Slashdot Mirror

← Back to Stories (view on slashdot.org)

Sniffing Browser History Without Javascript

Posted by kdawson on from the hole-in-css dept.

Ergasiophobia alerts us to a somewhat alarming technology demonstration, in which a Web site you visit generates a pretty good list of sites you have visited — without requiring JavaScript. NoScript will not protect you here. The only obvious drawbacks to this method are that it puts a load on your browser, and that it requires a list of Web sites to check against. "It actually works pretty simply — it is simpler than the JavaScript implementation. All it does is load a page (in a hidden iframe) which contains lots of links. If a link is visited, a background (which isn't really a background) is loaded as defined in the CSS. The 'background' image will log the information, and then store it (and, in this case, it is displayed to you)."

10 of 216 comments (clear)

  1. Old stuff by kasot · · Score: 5, Informative

    The CSS history hack has been known since (at least) August 2006: http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html

    1. Re:Old stuff by Anonymous Coward · · Score: 4, Informative

      Long before that, honestly.

      There are Firefox extensions that can help protect against this (see http://www.safecache.com/ and http://www.safehistory.com/ ), but they break enough things on the web that even their creators admit they're not terribly practical.

      (Disclaimer: Two of the folks that worked on this also worked for awhile on Chromium with me.)

    2. Re:Old stuff by zmooc · · Score: 5, Informative

      Bug 57351 - css on a:visited can load an image and/or reveal if visitor been to a site
      Reported: 2000-10-19 16:57 PDT by Jesse Ruderman

      --
      0x or or snor perron?!
    3. Re:Old stuff by glodime · · Score: 5, Informative

      Bug 57351

      Was marked ass a duplicate of 147777
      See: https://bugzilla.mozilla.org/show_bug.cgi?id=147777

      Vitaly Sharovatov and Walt Gordon Jones have an interesting back and forth on ideas for a proper fix. Search the page linked below for "Walt Gordon Jones" to follow the conversation.
      http://sharovatov.wordpress.com/2009/04/21/startpaniccom-and-visited-links-privacy-issue/

      Walt Gordon Jones summarizes his point:

      The idea that the only way to protect your history data is to give up keeping history at all seems broken to me. Just because the information is in the browser, and I may use it in other ways, doesn't mean it has to be used to mark up the rendered HTML on sites I visit. There's nothing that inextricably ties history to the browser's rendering engine.

    4. Re:Old stuff by zobier · · Score: 4, Informative

      Alternatively, add
      a:visited { background-image: none ! important; }
      To your userContent.css
      I can confirm that this works.

      --
      Me lost me cookie at the disco.
  2. big issue is NoScript by bcrowell · · Score: 5, Informative

    I'd care a lot more about this if NoScript was still a viable option. NoScript has become malware at this point. The real issue is the need for someone more trustworthy to make a simpler, and more trustworthy replacement for NoScript. Please? Pretty please?

    --
    Find free books.
    1. Re:big issue is NoScript by VGPowerlord · · Score: 5, Informative

      If anything, I'd say the author of Noscript has proved two things: one, that he is human and makes mistakes, and two, that he has the integrity of character to appologise for his mistakes and rectify them. Neither of which makes him any less trustworthy than anyone else.

      From what I hear, he only "apologized" and fixed the problem for several reasons:
      1. Because the Firefox devs said that NoScript was breaking Firefox's Add-on Policy when it started monkeying around with AdBlock Plus.
      2. NoScript's rating was plummeting on the Firefox Add-on site. If this rating drops too much, NoScript would no longer be considered a trusted add-on, and therefore every version would be subject to security review before it exited the Sandbox.

      Oh, yes, you read that correctly. NoScript is currently not reviewed before new versions go up on the Firefox add-on site.

      Incidentally, Mozilla made a new policy spelling out some restrictions for add-ons after this incident.

      --
      GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
  3. Re:Will it.. by orange47 · · Score: 4, Informative

    its easy to tell, with that nickname of yours.. :)

  4. Re:It requires an iframe, so noscript will help yo by yacc143 · · Score: 5, Informative

    It does not require an iframe. It's just that this way it's easier to hide any visual clues.

    The basic hack works simple. It sets a different style for visited links. (As such it will only match exact URLs). And one of the cool things your style for visited links specifies is a background URL that works as a webbug.

    yacc

  5. Re:Chrome by Z80xxc! · · Score: 4, Informative

    would be a lot easier if I could run two separate instances of Firefox simultaneously.

    Send Firefox developers a polite nasty-gram, telling them that you want the ability to open a second, third, or even fourth instance of FF in seperate memory space.

    This functionality already exists.

    "%programfiles%\Mozilla Firefox\firefox.exe" -P "profile to use" -no-remote