Slashdot Mirror

← Back to Stories (view on slashdot.org)

Your Browser History Is Showing

Posted by samzenpus on from the wasted-days-and-wasted-art dept.

tiffanydanica writes "For a lot of us our browser history is something we consider private, or at least not something we want to expose to every website we visit. Web2.0collage is showing just how easy it is (with code!) for sites to determine what sites you visit. When you visit the site it sniffs your browser history, and creates a collage of the (safe for work) sites that you visit. It is an interesting application of potentially scary technology (imagine a job application site using this to screen candidates). You can jump right into having your history sniffed if you so desire. While the collages are cool on their own merit, they also serve as an illustration of the privacy implications of browser history sniffing."

174 comments

  1. Comment removed by account_deleted · · Score: 2, Funny

    Comment removed based on user account deletion

  2. Something tells me by Anonymous Coward · · Score: 0

    That I would not want to look at the browser history of the guy that is in the attached featured article picture.

  3. ...So.... by Darkness404 · · Score: 1

    So just disable your browser history if you are that paranoid about it. It only takes a few clicks in any major browser. Plus if you for some reason don't want to do that, most browsers now have a private mode that doesn't record those sites in the history.

    --
    Taxation is legalized theft, no more, no less.
    1. Re:...So.... by MyLongNickName · · Score: 4, Insightful

      So, the choice is

      1. Allow everyone in the world to sniff my browsing history.
      2. give up the ability to see my own browsing history.

      Somehow, this doesn't seem right...

      --
      See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
    2. Re:...So.... by causality · · Score: 3, Insightful

      So just disable your browser history if you are that paranoid about it. It only takes a few clicks in any major browser. Plus if you for some reason don't want to do that, most browsers now have a private mode that doesn't record those sites in the history.

      I think the point can be explained this way: "who's the numbnuts who thought it would be a great idea to make this information available to anyone who asks for it?" Speaking generally about all user data and all remote IP addresses, all remote hosts are on a need-to-know basis and 99.999% of the time, they don't need to know. They particularly don't need to know without prompting the user and asking "do you want to give out this information?" with that question defaulting to "No" and a box, checked by default, which says "Remember this preference".

      You can subtly dismiss it as paranoia if you like. That doesn't excuse poor design. Also, globally disabling the browser history would deny the remote Web site access to the browser's history, sure, but it would also deprive the user of this local feature. There should be a more reasonable alternative to either "lose this feature" or "make this feature available to anyone who asks with no regard for privacy." Apparently NoScript provides such an alternative.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    3. Re:...So.... by Jurily · · Score: 5, Insightful

      1. Allow everyone in the world to sniff my browsing history.
      2. give up the ability to see my own browsing history.

      How about

      3. treat this as a serious security risk and act accordingly (report the bug and use the browser that comes out first with a patch)

    4. Re:...So.... by Qzukk · · Score: 0

      who's the numbnuts who thought it would be a great idea to make this information available to anyone who asks for it?

      Changing the color of a link you've visited has been around forever. Changing the style of a link you've visited to one that can send information back to the server eg "background-image:url(/visited.pl?site=slashdot)", that's newer.

      --
      If I have been able to see further than others, it is because I bought a pair of binoculars.
    5. Re:...So.... by causality · · Score: 1

      who's the numbnuts who thought it would be a great idea to make this information available to anyone who asks for it?

      Changing the color of a link you've visited has been around forever. Changing the style of a link you've visited to one that can send information back to the server eg "background-image:url(/visited.pl?site=slashdot)", that's newer.

      Sorry but I don't think I fully understand how that relates to this story. Would you elaborate please? What you describe there sounds like a re-implementation of so-called "http ping."

      --
      It is a miracle that curiosity survives formal education. - Einstein
    6. Re:...So.... by Goaway · · Score: 2, Informative

      This has been known for several years, and none of the browsers have done anything to fix it.

    7. Re:...So.... by uglyduckling · · Score: 4, Informative

      Because that's how this vulnerability works. It doesn't really sniff your browser history - as such - what it does it it has a huge page full of popular websites, displays them as links (invisible) and sees which links change colour. There's no easy workaround that will both allow you to have a history, and allow web pages to display something different (e.g. link colour / style) for pages that you have visited already. Perhaps the best compromise would be to allow changes to link style only within the domain of the page that's attempting to set that style. But it's still a major backward step in usability. The other option might be to disable link styles for pages that have greater than a certain number of links (say 50).

    8. Re:...So.... by nmoore · · Score: 1

      who's the numbnuts who thought it would be a great idea to make this information available to anyone who asks for it?

      Changing the color of a link you've visited has been around forever. Changing the style of a link you've visited to one that can send information back to the server eg "background-image:url(/visited.pl?site=slashdot)", that's newer.

      Sorry but I don't think I fully understand how that relates to this story. Would you elaborate please? What you describe there sounds like a re-implementation of so-called "http ping."

      By putting this CSS under an a:visited selector, they only get the ping if the link points to a URL you have visited. Though they can't get your entire history list, they can query whether (your browser thinks) you've been to a specific page.

    9. Re:...So.... by vidarh · · Score: 3, Informative
      Whether or not you can *read* the history of a browser is irrelevant if you want to know whether or not a user has visited a specific site. In that case you can simply create a page that will set appropriate CSS rules to make the browser try to load a specific background image for visited URL's for each site you want to check for. Then when the user loads your page, you'll get a barrage of what you call http pings, and all you need to do is collate that information and you know which of the sites you care about that the user has visited recently.

      It's less invasive than being able to wholesale dump the browser history (you don't know when the sites were visited, for example), but protecting against it also means disabling functionality (you'd need to prevent an app from being able to tell whether or not a link on it's own page has been clicked via CSS rules or other means, which means either disabling the distinction between visited or not completely or disabling reading back style information and/or preventing setting CSS rules that trigger loading of external resources).

    10. Re:...So.... by Anonymous Coward · · Score: 0

      Or just use NoScript or better yet use Opera's version of NoScript, which is not spyware.

    11. Re:...So.... by Minwee · · Score: 4, Funny

      And nobody will until someone constructs a detailed history of the porn sites that Steve Ballmer, Sergey Brin and Mitchell Baker have visited.

    12. Re:...So.... by MyLongNickName · · Score: 4, Funny

      I heard they collaborated and made their own.

      Please mod: -1, Ewwwww.

      --
      See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
    13. Re:...So.... by Anonymous Coward · · Score: 3, Insightful

      There's no easy workaround that will both allow you to have a history, and allow web pages to display something different (e.g. link colour / style) for pages that you have visited already.

      Sure there is. Have your browser always pull the visited and unvisited styles, then just display the relevant one. Problem solved.

    14. Re:...So.... by Anonymous Coward · · Score: 0

      Or another method, don't allow the javascript to see what color the link is. That might break some stuff.

    15. Re:...So.... by zippthorne · · Score: 1

      Of course there is. The easy workaround is to automatically load all of the link background images. Then the server can't sniff anything.

