Slashdot Mirror

← Back to Stories (view on slashdot.org)

Your Browser History Is Showing

Posted by samzenpus on from the wasted-days-and-wasted-art dept.

tiffanydanica writes "For a lot of us our browser history is something we consider private, or at least not something we want to expose to every website we visit. Web2.0collage is showing just how easy it is (with code!) for sites to determine what sites you visit. When you visit the site it sniffs your browser history, and creates a collage of the (safe for work) sites that you visit. It is an interesting application of potentially scary technology (imagine a job application site using this to screen candidates). You can jump right into having your history sniffed if you so desire. While the collages are cool on their own merit, they also serve as an illustration of the privacy implications of browser history sniffing."

8 of 174 comments (clear)

  1. Not mine by Monoman · · Score: 4, Informative

    No Script baby

    --
    Keep the Classic Slashdot.
    1. Re:Not mine by gazbo · · Score: 5, Informative

      No Script may help in this case, but not in general. There was a story here only a couple of weeks back talking about a pure CSS method for doing exactly this.

  2. Re:Microsoft actually did something right by sam0vi · · Score: 5, Informative

    I'm using FF 3.0.11 on Jaunty with history disabled, and it did not get anything from my browser even though the "recently closed tabs" menu has many entries in it. All i got was a black square. I also had to tell NoScript to allow their domain. This made me feel better about my paranoid ways!

    --
    When my Karma level reaches 0 I feel in piece with the Universe
  3. Comment removed by account_deleted · · Score: 4, Informative

    Comment removed based on user account deletion

  4. Re:This methodology is actually quite old by Anonymous Coward · · Score: 4, Informative

    New about:config setting in FF 3.5:
    layout.css.visited_links_enabled

    If "visited" is a useful feature for you check out SafeHistory:

    Restricts the marking of visited links on the basis of the originating document, defending against web privacy attacks that remote sites can use to determine your browser history at other sites

  5. Known since at least 2006 by ugen · · Score: 4, Informative

    http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html

    Of course there is no reason this is still not fixed (by being able to disable a:visited style).

  6. Re:...So.... by uglyduckling · · Score: 4, Informative

    Because that's how this vulnerability works. It doesn't really sniff your browser history - as such - what it does it it has a huge page full of popular websites, displays them as links (invisible) and sees which links change colour. There's no easy workaround that will both allow you to have a history, and allow web pages to display something different (e.g. link colour / style) for pages that you have visited already. Perhaps the best compromise would be to allow changes to link style only within the domain of the page that's attempting to set that style. But it's still a major backward step in usability. The other option might be to disable link styles for pages that have greater than a certain number of links (say 50).

  7. workaround in firefox by denominateur · · Score: 5, Informative

    in firefox:

      set layout.css.visited_links_enabled to FALSE in about config

    This will break (a tiny part of) the layout of sites that use CSS to change the style of links that were visited by the user, but it protects against this problem.