Slashdot Mirror
Sniffing Browser History Without Javascript
Ergasiophobia alerts us to a somewhat alarming technology demonstration, in which a Web site you visit generates a pretty good list of sites you have visited — without requiring JavaScript. NoScript will not protect you here. The only obvious drawbacks to this method are that it puts a load on your browser, and that it requires a list of Web sites to check against. "It actually works pretty simply — it is simpler than the JavaScript implementation. All it does is load a page (in a hidden iframe) which contains lots of links. If a link is visited, a background (which isn't really a background) is loaded as defined in the CSS. The 'background' image will log the information, and then store it (and, in this case, it is displayed to you)."
The CSS history hack has been known since (at least) August 2006: http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html
I'd care a lot more about this if NoScript was still a viable option. NoScript has become malware at this point. The real issue is the need for someone more trustworthy to make a simpler, and more trustworthy replacement for NoScript. Please? Pretty please?
Find free books.
its easy to tell, with that nickname of yours.. :)
Doesn't work on me - Firefox, with adblock plus, element hiding helper, and flashblock, running whatever the latest Ubuntu is.
Maybe just clear your cache more often. It's easy, fast and good practice. Ctrl-Shift-Del, press enter.
Do this every time you close FF.
You can't legislate goodness. Let each to his own destiny, by will of his freely made choices.
It does not require an iframe. It's just that this way it's easier to hide any visual clues.
The basic hack works simple. It sets a different style for visited links. (As such it will only match exact URLs). And one of the cool things your style for visited links specifies is a background URL that works as a webbug.
yacc
Small but important distinction: this exploit is for browser history, not cache. That shortcut (or shift-command-delete* on a Mac) will bring up the 'clear private data' dialog which covers browser history (the one this exploit is for), download history, saved form and search history, browser cache, and other items.
* Unlike PCs, which have 'backspace' and '(forward) delete' buttons, Macs have two buttons labeled 'delete' or 'del'--the big one which is backspace, and the small one next to help, home, end, etc., which is forward delete. That's the one you need for this shortcut. I imagine laptop users and people who use those new small keyboards are SOL.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
You should only load remote images on demand.
[...]
Yeah , I know must be new here..
You're not new here, I can tell by the fact that you didn't read the article. Or the summary ;)
This feature actually works like you want it to: It *does* load on demand. And that's the problem here. If it always loaded it this exploit wouldn't work. Its based on only being loaded on demand.
would be a lot easier if I could run two separate instances of Firefox simultaneously.
Send Firefox developers a polite nasty-gram, telling them that you want the ability to open a second, third, or even fourth instance of FF in seperate memory space.
This functionality already exists.
"%programfiles%\Mozilla Firefox\firefox.exe" -P "profile to use" -no-remote
So... you posted just to brag about the extreme efforts you go to to support your irrational paranoia?
Thanks, I guess?
Comment of the year
putting the rule
a:visited {
background:none !important;
in userContent.css seems to stop this particular scan.
I have written bug reports which got no attention at all. For years I was laughed at in forums for describing this problem.
There are some tools, which don't get updated anymore, safecache and safehistory. Here are papers from 2006:
http://crypto.stanford.edu/sameorigin/
cb
This is for FF 3.0. YMMV with other versions and other browsers.
Go to Preferences -> Advanced -> General. Under "Accessibility" check the option for "Warn me when web sites try to redirect or reload the page".
The attack relies on trying a lot of links ... but with the above setting FF warns on each attempt, with a warning across the top of the page saying "Firefox prevented this page from automatically redirecting to another page". So the attack could proceed if you sat there clicking the "approve" button constantly. But after the second or third warning, well, I hope you'd become suspicious.
layout.css.visited_links_enabled = false
or change the about:config setting called "layout.css.visited_links_enabled"