      --
      Can you be Even More Awesome?!
    16. Re:...So.... by AtomicJake · · Score: 2, Insightful

      Because that's how this vulnerability works. It doesn't really sniff your browser history - as such - what it does it it has a huge page full of popular websites, displays them as links (invisible) and sees which links change colour. There's no easy workaround that will both allow you to have a history, and allow web pages to display something different (e.g. link colour / style) for pages that you have visited already.

      The Web page (HTML, Javascript code, ...) should not be able to detect such differences and be able to report them back home; it's OK to tell the browser how to render visited links, but not to get the feedback by the browser how it rendered which links. The feedback is actually breaking the sandbox principle.

      I actually think that the current direction to "the browser is the OS (or even worse, the Flash player in your browser is the OS)" is a security nightmare.

    17. Re:...So.... by Anonymous Coward · · Score: 1, Informative

      Then you investigate the DOM to see which is there...

    18. Re:...So.... by Anonymous Coward · · Score: 0

      I've never understood why anyone would want to keep their browsing history? I've been deleting mine along with cookies since the 90's! It's something I have no value for.

    19. Re:...So.... by TitusC3v5 · · Score: 1

      That gives a whole new meaning to the phrase 'Spanking the monkey.'

      --
      And the masses cried out, "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0!"
    20. Re:...So.... by Jurily · · Score: 1

      And to "throw a chair".

    21. Re:...So.... by Anonymous Coward · · Score: 0

      Or just install noscript.

    22. Re:...So.... by maxume · · Score: 1

      You are describing the pure CSS version of the attack. If you are using javascript (As the page in the story does), you can use getComputedStyle to check if a link has been visited and then just submit the info to the server.

      Of course, the nearly 14,000 urls contained in the sitelist.js file from the site are a little more than 'a few popular web2.0' sites.

      (There appears to be some user agent sniffing in place to protect that file from casual viewing, but the new link enabled source viewer in FireFox 3.5 doesn't care.)

      --
      Nerd rage is the funniest rage.
    23. Re:...So.... by causality · · Score: 1

      Or another method, don't allow the javascript to see what color the link is. That might break some stuff.

      I seriously cannot think of any Web site that would break without this functionality. Though, I may be biased as I have been using NoScript for a long time now and think that default-deny is a great idea. As in, it's borderline negligence that all browsers don't have something like NoScript built in as a standard feature.

      Personally I think seeing the color of the link is likely to be a frivolous/cosmetic feature of dubious utility. But let's just assume for the sake of argument that it's a critical feature for some important Web site. In that case, why does JS need to be able to transmit this information back to the Web server?

      --
      It is a miracle that curiosity survives formal education. - Einstein
    24. Re:...So.... by Hynee · · Score: 1

      There's no easy workaround that will both allow you to have a history, and allow web pages to display something different (e.g. link colour / style) for pages that you have visited already.

      Sure there is. Have your browser always pull the visited and unvisited styles, then just display the relevant one. Problem solved.

      Exactly, if the visited/unvisited pseudoclasses are pulled/suppressed when the textcolor is being read, this particular site would no longer be able to read people's history. This should be easy to implement in a Firefox extension.

      There would be no loss of usability, although some "pretty" scripts might not function correctly, eg, a script that fades a link colour to a different colour triggered by an onmouseover event.

      This may not cover the security hole, because there are probably other ways of getting the text colour, perhaps using Canvas in Firefox.

      I'm guessing every hole in this solution could be covered, but I don't work on Firefox.

      The other browsers should be able to be "fixed" too.

      --
      Damn, I already moderated this topic. Now I'll have to log in with my sock puppet to comment.
    25. Re:...So.... by uglyduckling · · Score: 1

      That would make it harder, but not impossible. If you have a background image for each link style, and give that background image a unique (one-time generated) name, then the server would know when that image had been pulled, and hence which links had been visited.

    26. Re:...So.... by maxume · · Score: 1

      You have to mask the information returned by getComputedStyle too (and apparently, you have to make sure that parent elements don't change size if the font size of visited links is set differently).

      --
      Nerd rage is the funniest rage.
    27. Re:...So.... by uglyduckling · · Score: 1

      Ooooh, I just re-read your post and see what you mean. Sorry. I still think there could be ways of doing it though, like making the images different sizes and then seeing what size the containing object has become - in fact this would work by using fonts of different sizes. I think once you start trying to prevent this, you pull on one little thread and the whole CSS/DOM thing unravels.

    28. Re:...So.... by uglyduckling · · Score: 1

      I thought of another way to defeat your workaround - make the links very different font sizes then read the size of the containing object. I think, ultimately, it would be very difficult to allow any kind of introspection whilst at the same time protecting completely against this vulnerability.

    29. Re:...So.... by uglyduckling · · Score: 1

      I think there would always be a way round this. I suspect there would be a clever computational way of benchmarking the rendering engine and then creating images of different sizes on-the-fly in a complex layout and finding out which combinations were rendered. Sounds complex, but with a little thought I think there will always be a workaround.

    30. Re:...So.... by maxume · · Score: 1

      Whoops, it is just hidden from morans. It is here:

      http://web2.0collage.com/sitelist.js

      --
      Nerd rage is the funniest rage.
    31. Re:...So.... by maxume · · Score: 1

      A lot of people use their history as a set of bookmarks.

      --
      Nerd rage is the funniest rage.
    32. Re:...So.... by ceoyoyo · · Score: 1

      "There's no easy workaround that will both allow you to have a history, and allow web pages to display something different (e.g. link colour / style) for pages that you have visited already."

      Wait a minute, you could just make it work like it's SUPPOSED to. The page says "hey, can you make any visited links a different colour?" and my browser, if I say so, displays those links to me in a different colour.

      If for some reason the web server wants to know what's happening on my end (say, it wants to do some web 2.0-y stuff), then those links can be reported back in a nondescript way.

    33. Re:...So.... by Anonymous Coward · · Score: 0

      Correct. I found it on my own, prepared to report it, only to find that a bug-report about this problem had existed for years already. It would be pretty simple to allow a history but without differentiating links in the content window.

    34. Re:...So.... by Anonymous Coward · · Score: 0

      The browser doesn't actually report anything back. The website tellts the browser how to render something. The browser sees that a picture is needed to display a visited link. The browser then gets this picture from the website. And the server knows, if someone gets this specific image he has visited this specific site.

    35. Re:...So.... by Anonymous Coward · · Score: 0

      Why no browser maker does anything about this long-known problem is hard to understand. This is a very nice source of information for phishers: Which banking web site have you visited in the last few days?

    36. Re:...So.... by Goaway · · Score: 2, Interesting

      I learned elsewhere in this thread that Firefox 3.5 has finally implemented such a feature, although it might be off by default and hidden (I'm not sure about that, though).

    37. Re:...So.... by Anonymous Coward · · Score: 0

      Is there a reason the DOM must return the same answer to a script that it returns to the rendering engine? It seems to me that this is where the hole should be plugged.

    38. Re:...So.... by Simetrical · · Score: 1

      The Web page (HTML, Javascript code, ...) should not be able to detect such differences and be able to report them back home; it's OK to tell the browser how to render visited links, but not to get the feedback by the browser how it rendered which links.

