Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Retrieving your browsing history through a CAPTCHA

varun.ch

Post reply on HN
Print view View original

41–50 of 63 posts

Re: Retrieving your browsing history through a CAPTCHA

#41

Post by kevincox »

varun_ch wrote: post #39
kevincox wrote: post #21

Earlier quoted context omitted.

It could even just use CSS selectors to reveal an image or change a background image that results in a request to the backend.

Fortunately most browsers already have some measures to prevent that ( https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and... ), the demo avoids automating the process altogether, and relies on tricking the visitor into 'voluntarily' telling if they've visited a site.

I meant you can use CSS on the checkbox once it is checked, there is no need to actually submit a form. I understand that you can't use CSS directly on the :visited selector.

Re: Retrieving your browsing history through a CAPTCHA

#42

Post by varun_ch »

kevincox wrote: post #41
varun_ch wrote: post #39

Earlier quoted context omitted.

Fortunately most browsers already have some measures to prevent that ( https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and... ), the demo avoids automating the process altogether, and relies on tricking the visitor into 'voluntarily' telling if they've visited a site.

I meant you can use CSS on the checkbox once it is checked, there is no need to actually submit a form. I understand that you can't use CSS directly on the :visited selector.

Ah I see, that makes sense.

Re: Retrieving your browsing history through a CAPTCHA

#43

Post by huhtenberg »

varun_ch wrote: post #36
huhtenberg wrote: post #23

Sly and clever, but the demo's not working. That's all I see - https://i.imgur.com/zl1iv6O.png Recent Firefox + uBlock.

Do you have JavaScript disabled?

No, not blocked. Nothing on the console too except that the loading of "plausible.js" was blocked.

PS. Played with it a bit and .box divs are zero-height. You need to have some content in tags for them to not collapse vertically. This fixes it (somewhat) -

  document.querySelectorAll('.box a').forEach(e => e.innerHTML = ' ')
PPS. Also this .box rule is marked with "invalid property name" -

  aspect-ratio: 1/1

Re: Retrieving your browsing history through a CAPTCHA

#44

Post by shkkmo »

mmahemoff wrote: post #16
xPaw wrote: post #4

I rarely see websites that actually make use of `:visited` style as intended, it would be good if browsers had an option to just disable it and prevent this class of leaks completely.

The only time I ever see a visited style link is when links aren't styled at all. It's anachronistic and the feature should probably be dropped altogether. If some users want to see it, it could be done with an extension that has history access (or a coarse-grained version of history). Then they'd be able to see it for all sites, not just the tiny fraction of sites that don't style links.

This is clearly not true as you are currently posting on a site that has styled links and also has lighter styled visited links.

Re: Retrieving your browsing history through a CAPTCHA

#45

Post by hackerfromthefu »

mmahemoff wrote: post #16
xPaw wrote: post #4

I rarely see websites that actually make use of `:visited` style as intended, it would be good if browsers had an option to just disable it and prevent this class of leaks completely.

The only time I ever see a visited style link is when links aren't styled at all. It's anachronistic and the feature should probably be dropped altogether. If some users want to see it, it could be done with an extension that has history access (or a coarse-grained version of history). Then they'd be able to see it for all sites, not just the tiny fraction of sites that don't style links.

Counterpoint, plenty of sites I use properly show visited links, and it's a very useful feature!

Re: Retrieving your browsing history through a CAPTCHA

#46

Post by varun_ch »

huhtenberg wrote: post #43
varun_ch wrote: post #36

Earlier quoted context omitted.

Do you have JavaScript disabled?

No, not blocked. Nothing on the console too except that the loading of "plausible.js" was blocked. PS. Played with it a bit and .box divs are zero-height. You need to have some content in tags for them to not collapse vertically. This fixes it (somewhat) - document.querySelectorAll('.box a').forEach(e => e.innerHTML = ' ') PPS. Also this .box rule is marked with "invalid property name" - aspect-ratio: 1/1

Thanks. I can't reproduce the issue on Chrome or Firefox (98), but I've just pushed an update that changes "aspect-ratio: 1/1", to "aspect-ratio: 1 / 1". Perhaps I needed those spaces.

Let me know if that solves it. :)

Edit: Looks like Firefox only got support for aspect-ratio in version 89, is your browser up to date?

Re: Retrieving your browsing history through a CAPTCHA

#47

Post by gowld »

chrismorgan wrote: post #29
xPaw wrote: post #4

I rarely see websites that actually make use of `:visited` style as intended, it would be good if browsers had an option to just disable it and prevent this class of leaks completely.

I like :visited. It’s useful. I don’t want browsers to disable it, but developers to stop clobbering and disabling it on their sites. Any site I make will have sane blue underlined links and purple underlined visited links. I’m willing to vary the shades of blue and purple, and I prefer to reduce the opacity of the underline when not interacting with the link, but I say general links should be blue and purple and und…

The think you like is client link styling, not :visited attribute manipulated via CSS/JS.

Re: Retrieving your browsing history through a CAPTCHA

#48

Post by gowld »

rightbyte wrote: post #11
cabirum wrote: post #5

Earlier quoted context omitted.

It does not require js to work. In essense, it uses css styles to exploit visited links.

You need js to extract the PI though?

JS or user submitting a form -- some form of client interaction.

Re: Retrieving your browsing history through a CAPTCHA

#49

Post by sylware »

leodriesch wrote: post #27
rightbyte wrote: post #11

Earlier quoted context omitted.

You need js to extract the PI though?

This one does not really need JS, the captcha could be done with an HTML form and checkboxes.

captchas which are not working with noscript/basic (x)html browsers are definitive no-no anyway.
Post reply on HN