a clickjacking attack, for instance if you detect amazon.com loading from cache.

Since recently, Amazon has X-Frame-Options header which forbids the browser from loading the website in a frame.

Re: jSpy: Automatically detect user's history

#38

Post by ttty »

milankragujevic wrote: post #24
ttty wrote: post #23

Earlier quoted context omitted.

Suggestions: - use if else; - replace "if(stop){return}" with "cancelAnimationFrame"; - don't save data in the html nodes, DOM is slow, use js object to store data (timespans[currentUrl].textContent = d;). - no need to use "window.links = ..." you can simply "links = ..."

Thanks for the suggestions, I implemented them, and also un-obfuscated and formatted the code. Also, now it's much faster since it doesn't use DOM.

Thanks for sharing (: as always open source (or almost) comes with suggestions

Re: jSpy: Automatically detect user's history

#39

Post by milankragujevic »

samuelgabriel wrote: post #35
belandrew wrote: post #30

This really didn't work at all. I'm using the latest stable Chrome on a Mac. Roughly 3/4 of the results (there's too many to bother counting) are sites I've never been to.

Have the same problem. Even if I'm using either Chrome or Safari on my Macbook.

I have tried it on Safari on Windows, Opera on Windows and Chrome on Windows and it works in 99% of the cases. Also my friends tested it. It works on Opera on Android and Chrome on Android (sometimes) on Samsung Galaxy S3 Mini.
Post reply on HN