      So say I make my :visited links twice as tall as my regular links. Are you saying JavaScript shouldn't be able to read the height of the element? That would break all scripts that position anything. Once I can read it with JavaScript, I can always send it back home (e.g., via AJAX, add an image or iframe with a magic URL the browser will load, . . .).

      The only way I see to fix this would be to sharply limit the properties that can be set based on :visited, to things like color and background-image; fetch background images for :visited links even if they aren't visited and the image won't be used; and lie to script when it asks about the color of a visited link (by pretending it's not visited in all cases). You can't even allow things like font-weight to be set: anything that affects sizes is going to be impossible to hide from script.

      Or you could, you know, not worry that random sites can figure out that omg you visit Slashdot (very inefficiently, by the way). That's the tactic I'm taking, personally.

      --
      MediaWiki developer, Total War Center sysadmin
    39. Re:...So.... by CastrTroy · · Score: 1

      It doesn't need to be able to transmit this data back to the server, but it's extremely difficult to get it to not transmit it back to the server, if you are allowing at least something to be transmitted back to the server. Say you didn't want the size of an element transmitted back to the server. Well, you'd have to track every variable you assigned it to, and track every variable those were assigned, appended, or encoded to to ensure that none of that data in any way made it out to a server anywhere. It's a very hard problem when you think about all the ways you could obfuscate the data, and try to confuse the javascript engine as to what you are trying to do with the data.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    40. Re:...So.... by Hynee · · Score: 1

      Yeah, that would work. How about dropping the visited state on any attempt to read any text value?

      Chances are the JS/DOM engine is sufficiently complex that it's impossible to cover this security hole.

      --
      Damn, I already moderated this topic. Now I'll have to log in with my sock puppet to comment.
    41. Re:...So.... by AtomicJake · · Score: 1

      The Web page (HTML, Javascript code, ...) should not be able to detect such differences and be able to report them back home; it's OK to tell the browser how to render visited links, but not to get the feedback by the browser how it rendered which links.

      So say I make my :visited links twice as tall as my regular links. Are you saying JavaScript shouldn't be able to read the height of the element? That would break all scripts that position anything. Once I can read it with JavaScript, I can always send it back home (e.g., via AJAX, add an image or iframe with a magic URL the browser will load, . . .).

      You are completely right.

      The only way I see to fix this would be to sharply limit the properties that can be set based on :visited, to things like color and background-image; fetch background images for :visited links even if they aren't visited and the image won't be used; and lie to script when it asks about the color of a visited link (by pretending it's not visited in all cases). You can't even allow things like font-weight to be set: anything that affects sizes is going to be impossible to hide from script.

      Good idea making :visited very restricted.

      Or you could, you know, not worry that random sites can figure out that omg you visit Slashdot (very inefficiently, by the way). That's the tactic I'm taking, personally.

      Here, I do not agere at all. This is a privacy issue. And a privacy issue can become very fast a security issue (phishing). And, even if is not phishing, I do not want /. or any other page to let find out what I looked at before. Of course, for tracking sites this is a very cool possibility to get more information from you (and to earn more dollars with this information). Your tactic may work for you, but for most users it's a privacy nightmare. And you don't need to be paranoiac ...

    42. Re:...So.... by Simetrical · · Score: 1

      Here, I do not agere at all. This is a privacy issue. And a privacy issue can become very fast a security issue (phishing). And, even if is not phishing, I do not want /. or any other page to let find out what I looked at before. Of course, for tracking sites this is a very cool possibility to get more information from you (and to earn more dollars with this information). Your tactic may work for you, but for most users it's a privacy nightmare. And you don't need to be paranoiac ...

      I strongly suspect that most users don't really care that much. And I don't think it's very worrisome even if you're concerned about privacy. The concept has been public for eight years now, but there's not a single attack that's ever been identified in the wild, nor is there any indication that one is likely anytime soon.

      It's a complicated and slow technique that gets you very little useful information. Phishers could (and do) more profitably spending their time trying to get more people to visit their site, rather than trying to go to great lengths to get slightly higher success rates for people who do visit.

      The tactics are completely ineffectual without JavaScript (or at least, they could be easily fixed by browser vendors to not work without JavaScript). If you're really so concerned about privacy as to think this theoretical issue is a serious concern, then you should already be using NoScript anyway â otherwise you're going to be sending much more detailed private data to Analytics and ad services anyway.

      So the browser defaults are fine, not an issue. Paranoid people could be given some options, of course (as in Firefox 3.5), but most people won't want :visited crippled because of a theoretical and not very effective attack. Browsers may as well load images unconditionally, so that non-JS attacks don't work and NoScript users are protected, but that's about the limit of what can reasonably be done by default here.

      --
      MediaWiki developer, Total War Center sysadmin
  4. Re:Microsoft actually did something right by calumtdalek · · Score: 3, Insightful

    It all depends on if your inprivate browser history changes the color of links when they are displayed (or in general obey the css style sheets for visited links). Perhaps someone with IE8 can test it out for us [I lack access to a windows machine]?

  5. black image by Red+Flayer · · Score: 4, Funny

    I tried it.

    I got a black screen (apparently no history to be shown).

    Either the engine is borked, or my privacy add-ins are working properly...

    Or possible the Oracle of Browser History has determined that my history is darker than the darkest dark, and refused to show images.

    --
    "Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
    1. Re:black image by houghi · · Score: 1

      I also get a dark field in FF and IE.

      --
      Don't fight for your country, if your country does not fight for you.
    2. Re:black image by Anonymous Coward · · Score: 0

      My machine ground to a halt and the 3 other browser tabs beachballed in FF 3.0.4. Not a very stealthy way to find the history. By the time I restarted FF the Penguin had only waddled to 4% and I've got the history set at 0.

  6. Not mine by Monoman · · Score: 4, Informative

    No Script baby

    --
    Keep the Classic Slashdot.
    1. Re:Not mine by thedonger · · Score: 1

      No Script baby

      I second that emotion. I never browse at work without it.

      --
      Help fight poverty: Punch a poor person.
    2. Re:Not mine by Yaa+101 · · Score: 0, Redundant

      It is unbelievable how many sites try to cram your surfing session with all sorts of cross scripting and other nuisance from 3rd parties.

      Noscript essentially gives back the decision of running scripts to the owner of the web client.

    3. Re:Not mine by Anonymous Coward · · Score: 1, Insightful

      It can also be done using CSS and then grepping accesslog. NoScript will not help you there.

    4. Re:Not mine by gazbo · · Score: 5, Informative

      No Script may help in this case, but not in general. There was a story here only a couple of weeks back talking about a pure CSS method for doing exactly this.

    5. Re:Not mine by L4t3r4lu5 · · Score: 1

      I second that emotion. I never browse without it.

      --
      Finally had enough. Come see us over at https://soylentnews.org/
    6. Re:Not mine by stickrnan · · Score: 1

      A lot of sites need javascript allowed to see any content. Are you planning on browsing with absolutely no script?

