Slashdot Mirror

← Back to Stories (view on slashdot.org)

Sniffing Browser History Without Javascript

Posted by kdawson on from the hole-in-css dept.

Ergasiophobia alerts us to a somewhat alarming technology demonstration, in which a Web site you visit generates a pretty good list of sites you have visited — without requiring JavaScript. NoScript will not protect you here. The only obvious drawbacks to this method are that it puts a load on your browser, and that it requires a list of Web sites to check against. "It actually works pretty simply — it is simpler than the JavaScript implementation. All it does is load a page (in a hidden iframe) which contains lots of links. If a link is visited, a background (which isn't really a background) is loaded as defined in the CSS. The 'background' image will log the information, and then store it (and, in this case, it is displayed to you)."

4 of 216 comments (clear)

  1. damnit by Anonymous Coward · · Score: -1, Offtopic

    hotgaycock.cum again?

    oh well... i do enjoy the meat missile!

    1. Re:damnit by Tubal-Cain · · Score: 0, Offtopic

      .cum

      They started handing out custom TLDs already?

  2. Re:big issue is NoScript by Anonymous Coward · · Score: -1, Offtopic

    1. Press ALT-F2,
    2. Type "free the fish"
    3. Notice that fish wandering around your screen? That's crapware.
    4. ???
    5. PROFIT!!!!

  3. Re:No more "cool" stuff, please. by Anonymous Coward · · Score: -1, Offtopic

    Why don't you just install Lynx / Elinks and quit your whining gramps?
    Seriously, you really are a massive baby if you are moaning over AJAX.
    You really hate AJAX?
    Yeah, i will give you that most people end up screwing it up, but it can be used to great effect, main one being that it saves bandwidth for you and the servers owners.
    And this is why you are the big baby, because you don't care about the owners of the server, nor do you care about your own bandwidth, you just want it, like a leech.

    Also, why are you even on here? I could bet you are using that lovely AJAX interface for Slashdot.