Sniffing Browser History Without Javascript

Ergasiophobia alerts us to a somewhat alarming technology demonstration, in which a Web site you visit generates a pretty good list of sites you have visited — without requiring JavaScript. NoScript will not protect you here. The only obvious drawbacks to this method are that it puts a load on your browser, and that it requires a list of Web sites to check against. "It actually works pretty simply — it is simpler than the JavaScript implementation. All it does is load a page (in a hidden iframe) which contains lots of links. If a link is visited, a background (which isn't really a background) is loaded as defined in the CSS. The 'background' image will log the information, and then store it (and, in this case, it is displayed to you)."

Comments

Old stuff

[kasot]

The CSS history hack has been known since (at least) August 2006: http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html

Re:Old stuff

[Anonymous Coward]

Long before that, honestly.

There are Firefox extensions that can help protect against this (see http://www.safecache.com/ and http://www.safehistory.com/ ), but they break enough things on the web that even their creators admit they're not terribly practical.

(Disclaimer: Two of the folks that worked on this also worked for awhile on Chromium with me.)

Re:Old stuff

[zmooc]

Bug 57351 - css on a:visited can load an image and/or reveal if visitor been to a site
Reported: 2000-10-19 16:57 PDT by Jesse Ruderman

Re:Old stuff

[glodime]

Bug 57351

Was marked ass a duplicate of 147777
See: https://bugzilla.mozilla.org/show_bug.cgi?id=147777

Vitaly Sharovatov and Walt Gordon Jones have an interesting back and forth on ideas for a proper fix. Search the page linked below for "Walt Gordon Jones" to follow the conversation.
http://sharovatov.wordpress.com/2009/04/21/startpaniccom-and-visited-links-privacy-issue/

Walt Gordon Jones summarizes his point:

The idea that the only way to protect your history data is to give up keeping history at all seems broken to me. Just because the information is in the browser, and I may use it in other ways, doesn't mean it has to be used to mark up the rendered HTML on sites I visit. There's nothing that inextricably ties history to the browser's rendering engine.

Re:Old stuff

[pavon]

No it wouldn't. Most legitimate sites don't do anything exotic with the visited property, they just change color or font properties. Even those that do use the background property or some other property that accepts urls will have a single url that applies to all or a large class of visited links. The only sites that would generate a lot of bandwidth are the tiny minority that intentionally have a different visited resource for each link on their site. They have an interest in keeping this bandwith low themselves and will make those resources to be as small as possible. Hell, the CSS dictating all these resources might even be as large as the resources themselves. Honestly, this is a complete non-issue compared to the bandwidth problems caused by plain old bad site design.

Re:Old stuff

[zobier]

Alternatively, add
a:visited { background-image: none ! important; }
To your userContent.css
I can confirm that this works.

big issue is NoScript

[bcrowell]

I'd care a lot more about this if NoScript was still a viable option. NoScript has become malware at this point. The real issue is the need for someone more trustworthy to make a simpler, and more trustworthy replacement for NoScript. Please? Pretty please?

Re:big issue is NoScript

[mrmeval]

He was trying to work around a problem with easylist and handled it badly but easylist is as much to blame for targeting him.

He answers his emails if you care to ask but easylist has ignored me so far.

Re:big issue is NoScript

[VGPowerlord]

If anything, I'd say the author of Noscript has proved two things: one, that he is human and makes mistakes, and two, that he has the integrity of character to appologise for his mistakes and rectify them. Neither of which makes him any less trustworthy than anyone else.

From what I hear, he only "apologized" and fixed the problem for several reasons:
1. Because the Firefox devs said that NoScript was breaking Firefox's Add-on Policy when it started monkeying around with AdBlock Plus.
2. NoScript's rating was plummeting on the Firefox Add-on site. If this rating drops too much, NoScript would no longer be considered a trusted add-on, and therefore every version would be subject to security review before it exited the Sandbox.

Oh, yes, you read that correctly. NoScript is currently not reviewed before new versions go up on the Firefox add-on site.

Incidentally, Mozilla made a new policy spelling out some restrictions for add-ons after this incident.

Re:Will it..

[orange47]

its easy to tell, with that nickname of yours.. :)

Re:It requires an iframe, so noscript will help yo

[yacc143]

It does not require an iframe. It's just that this way it's easier to hide any visual clues.

The basic hack works simple. It sets a different style for visited links. (As such it will only match exact URLs). And one of the cool things your style for visited links specifies is a background URL that works as a webbug.

yacc

Re:Chrome

[Z80xxc!]

would be a lot easier if I could run two separate instances of Firefox simultaneously.

Send Firefox developers a polite nasty-gram, telling them that you want the ability to open a second, third, or even fourth instance of FF in seperate memory space.

This functionality already exists.

"%programfiles%\Mozilla Firefox\firefox.exe" -P "profile to use" -no-remote

simple block

[Anonymous Coward]

putting the rule
a:visited {
          background:none !important;
in userContent.css seems to stop this particular scan.