    7. Re:Not mine by countertrolling · · Score: 3, Informative

      I third it. I never browse at work.

      --
      For justice, we must go to Don Corleone
    8. Re:Not mine by Anonymous Coward · · Score: 0

      There was a story here only a couple of weeks back talking about a pure CSS method for doing exactly this.

      There's an example for a CSS-only implementation here:
      http://making-the-web.com/misc/sites-you-visit/nojs/

    9. Re:Not mine by BigBlueOx · · Score: 2, Funny

      I fourth it. I never work. I browse.

    10. Re:Not mine by orngjce223 · · Score: 1

      Then I just send a letter to the webmaster complaining that they broke, say, Lynx or a screenreader (not that I use either, but you know, accessibility is big around here). That works just fine for Flash idiot devs - just because it's a screenreader doesn't mean it intermeshes perfectly with Adobe's idea of "accessibility" which requires more work by the devs who put their whole freaking site into Flash - and by that point, it's less work to learn basic HTML and stick a menu at the bottom for navigational purposes.

      And yes, by the way, I let scripts through on Slashdot. It freezes up when it's populating the comments, but I just do that at the beginning of my browsing session (I close the browser once a day) and then close tabs as I go (I have never required more than 10 at a time). *shrug* But that's offtopic.

      --
      Note: I was 13 when I wrote most of this. Take with several grains of salt.
    11. Re:Not mine by Anonymous Coward · · Score: 0

      I fourth it. I never use browser.

    12. Re:Not mine by Daimanta · · Score: 1

      Well, then I'll install a NoCSS add-on. Who needs layout anyway.

      --
      Knowledge is power. Knowledge shared is power lost.
    13. Re:Not mine by Anonymous Coward · · Score: 0

      Nor mine. Opera. javascript OFF by default; ON only for a few (lame-ass) sites.

    14. Re:Not mine by Simetrical · · Score: 1

      It can also be done using CSS and then grepping accesslog. NoScript will not help you there.

      That could be easily circumvented if browsers just fetched the image unconditionally for :visited. The script methods are impossible to stop without locking down what properties are valid to use for :visited.

      --
      MediaWiki developer, Total War Center sysadmin
    15. Re:Not mine by ekhben · · Score: 2, Informative

      Both use the same overall technique, which is that browsers display visited links differently to unvisited links. The JS implementation trawls a set of links looking for particular markers in the font colour or size, and the CSS implementation uses "a:visited {background-image:...}" to trick the browser into telling the server which links are visited and which are not.

      The Link Status extension for FF3.5 can disable the :visited pseudo-class, preventing both methods from working.

  7. Sensationalism in summary by sys.stdout.write · · Score: 1

    Being able to query whether or not I visit common sites is a far cry from my browser history being shown, but still this needs to be fixed.

    How long until a politician gets busted for visiting a child pornography website?

    1. Re:Sensationalism in summary by poormanjoe · · Score: 1

      In regards to your sig, and only your sig, the mayor of my hometown has already been busted for child pornography/child entisement. He one of many articles.

      --
      I want to be retired when I grow up.
    2. Re:Sensationalism in summary by Anonymous Coward · · Score: 0

      That wasn't his sig. It was a line he typed. Note the absence of the "--" found at the beginning of each and every sig.

      So, you failed. Please try again. Thank you. Mmmkay?

  8. I checked it out by oodaloop · · Score: 1

    And all it showed was pictures of raptors and deadbolts.

    --
    Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
    1. Re:I checked it out by file_reaper · · Score: 1

      Soo...you like dinosaur comics yes?

    2. Re:I checked it out by Anonymous Coward · · Score: 0

      All I got was the slashdot logo and the google logo...

      Maybe I am just that boring...

  9. This methodology is actually quite old by Anonymous Coward · · Score: 5, Insightful

    This methodology is actually quite old. It takes advantage of the CSS a:visited tag. Imagine making a:visited have a width of 5 and A have a width of 100. Drop another element right next to it and then after the page loads, check to see the location of that second element. Even if the browser attempts to block JS from accessing the style applied to the visited link, it can't keep you from accessing everything else on the page. Voila, by injecting a lot of links onto the page, you can find out where a person has been.

    This is particularly dangerous because it can make Phishing very powerful. Imagine creating a resource that collects email addresses, but on that same page running this script to check the login pages of major banks. Then, you can send out targeted emails to people who you know have bank accounts at particular providers.

    1. Re:This methodology is actually quite old by Vectronic · · Score: 4, Insightful

      Sniffing Browser History Without Javascript Some 20 days ago.

    2. Re:This methodology is actually quite old by Anonymous Coward · · Score: 4, Informative

      New about:config setting in FF 3.5:
      layout.css.visited_links_enabled

      If "visited" is a useful feature for you check out SafeHistory:

      Restricts the marking of visited links on the basis of the originating document, defending against web privacy attacks that remote sites can use to determine your browser history at other sites

    3. Re:This methodology is actually quite old by jizziknight · · Score: 1

      Too bad that extension doesn't work for FF3.x

      --
      Everything I say is a lie. Except that... and that... and that, and that, and that, and that... and that.
    4. Re:This methodology is actually quite old by Anonymous Coward · · Score: 0

      I have it working on my FF3.5 instance but had to disable compatibility checking.

      There appears to be a newer version on their website than the one on the moz addons site.

    5. Re:This methodology is actually quite old by Anonymous Coward · · Score: 0

      Yes, the copy on that website is newer, but it is not by default any more compatible with recent versions of Firefox than the one on the Mozilla site.

      They have something similar, called SafeCache, that works with recent browsers. But I don't think SafeCache will solve any problems mentioned in this thread.

  10. Did not work for me by danzona · · Score: 1

    I went to the sniffing page linked from the summary and it stayed on 0% for 5 minutes so I guess it does not work for me.

    NoScript (I presume) saves the day again!

    1. Re:Did not work for me by MindStalker · · Score: 1

      Eh, noscript has become adware in the last year. The reason it keeps updating itself is for ads and to make sure you aren't blocking its own ads, and not for actual updates.

    2. Re:Did not work for me by Krneki · · Score: 1

      Same story here, it does not work.

      --
      Love many, trust a few, do harm to none.
    3. Re:Did not work for me by causality · · Score: 1

      I went to the sniffing page linked from the summary and it stayed on 0% for 5 minutes so I guess it does not work for me. NoScript (I presume) saves the day again!

      Well, yeah. The whole thing is JavaScript powered, so if you're not executing their JavaScript it's going to stay at 0% for a lot longer than 5 minutes ...

      This is defnitely not the first time I was glad I use NoScript.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    4. Re:Did not work for me by swb · · Score: 1

      Are you sure about that?

      It seems to work fine and I don't notice any additional ads, and when it does update there almost always seems to be something "new" that has been added.

    5. Re:Did not work for me by radtea · · Score: 3, Informative

      Eh, noscript has become adware in the last year.

      This is an out-dated claim: http://hackademix.net/2009/05/04/dear-adblock-plus-and-noscript-users-dear-mozilla-community/ It pertains to an ugly episode for which the NoScript author is rightfully apologetic.

