Slashdot Mirror
Sniffing Browser History Without Javascript
Ergasiophobia alerts us to a somewhat alarming technology demonstration, in which a Web site you visit generates a pretty good list of sites you have visited — without requiring JavaScript. NoScript will not protect you here. The only obvious drawbacks to this method are that it puts a load on your browser, and that it requires a list of Web sites to check against. "It actually works pretty simply — it is simpler than the JavaScript implementation. All it does is load a page (in a hidden iframe) which contains lots of links. If a link is visited, a background (which isn't really a background) is loaded as defined in the CSS. The 'background' image will log the information, and then store it (and, in this case, it is displayed to you)."
You can't tell what sites I've been to if it's Slashdotted!
The CSS history hack has been known since (at least) August 2006: http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html
I'd care a lot more about this if NoScript was still a viable option. NoScript has become malware at this point. The real issue is the need for someone more trustworthy to make a simpler, and more trustworthy replacement for NoScript. Please? Pretty please?
Find free books.
its easy to tell, with that nickname of yours.. :)
then it means you've come from Slashdot.
... and maybe even nefarious, but you've got to admit: it's a neat hack (in the original sense of the word--i.e., clever)
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Awesome! Now for all the people who can take and act upon that advice, we can protect .000001% of the population.
It's a start!
AnimePapers.org: Anime Wallpapers Handled With Care
Anyone who allows their browser to cache and keep a history is stupid? Perhaps your tin foil hat is a size too small.
Some of us actually use the browser history.
It does not require an iframe. It's just that this way it's easier to hide any visual clues.
The basic hack works simple. It sets a different style for visited links. (As such it will only match exact URLs). And one of the cool things your style for visited links specifies is a background URL that works as a webbug.
yacc
Most people will never understand and basic exploits like this will always work against them.
So what, we shouldn't fix it then? The fix is dead-simple: the browser should load all "a:visited" images, regardless of whether or not it will display them.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
And some of us use one browser for their everyday surfing and one for the naughty pages... I mean, I would do that if I surfed to naughty pages, of course...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I'm letting it scan my browser now. So far the only thing it has found is Slashdot. It could maybe find sites that I've followed links from Slashdot to. But it won't find much because I run a separate browser instance, with its own (initially empty) browser history, cookies, etc, for each site I visit via by the means I have set up to start a new browser (command line script, and menu selection for the browser). And for those of you who are wanting to tell me "but Firefox just joins all startups into the same process and only gives you a new window". Well, I defeated that by dynamically creating a new home directory on the fly for each startup, populating it with a template set of files Firefox expects, setting the HOME environment variable to that path, and starting the Firefox process. So the scanning of my browser is limited to just what this one I use for Slashdot has visited recently.
now we need to go OSS in diesel cars
Comment removed based on user account deletion
would be a lot easier if I could run two separate instances of Firefox simultaneously.
Send Firefox developers a polite nasty-gram, telling them that you want the ability to open a second, third, or even fourth instance of FF in seperate memory space.
This functionality already exists.
"%programfiles%\Mozilla Firefox\firefox.exe" -P "profile to use" -no-remote
It's not DEAD-SIMPLE. I'd imagine the only real way is to kill "visited" functionality all together. Blocking images will just block that one exploit. JS isn't needed for this exploit, but it could be used to create other ones.
If a page has the rule: a:visited { color: red; }
And I have a link element with id="myElement". I can just do something like: if($('myElement').style.color === '#f00') alert('scream real loud (with ajax, or load an image.. or something)');
I just thought of that one off hand. Someone may be able to come up with something trickier that requires no js.
The point here is, the solution is not dead simple.
the "no mod and comment" rule is perhaps one of the most ill-concieved rules I have seen.
Then perhaps you haven't understood the concept behind the rule. The idea is to prevent individuals having unrestrained ability to push an agenda of their own: hence mod or post, but not both.
Unlike some other long-standing rules on this forum, this is one that actually has very sound reasoning behind it.
putting the rule
a:visited {
background:none !important;
in userContent.css seems to stop this particular scan.