      It's a curious phenomenon, how the mind closes once a certain type of conclusion has been reached. This is the phenomenon that lead to the the NoScript/AbBlock war, and it seems entirely unfruitful to emulate exactly the kind of thinking that caused the issue in the first place.

      --
      Blasphemy is a human right. Blasphemophobia kills.
    6. Re:Did not work for me by catmandi · · Score: 1

      After the outcry over the adblock plus filter snafu, NoScript has stopped adding any filters to adblocking extensions.

      IIRC, there was a movement to vote NoScript down so that it would be required to undergo a full code review of each update. The author apologised and removed the offending code.

      You show me a better protection from JS and other plugins and I'll install it. But you can't, because there isn't anything in NoScript's league.

      --
      I was promised flying cars...Why are there no flying cars?
    7. Re:Did not work for me by Anonymous Coward · · Score: 0

      You show me a better protection from JS and other plugins and I'll install it. But you can't, because there isn't anything in NoScript's league.

      Here you go

    8. Re:Did not work for me by Anonymous Coward · · Score: 0

      Does not work with Opera. The page just loads for a while, then endlessly reloads itself without result. Once again it looks like Opera is immune to yet another web "vulnerability".

      I love that Opera continues to be the most secure and standards compliant web browser ever made.

    9. Re:Did not work for me by Anonymous Coward · · Score: 0

      He undid that one change, but he has no privacy policy, and he has never promised that he wouldn't do it again or that he doesn't already do similar things in the program.

    10. Re:Did not work for me by orngjce223 · · Score: 1

      And can I reskin that, and use all my other extensions to boot (? No, the only thing I'm sticking with FF for is the extensions database.

      Here, I'll even paste in all my enabled extensions and explain what they do. I use each and every one of them EVERY SINGLE DAY. Replace all of them, and you'll have me. Yep, that's a challenge. Email me if you can find all of them for any other browser.

      Extensions:
      ChatZilla (IRC client)
      DashBlog (blogging extension)
      FEBE (extension backup service)
      Forecastfox (forecasts in the statusbar)
      Google Gears (look it up)
      Java (for those chemistry websites that have Java-based viewers)
      NoScript (see above)
      Stylish (CSS substitution)
      Tab Mix Plus (tab manager)
      +various themes I won't enumerate here

      --
      Note: I was 13 when I wrote most of this. Take with several grains of salt.
    11. Re:Did not work for me by Anonymous Coward · · Score: 0

      ChatZilla (IRC client)

      Built in.

      DashBlog (blogging extension)

      Install widget.

      FEBE (extension backup service)

      Built in.

      Forecastfox (forecasts in the statusbar)

      Install widget.

      Google Gears (look it up)

      Works fine.

      Java (for those chemistry websites that have Java-based viewers)

      Works fine.

      NoScript (see above)

      Built in.

      Stylish (CSS substitution)

      Built in.

      Tab Mix Plus (tab manager)

      Built in. (such a joke that Firefox needs an addon for this very basic functionality)

      +various themes I won't enumerate here

      Download all of the Opera skins and buttons you want or make your own. It's faster and seamless to add or change skins in Opera, unlike the clunky method Firefox uses.

    12. Re:Did not work for me by arkhan_jg · · Score: 1

      Just because he apologised and changed the behaviour, that doesn't mean we're all happy-clappy about noscript again.

      Trust, once lost, takes time to be earned again.

      --
      Remember kids, it's all fun and games until someone commits wholesale galactic genocide.
    13. Re:Did not work for me by Anonymous Coward · · Score: 0

      And by "out of date" you mean "it happened two months ago"? http://adblockplus.org/blog/attention-noscript-users http://hackademix.net/2009/05/04/dear-adblock-plus-and-noscript-users-dear-mozilla-community/ Sorry. My forgiveness doesn't come that quickly.

  11. It's slashdotted by tepples · · Score: 3, Informative
    Twice in a row, all I get is

    Expired

    This URL has expired. Please return to the home page.This is likely because of increased load. It shouldn't happen again.

    1. Re:It's slashdotted by Anonymous Coward · · Score: 0

      The man's restarting the process with a higher memory threshold...

  12. Re:Microsoft actually did something right by Freetardo+Jones · · Score: 2, Insightful

    Microsoft actually did something right

    You mean like the mode Safari had 4 years ago?

  13. Awesomeness... by Anonymous Coward · · Score: 0

    The whole world can see my pr0n and um...blogs....and it totally dosen't crash all mai machinez!

  14. Another security hole by Scutter · · Score: 1

    Can we please just have something that doesn't give up our privacy every three seconds? If you like having a browser history or enjoy the benefits of javascript, you're screwed. The only answer is to disable one or both of those.

    --

    "Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
    1. Re:Another security hole by Krneki · · Score: 1

      Most of the people here are getting errors, while still enjoining the benefits of history or Java scripts.

      --
      Love many, trust a few, do harm to none.
  15. Re:Microsoft actually did something right by sam0vi · · Score: 5, Informative

    I'm using FF 3.0.11 on Jaunty with history disabled, and it did not get anything from my browser even though the "recently closed tabs" menu has many entries in it. All i got was a black square. I also had to tell NoScript to allow their domain. This made me feel better about my paranoid ways!

    --
    When my Karma level reaches 0 I feel in piece with the Universe
  16. Comment removed by account_deleted · · Score: 4, Informative

    Comment removed based on user account deletion

  17. Broken or Slashdotted? by stry_cat · · Score: 1

    ERROR
    The requested URL could not be retrieved

    While trying to retrieve the URL: http://web2.0collage.com/app/;((%22k%22%20.%20%22(1970%201%2079269687)%22))

    The following error was encountered:

            * Unable to forward this request at this time.

    This request could not be forwarded to the origin server or to any parent caches. The most likely cause for this error is that:

            * The cache administrator does not allow this cache to make direct connections to origin servers, and
            * All configured parent caches are currently unreachable.

    Your cache administrator is webmaster.
    Generated Thu, 02 Jul 2009 14:23:14 GMT by nullsleep.csclub.uwaterloo.ca (squid/2.7.STABLE3)

    1. Re:Broken or Slashdotted? by coffeeisclassy · · Score: 1

      slashdotted most likely. According to #scheme, where the creatore is hanging out, the webserver ran out of virtual memory and shat its self. Its been re-configured so it might be running better now.

  18. Known since at least 2006 by ugen · · Score: 4, Informative

    http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html

    Of course there is no reason this is still not fixed (by being able to disable a:visited style).

    1. Re:Known since at least 2006 by maxume · · Score: 2, Informative

      Bugzilla bug 57351 was reported in October of 2000:

      https://bugzilla.mozilla.org/show_bug.cgi?id=57351

      (Bugzilla may or may not still hate Slashdot, copy and paste if clicking the link does not work).

      --
      Nerd rage is the funniest rage.
    2. Re:Known since at least 2006 by interiot · · Score: 1

      Of course there is no reason this is still not fixed (by being able to disable a:visited style)

      If the issue were so simple, why has no major browser implemented a proper fix for this yet, despite the fact that we've known about the issue for nine years ?

      A:visited is very useful to the user in some circumstances, so it's unacceptable to turn it off for every user in every circumstance. Firefox 3.5 added a hidden preference in case some users want to turn it on sometimes, but that solution doesn't work for 80% of the people out there. Personally, I think applying the "same origin" policy to a:visited is a better solution, but that hasn't been integrated into any mainline either.

  19. Really no script by Anonymous Coward · · Score: 0

    Thanks for pointing out! I now realize you can do the whole thing, including server communication, in CSS. Just combine the "visited" tag with a unique background image on the same server. The background image URL can then be the server-side script that handles the privacy violation.

  20. wommens by psergiu · · Score: 2, Funny

    Quote from the final page of the script:

    You can get your web2.0collage as a mug,wommens ...

    I can have it as WHAT ? Okay, then can i have my wommens without the /. favicon all over them ?

    --
    1% APY, No fees, Online Bank https://captl1.co/2uIErYq Don't let your $$$ sit in a no-interest acct.
  21. who the hell by Anonymous Coward · · Score: 0

    who the hell is that guy in the picture?

  22. Another link with similar technique. by vieux+schnock · · Score: 1

    Maybe it's an old story but I found this site that uses the same technique:
    http://www.schillmania.com/random/humour/web20awareness/

  23. The guy in the picture of this artical. by orsty3001 · · Score: 1

    He just typed, "15/f/CA".

  24. ooooh! by gandhi_2 · · Score: 1

    It's like a collage of my favorite porn sites.

    --
    THL phish sticks
  25. Duh by Akira+Kogami · · Score: 1

    Am I the only person who simply doesn't keep a browser history? I set my Firefox not to and it works fine.

    1. Re:Duh by CastrTroy · · Score: 1

      I turned history off a long time ago. I don't ever use it. With the number of sites I visit in a day, I can't every find anything in there anyway, so no point leaving it around for others to stumble upon.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
  26. It's pretty obvious by phantomcircuit · · Score: 1

    I am using Firefox 3.0.11 on Ubuntu 9.04 with a T7500 CPU (Core 2 Duo 2.2 GHz).

    That site pegged one core of my CPU.

    Really? That would be damn obvious, not to mention most people would see the slow down and close the browser.

    1. Re:It's pretty obvious by causality · · Score: 1

      I am using Firefox 3.0.11 on Ubuntu 9.04 with a T7500 CPU (Core 2 Duo 2.2 GHz).

      That site pegged one core of my CPU.

      Really? That would be damn obvious, not to mention most people would see the slow down and close the browser.

      If they were also reading Slashdot then I don't know how the hell they'd notice.

      Seriously. I like Slashdot very much, but its JS is atrociously, embarassingly slow.

      --
      It is a miracle that curiosity survives formal education. - Einstein
  27. workaround in firefox by denominateur · · Score: 5, Informative

    in firefox:

      set layout.css.visited_links_enabled to FALSE in about config

    This will break (a tiny part of) the layout of sites that use CSS to change the style of links that were visited by the user, but it protects against this problem.

    1. Re:workaround in firefox by stry_cat · · Score: 1

      This is not a good work around for me. I like being able to tell which links I've already visited. I suspect a lot of people like it too.

    2. Re:workaround in firefox by Qzukk · · Score: 2, Insightful

      This is not a good work around for me. I like being able to tell which links I've already visited. I suspect a lot of people like it too.

      Then perhaps a better idea for you is to set a local style for a:visited that includes background, background-image, size, and so on in addition to the text color.

      --
      If I have been able to see further than others, it is because I bought a pair of binoculars.
    3. Re:workaround in firefox by haifastudent · · Score: 0

      That workaround is a myth. See here for all about:config entries: http://kb.mozillazine.org/Firefox_:_FAQs_:_About:config_Entries So by using that method, not only is the user not protected, but he _thinks_ that he is protected. That's worse.

      --
      Thank for reading to the sig. You may stop reading now. It is safe. There is no more content. Why are you still reading?
    4. Re:workaround in firefox by denominateur · · Score: 1

      That workaround is a myth.

      Interesting, testing it with firefox 3.5 on http://www.making-the-web.com/misc/sites-you-visit/nojs/ and http://www.making-the-web.com/misc/sites-you-visit/ it clearly works!

      But you are right that it fails to provide protection with firefox 3.0.xx. Not sure about the 3.1 and 3.2 series.

    5. Re:workaround in firefox by haifastudent · · Score: 0

      Thanks, that is good to know. Another reason to upgrade.

      --
      Thank for reading to the sig. You may stop reading now. It is safe. There is no more content. Why are you still reading?
    6. Re:workaround in firefox by Brazilian+Geek · · Score: 1

      Worked for me too.

      On Firefox 3.5 and with the about:config edit, the tests return zero results.

      --
      All browsers' default homepage should read: Don't Panic...
    7. Re:workaround in firefox by colfer · · Score: 1

      That kb is out of date on many topics.

    8. Re:workaround in firefox by Anonymous Coward · · Score: 0

      This is not a good work around for me. I like being able to tell which links I've already visited. I suspect a lot of people like it too.

      And I like to see the dancing cats with the malware embedded. I also like having sex with multiple hot, horny, porn-star quality women.

      Point being, there are always things in life that you want that you can't have, or require you to take risks.

      Simply saying "That doesn't help" ... doesn't help. What is YOUR proposed solution?

  28. Google did something right too by memojuez · · Score: 1

    I tested it in Chrome's Incognito Window and the site was unable to detect my browser history. When I tested Chrome in regular mode, it found all kinds of good stuff.

    --
    Signature applied for, Patent Pending
  29. worked for me by itsamemario · · Score: 1

    Although I get the impression its randomly failing what with the slashdot load and being written in an interperted language. I put up a picture here.

  30. I see London, by smackenzie · · Score: 4, Funny

    I see France,
    I see you shopping online at Victoria's Secret for underpants...

  31. Four Things by jason.sweet · · Score: 1

    The results are rather disappointing.
    A t-shirt!?!?!?
    Why does this jackass misspell 'women'?
    Why the fuck is this even possible?!?!?

  32. Reminds me of timing attacks. by askksa · · Score: 1

    http://www.cs.princeton.edu/sip/pub/webtiming.pdf

  33. Re:Microsoft actually did something right by Geoffrey.landis · · Score: 1

    With its "inprivate" browsing mode in IE8. Since it doesn't track your history, I'm assuming that it your "inprivate" history can't be "sniffed".

    The same as the Safari "private browsing" mode, I assume.

    --
    http://www.geoffreylandis.com
  34. This is what I got: by XxtraLarGe · · Score: 1
    ERROR

    The requested URL could not be retrieved

    While trying to retrieve the URL: http://web2.0collage.com/app/;...

    The following error was encountered:

    Unable to forward this request at this time.

    This request could not be forwarded to the origin server or to any parent caches. The most likely cause for this error is that:

    Being on slashdot!

    imagemagick bindings that leak memory

    a hard limit of 4gb in a 64bit version of mzscheme for reason's I don't know

    Your cache administrator is webmaster.

    Generated Thu, 02 Jul 2009 15:32:25 GMT by nullsleep.csclub.uwaterloo.ca (squid/2.7.STABLE3)

    --
    Taking guns away from the 99% gives the 1% 100% of the power.
  35. isn't this what Safari and Chrome are for? by alen · · Score: 1

    use the niche browsers for your private surfing and IE/Firefox for important things

    1. Re:isn't this what Safari and Chrome are for? by edalytical · · Score: 1

      No. It was able to sniff my history and I'm running Safari 4.0.1 (5530.18). This has more to do with JavaScript and CSS breaking the fundamental user model of the web. It's not a problem with any particular browser, it's the web standard that is flawed. As we move toward better DOM, JavaScript and web apps, expect this kind of stuff even more.

      --
      Win a signed Stephen Carpenter ESP Guitar from the Deftones: http://def-tag.com/?r=0008781
    2. Re:isn't this what Safari and Chrome are for? by Raisputin · · Score: 1

      It came up with nothing when I did it within Safari (MacOS X)

      --
      +(norad) if you rearrange the letters in mother in law, you get woman hitler
    3. Re:isn't this what Safari and Chrome are for? by edalytical · · Score: 1

      How long did you wait?

      --
      Win a signed Stephen Carpenter ESP Guitar from the Deftones: http://def-tag.com/?r=0008781
  36. Site is 404'ing "Slashdot" by rotide · · Score: 0, Redundant
    Not a joke, look down at the possible reasons for the error, one is being on slashdot.

    .

    ERROR The requested URL could not be retrieved

    While trying to retrieve the URL: http://web2.0collage.com/app/;(a12v)

    The following error was encountered:

    * Unable to forward this request at this time.

    This request could not be forwarded to the origin server or to any parent caches. The most likely cause for this error is that:

    * Being on slashdot!
    * imagemagick bindings that leak memory
    * a hard limit of 4gb in a 64bit version of mzscheme for reason's I don't know

    Your cache administrator is webmaster.
    Generated Thu, 02 Jul 2009 15:32:25 GMT by nullsleep.csclub.uwaterloo.ca (squid/2.7.STABLE3)

  37. It uses javascript by Anonymous Coward · · Score: 1, Funny

    Javascript runs locally on my own computer; so I'm sniffing myself?

  38. Re:Microsoft actually did something right by haifastudent · · Score: 1, Interesting

    On a stock Firefox 3.0.11 on a fresh install and no extensions, I visited about 20 popular sites (facebook.com, digg.com, xnxx.com and the like), then tried the history site. Just a big black png. Either the script is /.ed or I don't know the right sites to visit.

    --
    Thank for reading to the sig. You may stop reading now. It is safe. There is no more content. Why are you still reading?
  39. Re:Microsoft actually did something right by Krojack · · Score: 1

    Same for me only I don't have history disabled. NoScript just didn't allow the scanning.

  40. Nice by tsnorquist · · Score: 1

    The following error was encountered:

            * Unable to forward this request at this time.

    This request could not be forwarded to the origin server or to any parent caches. The most likely cause for this error is that:

            *
                Being on slashdot!
            * imagemagick bindings that leak memory
            * a hard limit of 4gb in a 64bit version of mzscheme for reason's I don't know

  41. Re:Microsoft actually did something right by recoiledsnake · · Score: 1

    Except that it isn't so private. http://uneasysilence.com/archive/2008/03/13061/

    --
    This space for rent.
  42. OLD by user24 · · Score: 1

    I'm stunned this is still exploitable. This bug is YEARS old.

  43. No problem here... and I still have my history by aaaurgh · · Score: 1

    Yawn... been waiting for the collage for about ten minutes so far but the progress bar seems stuck at 0%.

    I wonder if it has something to do with the unchecked "Enable JavaScript" checkbox I have displayed at the bottom of my Opera 10 window.

    --

    Go permanent? In your dreams and my worst nightmares.
  44. Re:Microsoft actually did something right by noirsoldats · · Score: 2, Informative

    Hate to tell you, this /.'d sites methods are... Extremely overkill.. You can do the same thing without any Javascript at all.. So your little 'No Script' bubble has just been popped. http://www.making-the-web.com/misc/sites-you-visit/nojs/

  45. Hmmm... by noirsoldats · · Score: 1

    Has it been forgotten that a few weeks ago a more advanced form of this 'sniffing' was shown NOT using javascript? http://it.slashdot.org/story/09/06/13/2125211/Sniffing-Browser-History-Without-Javascript So, y'all that thing 'Oh, No Script protects me' think again.. This exploit has been around for years and I'm pretty sure it's been used for quite some time as well. Maybe I'm just apathetic about people knowing what sites I visit but... Meh, let them know, what harm could it do? (Yea, I know, I don't visit child porn so what do I have to hide?) :)

  46. doesn't work here by brezel · · Score: 1

    sits at 0% forever. ff+noscript+linux

  47. Re:Microsoft actually did something right by ceoyoyo · · Score: 1

    They must have fixed it. It doesn't show any sites on my machine.

  48. Re:Microsoft actually did something right by Freetardo+Jones · · Score: 1

    And that article is 17 months old. That issue has long since been fixed.

  49. Re:Microsoft actually did something right by DeskLazer · · Score: 1

    mod this up. that's scary that it can be done without javascript, and practically in every browser.

  50. Surprisingly by Anonymous Coward · · Score: 0

    my collage only has slashdot and ars technica symblos...and I vist a LOT of other sites

  51. Re:Microsoft actually did something right by sairax · · Score: 0

    Yes, but Microsoft can't protect you from Linus Torvalds. He takes one look at your desktop and knows which porn sites you visited. In the last ten years.

  52. Anonymous Coward by Anonymous Coward · · Score: 0

    I have been on the internet since 1995, and let me state, I couldn't care less if people see what I am browsing.

    The Tin Foil hat Anon-program running people have always amused me. If some person really wants to see what websites I visit, I truely don't care.

    I remember back in 1998 or so when everyone freaked out about Cookies, and I had many friends that made it so their browser would reject any website that tried to set one.

    IMO people freaking out about privacy is just a way for people to feel important.

    1. Re:Anonymous Coward by Fantastic+Lad · · Score: 1

      IMO people freaking out about privacy is just a way for people to feel important.

      How interesting. Now will you please include here for public scrutiny your real name, address, phone number as well as your social security number and the last 500 sites you have visited, the last 100 books you read, a disclosure of all the women/men you've slept with, your medical conditions, all the drugs you've taken (legal and not), all the times and locations you've perpetrated any crime including traffic or tax violations and a full list of all copyrighted media you have downloaded, your political and religious affiliations as well as a full list of your employers, schools attended and all your immediate friends and family. Please also include anything we might not have thought of but which you might find potentially harmful were it in the public domain.

      Please rest assured that nobody here would EVER mis-use your information and we take your privacy seriously.

      -FL

  53. Just slashdot? by eliphas_levy · · Score: 1

    Mine showed just four slashdot favicons in a square...
    Should I start to go on other web2.0 websites? :)
    http://web2.0collage.com/app/;((%22k%22%20.%20%22(1014%205%2031402284)%22))

    --
    eliphas
  54. Re:Microsoft actually did something right by Anonymous Coward · · Score: 0

    http://blogs.msdn.com/ieinternals/archive/2009/06/17/CSSHistoryProbing.aspx

  55. Forget your silly pr0n folks by galego · · Score: 1

    Granted, some of you are concerned about people finding out the sites you visit, but what about a real world problem (or two)?

    Some time back, there was an attack that threw a phony dialog pop-up saying that your timeout had been expired at your bank site. Combine that with being able to see *what* bank's site (and whether or not you have been at it recently). This could even be injected through a compromised ad-server system or the like. Maybe you don't even have to visit my site. There's some moving parts in there, but things like this, combined with click-happy-and-fill-in-personal-data user syndrome could make for some pretty sophisticated attacks.

    From a private organization's perspective (many of whom have private systems, blocked off from the outer world) ... this can also be used to help map their internal network from the outside (just by one of their users visiting a site). Think about that after you visit your interal cisco web interface and then merrily tab into some other site.

    I am particular about who I allow to set cookies, but not so much about my history (except that I do wipe it .. and other 'private data' when FF closes). don't know that I'll change that behavior yet, but will probably modify the config on visited site styles as some have suggested here.

    --

    Que Deus te de em dobro o que me desejas

    [May God give you double that which you wish for me]

  56. Re:Microsoft actually did something right by recoiledsnake · · Score: 1

    This one is less than two months old. http://www.switchingtomac.com/tutorials/how-to-make-safaris-private-browsing-feature-actually-private/

    --
    This space for rent.
  57. Re:Microsoft actually did something right by Anonymous Coward · · Score: 0

    I call shenanigans. All it gave me was a list of popular-looking sites many people could have visited, and at least 2 I've not heard of and do not appear in my browser history either.

    So I downloaded Opera, a browser I have never used on this machine and has an empty browser history (last OS install about 8 months ago, last used Opera in the early 2000s) and got a similar (but slightly different) list of popular sites.

    This is called a hoax, people. How hard is it for an oracle to go "ommmmmm I'm channeling the spirits who tell me you've visited wikipedia, google and imdb recently".

    No shit sherlock, let me predict you've gone for a shit AND a piss in the last week. I bet you've also eaten something. Why is this a story?

  58. Re:Microsoft actually did something right by profplump · · Score: 1

    Unless you want to browse by IP address there's no way to avoid DNS lookups when you're browsing, no matter what the browser does or doesn't store. There's also no way for the browser to disable that caching -- it's an OS-level function (in all OSes, not just OS X), not a browser feature.

    It's silly anyway, because if someone is trying to track your DNS lookups it would likely be easier to simply listen for them on the network, or to guess against your network DNS cache, rather than to interface with your local cache. Unless your machine is already compromised, in which case they can see where you're browsing and what DNS queries you make no matter what OS or browser you're using, or what privacy settings you've got enabled.

  59. Re:Microsoft actually did something right by Anonymous Coward · · Score: 0

    Same, pretty happy about seeing a black square myself :)

  60. "Ask Slashdot": "safe" browsing in FF?? by Ponga · · Score: 1

    I want to browse "safely"; protection against most XSS and sh1t like scripts reading my browser history, etc. However, I want the sites that I visit to "work" at the same time. Ya, NoScript is great, but with sites globally disallowed, the Internets are useless.

    Can anyone offer some suggestions to reasonably lock down FF where a balance is struck between security and usability??

    TIA, --ponga

  61. This smells fishy by Pictish+Prince · · Score: 1

    What do you bet the script checks to see if firefox is browsing it and just throws up a black box in that case?

    --
    Only his tendency toward a dazed stupor prevented him from screaming aloud.
  62. zilch by Spaham · · Score: 1

    It did a lot of blinkin' and stuff then I got that :
    An internal server error occurred. Please try again later.

    Running safari 4 on a mac, normal browsing (not safe mode)
    I wonder, still, if it would show the data locally or does the server really have access to it ?

  63. SafeHistory + SafeCache by Anonymous Coward · · Score: 0

    There *was* a FireFox extension called SafeHistory which somehow supposedly allowed only the site itself to see which links you had visited. There was a companion extension called SafeCache which did similar things with respect to your cache to block information extraction that way.

    Neither of them was ever updated for FireFox 3, so far as I know.

  64. Security Warnings by kasperd · · Score: 1

    I tried visiting the site. After I had closed the first 100 security warning windows, I closed the tab. As far as I know, most browsers do give warnings whenever you are about to submit a form over an unencrypted connection. And as far as I know, most users disable those warnings. Any user who have those warnings turned on would notice this attack. I have seen some css variant a while back, that didn't produce the same kind of warnings. So to me it looks like this new attack is inferior to what was previously demonstrated. (Somebody suggested that the CPU usage would give away the attack. But if you have multiple tabs opens in is actually very difficult to find out which of them are responsible for the CPU and memory usage of the browser).

    --

    Do you care about the security of your wireless mouse?
  65. Re:Microsoft actually did something right by hacker · · Score: 1

    Here, try this one which works without using Javascript at all.

  66. Re:Microsoft actually did something right by CastrTroy · · Score: 1

    I've been doing this with firefox for years. Just go to the privacy section of your options/preferences, and disable history, disable cookies, and tell it to clear your history every time you leave. Really I just have it set for no password/form/history saved, and only accept first party cookies until I close firefox, except for the white list I have so I don't have to keep on signing in to my usual sites.

    --

    Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
  67. Re:Microsoft actually did something right by rdnetto · · Score: 1

    Microsoft actually did something right

    You mean like the mode Safari had 4 years ago?

    Exactly. The 'something right' was copying features from better browsers.

    --
    Most human behaviour can be explained in terms of identity.
  68. Firefox 3.5 with Private Browsing by Anonymous Coward · · Score: 0

    Tried the link with Firefox 3.5, and got a nice collage of icons of sites I visited.

    However, switching to Private Browsing seems to block access to the browser history - I got the black square.

    Cheers

  69. I wonder what I'm doing then... by ShadowSystems · · Score: 1

    Ubuntu + Firefox + NoScript, and both the other sniffer site AND the site you've mentioned come up with a big fat *nada*.
    Ten minutes later & the first site tells me there's nothing found; scan completed on the second site & it reports squat.
    I wonder what I'm doing that thwarts them both?
    (This is NOT an attempt at flaming, this is an honest question to a serious issue.)

    1. Re:I wonder what I'm doing then... by itai.saku.kusari · · Score: 1

      Well, I'm using Midori (which is using webkit) and it didn't even go past the scanning process... Stayed stuck at 0% for much too long. (I really don't have a big browser history...) So perhaps it wasn't even functional pahaha.

  70. Re:Microsoft actually did something right by hh4m · · Score: 1

    i concur, i tested too.